Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: ThymeLeafSimple

org.flasby:ThymeLeafSimple:1.0-SNAPSHOT

Scan Information (show all):

Summary

Display: Showing Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
attoparser-2.0.7.RELEASE.jarpkg:maven/org.attoparser/attoparser@2.0.7.RELEASE 042
javassist-3.29.0-GA.jarpkg:maven/org.javassist/javassist@3.29.0-GA 056
log4j-core-2.24.3.jarcpe:2.3:a:apache:log4j:2.24.3:*:*:*:*:*:*:*pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3 0Highest40
lombok-1.18.36.jarpkg:maven/org.projectlombok/lombok@1.18.36 036
lombok-1.18.36.jar: mavenEcjBootstrapAgent.jar 07
ognl-3.3.4.jarcpe:2.3:a:ognl_project:ognl:3.3.4:*:*:*:*:*:*:*pkg:maven/ognl/ognl@3.3.4 0Highest27
slf4j-api-2.0.17.jarpkg:maven/org.slf4j/slf4j-api@2.0.17 029
thymeleaf-3.1.2.RELEASE.jarcpe:2.3:a:thymeleaf:thymeleaf:3.1.2:release:*:*:*:*:*:*pkg:maven/org.thymeleaf/thymeleaf@3.1.2.RELEASE 0Highest23
unbescape-1.1.6.RELEASE.jarpkg:maven/org.unbescape/unbescape@1.1.6.RELEASE 042

Dependencies (vulnerable)

attoparser-2.0.7.RELEASE.jar

Description:

Powerful, fast and easy to use HTML and XML parser for Java

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /var/lib/jenkins/.m2/repository/org/attoparser/attoparser/2.0.7.RELEASE/attoparser-2.0.7.RELEASE.jar
MD5: fd09ceba7061e05460e74e0e1e64f233
SHA1: e5d0e988d9124139d645bb5872b24dfa23e283cc
SHA256:75dd1c045492bff8e1963aabb28bfe903c2064e11e27fe2f0f0aff1ad3d84476
Referenced In Project/Scope: ThymeLeafSimple:compile
attoparser-2.0.7.RELEASE.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.thymeleaf/thymeleaf@3.1.2.RELEASE

Identifiers

javassist-3.29.0-GA.jar

Description:

  	Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation
    simple.  It is a class library for editing bytecodes in Java.

License:

MPL 1.1: http://www.mozilla.org/MPL/MPL-1.1.html
LGPL 2.1: http://www.gnu.org/licenses/lgpl-2.1.html
Apache License 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /var/lib/jenkins/.m2/repository/org/javassist/javassist/3.29.0-GA/javassist-3.29.0-GA.jar
MD5: aefc94eda66e54b96825ffc807cfbafd
SHA1: d3959fa7e00bf04dbe519228a23213d2afb625d8
SHA256:62d4065362e8969ce654f2b5541de1efb5b5bca6c146dbd38a595ea4df64cd31
Referenced In Project/Scope: ThymeLeafSimple:compile
javassist-3.29.0-GA.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.thymeleaf/thymeleaf@3.1.2.RELEASE

Identifiers

log4j-core-2.24.3.jar

Description:

A versatile, industrial-grade, and reference implementation of the Log4j API.
    It bundles a rich set of components to assist various use cases:
    Appenders targeting files, network sockets, databases, SMTP servers;
    Layouts that can render CSV, HTML, JSON, Syslog, etc. formatted outputs;
    Filters that can be configured using log event rates, regular expressions, scripts, time, etc.
    It contains several extension points to introduce custom components, if needed.

License:

Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /var/lib/jenkins/.m2/repository/org/apache/logging/log4j/log4j-core/2.24.3/log4j-core-2.24.3.jar
MD5: 3f52ab7782fdd1349bd872b5dcf48bed
SHA1: 7f6a261243ca767c7f38fd4b542bcde626c8894e
SHA256:7eb4084596ae25bd3c61698e48e8d0ab65a9260758884ed5cbb9c6e55c44a56a
Referenced In Project/Scope: ThymeLeafSimple:runtime
log4j-core-2.24.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.apache.logging.log4j/log4j-slf4j2-impl@2.24.3

Identifiers

lombok-1.18.36.jar

Description:

Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!

License:

The MIT License: https://projectlombok.org/LICENSE
File Path: /var/lib/jenkins/.m2/repository/org/projectlombok/lombok/1.18.36/lombok-1.18.36.jar
MD5: 92c08153ae16c161c8cc2cc8185d2724
SHA1: 5a30490a6e14977d97d9c73c924c1f1b5311ea95
SHA256:73b6b05b6a2d365b700bab08d30f94de9d336490bc0acce5b6181fef48cbf18e
Referenced In Project/Scope: ThymeLeafSimple:provided
lombok-1.18.36.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.flasby/ThymeLeafSimple@1.0-SNAPSHOT

Identifiers

lombok-1.18.36.jar: mavenEcjBootstrapAgent.jar

File Path: /var/lib/jenkins/.m2/repository/org/projectlombok/lombok/1.18.36/lombok-1.18.36.jar/lombok/launch/mavenEcjBootstrapAgent.jar
MD5: 27467519bf9615b24cad3b003c4353a9
SHA1: 37d92e0a726a67883ab94bee27c6f292e6318dcd
SHA256:9566d0706d6245cac3cdd9db6d1d81551aa3e727febcf64452c6db9701c40037
Referenced In Project/Scope: ThymeLeafSimple:provided

Identifiers

  • None

ognl-3.3.4.jar

Description:

OGNL - Object Graph Navigation Library

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /var/lib/jenkins/.m2/repository/ognl/ognl/3.3.4/ognl-3.3.4.jar
MD5: 1893dad14f3e7ddd95d211e1d3ca1a0f
SHA1: 1904789bdd96f226ad252a02f230be1015f4462b
SHA256:47fdd450407ff09b57df02f466f9b4c7d32818962d65f9d98e445c8b4d047603
Referenced In Project/Scope: ThymeLeafSimple:compile
ognl-3.3.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.thymeleaf/thymeleaf@3.1.2.RELEASE

Identifiers

slf4j-api-2.0.17.jar

Description:

The slf4j API

License:

https://opensource.org/license/mit
File Path: /var/lib/jenkins/.m2/repository/org/slf4j/slf4j-api/2.0.17/slf4j-api-2.0.17.jar
MD5: b6480d114a23683498ac3f746f959d2f
SHA1: d9e58ac9c7779ba3bf8142aff6c830617a7fe60f
SHA256:7b751d952061954d5abfed7181c1f645d336091b679891591d63329c622eb832
Referenced In Project/Scope: ThymeLeafSimple:compile
slf4j-api-2.0.17.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.thymeleaf/thymeleaf@3.1.2.RELEASE

Identifiers

thymeleaf-3.1.2.RELEASE.jar

File Path: /var/lib/jenkins/.m2/repository/org/thymeleaf/thymeleaf/3.1.2.RELEASE/thymeleaf-3.1.2.RELEASE.jar
MD5: 4a9b2210cb35b43fb0b8499e17b9c880
SHA1: 273997509a4c7aef86cee0521750140c587d9be2
SHA256:2b3a714be2de349ccb60c65603ae5e8bd7060c7a4f8833485707671e9a862a24
Referenced In Project/Scope: ThymeLeafSimple:compile
thymeleaf-3.1.2.RELEASE.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.flasby/ThymeLeafSimple@1.0-SNAPSHOT

Identifiers

unbescape-1.1.6.RELEASE.jar

Description:

Advanced yet easy-to-use escape/unescape library for Java

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /var/lib/jenkins/.m2/repository/org/unbescape/unbescape/1.1.6.RELEASE/unbescape-1.1.6.RELEASE.jar
MD5: d95ed94e1624e307a1958ee105ccbf39
SHA1: 7b90360afb2b860e09e8347112800d12c12b2a13
SHA256:597cf87d5b1a4f385b9d1cec974b7b483abb3ee85fc5b3f8b62af8e4bec95c2c
Referenced In Project/Scope: ThymeLeafSimple:compile
unbescape-1.1.6.RELEASE.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.thymeleaf/thymeleaf@3.1.2.RELEASE

Identifiers



This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.