Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: Bedework: Calendar and vcard utilities.

org.bedework:bw-util2:6.1.0-SNAPSHOT

Scan Information (show all):

Summary

Summary of Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
bw-base-2.0.0.jarpkg:maven/org.bedework/bw-base@2.0.0 042
bw-calws-soap-xml-6.0.0.jarpkg:maven/org.bedework/bw-calws-soap-xml@6.0.0 038
bw-ical4j-vcard-1.1.0.jarpkg:maven/org.bedework/bw-ical4j-vcard@1.1.0 036
bw-icalendar-xml-6.0.0.jarpkg:maven/org.bedework/bw-icalendar-xml@6.0.0 040
bw-util-caching-6.1.0.jarpkg:maven/org.bedework/bw-util-caching@6.1.0 044
bw-util-config-6.1.0.jarpkg:maven/org.bedework/bw-util-config@6.1.0 044
bw-util-http-6.2.1.jarpkg:maven/org.bedework/bw-util-http@6.2.1 044
bw-util-jmx-6.1.0.jarpkg:maven/org.bedework/bw-util-jmx@6.1.0 044
bw-util-json-6.1.0.jarpkg:maven/org.bedework/bw-util-json@6.1.0 044
bw-util-logging-6.0.0.jarpkg:maven/org.bedework/bw-util-logging@6.0.0 044
bw-util-misc-6.1.0.jarcpe:2.3:a:utils_project:utils:6.1.0:*:*:*:*:*:*:*pkg:maven/org.bedework/bw-util-misc@6.1.0 0Low44
bw-util-properties-6.1.0.jarcpe:2.3:a:com-property:com_properties:6.1.0:*:*:*:*:*:*:*pkg:maven/org.bedework/bw-util-properties@6.1.0 0High44
bw-util-tz-6.0.2.jarpkg:maven/org.bedework/bw-util-tz@6.0.2 042
bw-util-xml-6.1.0.jarpkg:maven/org.bedework/bw-util-xml@6.1.0 044
commons-codec-1.17.1.jarpkg:maven/commons-codec/commons-codec@1.17.1 0121
commons-io-2.20.0.jarcpe:2.3:a:apache:commons_io:2.20.0:*:*:*:*:*:*:*pkg:maven/commons-io/commons-io@2.20.0 0Highest125
commons-lang3-3.18.0.jarcpe:2.3:a:apache:commons_lang:3.18.0:*:*:*:*:*:*:*pkg:maven/org.apache.commons/commons-lang3@3.18.0 0Highest145
commons-logging-1.2.jarpkg:maven/commons-logging/commons-logging@1.2 0117
commons-text-1.14.0.jarcpe:2.3:a:apache:commons_text:1.14.0:*:*:*:*:*:*:*pkg:maven/org.apache.commons/commons-text@1.14.0 0Highest73
httpclient-4.5.14.jarcpe:2.3:a:apache:httpclient:4.5.14:*:*:*:*:*:*:*pkg:maven/org.apache.httpcomponents/httpclient@4.5.14 0Highest32
httpcore-4.4.16.jarpkg:maven/org.apache.httpcomponents/httpcore@4.4.16 032
ical4j-3.0.24.jarpkg:maven/org.bedework.ical4j/ical4j@3.0.24 038
jackson-core-2.18.2.jarcpe:2.3:a:fasterxml:jackson-core:2.18.2:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-modules-java8:2.18.2:*:*:*:*:*:*:*		pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.2 0Highest47
jackson-databind-2.18.2.jarcpe:2.3:a:fasterxml:jackson-core:2.18.2:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-databind:2.18.2:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-modules-java8:2.18.2:*:*:*:*:*:*:*		pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2HIGH5Highest41
jakarta.activation-api-2.1.3.jarpkg:maven/jakarta.activation/jakarta.activation-api@2.1.3 045
jakarta.jws-api-3.0.0.jarcpe:2.3:a:oracle:web_services:3.0.0:*:*:*:*:*:*:*pkg:maven/jakarta.jws/jakarta.jws-api@3.0.0 0Low43
jakarta.mail-api-2.1.3.jarcpe:2.3:a:eclipse:jakarta_mail:2.1.3:*:*:*:*:*:*:*pkg:maven/jakarta.mail/jakarta.mail-api@2.1.3 0High36
jakarta.xml.bind-api-4.0.2.jarpkg:maven/jakarta.xml.bind/jakarta.xml.bind-api@4.0.2 031
jakarta.xml.soap-api-3.0.2.jarpkg:maven/jakarta.xml.soap/jakarta.xml.soap-api@3.0.2 042
jakarta.xml.ws-api-4.0.2.jarcpe:2.3:a:web_project:web:4.0.2:*:*:*:*:*:*:*pkg:maven/jakarta.xml.ws/jakarta.xml.ws-api@4.0.2 0Low59
org.bedework:bw-util2-calendar:6.1.0-SNAPSHOTpkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT 06
slf4j-api-1.7.36.jarpkg:maven/org.slf4j/slf4j-api@1.7.36 029

Dependencies (vulnerable)

bw-base-2.0.0.jar

Description:

This project provides base classes, types and methods

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-base/2.0.0/bw-base-2.0.0.jar
MD5: 0480624145ad4fc5daeba898b7132099
SHA1: b24b7279e0475bb3c8c84e37af400ad87877c955
SHA256:10d27642e3bf1f2f4f85320293b5041b7e34cba02cc2656f29e79f75cee97cc5
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-base-2.0.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

bw-calws-soap-xml-6.0.0.jar

Description:

XML schemas for calws-soap

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-calws-soap-xml/6.0.0/bw-calws-soap-xml-6.0.0.jar
MD5: 9aa7ed6be142112dd9a4e87aeb2919d7
SHA1: b7d634737b6a85cd2290e1b0c49ec60d140e9241
SHA256:53f3162afc8b96e07174d0f37dca250479e7281ad85ba463d7e735e8d8e966ce
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-calws-soap-xml-6.0.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

bw-ical4j-vcard-1.1.0.jar

Description:

A fork of ical4j-vcard with customizations for bedework

License:

iCal4j - License: LICENSE
File Path: /home/runner/.m2/repository/org/bedework/bw-ical4j-vcard/1.1.0/bw-ical4j-vcard-1.1.0.jar
MD5: da711c67505b880aaf2a0388d880df89
SHA1: f4b7f4c6db7688d399bf8ec0caab9ea2809f58cc
SHA256:78d6fb05b5be04f5bdf0fbf0ceb1cc5988695d9188dbecff349310f01a0d35d8
Referenced In Project/Scope: Bedework: Vcard utilities:compile
bw-ical4j-vcard-1.1.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.bedework/bw-util2-vcard@6.1.0-SNAPSHOT

Identifiers

bw-icalendar-xml-6.0.0.jar

Description:

XML Icalendar schema for RFC 6321 specification

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-icalendar-xml/6.0.0/bw-icalendar-xml-6.0.0.jar
MD5: 4dc52cf8d386984041e33966e74d7e3c
SHA1: 98313f98b4784324be0b1d971a09be43470ce98d
SHA256:9e0887ef14669c8b9a4245f673eaa729fc129288c470f5bb688733222f9cb4c3
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-icalendar-xml-6.0.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

bw-util-caching-6.1.0.jar

Description:

This project provides a number of utility classes and methods

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-util-caching/6.1.0/bw-util-caching-6.1.0.jar
MD5: 3de55022977ea7c256e7b7bbcfde23a0
SHA1: e28d2bc61170775cbf54ae023ad8a9257020a3e8
SHA256:51192a42c87bc1f9c3280737cfa276dee6b337b59f0804f805858b1c7a3214ec
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-util-caching-6.1.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util-tz@6.0.2
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

bw-util-config-6.1.0.jar

Description:

This project provides a number of utility configuration classes and methods

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-util-config/6.1.0/bw-util-config-6.1.0.jar
MD5: 7db546c39232fd82b5d944d498618fe6
SHA1: b8e8a91513c79a8df1eec8c216afbd7b68599389
SHA256:360b90c0406fc847340472e7d3653f8c7c1aa2e6304fa748b15b9a89dd95c4c8
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-util-config-6.1.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util-tz@6.0.2

Identifiers

bw-util-http-6.2.1.jar

Description:

Network (http, DAV,servlet etc) related utilities

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-util-http/6.2.1/bw-util-http-6.2.1.jar
MD5: 12fbd2f43473d4e9388a4763aaba6d46
SHA1: 74350a2bfe23e4daa51b80cd04f1bfc9353ead41
SHA256:311d95bd59ed76124a50fc463b515c034589ce0b60954af43bb2710c87666e23
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-util-http-6.2.1.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util-tz@6.0.2
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

bw-util-jmx-6.1.0.jar

Description:

This project provides a number of utility configuration classes and methods

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-util-jmx/6.1.0/bw-util-jmx-6.1.0.jar
MD5: 2c7532087d8a5fa7f422c3accd146533
SHA1: dbe25fb4201c3eea12f73efb8e07bb1616f2d567
SHA256:771ace3629d3cdec7238de84c96624d056e4afcdacf78bebf7a3aee3710ce81c
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-util-jmx-6.1.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util-tz@6.0.2

Identifiers

bw-util-json-6.1.0.jar

Description:

This project provides a number of utility classes and methods

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-util-json/6.1.0/bw-util-json-6.1.0.jar
MD5: 4a047dc132e6d94d5766fba3dbf2b377
SHA1: d70ccbd5bbe9dc7fda4385f2019c78737ab08b4a
SHA256:16193992cc22c81f1773a9a92b5da3484fcdc8c7c629c670d762d32c54ccac44
Referenced In Project/Scope: Bedework: Vcard utilities:compile
bw-util-json-6.1.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.bedework/bw-util2-vcard@6.1.0-SNAPSHOT

Identifiers

bw-util-logging-6.0.0.jar

Description:

This project provides logging utility classes and methods

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-util-logging/6.0.0/bw-util-logging-6.0.0.jar
MD5: 2c63b9031e2d0852a00e57753320b409
SHA1: a12c15e6670f1298c8c4779d08b24595e921aceb
SHA256:e26bbaf5a5dcad998990fdc647f448b2e2dcac6eb628be6945fe24d53759b745
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-util-logging-6.0.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util-misc@6.1.0
  • pkg:maven/org.bedework/bw-util-misc@6.1.0

Identifiers

bw-util-misc-6.1.0.jar

Description:

This project provides a number of utility classes and methods

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-util-misc/6.1.0/bw-util-misc-6.1.0.jar
MD5: 64e9ec7335a45a0c04d7de572f336277
SHA1: c4a0b313cc9fd7ce0143b79be5be30c85b4a690b
SHA256:8234195ac2db248cf662fba299c4f03140292ff4b16848562da2568d36bc2736
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-util-misc-6.1.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-vcard@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

bw-util-properties-6.1.0.jar

Description:

This project provides a number of utility classes and methods

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-util-properties/6.1.0/bw-util-properties-6.1.0.jar
MD5: d34a23154158951611cb6af3a6cfd824
SHA1: c13660f845919e9f2dd3ef671ad9db00fef3869e
SHA256:08e9cec0a32c53c12e3d4b8a4c9a0a2bbdb6adf661f21ebf19783bf4783088ae
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-util-properties-6.1.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util-tz@6.0.2
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

bw-util-tz-6.0.2.jar

Description:

Timezone utility classes

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-util-tz/6.0.2/bw-util-tz-6.0.2.jar
MD5: e6f6ed3f3fc6fb4f4f7b1bf873dd932b
SHA1: d588ba81e03413eba42b77bba5de5171182c2c91
SHA256:c310a597eac84e6091f015bcc5bbbd02d8e28a037a13ba8291e48a6c43c41577
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-util-tz-6.0.2.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

bw-util-xml-6.1.0.jar

Description:

This project provides a number of utility classes and methods

License:

Apache License Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/org/bedework/bw-util-xml/6.1.0/bw-util-xml-6.1.0.jar
MD5: fad7395899d26df07585602c31c7baa0
SHA1: 568efc1a1753c0d18bbeb1e3d8d4839c2499e433
SHA256:c33957e34833d0874c4f1b5d748a7f63d47f9f8d41d5061c2a7f6b77cb5bee1b
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

bw-util-xml-6.1.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-vcard@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

commons-codec-1.17.1.jar

Description:

     The Apache Commons Codec component contains encoders and decoders for
     various formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
     widely used encoders and decoders, the codec package also maintains a
     collection of phonetic encoding utilities.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-codec/commons-codec/1.17.1/commons-codec-1.17.1.jar
MD5: 7b3438ab4c6d91e0066d410947e43f3e
SHA1: 973638b7149d333563584137ebf13a691bb60579
SHA256:f9f6cb103f2ddc3c99a9d80ada2ae7bf0685111fd6bffccb72033d1da4e6ff23
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

commons-codec-1.17.1.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-ical4j-vcard@1.1.0
  • pkg:maven/org.bedework/bw-util-tz@6.0.2

Identifiers

commons-io-2.20.0.jar

Description:

The Apache Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-io/commons-io/2.20.0/commons-io-2.20.0.jar
MD5: 94e7e6b9b5fe82388687b584d3571081
SHA1: 36f3474daec2849c149e877614e7f979b2082cd2
SHA256:df90bba0fe3cb586b7f164e78fe8f8f4da3f2dd5c27fa645f888100ccc25dd72
Referenced In Project/Scope: Bedework: Vcard utilities:compile
commons-io-2.20.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.bedework/bw-ical4j-vcard@1.1.0

Identifiers

commons-lang3-3.18.0.jar

Description:

  Apache Commons Lang, a package of Java utility classes for the
  classes that are in java.lang's hierarchy, or are considered to be so
  standard as to justify existence in java.lang.

  The code is tested using the latest revision of the JDK for supported
  LTS releases: 8, 11, 17 and 21 currently.
  See https://github.com/apache/commons-lang/blob/master/.github/workflows/maven.yml
  
  Please ensure your build environment is up-to-date and kindly report any build issues.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/commons/commons-lang3/3.18.0/commons-lang3-3.18.0.jar
MD5: 48b9886957920a4cdb602780ca345087
SHA1: fb14946f0e39748a6571de0635acbe44e7885491
SHA256:4eeeae8d20c078abb64b015ec158add383ac581571cddc45c68f0c9ae0230720
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

commons-lang3-3.18.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util-tz@6.0.2
  • pkg:maven/org.bedework/bw-ical4j-vcard@1.1.0

Identifiers

commons-logging-1.2.jar

Description:

Apache Commons Logging is a thin adapter allowing configurable bridging to other,
    well known logging systems.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-logging/commons-logging/1.2/commons-logging-1.2.jar
MD5: 040b4b4d8eac886f6b4a2a3bd2f31b00
SHA1: 4bfc12adfe4842bf07b657f0369c4cb522955686
SHA256:daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

commons-logging-1.2.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util-tz@6.0.2
  • pkg:maven/org.bedework/bw-ical4j-vcard@1.1.0

Identifiers

commons-text-1.14.0.jar

Description:

Apache Commons Text is a set of utility functions and reusable components for processing
    and manipulating text in a Java environment.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/commons/commons-text/1.14.0/commons-text-1.14.0.jar
MD5: 54960a12a82d52df3d5548d6934d87b2
SHA1: adcb0d4c67eabc79682604b47eb852aaff21138a
SHA256:121fce2282910c8f0c3ba793a5436b31beb710423cbe2d574a3fb7a73c508e92
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

commons-text-1.14.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util-misc@6.1.0
  • pkg:maven/org.bedework/bw-util-misc@6.1.0

Identifiers

httpclient-4.5.14.jar

Description:

   Apache HttpComponents Client

File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.14/httpclient-4.5.14.jar
MD5: 2cb357c4b763f47e58af6cad47df6ba3
SHA1: 1194890e6f56ec29177673f2f12d0b8e627dec98
SHA256:c8bc7e1c51a6d4ce72f40d2ebbabf1c4b68bfe76e732104b04381b493478e9d6
Referenced In Projects/Scopes:

  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

httpclient-4.5.14.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util-tz@6.0.2
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

httpcore-4.4.16.jar

Description:

   Apache HttpComponents Core (blocking I/O)

File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpcore/4.4.16/httpcore-4.4.16.jar
MD5: 28d2cd9bf8789fd2ec774fb88436ebd1
SHA1: 51cf043c87253c9f58b539c9f7e44c8894223850
SHA256:6c9b3dd142a09dc468e23ad39aad6f75a0f2b85125104469f026e52a474e464f
Referenced In Projects/Scopes:

  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

httpcore-4.4.16.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util-tz@6.0.2
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

ical4j-3.0.24.jar

Description:

A Java library for reading and writing iCalendar (*.ics) files

License:

BSD 3-Clause License: https://github.com/ical4j/ical4j/raw/refs/heads/develop/LICENSE.txt
File Path: /home/runner/.m2/repository/org/bedework/ical4j/ical4j/3.0.24/ical4j-3.0.24.jar
MD5: 8a13d47cb0406201477c9ebbd54d9a27
SHA1: d1aef2a3d985edbf59726889a1ff0adc18b20122
SHA256:042344cb9f0bd8429ba6a14a8f4d9c4486dbdd739e852539a42c7baff50614ff
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

ical4j-3.0.24.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util2-vcard@6.1.0-SNAPSHOT

Identifiers

jackson-core-2.18.2.jar

Description:

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.18.2/jackson-core-2.18.2.jar
MD5: bf935e6eca3a57defa13918661905cb0
SHA1: fb64ccac5c27dca8819418eb4e443a9f496d9ee7
SHA256:d8054ae7c0d1c2d2f55d28e46026ebe5892881f3fab5f439233184381c3b4a1f
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

jackson-core-2.18.2.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-vcard@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util-tz@6.0.2

Identifiers

jackson-databind-2.18.2.jar

Description:

General data-binding functionality for Jackson: works on core streaming API

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.18.2/jackson-databind-2.18.2.jar
MD5: 1b56887bcd3eaea1ff710eb673e610b0
SHA1: deef8697b92141fb6caf7aa86966cff4eec9b04f
SHA256:4b364e6850dc89172fcf1d4dd26b8ff5488eda44ff4657e22dd265203dd5ab3c
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

jackson-databind-2.18.2.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

CVE-2026-54512  

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
CWE-502 Deserialization of Untrusted Data, CWE-184 Incomplete List of Disallowed Inputs

CVSSv3:
  • Base Score: HIGH (8.1)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:2.2/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-54513  

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
CWE-184 Incomplete List of Disallowed Inputs

CVSSv3:
  • Base Score: HIGH (8.1)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:2.2/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-54515 (OSSINDEX)  

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://guide.sonatype.com/vulnerability/CVE-2026-54515 for details
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv2:
  • Base Score: MEDIUM (6.900000095367432)
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*

CVE-2026-54518 (OSSINDEX)  

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://guide.sonatype.com/vulnerability/CVE-2026-54518 for details
CWE-863 Incorrect Authorization

CVSSv2:
  • Base Score: MEDIUM (6.900000095367432)
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.18.2:*:*:*:*:*:*:*

CVE-2026-54514  

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
CWE-918 Server-Side Request Forgery (SSRF)

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

jakarta.activation-api-2.1.3.jar

Description:

  Specification

License:

EDL 1.0: http://www.eclipse.org/org/documents/edl-v10.php
File Path: /home/runner/.m2/repository/jakarta/activation/jakarta.activation-api/2.1.3/jakarta.activation-api-2.1.3.jar
MD5: 76e7b680375ea9f40f3ddbd702efcd25
SHA1: fa165bd70cda600368eee31555222776a46b881f
SHA256:01b176d718a169263e78290691fc479977186bcc6b333487325084d6586f4627
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

jakarta.activation-api-2.1.3.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/jakarta.xml.bind/jakarta.xml.bind-api@4.0.2
  • pkg:maven/jakarta.xml.bind/jakarta.xml.bind-api@4.0.2

Identifiers

jakarta.jws-api-3.0.0.jar

Description:

Jakarta Web Services Metadata API

License:

Eclipse Distribution License - v 1.0: http://www.eclipse.org/org/documents/edl-v10.php
File Path: /home/runner/.m2/repository/jakarta/jws/jakarta.jws-api/3.0.0/jakarta.jws-api-3.0.0.jar
MD5: 40d2c030ca6afa636a6178eb3eee6a56
SHA1: af8955221689acfde96fbd4b2c1c270589bc6903
SHA256:722a8ac1afe01d70f1f2c7a8289db3f764206c9c2f52a82b045e513be4cacbd7
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

jakarta.jws-api-3.0.0.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-calws-soap-xml@6.0.0

Identifiers

jakarta.mail-api-2.1.3.jar

Description:

  Specification API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
EDL 1.0: http://www.eclipse.org/org/documents/edl-v10.php
File Path: /home/runner/.m2/repository/jakarta/mail/jakarta.mail-api/2.1.3/jakarta.mail-api-2.1.3.jar
MD5: 288a687deb06b87602ce14cd03dddff4
SHA1: a327aa5f514ba86e80d54584417d7376ed2bde0e
SHA256:8051b58d75f982f9a5b963b3765426e824b2a64865ef0af17205e455b98db05c
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

jakarta.mail-api-2.1.3.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util-tz@6.0.2

Identifiers

jakarta.xml.bind-api-4.0.2.jar

Description:

Jakarta XML Binding API 4.0 Design Specification

License:

http://www.eclipse.org/org/documents/edl-v10.php
File Path: /home/runner/.m2/repository/jakarta/xml/bind/jakarta.xml.bind-api/4.0.2/jakarta.xml.bind-api-4.0.2.jar
MD5: 0c8f9991081def819435c3ff36e4d93f
SHA1: 6cd5a999b834b63238005b7144136379dc36cad2
SHA256:0d6bcfe47763e85047acf7c398336dc84ff85ebcad0a7cb6f3b9d3e981245406
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

jakarta.xml.bind-api-4.0.2.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT
  • pkg:maven/org.bedework/bw-util2-vcard@6.1.0-SNAPSHOT

Identifiers

jakarta.xml.soap-api-3.0.2.jar

Description:

Provides the API for creating and building SOAP messages.

License:

Eclipse Distribution License - v 1.0: http://www.eclipse.org/org/documents/edl-v10.php
File Path: /home/runner/.m2/repository/jakarta/xml/soap/jakarta.xml.soap-api/3.0.2/jakarta.xml.soap-api-3.0.2.jar
MD5: b75eb22ffc46058b28d78874902dd2d3
SHA1: 0445830286faf84fe40a3f47ccd7537d69cd58c4
SHA256:62ecd5c3b5c107779e5ffe84922594c381f7a8e397320a05c3ee3957b5b7863f
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

jakarta.xml.soap-api-3.0.2.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-calws-soap-xml@6.0.0
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

jakarta.xml.ws-api-4.0.2.jar

Description:

Jakarta XML Web Services API

License:

Eclipse Distribution License - v 1.0: http://www.eclipse.org/org/documents/edl-v10.php
File Path: /home/runner/.m2/repository/jakarta/xml/ws/jakarta.xml.ws-api/4.0.2/jakarta.xml.ws-api-4.0.2.jar
MD5: 9a41e8d9a62fb837d2228d47684a57da
SHA1: 331ecab874ee75b48db661a331319958cb04edec
SHA256:ae500d776eeb64471cd3e3bdfcd6a9e7de6d8f866be6d7e9b2f9ca606d68c203
Referenced In Projects/Scopes:
  • Bedework: Calendar utilities:compile
  • Bedework: Vcard utilities:compile

jakarta.xml.ws-api-4.0.2.jar is in the transitive dependency tree of the listed items.Included by:
  • pkg:maven/org.bedework/bw-calws-soap-xml@6.0.0
  • pkg:maven/org.bedework/bw-util2-calendar@6.1.0-SNAPSHOT

Identifiers

org.bedework:bw-util2-calendar:6.1.0-SNAPSHOT

Description:

Utility classes and methods with dependencies

License:

Apache License Version 2.0 http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/work/bw-util2/bw-util2/bw-util2-calendar/pom.xml

Referenced In Project/Scope: Bedework: Vcard utilities
org.bedework:bw-util2-calendar:6.1.0-SNAPSHOT is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.bedework/bw-util2-vcard@6.1.0-SNAPSHOT

Identifiers

slf4j-api-1.7.36.jar

Description:

The slf4j API

File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36.jar
MD5: 872da51f5de7f3923da4de871d57fd85
SHA1: 6c62681a2f655b49963a5983b8b0950a6120ae14
SHA256:d3ef575e3e4979678dc01bf1dcce51021493b4d11fb7f1be8ad982877c16a1c0
Referenced In Project/Scope: Bedework: Vcard utilities:compile
slf4j-api-1.7.36.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.bedework/bw-ical4j-vcard@1.1.0

Identifiers



This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.