Dependency-Check Report

Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

Scan Information (show all):

dependency-check version: 5.2.1
Report Generated On: Tue, 24 Sep 2019 22:21:59 -0700
Dependencies Scanned: 13 (6 unique)
Vulnerable Dependencies: 0
Vulnerabilities Found: 0
Vulnerabilities Suppressed: 0
...
NVD CVE Checked: 2019-09-24T22:00:09
NVD CVE Modified: 2019-09-24T17:02:28
VersionCheckOn: 2019-09-24T22:00:09

Summary

Display: Showing Vulnerable Dependencies (click to show all)

Dependency	Vulnerability IDs	Package	Confidence	Evidence Count
aopalliance-1.0.jar		pkg:maven/aopalliance/aopalliance@1.0		19
logback-core-1.2.3.jar	cpe:2.3:a:logback:logback:1.2.3:::::::*	pkg:maven/ch.qos.logback/logback-core@1.2.3	Highest	32
junit-4.12.jar		pkg:maven/junit/junit@4.12		24
hamcrest-core-1.3.jar		pkg:maven/org.hamcrest/hamcrest-core@1.3		26
spring-core-5.1.9.RELEASE.jar	cpe:2.3:a:pivotal_software:spring_framework:5.1.9.release:::::::* cpe:2.3:a:springsource:spring_framework:5.1.9.release:::::::* cpe:2.3:a:vmware:springsource_spring_framework:5.1.9:::::::*	pkg:maven/org.springframework/spring-core@5.1.9.RELEASE	Highest	30
slf4j-api-1.7.28.jar		pkg:maven/org.slf4j/slf4j-api@1.7.28		29

Dependencies

aopalliance-1.0.jar

Description:

AOP Alliance

License:

Public Domain

File Path: /Users/rexhoffman/.m2/repository/aopalliance/aopalliance/1.0/aopalliance-1.0.jar
MD5: 04177054e180d09e3998808efa0401c7
SHA1: 0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8
SHA256:0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08
Referenced In Project/Scope:AdviseLogback:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	pom	artifactid	aopalliance	Low
Vendor	jar	package name	aopalliance	Low
Vendor	jar	package name	aop	Highest
Vendor	pom	groupid	aopalliance	Highest
Vendor	file	name	aopalliance	High
Vendor	jar	package name	intercept	Low
Vendor	pom	url	http://aopalliance.sourceforge.net	Highest
Vendor	pom	name	AOP alliance	High
Vendor	jar	package name	aopalliance	Highest
Product	pom	url	http://aopalliance.sourceforge.net	Medium
Product	jar	package name	aop	Highest
Product	file	name	aopalliance	High
Product	jar	package name	intercept	Low
Product	pom	artifactid	aopalliance	Highest
Product	pom	groupid	aopalliance	Low
Product	pom	name	AOP alliance	High
Product	jar	package name	aopalliance	Highest
Version	pom	version	1.0	Highest
Version	file	version	1.0	Highest

Identifiers

pkg:maven/aopalliance/aopalliance@1.0 (Confidence:High)

logback-core-1.2.3.jar

Description:

logback-core module

License:

http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html

File Path: /Users/rexhoffman/.m2/repository/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar
MD5: 841fc80c6edff60d947a3872a2db4d45
SHA1: 864344400c3d4d92dfeb0a305dc87d953677c03c
SHA256:5946d837fe6f960c02a53eda7a6926ecc3c758bbdd69aa453ee429f858217f22
Referenced In Project/Scope:AdviseLogback:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	core	Highest
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.6	Low
Vendor	jar	package name	ch	Highest
Vendor	file	name	logback-core	High
Vendor	Manifest	bundle-symbolicname	ch.qos.logback.core	Medium
Vendor	pom	groupid	ch.qos.logback	Highest
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"	Low
Vendor	jar	package name	logback	Highest
Vendor	pom	parent-artifactid	logback-parent	Low
Vendor	Manifest	originally-created-by	Apache Maven Bundle Plugin	Low
Vendor	pom	artifactid	logback-core	Low
Vendor	pom	name	Logback Core Module	High
Vendor	jar	package name	qos	Highest
Vendor	Manifest	bundle-docurl	http://www.qos.ch	Low
Product	jar	package name	core	Highest
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-1.6	Low
Product	pom	parent-artifactid	logback-parent	Medium
Product	Manifest	Bundle-Name	Logback Core Module	Medium
Product	jar	package name	ch	Highest
Product	file	name	logback-core	High
Product	pom	artifactid	logback-core	Highest
Product	Manifest	bundle-symbolicname	ch.qos.logback.core	Medium
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"	Low
Product	jar	package name	logback	Highest
Product	Manifest	originally-created-by	Apache Maven Bundle Plugin	Low
Product	pom	name	Logback Core Module	High
Product	jar	package name	qos	Highest
Product	pom	groupid	ch.qos.logback	Low
Product	Manifest	bundle-docurl	http://www.qos.ch	Low
Version	Manifest	Bundle-Version	1.2.3	High
Version	pom	version	1.2.3	Highest
Version	file	version	1.2.3	Highest

Related Dependencies

Identifiers

pkg:maven/ch.qos.logback/logback-core@1.2.3 (Confidence:High)
cpe:2.3:a:logback:logback:1.2.3:*:*:*:*:*:*:* (Confidence:Highest)

junit-4.12.jar

Description:

JUnit is a unit testing framework for Java, created by Erich Gamma and Kent Beck.

License:

Eclipse Public License 1.0: http://www.eclipse.org/legal/epl-v10.html

File Path: /Users/rexhoffman/.m2/repository/junit/junit/4.12/junit-4.12.jar
MD5: 5b38c40c97fbd0adee29f91e60405584
SHA1: 2973d150c0dc1fefe998f834810d68f278ea58ec
SHA256:59721f0805e223d84b90677887d9ff567dc534d7c502ca903c0c2b17f05c116a
Referenced In Project/Scope:AdviseLogback:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	pom	organization name	JUnit	High
Vendor	pom	url	http://junit.org	Highest
Vendor	Manifest	Implementation-Vendor-Id	junit	Medium
Vendor	Manifest	Implementation-Vendor	JUnit	High
Vendor	pom	groupid	junit	Highest
Vendor	jar	package name	junit	Highest
Vendor	pom	organization url	http://www.junit.org	Medium
Vendor	pom	name	JUnit	High
Vendor	file	name	junit	High
Vendor	pom	artifactid	junit	Low
Vendor	jar	package name	framework	Highest
Product	pom	groupid	junit	Low
Product	pom	url	http://junit.org	Medium
Product	pom	organization name	JUnit	Low
Product	pom	organization url	http://www.junit.org	Low
Product	jar	package name	junit	Highest
Product	pom	name	JUnit	High
Product	pom	artifactid	junit	Highest
Product	file	name	junit	High
Product	Manifest	Implementation-Title	JUnit	High
Product	jar	package name	framework	Highest
Version	Manifest	Implementation-Version	4.12	High
Version	pom	version	4.12	Highest
Version	file	version	4.12	Highest

Identifiers

pkg:maven/junit/junit@4.12 (Confidence:High)

hamcrest-core-1.3.jar

Description:

    This is the core API of hamcrest matcher framework to be used by third-party framework providers. This includes the a foundation set of matcher implementations for common operations.

File Path: /Users/rexhoffman/.m2/repository/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
MD5: 6393363b47ddcbba82321110c3e07519
SHA1: 42a25dc3219429f0e5d060061f71acb49bf010a0
SHA256:66fdef91e9739348df7a096aa384a5685f4e875584cce89386a7a47251c4d8e9
Referenced In Project/Scope:AdviseLogback:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	core	Highest
Vendor	file	name	hamcrest-core	High
Vendor	jar	package name	matcher	Highest
Vendor	pom	artifactid	hamcrest-core	Low
Vendor	pom	groupid	org.hamcrest	Highest
Vendor	jar	package name	hamcrest	Highest
Vendor	pom	parent-artifactid	hamcrest-parent	Low
Vendor	Manifest	Implementation-Vendor	hamcrest.org	High
Vendor	pom	parent-groupid	org.hamcrest	Medium
Vendor	pom	name	Hamcrest Core	High
Vendor	Manifest	built-date	2012-07-09 19:49:34	Low
Vendor	pom	groupid	hamcrest	Highest
Product	jar	package name	core	Highest
Product	pom	parent-artifactid	hamcrest-parent	Medium
Product	file	name	hamcrest-core	High
Product	jar	package name	matcher	Highest
Product	pom	groupid	hamcrest	Low
Product	pom	name	Hamcrest Core	High
Product	Manifest	Implementation-Title	hamcrest-core	High
Product	pom	parent-groupid	org.hamcrest	Low
Product	Manifest	built-date	2012-07-09 19:49:34	Low
Product	pom	artifactid	hamcrest-core	Highest
Product	jar	package name	hamcrest	Highest
Version	pom	version	1.3	Highest
Version	file	version	1.3	Highest
Version	Manifest	Implementation-Version	1.3	High

Identifiers

pkg:maven/org.hamcrest/hamcrest-core@1.3 (Confidence:High)

spring-core-5.1.9.RELEASE.jar

Description:

Spring Core

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0

File Path: /Users/rexhoffman/.m2/repository/org/springframework/spring-core/5.1.9.RELEASE/spring-core-5.1.9.RELEASE.jar
MD5: fad0a88be0f6d46008bd84ebb153ebce
SHA1: dc3815439579b4fa0c19970e6b8e5d774af8d988
SHA256:427406f5423e032e08e5d43e5d3eccfbc83350b0d7c6ec22db839755ff1120de
Referenced In Project/Scope:AdviseLogback:compile

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	core	Highest
Vendor	pom	url	spring-projects/spring-framework	Highest
Vendor	jar	package name	springframework	Highest
Vendor	Manifest	automatic-module-name	spring.core	Medium
Vendor	pom	groupid	springframework	Highest
Vendor	pom	artifactid	spring-core	Low
Vendor	pom	name	Spring Core	High
Vendor	pom	organization name	Spring IO	High
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	pom	groupid	org.springframework	Highest
Vendor	file	name	spring-core	High
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	io	Highest
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	pom	organization url	https://projects.spring.io/spring-framework	Medium
Product	jar	package name	core	Highest
Product	pom	url	spring-projects/spring-framework	High
Product	jar	package name	springframework	Highest
Product	pom	organization name	Spring IO	Low
Product	Manifest	automatic-module-name	spring.core	Medium
Product	pom	name	Spring Core	High
Product	pom	organization url	https://projects.spring.io/spring-framework	Low
Product	hint analyzer	product	springsource_spring_framework	Highest
Product	file	name	spring-core	High
Product	Manifest	Implementation-Title	spring-core	High
Product	jar	package name	io	Highest
Product	pom	artifactid	spring-core	Highest
Product	pom	groupid	springframework	Low
Version	pom	version	5.1.9.RELEASE	Highest
Version	Manifest	Implementation-Version	5.1.9.RELEASE	High

Related Dependencies

spring-beans-5.1.9.RELEASE.jar
- File Path: /Users/rexhoffman/.m2/repository/org/springframework/spring-beans/5.1.9.RELEASE/spring-beans-5.1.9.RELEASE.jar
- MD5: 26a027230943159f49b79c9521d0e592
- SHA1: 05a03b3983108d73978aec2fa3e681aedad6782c
- SHA256: e53ac6c352a41050c9f2186590157bbe61899428f3d62bab772f1ef96f141237
- pkg:maven/org.springframework/spring-beans@5.1.9.RELEASE
spring-context-support-5.1.9.RELEASE.jar
- File Path: /Users/rexhoffman/.m2/repository/org/springframework/spring-context-support/5.1.9.RELEASE/spring-context-support-5.1.9.RELEASE.jar
- MD5: 1978d6511a94a8712e55cbb884ea7154
- SHA1: 156dac24edaf3b73a2cd24682d8fbc7d82b70423
- SHA256: 77167b19fe5c9d3c57280932fefce3a69d5dab7c79a1f3b296f5866344e92189
- pkg:maven/org.springframework/spring-context-support@5.1.9.RELEASE
spring-context-5.1.9.RELEASE.jar
- File Path: /Users/rexhoffman/.m2/repository/org/springframework/spring-context/5.1.9.RELEASE/spring-context-5.1.9.RELEASE.jar
- MD5: ea09f1711c340d526e9d417242f8dc16
- SHA1: c37f8fe15a5ae4ea1f351bd46167fd492a84eefa
- SHA256: 129e4c38c34c0a541073f1c9614892a7f44e967101230632a060c0d9a8bae187
- pkg:maven/org.springframework/spring-context@5.1.9.RELEASE
spring-jcl-5.1.9.RELEASE.jar
- File Path: /Users/rexhoffman/.m2/repository/org/springframework/spring-jcl/5.1.9.RELEASE/spring-jcl-5.1.9.RELEASE.jar
- MD5: 8e0f77930c11ea66237ea479b08750d9
- SHA1: 7c372790c999777d20f364960cf557dd74f890cf
- SHA256: e6f5a8162bc57aec3d9260fec9efc019cee904de2b0c5a6abe02598a17d10456
- pkg:maven/org.springframework/spring-jcl@5.1.9.RELEASE
spring-expression-5.1.9.RELEASE.jar
- File Path: /Users/rexhoffman/.m2/repository/org/springframework/spring-expression/5.1.9.RELEASE/spring-expression-5.1.9.RELEASE.jar
- MD5: b689570e1cdc5979c1faa27719beaabe
- SHA1: db3a2468c1b7d697ec3b3ec6e5652dc282994fe3
- SHA256: e13b81f767f4a1b64194c854b03af7ef7987cc48fe98203e5f3b9a259d18bee0
- pkg:maven/org.springframework/spring-expression@5.1.9.RELEASE
spring-aop-5.1.9.RELEASE.jar
- File Path: /Users/rexhoffman/.m2/repository/org/springframework/spring-aop/5.1.9.RELEASE/spring-aop-5.1.9.RELEASE.jar
- MD5: ff12a2b6d156f02dfd7edfd5bebada3f
- SHA1: bc2312ffad02251b9d472e4a7c0e472a58f50fbf
- SHA256: 91e07b10b52c3e5370e90866af1dc4f9d3d4d193ca4b9100667e0df577c37a8d
- pkg:maven/org.springframework/spring-aop@5.1.9.RELEASE

Identifiers

pkg:maven/org.springframework/spring-core@5.1.9.RELEASE (Confidence:High)
cpe:2.3:a:pivotal_software:spring_framework:5.1.9.release:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:springsource:spring_framework:5.1.9.release:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:springsource_spring_framework:5.1.9:*:*:*:*:*:*:* (Confidence:Low)

slf4j-api-1.7.28.jar

Description:

The slf4j API

File Path: /Users/rexhoffman/.m2/repository/org/slf4j/slf4j-api/1.7.28/slf4j-api-1.7.28.jar
MD5: 1468c816e659d8013027d912863dc865
SHA1: 2cd9b264f76e3d087ee21bfc99305928e1bdb443
SHA256:fb6e4f67a2a4689e3e713584db17a5d1090c1ebe6eec30e9e0349a6ee118141e
Referenced In Project/Scope:AdviseLogback:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	slf4j	Highest
Vendor	pom	parent-artifactid	slf4j-parent	Low
Vendor	file	name	slf4j-api	High
Vendor	pom	parent-groupid	org.slf4j	Medium
Vendor	pom	groupid	slf4j	Highest
Vendor	pom	url	http://www.slf4j.org	Highest
Vendor	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Vendor	pom	name	SLF4J API Module	High
Vendor	pom	groupid	org.slf4j	Highest
Vendor	pom	artifactid	slf4j-api	Low
Vendor	Manifest	bundle-symbolicname	slf4j.api	Medium
Vendor	Manifest	automatic-module-name	org.slf4j	Medium
Product	jar	package name	slf4j	Highest
Product	pom	parent-groupid	org.slf4j	Low
Product	file	name	slf4j-api	High
Product	Manifest	Implementation-Title	slf4j-api	High
Product	pom	artifactid	slf4j-api	Highest
Product	pom	url	http://www.slf4j.org	Medium
Product	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Product	Manifest	Bundle-Name	slf4j-api	Medium
Product	pom	name	SLF4J API Module	High
Product	Manifest	bundle-symbolicname	slf4j.api	Medium
Product	pom	groupid	slf4j	Low
Product	pom	parent-artifactid	slf4j-parent	Medium
Product	Manifest	automatic-module-name	org.slf4j	Medium
Version	Manifest	Implementation-Version	1.7.28	High
Version	pom	version	1.7.28	Highest
Version	Manifest	Bundle-Version	1.7.28	High
Version	file	version	1.7.28	Highest

Identifiers

pkg:maven/org.slf4j/slf4j-api@1.7.28 (Confidence:High)

How to read the report | Suppressing false positives | Getting Help: github issues

Project: AdviseLogback

com.github.advisedtesting:AdviseLogback:1.3.1

Summary

Dependencies

aopalliance-1.0.jar

Evidence

Identifiers

logback-core-1.2.3.jar

Evidence

Related Dependencies

Identifiers

junit-4.12.jar

Evidence

Identifiers

hamcrest-core-1.3.jar

Evidence

Identifiers

spring-core-5.1.9.RELEASE.jar

Evidence

Related Dependencies

Identifiers

slf4j-api-1.7.28.jar

Evidence

Identifiers