Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.
License:
The MIT License: http://opensource.org/licenses/MIT
File Path: /opt/tomcat/.m2/repository/org/checkerframework/checker-qual/3.48.3/checker-qual-3.48.3.jar MD5: 9fe3deae54d20bd78960459c952ac7d4 SHA1: c48effe7d78de3cf5e8a98c614281ec6a2466a77 SHA256:443685b1b232803baaf803c15d6f5a425473c6f7b81c5f276dfcf93288e389a5 Referenced In Project/Scope: Core DB:runtime checker-qual-3.48.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.postgresql/postgresql@42.7.5
File Path: /opt/tomcat/.m2/repository/org/flywaydb/flyway-core/10.10.0/flyway-core-10.10.0.jar MD5: c31003dacfe66439c92a78f5019775d4 SHA1: 8761d308b9fc9697a95ae362bcbbb5abe8f6e08f SHA256:9ca803176bf3c9450b58af79c07ffdc7922fa029b97e4f51675b6a9766d4e1d6 Referenced In Project/Scope: Core DB:compile flyway-core-10.10.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/net.andresbustamante/y-a-foot-core-db@2.0.0-SNAPSHOT
File Path: /opt/tomcat/.m2/repository/com/google/code/gson/gson/2.10.1/gson-2.10.1.jar MD5: df6097815738cb31fc56391553210843 SHA1: b3add478d4382b78ea20b1671390a858002feb6c SHA256:4241c14a7727c34feea6507ec801318a3d4a90f070e4525681079fb94ee4c593 Referenced In Project/Scope: Core DB:compile gson-2.10.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.flywaydb/flyway-core@10.10.0
Core annotations used for value types, used by Jackson data binding package.
License:
The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /opt/tomcat/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.17.3/jackson-annotations-2.17.3.jar MD5: cb80e34a9fa3c0b27560e1562dfdff43 SHA1: 4f30a05d2eee0ab700cdc27aa5967e934d3042b2 SHA256:2747f60343783a6ec8a68405c7c839fa0bbe30ee4e2459d21a1ac3b7365e1ed5 Referenced In Project/Scope: Core DB:compile jackson-annotations-2.17.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.flywaydb/flyway-core@10.10.0
Core Jackson processing abstractions (aka Streaming API), implementation for JSON
License:
The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /opt/tomcat/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.17.3/jackson-core-2.17.3.jar MD5: b38c1cd06ec2b87bd23494962c44da69 SHA1: 1d6eb3e959c737692b720d3492b2f1f34c4c8579 SHA256:19e03ee71f00a86255fa3c980560b231e1305486f6482c905601209014f5870c Referenced In Project/Scope: Core DB:compile jackson-core-2.17.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.flywaydb/flyway-core@10.10.0
A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.
CWE-770 Allocation of Resources Without Limits or Throttling
General data-binding functionality for Jackson: works on core streaming API
License:
The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /opt/tomcat/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.17.3/jackson-databind-2.17.3.jar MD5: 820811143157937e800b899a4feeb261 SHA1: 42c617beb411ee813bdc39a287424bfb19d99185 SHA256:93b13e709a0b620de42019180a75bc1fc4885c81fe5b6087a4aa248f91fb9a95 Referenced In Project/Scope: Core DB:compile jackson-databind-2.17.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.flywaydb/flyway-core@10.10.0
Support for reading and writing TOML-encoded data via Jackson abstractions.
License:
The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /opt/tomcat/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-toml/2.17.3/jackson-dataformat-toml-2.17.3.jar MD5: d2ad35af9cbda38b7c342e5db2f42714 SHA1: 34c86ea69dac79a2a684d5d2261b62116e788e37 SHA256:c5785f6ab645e4cda167424359b32a6af466a06d46d6c2195c1f14058be7e212 Referenced In Project/Scope: Core DB:compile jackson-dataformat-toml-2.17.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.flywaydb/flyway-core@10.10.0
File Path: /opt/tomcat/.m2/repository/org/postgresql/postgresql/42.7.5/postgresql-42.7.5.jar MD5: 5cd7ba0dfa9ec82c4812b5bf387de185 SHA1: 747897987b86c741fb8b56f6b81929ae1e6e4b46 SHA256:69020b3bd20984543e817393f2e6c01a890ef2e37a77dd11d6d8508181d079ab Referenced In Project/Scope: Core DB:compile postgresql-42.7.5.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/net.andresbustamante/y-a-foot-core-db@2.0.0-SNAPSHOT
Evidence
Type
Source
Name
Value
Confidence
Vendor
file
name
postgresql
High
Vendor
jar
package name
driver
Highest
Vendor
jar
package name
jdbc
Highest
Vendor
jar
package name
postgresql
Highest
Vendor
Manifest
automatic-module-name
org.postgresql.jdbc
Medium
Vendor
Manifest
bundle-copyright
Copyright (c) 2003-2024, PostgreSQL Global Development Group