kevin.json

{
  "name": "io.github.snyk:todolist-mvc",
  "version": "1.0-SNAPSHOT",
  "dependencies": {
    "javax.xml.bind:jaxb-api": {
      "name": "javax.xml.bind:jaxb-api",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "com.sun.xml.bind:jaxb-core": {
      "name": "com.sun.xml.bind:jaxb-core",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "com.sun.xml.bind:jaxb-impl": {
      "name": "com.sun.xml.bind:jaxb-impl",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    }
  },
  "packageFormatVersion": "mvn:0.0.1"
}
{
  "name": "io.github.snyk:todolist-core",
  "version": "1.0-SNAPSHOT",
  "dependencies": {
    "org.springframework:spring-context": {
      "name": "org.springframework:spring-context",
      "version": "3.2.6.RELEASE",
      "dependencies": {
        "org.springframework:spring-aop": {
          "name": "org.springframework:spring-aop",
          "version": "3.2.6.RELEASE",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.springframework:spring-beans": {
          "name": "org.springframework:spring-beans",
          "version": "3.2.6.RELEASE",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.springframework:spring-core": {
          "name": "org.springframework:spring-core",
          "version": "3.2.6.RELEASE",
          "dependencies": {
            "commons-logging:commons-logging": {
              "name": "commons-logging:commons-logging",
              "version": "1.1.1",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        },
        "org.springframework:spring-expression": {
          "name": "org.springframework:spring-expression",
          "version": "3.2.6.RELEASE",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "org.springframework:spring-orm": {
      "name": "org.springframework:spring-orm",
      "version": "3.2.6.RELEASE",
      "dependencies": {
        "aopalliance:aopalliance": {
          "name": "aopalliance:aopalliance",
          "version": "1.0",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.springframework:spring-jdbc": {
          "name": "org.springframework:spring-jdbc",
          "version": "3.2.6.RELEASE",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.springframework:spring-tx": {
          "name": "org.springframework:spring-tx",
          "version": "3.2.6.RELEASE",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "org.springframework:spring-aspects": {
      "name": "org.springframework:spring-aspects",
      "version": "3.2.6.RELEASE",
      "dependencies": {
        "org.springframework:spring-context-support": {
          "name": "org.springframework:spring-context-support",
          "version": "3.2.6.RELEASE",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "cglib:cglib": {
      "name": "cglib:cglib",
      "version": "2.2.2",
      "dependencies": {
        "asm:asm": {
          "name": "asm:asm",
          "version": "3.3.1",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "org.aspectj:aspectjweaver": {
      "name": "org.aspectj:aspectjweaver",
      "version": "1.8.2",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "c3p0:c3p0": {
      "name": "c3p0:c3p0",
      "version": "0.9.1.2",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "org.hsqldb:hsqldb": {
      "name": "org.hsqldb:hsqldb",
      "version": "2.3.2",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "org.hibernate:hibernate-core": {
      "name": "org.hibernate:hibernate-core",
      "version": "4.3.7.Final",
      "dependencies": {
        "org.jboss.logging:jboss-logging": {
          "name": "org.jboss.logging:jboss-logging",
          "version": "3.1.3.GA",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.jboss.logging:jboss-logging-annotations": {
          "name": "org.jboss.logging:jboss-logging-annotations",
          "version": "1.2.0.Beta1",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec": {
          "name": "org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec",
          "version": "1.0.0.Final",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "dom4j:dom4j": {
          "name": "dom4j:dom4j",
          "version": "1.6.1",
          "dependencies": {
            "xml-apis:xml-apis": {
              "name": "xml-apis:xml-apis",
              "version": "1.0.b2",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        },
        "org.hibernate.common:hibernate-commons-annotations": {
          "name": "org.hibernate.common:hibernate-commons-annotations",
          "version": "4.0.5.Final",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.hibernate.javax.persistence:hibernate-jpa-2.1-api": {
          "name": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
          "version": "1.0.0.Final",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.javassist:javassist": {
          "name": "org.javassist:javassist",
          "version": "3.18.1-GA",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "antlr:antlr": {
          "name": "antlr:antlr",
          "version": "2.7.7",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.jboss:jandex": {
          "name": "org.jboss:jandex",
          "version": "1.1.0.Final",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "org.hibernate:hibernate-entitymanager": {
      "name": "org.hibernate:hibernate-entitymanager",
      "version": "4.3.7.Final",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "org.hibernate.javax.persistence:hibernate-jpa-2.0-api": {
      "name": "org.hibernate.javax.persistence:hibernate-jpa-2.0-api",
      "version": "1.0.1.Final",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "commons-collections:commons-collections": {
      "name": "commons-collections:commons-collections",
      "version": "3.2.2",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "javax.xml.bind:jaxb-api": {
      "name": "javax.xml.bind:jaxb-api",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "com.sun.xml.bind:jaxb-core": {
      "name": "com.sun.xml.bind:jaxb-core",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "com.sun.xml.bind:jaxb-impl": {
      "name": "com.sun.xml.bind:jaxb-impl",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    }
  },
  "packageFormatVersion": "mvn:0.0.1"
}
{
  "name": "io.github.snyk:todolist-web-common",
  "version": "1.0-SNAPSHOT",
  "dependencies": {
    "io.github.snyk:todolist-core": {
      "name": "io.github.snyk:todolist-core",
      "version": "1.0-SNAPSHOT",
      "dependencies": {
        "org.springframework:spring-context": {
          "name": "org.springframework:spring-context",
          "version": "3.2.6.RELEASE",
          "dependencies": {
            "org.springframework:spring-aop": {
              "name": "org.springframework:spring-aop",
              "version": "3.2.6.RELEASE",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.springframework:spring-beans": {
              "name": "org.springframework:spring-beans",
              "version": "3.2.6.RELEASE",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.springframework:spring-core": {
              "name": "org.springframework:spring-core",
              "version": "3.2.6.RELEASE",
              "dependencies": {
                "commons-logging:commons-logging": {
                  "name": "commons-logging:commons-logging",
                  "version": "1.1.1",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                }
              },
              "labels": {
                "scope": "compile"
              }
            },
            "org.springframework:spring-expression": {
              "name": "org.springframework:spring-expression",
              "version": "3.2.6.RELEASE",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        },
        "org.springframework:spring-orm": {
          "name": "org.springframework:spring-orm",
          "version": "3.2.6.RELEASE",
          "dependencies": {
            "aopalliance:aopalliance": {
              "name": "aopalliance:aopalliance",
              "version": "1.0",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.springframework:spring-jdbc": {
              "name": "org.springframework:spring-jdbc",
              "version": "3.2.6.RELEASE",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.springframework:spring-tx": {
              "name": "org.springframework:spring-tx",
              "version": "3.2.6.RELEASE",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        },
        "org.springframework:spring-aspects": {
          "name": "org.springframework:spring-aspects",
          "version": "3.2.6.RELEASE",
          "dependencies": {
            "org.springframework:spring-context-support": {
              "name": "org.springframework:spring-context-support",
              "version": "3.2.6.RELEASE",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        },
        "cglib:cglib": {
          "name": "cglib:cglib",
          "version": "2.2.2",
          "dependencies": {
            "asm:asm": {
              "name": "asm:asm",
              "version": "3.3.1",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        },
        "org.aspectj:aspectjweaver": {
          "name": "org.aspectj:aspectjweaver",
          "version": "1.8.2",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "c3p0:c3p0": {
          "name": "c3p0:c3p0",
          "version": "0.9.1.2",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.hsqldb:hsqldb": {
          "name": "org.hsqldb:hsqldb",
          "version": "2.3.2",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.hibernate:hibernate-core": {
          "name": "org.hibernate:hibernate-core",
          "version": "4.3.7.Final",
          "dependencies": {
            "org.jboss.logging:jboss-logging-annotations": {
              "name": "org.jboss.logging:jboss-logging-annotations",
              "version": "1.2.0.Beta1",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec": {
              "name": "org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec",
              "version": "1.0.0.Final",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "dom4j:dom4j": {
              "name": "dom4j:dom4j",
              "version": "1.6.1",
              "dependencies": {
                "xml-apis:xml-apis": {
                  "name": "xml-apis:xml-apis",
                  "version": "1.0.b2",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                }
              },
              "labels": {
                "scope": "compile"
              }
            },
            "org.hibernate.common:hibernate-commons-annotations": {
              "name": "org.hibernate.common:hibernate-commons-annotations",
              "version": "4.0.5.Final",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.hibernate.javax.persistence:hibernate-jpa-2.1-api": {
              "name": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
              "version": "1.0.0.Final",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.javassist:javassist": {
              "name": "org.javassist:javassist",
              "version": "3.18.1-GA",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "antlr:antlr": {
              "name": "antlr:antlr",
              "version": "2.7.7",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.jboss:jandex": {
              "name": "org.jboss:jandex",
              "version": "1.1.0.Final",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        },
        "org.hibernate:hibernate-entitymanager": {
          "name": "org.hibernate:hibernate-entitymanager",
          "version": "4.3.7.Final",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.hibernate.javax.persistence:hibernate-jpa-2.0-api": {
          "name": "org.hibernate.javax.persistence:hibernate-jpa-2.0-api",
          "version": "1.0.1.Final",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "commons-collections:commons-collections": {
          "name": "commons-collections:commons-collections",
          "version": "3.2.2",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "javax:javaee-web-api": {
      "name": "javax:javaee-web-api",
      "version": "7.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "javax.servlet:jstl": {
      "name": "javax.servlet:jstl",
      "version": "1.2",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "org.hibernate:hibernate-validator": {
      "name": "org.hibernate:hibernate-validator",
      "version": "4.3.1.Final",
      "dependencies": {
        "javax.validation:validation-api": {
          "name": "javax.validation:validation-api",
          "version": "1.0.0.GA",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.jboss.logging:jboss-logging": {
          "name": "org.jboss.logging:jboss-logging",
          "version": "3.1.0.CR2",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "javax.xml.bind:jaxb-api": {
      "name": "javax.xml.bind:jaxb-api",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "com.sun.xml.bind:jaxb-core": {
      "name": "com.sun.xml.bind:jaxb-core",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "com.sun.xml.bind:jaxb-impl": {
      "name": "com.sun.xml.bind:jaxb-impl",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    }
  },
  "packageFormatVersion": "mvn:0.0.1"
}
{
  "name": "io.github.snyk:todolist-web-struts",
  "version": "1.0-SNAPSHOT",
  "dependencies": {
    "io.github.snyk:todolist-web-common": {
      "name": "io.github.snyk:todolist-web-common",
      "version": "1.0-SNAPSHOT",
      "dependencies": {
        "io.github.snyk:todolist-core": {
          "name": "io.github.snyk:todolist-core",
          "version": "1.0-SNAPSHOT",
          "dependencies": {
            "org.springframework:spring-orm": {
              "name": "org.springframework:spring-orm",
              "version": "3.2.6.RELEASE",
              "dependencies": {
                "org.springframework:spring-jdbc": {
                  "name": "org.springframework:spring-jdbc",
                  "version": "3.2.6.RELEASE",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                },
                "org.springframework:spring-tx": {
                  "name": "org.springframework:spring-tx",
                  "version": "3.2.6.RELEASE",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                }
              },
              "labels": {
                "scope": "compile"
              }
            },
            "org.springframework:spring-aspects": {
              "name": "org.springframework:spring-aspects",
              "version": "3.2.6.RELEASE",
              "dependencies": {
                "org.springframework:spring-context-support": {
                  "name": "org.springframework:spring-context-support",
                  "version": "3.2.6.RELEASE",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                }
              },
              "labels": {
                "scope": "compile"
              }
            },
            "cglib:cglib": {
              "name": "cglib:cglib",
              "version": "2.2.2",
              "dependencies": {
                "asm:asm": {
                  "name": "asm:asm",
                  "version": "3.3.1",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                }
              },
              "labels": {
                "scope": "compile"
              }
            },
            "org.aspectj:aspectjweaver": {
              "name": "org.aspectj:aspectjweaver",
              "version": "1.8.2",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "c3p0:c3p0": {
              "name": "c3p0:c3p0",
              "version": "0.9.1.2",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.hsqldb:hsqldb": {
              "name": "org.hsqldb:hsqldb",
              "version": "2.3.2",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.hibernate:hibernate-core": {
              "name": "org.hibernate:hibernate-core",
              "version": "4.3.7.Final",
              "dependencies": {
                "org.jboss.logging:jboss-logging-annotations": {
                  "name": "org.jboss.logging:jboss-logging-annotations",
                  "version": "1.2.0.Beta1",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                },
                "org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec": {
                  "name": "org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec",
                  "version": "1.0.0.Final",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                },
                "dom4j:dom4j": {
                  "name": "dom4j:dom4j",
                  "version": "1.6.1",
                  "dependencies": {
                    "xml-apis:xml-apis": {
                      "name": "xml-apis:xml-apis",
                      "version": "1.0.b2",
                      "dependencies": {},
                      "labels": {
                        "scope": "compile"
                      }
                    }
                  },
                  "labels": {
                    "scope": "compile"
                  }
                },
                "org.hibernate.common:hibernate-commons-annotations": {
                  "name": "org.hibernate.common:hibernate-commons-annotations",
                  "version": "4.0.5.Final",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                },
                "org.hibernate.javax.persistence:hibernate-jpa-2.1-api": {
                  "name": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
                  "version": "1.0.0.Final",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                },
                "org.javassist:javassist": {
                  "name": "org.javassist:javassist",
                  "version": "3.18.1-GA",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                },
                "antlr:antlr": {
                  "name": "antlr:antlr",
                  "version": "2.7.7",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                },
                "org.jboss:jandex": {
                  "name": "org.jboss:jandex",
                  "version": "1.1.0.Final",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                }
              },
              "labels": {
                "scope": "compile"
              }
            },
            "org.hibernate:hibernate-entitymanager": {
              "name": "org.hibernate:hibernate-entitymanager",
              "version": "4.3.7.Final",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.hibernate.javax.persistence:hibernate-jpa-2.0-api": {
              "name": "org.hibernate.javax.persistence:hibernate-jpa-2.0-api",
              "version": "1.0.1.Final",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "commons-collections:commons-collections": {
              "name": "commons-collections:commons-collections",
              "version": "3.2.2",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        },
        "javax.servlet:jstl": {
          "name": "javax.servlet:jstl",
          "version": "1.2",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.hibernate:hibernate-validator": {
          "name": "org.hibernate:hibernate-validator",
          "version": "4.3.1.Final",
          "dependencies": {
            "javax.validation:validation-api": {
              "name": "javax.validation:validation-api",
              "version": "1.0.0.GA",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.jboss.logging:jboss-logging": {
              "name": "org.jboss.logging:jboss-logging",
              "version": "3.1.0.CR2",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "javax:javaee-web-api": {
      "name": "javax:javaee-web-api",
      "version": "7.0",
      "dependencies": {},
      "labels": {
        "scope": "provided"
      }
    },
    "org.springframework:spring-web": {
      "name": "org.springframework:spring-web",
      "version": "3.2.6.RELEASE",
      "dependencies": {
        "aopalliance:aopalliance": {
          "name": "aopalliance:aopalliance",
          "version": "1.0",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.springframework:spring-aop": {
          "name": "org.springframework:spring-aop",
          "version": "3.2.6.RELEASE",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.springframework:spring-beans": {
          "name": "org.springframework:spring-beans",
          "version": "3.2.6.RELEASE",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "org.springframework:spring-context": {
          "name": "org.springframework:spring-context",
          "version": "3.2.6.RELEASE",
          "dependencies": {
            "org.springframework:spring-expression": {
              "name": "org.springframework:spring-expression",
              "version": "3.2.6.RELEASE",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        },
        "org.springframework:spring-core": {
          "name": "org.springframework:spring-core",
          "version": "3.2.6.RELEASE",
          "dependencies": {
            "commons-logging:commons-logging": {
              "name": "commons-logging:commons-logging",
              "version": "1.1.1",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "org.apache.struts:struts2-core": {
      "name": "org.apache.struts:struts2-core",
      "version": "2.3.20",
      "dependencies": {
        "org.apache.struts.xwork:xwork-core": {
          "name": "org.apache.struts.xwork:xwork-core",
          "version": "2.3.20",
          "dependencies": {
            "org.ow2.asm:asm": {
              "name": "org.ow2.asm:asm",
              "version": "5.0.2",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            },
            "org.ow2.asm:asm-commons": {
              "name": "org.ow2.asm:asm-commons",
              "version": "5.0.2",
              "dependencies": {
                "org.ow2.asm:asm-tree": {
                  "name": "org.ow2.asm:asm-tree",
                  "version": "5.0.2",
                  "dependencies": {},
                  "labels": {
                    "scope": "compile"
                  }
                }
              },
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        },
        "org.freemarker:freemarker": {
          "name": "org.freemarker:freemarker",
          "version": "2.3.19",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "ognl:ognl": {
          "name": "ognl:ognl",
          "version": "3.0.6",
          "dependencies": {
            "javassist:javassist": {
              "name": "javassist:javassist",
              "version": "3.11.0.GA",
              "dependencies": {},
              "labels": {
                "scope": "compile"
              }
            }
          },
          "labels": {
            "scope": "compile"
          }
        },
        "commons-fileupload:commons-fileupload": {
          "name": "commons-fileupload:commons-fileupload",
          "version": "1.3.1",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        },
        "commons-io:commons-io": {
          "name": "commons-io:commons-io",
          "version": "2.2",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "org.apache.struts:struts2-spring-plugin": {
      "name": "org.apache.struts:struts2-spring-plugin",
      "version": "2.3.20",
      "dependencies": {
        "org.apache.commons:commons-lang3": {
          "name": "org.apache.commons:commons-lang3",
          "version": "3.2",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "org.zeroturnaround:zt-zip": {
      "name": "org.zeroturnaround:zt-zip",
      "version": "1.12",
      "dependencies": {
        "org.slf4j:slf4j-api": {
          "name": "org.slf4j:slf4j-api",
          "version": "1.6.6",
          "dependencies": {},
          "labels": {
            "scope": "compile"
          }
        }
      },
      "labels": {
        "scope": "compile"
      }
    },
    "javax.xml.bind:jaxb-api": {
      "name": "javax.xml.bind:jaxb-api",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "com.sun.xml.bind:jaxb-core": {
      "name": "com.sun.xml.bind:jaxb-core",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    },
    "com.sun.xml.bind:jaxb-impl": {
      "name": "com.sun.xml.bind:jaxb-impl",
      "version": "2.3.0",
      "dependencies": {},
      "labels": {
        "scope": "compile"
      }
    }
  },
  "packageFormatVersion": "mvn:0.0.1"
}
[
  {
    "vulnerabilities": [],
    "ok": true,
    "dependencyCount": 3,
    "org": "kevin-s31-org",
    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.0\nignore: {}\npatch: {}\n",
    "isPrivate": true,
    "licensesPolicy": {
      "severities": {},
      "orgLicenseRules": {
        "AGPL-1.0": {
          "licenseType": "AGPL-1.0",
          "severity": "high",
          "instructions": ""
        },
        "AGPL-3.0": {
          "licenseType": "AGPL-3.0",
          "severity": "high",
          "instructions": ""
        },
        "Artistic-1.0": {
          "licenseType": "Artistic-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "Artistic-2.0": {
          "licenseType": "Artistic-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "CDDL-1.0": {
          "licenseType": "CDDL-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "CPOL-1.02": {
          "licenseType": "CPOL-1.02",
          "severity": "high",
          "instructions": ""
        },
        "EPL-1.0": {
          "licenseType": "EPL-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "GPL-2.0": {
          "licenseType": "GPL-2.0",
          "severity": "high",
          "instructions": ""
        },
        "GPL-3.0": {
          "licenseType": "GPL-3.0",
          "severity": "high",
          "instructions": ""
        },
        "LGPL-2.0": {
          "licenseType": "LGPL-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "LGPL-2.1": {
          "licenseType": "LGPL-2.1",
          "severity": "medium",
          "instructions": ""
        },
        "LGPL-3.0": {
          "licenseType": "LGPL-3.0",
          "severity": "medium",
          "instructions": ""
        },
        "MPL-1.1": {
          "licenseType": "MPL-1.1",
          "severity": "medium",
          "instructions": ""
        },
        "MPL-2.0": {
          "licenseType": "MPL-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "MS-RL": {
          "licenseType": "MS-RL",
          "severity": "medium",
          "instructions": ""
        },
        "SimPL-2.0": {
          "licenseType": "SimPL-2.0",
          "severity": "high",
          "instructions": ""
        }
      }
    },
    "packageManager": "maven",
    "ignoreSettings": {
      "adminOnly": false,
      "reasonRequired": false,
      "disregardFilesystemIgnores": false
    },
    "summary": "No known vulnerabilities",
    "filesystemPolicy": false,
    "uniqueCount": 0,
    "projectName": "io.github.snyk:todolist-mvc",
    "foundProjectCount": 3,
    "displayTargetFile": "pom.xml",
    "path": "/Users/ksuzy31/Kev-Stuff/Java-Goof/java-goof"
  },
  {
    "vulnerabilities": [
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2019-09-05T16:17:58.383761Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection.\nvia the `extractXmlConfigFromInputStream` in `com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java` during initialization.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\r\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\r\n\r\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\r\n\r\nFor example, below is a sample XML document, containing an XML element- username.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n   <username>John</username>\r\n</xml>\r\n```\r\n\r\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n<!DOCTYPE foo [\r\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\r\n   <username>&xxe;</username>\r\n</xml>\r\n```\r\n\r\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n\n## Remediation\n\nThere is no fixed version for `c3p0:c3p0`.\n\n\n## References\n\n- [GitHub Commit](https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1)\n",
        "disclosureTime": "2018-12-24T13:29:00Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
              "className": "C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "fixedIn": [],
        "id": "SNYK-JAVA-C3P0-461017",
        "identifiers": {
          "CWE": [
            "CWE-611"
          ],
          "CVE": [
            "CVE-2018-20433"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:01.987191Z",
        "moduleName": "c3p0:c3p0",
        "packageManager": "maven",
        "packageName": "c3p0:c3p0",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2019-07-21T14:22:18Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-01-03T16:25:31.174274Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "c3p0",
          "artifactId": "c3p0"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "c3p0:c3p0@0.9.1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "c3p0:c3p0",
        "version": "0.9.1.2"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O",
        "alternativeIds": [],
        "creationTime": "2019-09-05T16:24:58.914446Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to missing protections against recursive entity expansion when loading XML configurations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nThere is no fixed version for `c3p0:c3p0`.\n## References\n- [POC: Hackerone Report](https://hackerone.com/reports/509315)\n",
        "disclosureTime": "2019-04-22T22:18:26Z",
        "exploit": "Proof of Concept",
        "functions": [
          {
            "functionId": {
              "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
              "className": "C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "fixedIn": [],
        "id": "SNYK-JAVA-C3P0-461018",
        "identifiers": {
          "CWE": [
            "CWE-776"
          ],
          "GHSA": [
            "GHSA-84p2-vf58-xhxv"
          ],
          "CVE": [
            "CVE-2019-5427"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-04-24T11:13:58.306515Z",
        "moduleName": "c3p0:c3p0",
        "packageManager": "maven",
        "packageName": "c3p0:c3p0",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2019-04-22T22:18:26Z",
        "references": [
          {
            "title": "POC: Hackerone Report",
            "url": "https://hackerone.com/reports/509315"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-04-23T01:11:20.164193Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "c3p0",
          "artifactId": "c3p0"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "c3p0:c3p0@0.9.1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "c3p0:c3p0",
        "version": "0.9.1.2"
      },
      {
        "id": "snyk:lic:maven:c3p0:c3p0:LGPL-3.0",
        "packageName": "c3p0:c3p0",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-10T14:28:57.415Z",
        "description": "LGPL-3.0 license",
        "language": "java",
        "license": "LGPL-3.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-10T14:28:57.415Z",
        "title": "LGPL-3.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "c3p0:c3p0@0.9.1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "c3p0:c3p0",
        "version": "0.9.1.2"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
        "alternativeIds": [],
        "creationTime": "2019-04-10T16:07:04.634619Z",
        "credit": [
          "Mario Areias"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection due to improper validation of the `QName` inputs.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387)\n- [GitHub Issue](https://github.com/dom4j/dom4j/issues/48)\n- [POC: Ihacktoprotect Blog](https://ihacktoprotect.com/post/dom4j-xml-injection/)\n",
        "disclosureTime": "2018-07-01T19:12:29Z",
        "exploit": "Proof of Concept",
        "functions": [
          {
            "functionId": {
              "filePath": "org/dom4j/Namespace.java",
              "className": "Namespace",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          },
          {
            "functionId": {
              "filePath": "org/dom4j/QName.java",
              "className": "QName",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          }
        ],
        "fixedIn": [],
        "id": "SNYK-JAVA-DOM4J-174153",
        "identifiers": {
          "CWE": [
            "CWE-611"
          ],
          "GHSA": [
            "GHSA-6pcc-3rfx-4gpm"
          ],
          "CVE": [
            "CVE-2018-1000632"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-22T12:44:25.928596Z",
        "moduleName": "dom4j:dom4j",
        "packageManager": "maven",
        "packageName": "dom4j:dom4j",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2018-08-21T14:16:13Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/dom4j/dom4j/issues/48"
          },
          {
            "title": "POC: Ihacktoprotect Blog",
            "url": "https://ihacktoprotect.com/post/dom4j-xml-injection/"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "SUSE",
            "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "cvssV3BaseScore": 6.1,
            "severity": "medium",
            "modificationTime": "2022-05-04T00:48:09.564645Z"
          },
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T16:12:35.769596Z"
          },
          {
            "assigner": "RHEL",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-05-31T14:35:13.279641Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.dom4j.Namespace",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          },
          {
            "functionId": {
              "className": "org.dom4j.QName",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "dom4j",
          "artifactId": "dom4j"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "dom4j:dom4j@1.6.1"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "dom4j:dom4j",
        "version": "1.6.1"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
        "alternativeIds": [],
        "creationTime": "2022-05-10T12:56:27.582369Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 7.4,
        "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection. By using the default `SaxReader()` provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/a822852)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1694235)\n",
        "disclosureTime": "2020-04-15T09:38:17Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [],
        "id": "SNYK-JAVA-DOM4J-2812975",
        "identifiers": {
          "CWE": [
            "CWE-611"
          ],
          "GHSA": [
            "GHSA-hwj3-m3p6-hj38"
          ],
          "CVE": [
            "CVE-2020-10683"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-10T12:56:27.582382Z",
        "moduleName": "dom4j:dom4j",
        "packageManager": "maven",
        "packageName": "dom4j:dom4j",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-04-16T15:22:50Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/dom4j/dom4j/commit/a822852"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694235"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-07-26T01:11:31.495013Z"
          },
          {
            "assigner": "RHEL",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "cvssV3BaseScore": 7.4,
            "severity": "high",
            "modificationTime": "2022-05-31T14:51:07.029250Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "dom4j",
          "artifactId": "dom4j"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "dom4j:dom4j@1.6.1"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "dom4j:dom4j",
        "version": "1.6.1"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:U",
        "alternativeIds": [],
        "creationTime": "2020-11-19T16:51:52.251545Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 8.2,
        "description": "## Overview\n[org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) is a library providing Object/Relational Mapping (ORM) support to applications, libraries, and frameworks.\n\nAffected versions of this package are vulnerable to SQL Injection. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.\n## Remediation\nUpgrade `org.hibernate:hibernate-core` to version 5.4.24.Final or higher.\n## References\n- [GitHub Commit](https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78)\n- [Redhat CVE Details](https://access.redhat.com/security/cve/cve-2020-25638)\n",
        "disclosureTime": "2020-11-19T16:51:45Z",
        "exploit": "Unproven",
        "functions": [
          {
            "functionId": {
              "filePath": "org/hibernate/loader/plan/exec/query/internal/SelectStatementBuilder.java",
              "className": "SelectStatementBuilder",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Delete.java",
              "className": "Delete",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Insert.java",
              "className": "Insert",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/InsertSelect.java",
              "className": "InsertSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/QuerySelect.java",
              "className": "QuerySelect",
              "functionName": "toQueryString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Select.java",
              "className": "Select",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/SimpleSelect.java",
              "className": "SimpleSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Update.java",
              "className": "Update",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          }
        ],
        "fixedIn": [
          "5.4.24.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-1041788",
        "identifiers": {
          "CWE": [
            "CWE-89"
          ],
          "CVE": [
            "CVE-2020-25638"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-07-18T12:56:04.506674Z",
        "moduleName": "org.hibernate:hibernate-core",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-11-19T16:57:14.572204Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78"
          },
          {
            "title": "Redhat CVE Details",
            "url": "https://access.redhat.com/security/cve/cve-2020-25638"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "SQL Injection",
        "insights": {
          "triageAdvice": "This vulnerability is only applicable on systems using JPA Criteria API"
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "cvssV3BaseScore": 7.4,
            "severity": "high",
            "modificationTime": "2022-07-26T01:11:35.094170Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.hibernate.loader.plan.exec.query.internal.SelectStatementBuilder",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Delete",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Insert",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.InsertSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.QuerySelect",
              "functionName": "toQueryString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Select",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.SimpleSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Update",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,5.4.24.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final"
        ],
        "upgradePath": [
          false,
          "org.hibernate:hibernate-core@5.4.24.Final"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-core",
        "version": "4.3.7.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2020-07-15T13:53:15.331818Z",
        "credit": [
          "Gail Badner"
        ],
        "cvssScore": 8.1,
        "description": "## Overview\n[org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) is a library providing Object/Relational Mapping (ORM) support to applications, libraries, and frameworks.\n\nAffected versions of this package are vulnerable to SQL Injection. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.\n## Remediation\nUpgrade `org.hibernate:hibernate-core` to version 5.3.18.Final, 5.4.18.Final or higher.\n## References\n- [GitHub Pull Request](https://github.com/hibernate/hibernate-orm/pull/3438)\n- [Jira Ticket](https://hibernate.atlassian.net/browse/HHH-14077)\n",
        "disclosureTime": "2020-06-18T13:46:30Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/hibernate/query/criteria/internal/expression/LiteralExpression.java",
              "className": "LiteralExpression",
              "functionName": "renderProjection"
            },
            "version": [
              "[5.1.18.Final ,5.4.18.Final)"
            ]
          }
        ],
        "fixedIn": [
          "5.3.18.Final",
          "5.4.18.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-584563",
        "identifiers": {
          "CWE": [
            "CWE-89"
          ],
          "CVE": [
            "CVE-2019-14900"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-07-18T12:57:02.888829Z",
        "moduleName": "org.hibernate:hibernate-core",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-07-15T16:40:12Z",
        "references": [
          {
            "title": "GitHub Pull Request",
            "url": "https://github.com/hibernate/hibernate-orm/pull/3438"
          },
          {
            "title": "Jira Ticket",
            "url": "https://hibernate.atlassian.net/browse/HHH-14077"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "SQL Injection",
        "insights": {
          "triageAdvice": "This vulnerability is only applicable on systems using JPA Criteria API"
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "cvssV3BaseScore": 6.5,
            "severity": "medium",
            "modificationTime": "2022-04-30T01:10:36.121203Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.hibernate.query.criteria.internal.expression.LiteralExpression",
              "functionName": "renderProjection"
            },
            "version": [
              "[5.1.18.Final ,5.4.18.Final)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,5.3.18.Final)",
            "[5.4.0.Final, 5.4.18.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final"
        ],
        "upgradePath": [
          false,
          "org.hibernate:hibernate-core@5.3.18.Final"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-core",
        "version": "4.3.7.Final"
      },
      {
        "id": "snyk:lic:maven:org.hibernate:hibernate-core:LGPL-2.0",
        "packageName": "org.hibernate:hibernate-core",
        "semver": {
          "vulnerable": [
            "[3.3.0.CR1, 5.3.1.Final)"
          ]
        },
        "creationTime": "2022-09-11T12:51:18.861Z",
        "description": "LGPL-2.0 license",
        "language": "java",
        "license": "LGPL-2.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T12:51:18.861Z",
        "title": "LGPL-2.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final"
        ],
        "upgradePath": [
          false,
          "org.hibernate:hibernate-core@5.3.1.Final"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-core",
        "version": "4.3.7.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2022-01-02T11:14:46.053186Z",
        "credit": [
          "Dennis Kennedy"
        ],
        "cvssScore": 4.3,
        "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Improper Output Neutralization for Logs when a user provides malicious input, causing insertion of additional log entries.\n## Remediation\nUpgrade `org.springframework:spring-core` to version 5.3.12, 5.2.18 or higher.\n## References\n- [Github Commit](https://github.com/spring-projects/spring-framework/commit/346b75580267dc5d8d257be198d5841ce4e1add5)\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2021-22096)\n",
        "disclosureTime": "2021-10-27T12:52:59Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.3.12",
          "5.2.18"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2021-22096"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-01-02T11:14:46.378072Z",
        "moduleName": "org.springframework:spring-core",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2021-10-27T16:55:13Z",
        "references": [
          {
            "title": "Github Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/346b75580267dc5d8d257be198d5841ce4e1add5"
          },
          {
            "title": "Pivotal Security Advisory",
            "url": "https://pivotal.io/security/cve-2021-22096"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Improper Output Neutralization for Logs",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 4.3,
            "severity": "medium",
            "modificationTime": "2022-04-29T01:10:51.241222Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[5.3.0,5.3.12)",
            "[,5.2.18)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-core@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-context@5.2.18.RELEASE",
          "org.springframework:spring-core@5.2.18.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-core",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2022-01-06T12:31:26.181234Z",
        "credit": [
          "psytester"
        ],
        "cvssScore": 4.3,
        "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Improper Input Validation when a user provides malicious input, causing insertion of additional log entries.\n## Remediation\nUpgrade `org.springframework:spring-core` to version 5.2.19.RELEASE, 5.3.14 or higher.\n## References\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2021-22060)\n",
        "disclosureTime": "2022-01-06T11:18:34Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.2.19.RELEASE",
          "5.3.14"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2330878",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2021-22060"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-01-25T15:25:00.337700Z",
        "moduleName": "org.springframework:spring-core",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-01-06T17:17:24.995166Z",
        "references": [
          {
            "title": "Pivotal Security Advisory",
            "url": "https://pivotal.io/security/cve-2021-22060"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Improper Input Validation",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 4.3,
            "severity": "medium",
            "modificationTime": "2022-05-14T01:11:17.670128Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,5.2.19.RELEASE)",
            "[5.3.0,5.3.14)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-core@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-context@5.2.19.RELEASE",
          "org.springframework:spring-core@5.2.19.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-core",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:31.465000Z",
        "credit": [
          "Takeshi Terada"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Directory Traversal. It allows remote attackers to read arbitrary files via a crafted URL.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `org.springframework:spring-core` to version 3.2.9.RELEASE, 4.0.5.RELEASE or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/e3e71ba92a8b82dadf474eda76cd2741f65a77a8)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/f6fddeb6eb7da625fd711ab371ff16512f431e8d)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/16414)\n- [Jira Issue](https://jira.spring.io/browse/SPR-12354)\n- [JVNDB](http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000054.html)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3578)\n- [Pivotal Security](https://pivotal.io/security/cve-2014-3578)\n- [Pivotal Security](http://www.pivotal.io/security/cve-2014-3578)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1131882)\n",
        "disclosureTime": "2014-09-05T17:16:58Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/springframework/util/StringUtils.java",
              "className": "StringUtils",
              "functionName": "cleanPath"
            },
            "version": [
              "[3.0.0.RELEASE, 3.2.9.RELEASE)",
              "[4.0.0.RELEASE, 4.0.5.RELEASE)"
            ]
          }
        ],
        "fixedIn": [
          "3.2.9.RELEASE",
          "4.0.5.RELEASE"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-31325",
        "identifiers": {
          "CWE": [
            "CWE-22"
          ],
          "CVE": [
            "CVE-2014-3578"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2021-02-01T12:09:21.542397Z",
        "moduleName": "org.springframework:spring-core",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2014-09-05T17:16:58Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/e3e71ba92a8b82dadf474eda76cd2741f65a77a8"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/f6fddeb6eb7da625fd711ab371ff16512f431e8d"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/16414"
          },
          {
            "title": "Jira Issue",
            "url": "https://jira.spring.io/browse/SPR-12354"
          },
          {
            "title": "JVNDB",
            "url": "http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000054.html"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3578"
          },
          {
            "title": "Pivotal Security",
            "url": "https://pivotal.io/security/cve-2014-3578"
          },
          {
            "title": "Pivotal Security",
            "url": "http://www.pivotal.io/security/cve-2014-3578"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Directory Traversal",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": null,
            "cvssV3BaseScore": null,
            "severity": "medium",
            "modificationTime": "2022-01-03T17:37:14.768247Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.springframework.util.StringUtils",
              "functionName": "cleanPath"
            },
            "version": [
              "[3.0.0.RELEASE, 3.2.9.RELEASE)",
              "[4.0.0.RELEASE, 4.0.5.RELEASE)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[3.0.0.RELEASE, 3.2.9.RELEASE)",
            "[4.0.0.RELEASE, 4.0.5.RELEASE)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-core@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-context@3.2.9.RELEASE",
          "org.springframework:spring-core@3.2.9.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-core",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
        "alternativeIds": [],
        "creationTime": "2022-03-29T10:05:31.971026Z",
        "credit": [
          "4ra1n"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) by providing a specially crafted SpEL expression, that might result in an `OutOfMemoryError`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `org.springframework:spring-expression` to version 5.3.17, 5.2.20.RELEASE or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/28145)\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2022-22950)\n",
        "disclosureTime": "2022-03-29T09:51:43Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.3.17",
          "5.2.20.RELEASE"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828",
        "identifiers": {
          "CWE": [
            "CWE-400"
          ],
          "CVE": [
            "CVE-2022-22950"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-07-17T12:57:31.345773Z",
        "moduleName": "org.springframework:spring-expression",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-expression",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-03-29T14:24:08Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/28145"
          },
          {
            "title": "Pivotal Security Advisory",
            "url": "https://pivotal.io/security/cve-2022-22950"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": "This vulnerability is only applicable on systems using Spring Expression Language (SpEL)"
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 6.5,
            "severity": "medium",
            "modificationTime": "2022-06-23T01:11:13.680071Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[5.3.0,5.3.17)",
            "[,5.2.20.RELEASE)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-expression"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-expression@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-context@5.2.20.RELEASE",
          "org.springframework:spring-expression@5.2.20.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-expression",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H",
        "alternativeIds": [],
        "creationTime": "2022-03-30T21:42:31.436000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n[org.springframework:spring-beans](https://www.baeldung.com/spring-bean) is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.\n\nAffected versions of this package are vulnerable to Remote Code Execution via manipulation of `ClassLoader` that is achievable with a POST HTTP request. This could allow an attacker to execute a webshell on a victim's application (TomCat), or download arbitrary files from the server (Payara/Glassfish).\r\n\r\n**Note:** \r\n* Current public exploits require victim applications to be built with JRE version 9 (or above) and to be deployed on either Tomcat, Payara or Glassfish. \r\n* However, we have confirmed that it is technically possible for additional exploits to work under additional application configurations as well. \r\n* As such while we recommend users prioritise first remediating against the configuration described above, for full protection we also recommend upgrading all vulnerable versions to the fixed `spring-beans` version regardless of the application configuration.\r\n\r\n### Update Log \r\n* **31/03/2022 -** Severity was raised from 8.1 to 9.8\r\n* **08/04/2022 -** Advisory was updated to reflect that Snyk's security research team was able to author a working PoC of this vulnerability against applications that are deployed on Payara (which is based on Glassfish). \r\n\r\n\r\n## PoC\r\n```java\r\n1/ docker run -p 8888:8080 --rm --interactive --tty --name vm1 tomcat:9.0\r\n2/ ./mvnw install\r\n3/ docker cp target/handling-form-submission-complete.war vm1:/usr/local/tomcat/webapps\r\n4/ curl -X POST \\\r\n  -H \"pre:<%\" \\\r\n  -H \"post:;%>\" \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.pattern=%{pre}iSystem.out.println(123)%{post}i' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/handling-form-submission-complete' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.prefix=rce' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=' \\\r\n  http://localhost:8888/handling-form-submission-complete/greeting\r\n5/ curl http://localhost:8888/handling-form-submission-complete/rce.jsp\r\n```\n## Remediation\nUpgrade `org.springframework:spring-beans` to version 5.2.20, 5.3.18 or higher.\n## References\n- [CyberKendra Post](https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15)\n- [LunaSec Blog](https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/)\n- [Payara Blogpost](https://blog.payara.fish/payara-and-spring4shell)\n- [Payara PoC](https://github.com/CalumHutton/CVE-2022-22965-PoC_Payara)\n- [Snyk Blog - Technical Breakdown](https://snyk.io/blog/spring4shell-zero-day-rce-spring-framework-explained/)\n- [Snyk PoC](https://github.com/Kirill89/CVE-2022-22965-PoC)\n- [Spring Security Announcement](https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)\n- [Spring Tomcat Mitigation Advice](https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative)\n- [CISA - Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n",
        "disclosureTime": "2022-03-30T21:42:24Z",
        "exploit": "High",
        "functions": [
          {
            "functionId": {
              "filePath": "org/springframework/beans/CachedIntrospectionResults.java",
              "className": "CachedIntrospectionResults",
              "functionName": "<init>"
            },
            "version": [
              "[ ,5.2.20)",
              "[5.3.0, 5.3.18)"
            ]
          }
        ],
        "fixedIn": [
          "5.2.20",
          "5.3.18"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751",
        "identifiers": {
          "CWE": [
            "CWE-94"
          ],
          "CVE": [
            "CVE-2022-22965"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-08-12T15:25:01.081783Z",
        "moduleName": "org.springframework:spring-beans",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-beans",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-03-30T22:32:44Z",
        "references": [
          {
            "title": "CyberKendra Post",
            "url": "https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15"
          },
          {
            "title": "LunaSec Blog",
            "url": "https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/"
          },
          {
            "title": "Payara Blogpost",
            "url": "https://blog.payara.fish/payara-and-spring4shell"
          },
          {
            "title": "Payara PoC",
            "url": "https://github.com/CalumHutton/CVE-2022-22965-PoC_Payara"
          },
          {
            "title": "Snyk Blog - Technical Breakdown",
            "url": "https://snyk.io/blog/spring4shell-zero-day-rce-spring-framework-explained/"
          },
          {
            "title": "Snyk PoC",
            "url": "https://github.com/Kirill89/CVE-2022-22965-PoC"
          },
          {
            "title": "Spring Security Announcement",
            "url": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement"
          },
          {
            "title": "Spring Tomcat Mitigation Advice",
            "url": "https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative"
          },
          {
            "title": "CISA - Known Exploited Vulnerabilities",
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Remote Code Execution",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-07-26T01:11:22.743934Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.springframework.beans.CachedIntrospectionResults",
              "functionName": "<init>"
            },
            "version": [
              "[ ,5.2.20)",
              "[5.3.0, 5.3.18)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[ ,5.2.20)",
            "[5.3.0, 5.3.18)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-beans"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-beans@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-context@5.2.20.RELEASE",
          "org.springframework:spring-beans@5.2.20.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-beans",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
        "alternativeIds": [],
        "creationTime": "2022-05-12T08:45:35.744127Z",
        "credit": [
          "Rob Ryan"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.springframework:spring-beans](https://www.baeldung.com/spring-bean) is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) if it relies on data binding to set a `MultipartFile` or `javax.servlet.Part` to a field in a model object.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `org.springframework:spring-beans` to version 5.2.22.RELEASE, 5.3.20 or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583)\n- [Tanzu vmware](https://tanzu.vmware.com/security/cve-2022-22970)\n",
        "disclosureTime": "2022-05-12T08:17:10Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.2.22.RELEASE",
          "5.3.20"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2823313",
        "identifiers": {
          "CWE": [
            "CWE-400"
          ],
          "CVE": [
            "CVE-2022-22970"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-12T09:49:10.835416Z",
        "moduleName": "org.springframework:spring-beans",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-beans",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-05-12T09:49:10.833602Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583"
          },
          {
            "title": "Tanzu vmware",
            "url": "https://tanzu.vmware.com/security/cve-2022-22970"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-07-26T01:11:19.570522Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,5.2.22.RELEASE)",
            "[5.3.0,5.3.20)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-beans"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-beans@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-context@5.2.22.RELEASE",
          "org.springframework:spring-beans@5.2.22.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-beans",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P",
        "alternativeIds": [],
        "creationTime": "2022-04-14T11:54:10.207823Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 3.7,
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the patterns for `disallowedFields` on a `DataBinder`. As a result, a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including nested fields within the property path.\n## Remediation\nUpgrade `org.springframework:spring-context` to version 5.2.21, 5.3.19 or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/28333)\n- [PoC](https://github.com/MarcinGadz/spring-rce-poc)\n- [Spring Blog Post](https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968)\n- [Tanzu Advisory](https://tanzu.vmware.com/security/cve-2022-22968)\n",
        "disclosureTime": "2022-04-14T11:43:54Z",
        "exploit": "Proof of Concept",
        "functions": [],
        "fixedIn": [
          "5.2.21",
          "5.3.19"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2689634",
        "identifiers": {
          "CWE": [
            "CWE-178"
          ],
          "CVE": [
            "CVE-2022-22968"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-15T07:59:33.898723Z",
        "moduleName": "org.springframework:spring-context",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-context",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-04-14T12:09:40Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/28333"
          },
          {
            "title": "PoC",
            "url": "https://github.com/MarcinGadz/spring-rce-poc"
          },
          {
            "title": "Spring Blog Post",
            "url": "https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968"
          },
          {
            "title": "Tanzu Advisory",
            "url": "https://tanzu.vmware.com/security/cve-2022-22968"
          }
        ],
        "severity": "low",
        "socialTrendAlert": false,
        "title": "Improper Handling of Case Sensitivity",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-07-26T01:11:20.613128Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,5.2.21)",
            "[5.3.0, 5.3.19)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-context"
        },
        "severityWithCritical": "low",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-context@5.2.21.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-context",
        "version": "3.2.6.RELEASE"
      },
      {
        "id": "snyk:lic:maven:org.aspectj:aspectjweaver:EPL-1.0",
        "packageName": "org.aspectj:aspectjweaver",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-11T15:48:31.375Z",
        "description": "EPL-1.0 license",
        "language": "java",
        "license": "EPL-1.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T15:48:31.375Z",
        "title": "EPL-1.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.aspectj:aspectjweaver@1.8.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.aspectj:aspectjweaver",
        "version": "1.8.2"
      },
      {
        "id": "snyk:lic:maven:org.hibernate.common:hibernate-commons-annotations:LGPL-2.1",
        "packageName": "org.hibernate.common:hibernate-commons-annotations",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-11T02:03:20.921Z",
        "description": "LGPL-2.1 license",
        "language": "java",
        "license": "LGPL-2.1",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T02:03:20.921Z",
        "title": "LGPL-2.1 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "org.hibernate.common:hibernate-commons-annotations@4.0.5.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate.common:hibernate-commons-annotations",
        "version": "4.0.5.Final"
      },
      {
        "id": "snyk:lic:maven:org.hibernate.javax.persistence:hibernate-jpa-2.1-api:EPL-1.0",
        "packageName": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-11T03:29:28.476Z",
        "description": "EPL-1.0 license",
        "language": "java",
        "license": "EPL-1.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T03:29:28.476Z",
        "title": "EPL-1.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "org.hibernate.javax.persistence:hibernate-jpa-2.1-api@1.0.0.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
        "version": "1.0.0.Final"
      },
      {
        "id": "snyk:lic:maven:org.hibernate:hibernate-entitymanager:LGPL-2.0",
        "packageName": "org.hibernate:hibernate-entitymanager",
        "semver": {
          "vulnerable": [
            "[3.5.0.Beta-1, 5.3.1.Final)"
          ]
        },
        "creationTime": "2022-09-11T03:11:24.569Z",
        "description": "LGPL-2.0 license",
        "language": "java",
        "license": "LGPL-2.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T03:11:24.569Z",
        "title": "LGPL-2.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-entitymanager@4.3.7.Final"
        ],
        "upgradePath": [
          false,
          "org.hibernate:hibernate-entitymanager@5.3.1.Final"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-entitymanager",
        "version": "4.3.7.Final"
      }
    ],
    "ok": false,
    "dependencyCount": 34,
    "org": "kevin-s31-org",
    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.0\nignore: {}\npatch: {}\n",
    "isPrivate": true,
    "licensesPolicy": {
      "severities": {},
      "orgLicenseRules": {
        "AGPL-1.0": {
          "licenseType": "AGPL-1.0",
          "severity": "high",
          "instructions": ""
        },
        "AGPL-3.0": {
          "licenseType": "AGPL-3.0",
          "severity": "high",
          "instructions": ""
        },
        "Artistic-1.0": {
          "licenseType": "Artistic-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "Artistic-2.0": {
          "licenseType": "Artistic-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "CDDL-1.0": {
          "licenseType": "CDDL-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "CPOL-1.02": {
          "licenseType": "CPOL-1.02",
          "severity": "high",
          "instructions": ""
        },
        "EPL-1.0": {
          "licenseType": "EPL-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "GPL-2.0": {
          "licenseType": "GPL-2.0",
          "severity": "high",
          "instructions": ""
        },
        "GPL-3.0": {
          "licenseType": "GPL-3.0",
          "severity": "high",
          "instructions": ""
        },
        "LGPL-2.0": {
          "licenseType": "LGPL-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "LGPL-2.1": {
          "licenseType": "LGPL-2.1",
          "severity": "medium",
          "instructions": ""
        },
        "LGPL-3.0": {
          "licenseType": "LGPL-3.0",
          "severity": "medium",
          "instructions": ""
        },
        "MPL-1.1": {
          "licenseType": "MPL-1.1",
          "severity": "medium",
          "instructions": ""
        },
        "MPL-2.0": {
          "licenseType": "MPL-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "MS-RL": {
          "licenseType": "MS-RL",
          "severity": "medium",
          "instructions": ""
        },
        "SimPL-2.0": {
          "licenseType": "SimPL-2.0",
          "severity": "high",
          "instructions": ""
        }
      }
    },
    "packageManager": "maven",
    "ignoreSettings": {
      "adminOnly": false,
      "reasonRequired": false,
      "disregardFilesystemIgnores": false
    },
    "summary": "19 vulnerable dependency paths",
    "remediation": {
      "unresolved": [
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "alternativeIds": [],
          "creationTime": "2019-09-05T16:17:58.383761Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 9.8,
          "description": "## Overview\n\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection.\nvia the `extractXmlConfigFromInputStream` in `com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java` during initialization.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\r\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\r\n\r\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\r\n\r\nFor example, below is a sample XML document, containing an XML element- username.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n   <username>John</username>\r\n</xml>\r\n```\r\n\r\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n<!DOCTYPE foo [\r\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\r\n   <username>&xxe;</username>\r\n</xml>\r\n```\r\n\r\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n\n## Remediation\n\nThere is no fixed version for `c3p0:c3p0`.\n\n\n## References\n\n- [GitHub Commit](https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1)\n",
          "disclosureTime": "2018-12-24T13:29:00Z",
          "exploit": "Not Defined",
          "functions": [
            {
              "functionId": {
                "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
                "className": "C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "fixedIn": [],
          "id": "SNYK-JAVA-C3P0-461017",
          "identifiers": {
            "CWE": [
              "CWE-611"
            ],
            "CVE": [
              "CVE-2018-20433"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2020-12-14T14:41:01.987191Z",
          "moduleName": "c3p0:c3p0",
          "packageManager": "maven",
          "packageName": "c3p0:c3p0",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2019-07-21T14:22:18Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1"
            }
          ],
          "severity": "critical",
          "socialTrendAlert": false,
          "title": "XML External Entity (XXE) Injection",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "cvssV3BaseScore": 9.8,
              "severity": "critical",
              "modificationTime": "2022-01-03T16:25:31.174274Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "c3p0",
            "artifactId": "c3p0"
          },
          "from": [
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "c3p0:c3p0@0.9.1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "c3p0:c3p0",
          "version": "0.9.1.2",
          "severityWithCritical": "critical"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O",
          "alternativeIds": [],
          "creationTime": "2019-09-05T16:24:58.914446Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 7.5,
          "description": "## Overview\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to missing protections against recursive entity expansion when loading XML configurations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nThere is no fixed version for `c3p0:c3p0`.\n## References\n- [POC: Hackerone Report](https://hackerone.com/reports/509315)\n",
          "disclosureTime": "2019-04-22T22:18:26Z",
          "exploit": "Proof of Concept",
          "functions": [
            {
              "functionId": {
                "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
                "className": "C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "fixedIn": [],
          "id": "SNYK-JAVA-C3P0-461018",
          "identifiers": {
            "CWE": [
              "CWE-776"
            ],
            "GHSA": [
              "GHSA-84p2-vf58-xhxv"
            ],
            "CVE": [
              "CVE-2019-5427"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-04-24T11:13:58.306515Z",
          "moduleName": "c3p0:c3p0",
          "packageManager": "maven",
          "packageName": "c3p0:c3p0",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2019-04-22T22:18:26Z",
          "references": [
            {
              "title": "POC: Hackerone Report",
              "url": "https://hackerone.com/reports/509315"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "Denial of Service (DoS)",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "cvssV3BaseScore": 7.5,
              "severity": "high",
              "modificationTime": "2022-04-23T01:11:20.164193Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "c3p0",
            "artifactId": "c3p0"
          },
          "from": [
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "c3p0:c3p0@0.9.1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "c3p0:c3p0",
          "version": "0.9.1.2",
          "severityWithCritical": "high"
        },
        {
          "id": "snyk:lic:maven:c3p0:c3p0:LGPL-3.0",
          "packageName": "c3p0:c3p0",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-10T14:28:57.415Z",
          "description": "LGPL-3.0 license",
          "language": "java",
          "license": "LGPL-3.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-10T14:28:57.415Z",
          "title": "LGPL-3.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "c3p0:c3p0@0.9.1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "c3p0:c3p0",
          "version": "0.9.1.2",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
          "alternativeIds": [],
          "creationTime": "2019-04-10T16:07:04.634619Z",
          "credit": [
            "Mario Areias"
          ],
          "cvssScore": 7.5,
          "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection due to improper validation of the `QName` inputs.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387)\n- [GitHub Issue](https://github.com/dom4j/dom4j/issues/48)\n- [POC: Ihacktoprotect Blog](https://ihacktoprotect.com/post/dom4j-xml-injection/)\n",
          "disclosureTime": "2018-07-01T19:12:29Z",
          "exploit": "Proof of Concept",
          "functions": [
            {
              "functionId": {
                "filePath": "org/dom4j/Namespace.java",
                "className": "Namespace",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            },
            {
              "functionId": {
                "filePath": "org/dom4j/QName.java",
                "className": "QName",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            }
          ],
          "fixedIn": [],
          "id": "SNYK-JAVA-DOM4J-174153",
          "identifiers": {
            "CWE": [
              "CWE-611"
            ],
            "GHSA": [
              "GHSA-6pcc-3rfx-4gpm"
            ],
            "CVE": [
              "CVE-2018-1000632"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-05-22T12:44:25.928596Z",
          "moduleName": "dom4j:dom4j",
          "packageManager": "maven",
          "packageName": "dom4j:dom4j",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2018-08-21T14:16:13Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387"
            },
            {
              "title": "GitHub Issue",
              "url": "https://github.com/dom4j/dom4j/issues/48"
            },
            {
              "title": "POC: Ihacktoprotect Blog",
              "url": "https://ihacktoprotect.com/post/dom4j-xml-injection/"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "XML External Entity (XXE) Injection",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "SUSE",
              "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
              "cvssV3BaseScore": 6.1,
              "severity": "medium",
              "modificationTime": "2022-05-04T00:48:09.564645Z"
            },
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "cvssV3BaseScore": 7.5,
              "severity": "high",
              "modificationTime": "2022-01-03T16:12:35.769596Z"
            },
            {
              "assigner": "RHEL",
              "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "cvssV3BaseScore": 5.3,
              "severity": "medium",
              "modificationTime": "2022-05-31T14:35:13.279641Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "org.dom4j.Namespace",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            },
            {
              "functionId": {
                "className": "org.dom4j.QName",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "dom4j",
            "artifactId": "dom4j"
          },
          "from": [
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "dom4j:dom4j@1.6.1"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "dom4j:dom4j",
          "version": "1.6.1",
          "severityWithCritical": "high"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "alternativeIds": [],
          "creationTime": "2022-05-10T12:56:27.582369Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 7.4,
          "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection. By using the default `SaxReader()` provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/a822852)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1694235)\n",
          "disclosureTime": "2020-04-15T09:38:17Z",
          "exploit": "Not Defined",
          "functions": [],
          "fixedIn": [],
          "id": "SNYK-JAVA-DOM4J-2812975",
          "identifiers": {
            "CWE": [
              "CWE-611"
            ],
            "GHSA": [
              "GHSA-hwj3-m3p6-hj38"
            ],
            "CVE": [
              "CVE-2020-10683"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-05-10T12:56:27.582382Z",
          "moduleName": "dom4j:dom4j",
          "packageManager": "maven",
          "packageName": "dom4j:dom4j",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2020-04-16T15:22:50Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/dom4j/dom4j/commit/a822852"
            },
            {
              "title": "RedHat Bugzilla Bug",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694235"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "XML External Entity (XXE) Injection",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "cvssV3BaseScore": 9.8,
              "severity": "critical",
              "modificationTime": "2022-07-26T01:11:31.495013Z"
            },
            {
              "assigner": "RHEL",
              "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "cvssV3BaseScore": 7.4,
              "severity": "high",
              "modificationTime": "2022-05-31T14:51:07.029250Z"
            }
          ],
          "functions_new": [],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "dom4j",
            "artifactId": "dom4j"
          },
          "from": [
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "dom4j:dom4j@1.6.1"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "dom4j:dom4j",
          "version": "1.6.1",
          "severityWithCritical": "high"
        },
        {
          "id": "snyk:lic:maven:org.aspectj:aspectjweaver:EPL-1.0",
          "packageName": "org.aspectj:aspectjweaver",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-11T15:48:31.375Z",
          "description": "EPL-1.0 license",
          "language": "java",
          "license": "EPL-1.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T15:48:31.375Z",
          "title": "EPL-1.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.aspectj:aspectjweaver@1.8.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.aspectj:aspectjweaver",
          "version": "1.8.2",
          "severityWithCritical": "medium"
        },
        {
          "id": "snyk:lic:maven:org.hibernate.common:hibernate-commons-annotations:LGPL-2.1",
          "packageName": "org.hibernate.common:hibernate-commons-annotations",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-11T02:03:20.921Z",
          "description": "LGPL-2.1 license",
          "language": "java",
          "license": "LGPL-2.1",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T02:03:20.921Z",
          "title": "LGPL-2.1 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "org.hibernate.common:hibernate-commons-annotations@4.0.5.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate.common:hibernate-commons-annotations",
          "version": "4.0.5.Final",
          "severityWithCritical": "medium"
        },
        {
          "id": "snyk:lic:maven:org.hibernate.javax.persistence:hibernate-jpa-2.1-api:EPL-1.0",
          "packageName": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-11T03:29:28.476Z",
          "description": "EPL-1.0 license",
          "language": "java",
          "license": "EPL-1.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T03:29:28.476Z",
          "title": "EPL-1.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "org.hibernate.javax.persistence:hibernate-jpa-2.1-api@1.0.0.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
          "version": "1.0.0.Final",
          "severityWithCritical": "medium"
        }
      ],
      "upgrade": {
        "org.hibernate:hibernate-core@4.3.7.Final": {
          "upgradeTo": "org.hibernate:hibernate-core@5.4.24.Final",
          "upgrades": [
            "org.hibernate:hibernate-core@4.3.7.Final",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "org.hibernate:hibernate-core@4.3.7.Final"
          ],
          "vulns": [
            "SNYK-JAVA-ORGHIBERNATE-1041788",
            "SNYK-JAVA-ORGHIBERNATE-584563",
            "snyk:lic:maven:org.hibernate:hibernate-core:LGPL-2.0"
          ]
        },
        "org.hibernate:hibernate-entitymanager@4.3.7.Final": {
          "upgradeTo": "org.hibernate:hibernate-entitymanager@5.3.1.Final",
          "upgrades": [
            "org.hibernate:hibernate-entitymanager@4.3.7.Final"
          ],
          "vulns": [
            "snyk:lic:maven:org.hibernate:hibernate-entitymanager:LGPL-2.0"
          ]
        },
        "org.springframework:spring-context@3.2.6.RELEASE": {
          "upgradeTo": "org.springframework:spring-context@5.2.22.RELEASE",
          "upgrades": [
            "org.springframework:spring-beans@3.2.6.RELEASE",
            "org.springframework:spring-context@3.2.6.RELEASE",
            "org.springframework:spring-expression@3.2.6.RELEASE",
            "org.springframework:spring-beans@3.2.6.RELEASE",
            "org.springframework:spring-core@3.2.6.RELEASE",
            "org.springframework:spring-core@3.2.6.RELEASE",
            "org.springframework:spring-core@3.2.6.RELEASE"
          ],
          "vulns": [
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2823313",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2689634",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2330878",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-31325"
          ]
        }
      },
      "patch": {},
      "ignore": {},
      "pin": {}
    },
    "filesystemPolicy": false,
    "filtered": {
      "ignore": [],
      "patch": []
    },
    "uniqueCount": 19,
    "projectName": "io.github.snyk:todolist-core",
    "foundProjectCount": 3,
    "displayTargetFile": "todolist-core/pom.xml",
    "path": "/Users/ksuzy31/Kev-Stuff/Java-Goof/java-goof"
  },
  {
    "vulnerabilities": [
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2019-09-05T16:17:58.383761Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection.\nvia the `extractXmlConfigFromInputStream` in `com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java` during initialization.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\r\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\r\n\r\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\r\n\r\nFor example, below is a sample XML document, containing an XML element- username.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n   <username>John</username>\r\n</xml>\r\n```\r\n\r\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n<!DOCTYPE foo [\r\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\r\n   <username>&xxe;</username>\r\n</xml>\r\n```\r\n\r\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n\n## Remediation\n\nThere is no fixed version for `c3p0:c3p0`.\n\n\n## References\n\n- [GitHub Commit](https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1)\n",
        "disclosureTime": "2018-12-24T13:29:00Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
              "className": "C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "fixedIn": [],
        "id": "SNYK-JAVA-C3P0-461017",
        "identifiers": {
          "CWE": [
            "CWE-611"
          ],
          "CVE": [
            "CVE-2018-20433"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:01.987191Z",
        "moduleName": "c3p0:c3p0",
        "packageManager": "maven",
        "packageName": "c3p0:c3p0",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2019-07-21T14:22:18Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-01-03T16:25:31.174274Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "c3p0",
          "artifactId": "c3p0"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "c3p0:c3p0@0.9.1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "c3p0:c3p0",
        "version": "0.9.1.2"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O",
        "alternativeIds": [],
        "creationTime": "2019-09-05T16:24:58.914446Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to missing protections against recursive entity expansion when loading XML configurations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nThere is no fixed version for `c3p0:c3p0`.\n## References\n- [POC: Hackerone Report](https://hackerone.com/reports/509315)\n",
        "disclosureTime": "2019-04-22T22:18:26Z",
        "exploit": "Proof of Concept",
        "functions": [
          {
            "functionId": {
              "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
              "className": "C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "fixedIn": [],
        "id": "SNYK-JAVA-C3P0-461018",
        "identifiers": {
          "CWE": [
            "CWE-776"
          ],
          "GHSA": [
            "GHSA-84p2-vf58-xhxv"
          ],
          "CVE": [
            "CVE-2019-5427"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-04-24T11:13:58.306515Z",
        "moduleName": "c3p0:c3p0",
        "packageManager": "maven",
        "packageName": "c3p0:c3p0",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2019-04-22T22:18:26Z",
        "references": [
          {
            "title": "POC: Hackerone Report",
            "url": "https://hackerone.com/reports/509315"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-04-23T01:11:20.164193Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "c3p0",
          "artifactId": "c3p0"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "c3p0:c3p0@0.9.1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "c3p0:c3p0",
        "version": "0.9.1.2"
      },
      {
        "id": "snyk:lic:maven:c3p0:c3p0:LGPL-3.0",
        "packageName": "c3p0:c3p0",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-10T14:28:57.415Z",
        "description": "LGPL-3.0 license",
        "language": "java",
        "license": "LGPL-3.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-10T14:28:57.415Z",
        "title": "LGPL-3.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "c3p0:c3p0@0.9.1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "c3p0:c3p0",
        "version": "0.9.1.2"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
        "alternativeIds": [],
        "creationTime": "2019-04-10T16:07:04.634619Z",
        "credit": [
          "Mario Areias"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection due to improper validation of the `QName` inputs.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387)\n- [GitHub Issue](https://github.com/dom4j/dom4j/issues/48)\n- [POC: Ihacktoprotect Blog](https://ihacktoprotect.com/post/dom4j-xml-injection/)\n",
        "disclosureTime": "2018-07-01T19:12:29Z",
        "exploit": "Proof of Concept",
        "functions": [
          {
            "functionId": {
              "filePath": "org/dom4j/Namespace.java",
              "className": "Namespace",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          },
          {
            "functionId": {
              "filePath": "org/dom4j/QName.java",
              "className": "QName",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          }
        ],
        "fixedIn": [],
        "id": "SNYK-JAVA-DOM4J-174153",
        "identifiers": {
          "CWE": [
            "CWE-611"
          ],
          "GHSA": [
            "GHSA-6pcc-3rfx-4gpm"
          ],
          "CVE": [
            "CVE-2018-1000632"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-22T12:44:25.928596Z",
        "moduleName": "dom4j:dom4j",
        "packageManager": "maven",
        "packageName": "dom4j:dom4j",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2018-08-21T14:16:13Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/dom4j/dom4j/issues/48"
          },
          {
            "title": "POC: Ihacktoprotect Blog",
            "url": "https://ihacktoprotect.com/post/dom4j-xml-injection/"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "SUSE",
            "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "cvssV3BaseScore": 6.1,
            "severity": "medium",
            "modificationTime": "2022-05-04T00:48:09.564645Z"
          },
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T16:12:35.769596Z"
          },
          {
            "assigner": "RHEL",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-05-31T14:35:13.279641Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.dom4j.Namespace",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          },
          {
            "functionId": {
              "className": "org.dom4j.QName",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "dom4j",
          "artifactId": "dom4j"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "dom4j:dom4j@1.6.1"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "dom4j:dom4j",
        "version": "1.6.1"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
        "alternativeIds": [],
        "creationTime": "2022-05-10T12:56:27.582369Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 7.4,
        "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection. By using the default `SaxReader()` provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/a822852)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1694235)\n",
        "disclosureTime": "2020-04-15T09:38:17Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [],
        "id": "SNYK-JAVA-DOM4J-2812975",
        "identifiers": {
          "CWE": [
            "CWE-611"
          ],
          "GHSA": [
            "GHSA-hwj3-m3p6-hj38"
          ],
          "CVE": [
            "CVE-2020-10683"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-10T12:56:27.582382Z",
        "moduleName": "dom4j:dom4j",
        "packageManager": "maven",
        "packageName": "dom4j:dom4j",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-04-16T15:22:50Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/dom4j/dom4j/commit/a822852"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694235"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-07-26T01:11:31.495013Z"
          },
          {
            "assigner": "RHEL",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "cvssV3BaseScore": 7.4,
            "severity": "high",
            "modificationTime": "2022-05-31T14:51:07.029250Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "dom4j",
          "artifactId": "dom4j"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "dom4j:dom4j@1.6.1"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "dom4j:dom4j",
        "version": "1.6.1"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:19.341000Z",
        "credit": [
          "David Jorm"
        ],
        "cvssScore": 7.3,
        "description": "## Overview\n[javax.servlet:jstl](https://mvnrepository.com/artifact/javax.servlet/jstl) is a collection of useful JSP tags which encapsulates the core functionality common to many JSP applications.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection. Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a `<x:parse>` or `<x:transform>` JSTL XML tag.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `javax.servlet:jstl`.\n## References\n- [Apache Mail Archive](http://mail-archives.us.apache.org/mod_mbox/www-announce/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A@apache.org%3E)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0254)\n- [RedHat CVE Database](https://access.redhat.com/security/cve/CVE-2015-0254)\n",
        "disclosureTime": "2015-02-27T16:13:27Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [],
        "id": "SNYK-JAVA-JAVAXSERVLET-30449",
        "identifiers": {
          "CWE": [
            "CWE-94"
          ],
          "GHSA": [
            "GHSA-6x4w-8w53-xrvv"
          ],
          "CVE": [
            "CVE-2015-0254"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:40:54.105551Z",
        "moduleName": "javax.servlet:jstl",
        "packageManager": "maven",
        "packageName": "javax.servlet:jstl",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2015-02-27T16:51:55Z",
        "references": [
          {
            "title": "Apache Mail Archive",
            "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A@apache.org%3E"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0254"
          },
          {
            "title": "RedHat CVE Database",
            "url": "https://access.redhat.com/security/cve/CVE-2015-0254"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": null,
            "cvssV3BaseScore": null,
            "severity": "high",
            "modificationTime": "2022-01-03T17:28:38.191565Z"
          },
          {
            "assigner": "RHEL",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
            "cvssV3BaseScore": 7.6,
            "severity": "high",
            "modificationTime": "2022-05-31T17:09:25.699843Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "javax.servlet",
          "artifactId": "jstl"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "javax.servlet:jstl@1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "javax.servlet:jstl",
        "version": "1.2"
      },
      {
        "id": "snyk:lic:maven:javax.servlet:jstl:CDDL-1.0",
        "packageName": "javax.servlet:jstl",
        "semver": {
          "vulnerable": [
            "[1.2,)"
          ]
        },
        "creationTime": "2022-09-10T22:00:05.351Z",
        "description": "CDDL-1.0 license",
        "language": "java",
        "license": "CDDL-1.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-10T22:00:05.351Z",
        "title": "CDDL-1.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "javax.servlet:jstl@1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "javax.servlet:jstl",
        "version": "1.2"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:U",
        "alternativeIds": [],
        "creationTime": "2020-11-19T16:51:52.251545Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 8.2,
        "description": "## Overview\n[org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) is a library providing Object/Relational Mapping (ORM) support to applications, libraries, and frameworks.\n\nAffected versions of this package are vulnerable to SQL Injection. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.\n## Remediation\nUpgrade `org.hibernate:hibernate-core` to version 5.4.24.Final or higher.\n## References\n- [GitHub Commit](https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78)\n- [Redhat CVE Details](https://access.redhat.com/security/cve/cve-2020-25638)\n",
        "disclosureTime": "2020-11-19T16:51:45Z",
        "exploit": "Unproven",
        "functions": [
          {
            "functionId": {
              "filePath": "org/hibernate/loader/plan/exec/query/internal/SelectStatementBuilder.java",
              "className": "SelectStatementBuilder",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Delete.java",
              "className": "Delete",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Insert.java",
              "className": "Insert",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/InsertSelect.java",
              "className": "InsertSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/QuerySelect.java",
              "className": "QuerySelect",
              "functionName": "toQueryString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Select.java",
              "className": "Select",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/SimpleSelect.java",
              "className": "SimpleSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Update.java",
              "className": "Update",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          }
        ],
        "fixedIn": [
          "5.4.24.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-1041788",
        "identifiers": {
          "CWE": [
            "CWE-89"
          ],
          "CVE": [
            "CVE-2020-25638"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-07-18T12:56:04.506674Z",
        "moduleName": "org.hibernate:hibernate-core",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-11-19T16:57:14.572204Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78"
          },
          {
            "title": "Redhat CVE Details",
            "url": "https://access.redhat.com/security/cve/cve-2020-25638"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "SQL Injection",
        "insights": {
          "triageAdvice": "This vulnerability is only applicable on systems using JPA Criteria API"
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "cvssV3BaseScore": 7.4,
            "severity": "high",
            "modificationTime": "2022-07-26T01:11:35.094170Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.hibernate.loader.plan.exec.query.internal.SelectStatementBuilder",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Delete",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Insert",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.InsertSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.QuerySelect",
              "functionName": "toQueryString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Select",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.SimpleSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Update",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,5.4.24.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-core",
        "version": "4.3.7.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2020-07-15T13:53:15.331818Z",
        "credit": [
          "Gail Badner"
        ],
        "cvssScore": 8.1,
        "description": "## Overview\n[org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) is a library providing Object/Relational Mapping (ORM) support to applications, libraries, and frameworks.\n\nAffected versions of this package are vulnerable to SQL Injection. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.\n## Remediation\nUpgrade `org.hibernate:hibernate-core` to version 5.3.18.Final, 5.4.18.Final or higher.\n## References\n- [GitHub Pull Request](https://github.com/hibernate/hibernate-orm/pull/3438)\n- [Jira Ticket](https://hibernate.atlassian.net/browse/HHH-14077)\n",
        "disclosureTime": "2020-06-18T13:46:30Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/hibernate/query/criteria/internal/expression/LiteralExpression.java",
              "className": "LiteralExpression",
              "functionName": "renderProjection"
            },
            "version": [
              "[5.1.18.Final ,5.4.18.Final)"
            ]
          }
        ],
        "fixedIn": [
          "5.3.18.Final",
          "5.4.18.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-584563",
        "identifiers": {
          "CWE": [
            "CWE-89"
          ],
          "CVE": [
            "CVE-2019-14900"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-07-18T12:57:02.888829Z",
        "moduleName": "org.hibernate:hibernate-core",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-07-15T16:40:12Z",
        "references": [
          {
            "title": "GitHub Pull Request",
            "url": "https://github.com/hibernate/hibernate-orm/pull/3438"
          },
          {
            "title": "Jira Ticket",
            "url": "https://hibernate.atlassian.net/browse/HHH-14077"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "SQL Injection",
        "insights": {
          "triageAdvice": "This vulnerability is only applicable on systems using JPA Criteria API"
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "cvssV3BaseScore": 6.5,
            "severity": "medium",
            "modificationTime": "2022-04-30T01:10:36.121203Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.hibernate.query.criteria.internal.expression.LiteralExpression",
              "functionName": "renderProjection"
            },
            "version": [
              "[5.1.18.Final ,5.4.18.Final)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,5.3.18.Final)",
            "[5.4.0.Final, 5.4.18.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-core",
        "version": "4.3.7.Final"
      },
      {
        "id": "snyk:lic:maven:org.hibernate:hibernate-core:LGPL-2.0",
        "packageName": "org.hibernate:hibernate-core",
        "semver": {
          "vulnerable": [
            "[3.3.0.CR1, 5.3.1.Final)"
          ]
        },
        "creationTime": "2022-09-11T12:51:18.861Z",
        "description": "LGPL-2.0 license",
        "language": "java",
        "license": "LGPL-2.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T12:51:18.861Z",
        "title": "LGPL-2.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-core",
        "version": "4.3.7.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2016-12-25T16:51:53Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.hibernate:hibernate-validator](https://mvnrepository.com/artifact/org.hibernate/hibernate-validator) is a Hibernate Validator Engine Relocation Artifact.\n\nAffected versions of this package are vulnerable to JSM bypass via ReflectionHelper. ReflectionHelper (`org.hibernate.validator.util.ReflectionHelper`) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.\n## Remediation\nUpgrade `org.hibernate:hibernate-validator` to version 4.3.2.Final, 5.1.2.Final or higher.\n## References\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/2c95d4ea0ef20977be249e31a4a4f4f4f71c945d)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/67fdff14831c035c25e098fe14bd86523d17f726)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/7e7131939a4361a7cad3e77ab89a8462132c561c)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/c489416f699a46859c134796b3ccfea41ef3ce52)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/c9525ca544b1281e2b7c7347e86e87c86dc1dc6e)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/e8c42b689df8c6752d635d02c6518da3fece3870)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/f97c2021a03c825abdeca1692f5be51e77e76a8f)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/fd4eaed7fb930db6a5e4c03742b4b3adcfecc90e)\n- [Jira Issue](https://hibernate.atlassian.net/browse/HV-912)\n- [Redhat Bugzilla](https://bugzilla.redhat.com/CVE-2014-3558)\n",
        "disclosureTime": "2014-07-17T16:51:53Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "4.3.2.Final",
          "5.1.2.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-30098",
        "identifiers": {
          "CWE": [
            "CWE-592"
          ],
          "CVE": [
            "CVE-2014-3558"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:02.614281Z",
        "moduleName": "org.hibernate:hibernate-validator",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-validator",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2014-07-17T16:51:53Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/2c95d4ea0ef20977be249e31a4a4f4f4f71c945d"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/67fdff14831c035c25e098fe14bd86523d17f726"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/7e7131939a4361a7cad3e77ab89a8462132c561c"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/c489416f699a46859c134796b3ccfea41ef3ce52"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/c9525ca544b1281e2b7c7347e86e87c86dc1dc6e"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/e8c42b689df8c6752d635d02c6518da3fece3870"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/f97c2021a03c825abdeca1692f5be51e77e76a8f"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/fd4eaed7fb930db6a5e4c03742b4b3adcfecc90e"
          },
          {
            "title": "Jira Issue",
            "url": "https://hibernate.atlassian.net/browse/HV-912"
          },
          {
            "title": "Redhat Bugzilla",
            "url": "https://bugzilla.redhat.com/CVE-2014-3558"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "JSM bypass via ReflectionHelper",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": null,
            "cvssV3BaseScore": null,
            "severity": "medium",
            "modificationTime": "2022-01-03T17:36:59.992374Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[4.1.0.Beta1, 4.3.2.Final)",
            "[5.0.0.Final,5.1.2.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-validator"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "org.hibernate:hibernate-validator@4.3.1.Final"
        ],
        "upgradePath": [
          false,
          "org.hibernate:hibernate-validator@6.0.23.Final"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-validator",
        "version": "4.3.1.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2020-05-05T12:05:58.541980Z",
        "credit": [
          "Alvaro Muñoz"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.hibernate:hibernate-validator](https://mvnrepository.com/artifact/org.hibernate/hibernate-validator) is a Hibernate Validator Engine Relocation Artifact.\n\nAffected versions of this package are vulnerable to Improper Input Validation. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.\n## Remediation\nUpgrade `org.hibernate:hibernate-validator` to version 6.0.19.Final, 6.1.3.Final or higher.\n## References\n- [GitHub PR](https://github.com/hibernate/hibernate-validator/pull/1071)\n- [Jira Issue](https://hibernate.atlassian.net/browse/HV-1758)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1805501)\n",
        "disclosureTime": "2020-05-05T00:00:00Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/hibernate/validator/internal/engine/ValidatorImpl.java",
              "className": "ValidatorImpl",
              "functionName": "validate"
            },
            "version": [
              "[,6.0.19.Final)",
              "[6.1.0,6.1.3.Final)"
            ]
          }
        ],
        "fixedIn": [
          "6.0.19.Final",
          "6.1.3.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-568162",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "GHSA": [
            "GHSA-rmrm-75hp-phr2"
          ],
          "CVE": [
            "CVE-2020-10693"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2021-07-06T14:08:58.015029Z",
        "moduleName": "org.hibernate:hibernate-validator",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-validator",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-05-05T16:32:46Z",
        "references": [
          {
            "title": "GitHub PR",
            "url": "https://github.com/hibernate/hibernate-validator/pull/1071"
          },
          {
            "title": "Jira Issue",
            "url": "https://hibernate.atlassian.net/browse/HV-1758"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805501"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Improper Input Validation",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-05-11T01:11:03.963914Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.hibernate.validator.internal.engine.ValidatorImpl",
              "functionName": "validate"
            },
            "version": [
              "[,6.0.19.Final)",
              "[6.1.0,6.1.3.Final)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,6.0.19.Final)",
            "[6.1.0,6.1.3.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-validator"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "org.hibernate:hibernate-validator@4.3.1.Final"
        ],
        "upgradePath": [
          false,
          "org.hibernate:hibernate-validator@6.0.23.Final"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-validator",
        "version": "4.3.1.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:R",
        "alternativeIds": [],
        "creationTime": "2020-05-14T16:07:06.897969Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 6.5,
        "description": "## Overview\n[org.hibernate:hibernate-validator](https://mvnrepository.com/artifact/org.hibernate/hibernate-validator) is a Hibernate Validator Engine Relocation Artifact.\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS). The `SafeHtml` validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.\n## Details\n\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\n\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\n\nInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\n\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\n \nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \n\n### Types of attacks\nThere are a few methods by which XSS can be manipulated:\n\n|Type|Origin|Description|\n|--|--|--|\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\n\n### Affected environments\nThe following environments are susceptible to an XSS attack:\n\n* Web servers\n* Application servers\n* Web application environments\n\n### How to prevent\nThis section describes the top best practices designed to specifically protect your code: \n\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \n* Give users the option to disable client-side scripts.\n* Redirect invalid requests.\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n## Remediation\nUpgrade `org.hibernate:hibernate-validator` to version 6.0.18.Final, 6.1.0.Final or higher.\n## References\n- [Apache Security Advisory](https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf@%3Cnotifications.accumulo.apache.org%3E)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee)\n- [Hibernator Security Release Blog](https://in.relation.to/2019/11/20/hibernate-validator-610-6018-released/)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219)\n",
        "disclosureTime": "2018-10-18T14:55:21Z",
        "exploit": "Unproven",
        "functions": [
          {
            "functionId": {
              "filePath": "org/hibernate/validator/internal/constraintvalidators/hv/SafeHtmlValidator.java",
              "className": "SafeHtmlValidator",
              "functionName": "getFragmentAsDocument"
            },
            "version": [
              "[,6.0.18.Final)",
              "[6.1.0.Alpha1,6.1.0.Final)"
            ]
          }
        ],
        "fixedIn": [
          "6.0.18.Final",
          "6.1.0.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-569100",
        "identifiers": {
          "CWE": [
            "CWE-79"
          ],
          "CVE": [
            "CVE-2019-10219"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:02.408899Z",
        "moduleName": "org.hibernate:hibernate-validator",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-validator",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-01-09T14:55:12Z",
        "references": [
          {
            "title": "Apache Security Advisory",
            "url": "https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf@%3Cnotifications.accumulo.apache.org%3E"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee"
          },
          {
            "title": "Hibernator Security Release Blog",
            "url": "https://in.relation.to/2019/11/20/hibernate-validator-610-6018-released/"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Cross-site Scripting (XSS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "cvssV3BaseScore": 6.1,
            "severity": "medium",
            "modificationTime": "2022-05-24T01:11:23.425351Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator",
              "functionName": "getFragmentAsDocument"
            },
            "version": [
              "[,6.0.18.Final)",
              "[6.1.0.Alpha1,6.1.0.Final)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,6.0.18.Final)",
            "[6.1.0.Alpha1,6.1.0.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-validator"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "org.hibernate:hibernate-validator@4.3.1.Final"
        ],
        "upgradePath": [
          false,
          "org.hibernate:hibernate-validator@6.0.23.Final"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-validator",
        "version": "4.3.1.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2022-01-02T11:14:46.053186Z",
        "credit": [
          "Dennis Kennedy"
        ],
        "cvssScore": 4.3,
        "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Improper Output Neutralization for Logs when a user provides malicious input, causing insertion of additional log entries.\n## Remediation\nUpgrade `org.springframework:spring-core` to version 5.3.12, 5.2.18 or higher.\n## References\n- [Github Commit](https://github.com/spring-projects/spring-framework/commit/346b75580267dc5d8d257be198d5841ce4e1add5)\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2021-22096)\n",
        "disclosureTime": "2021-10-27T12:52:59Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.3.12",
          "5.2.18"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2021-22096"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-01-02T11:14:46.378072Z",
        "moduleName": "org.springframework:spring-core",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2021-10-27T16:55:13Z",
        "references": [
          {
            "title": "Github Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/346b75580267dc5d8d257be198d5841ce4e1add5"
          },
          {
            "title": "Pivotal Security Advisory",
            "url": "https://pivotal.io/security/cve-2021-22096"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Improper Output Neutralization for Logs",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 4.3,
            "severity": "medium",
            "modificationTime": "2022-04-29T01:10:51.241222Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[5.3.0,5.3.12)",
            "[,5.2.18)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-core@3.2.6.RELEASE"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.springframework:spring-core",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2022-01-06T12:31:26.181234Z",
        "credit": [
          "psytester"
        ],
        "cvssScore": 4.3,
        "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Improper Input Validation when a user provides malicious input, causing insertion of additional log entries.\n## Remediation\nUpgrade `org.springframework:spring-core` to version 5.2.19.RELEASE, 5.3.14 or higher.\n## References\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2021-22060)\n",
        "disclosureTime": "2022-01-06T11:18:34Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.2.19.RELEASE",
          "5.3.14"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2330878",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2021-22060"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-01-25T15:25:00.337700Z",
        "moduleName": "org.springframework:spring-core",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-01-06T17:17:24.995166Z",
        "references": [
          {
            "title": "Pivotal Security Advisory",
            "url": "https://pivotal.io/security/cve-2021-22060"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Improper Input Validation",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 4.3,
            "severity": "medium",
            "modificationTime": "2022-05-14T01:11:17.670128Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,5.2.19.RELEASE)",
            "[5.3.0,5.3.14)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-core@3.2.6.RELEASE"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.springframework:spring-core",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:31.465000Z",
        "credit": [
          "Takeshi Terada"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Directory Traversal. It allows remote attackers to read arbitrary files via a crafted URL.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `org.springframework:spring-core` to version 3.2.9.RELEASE, 4.0.5.RELEASE or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/e3e71ba92a8b82dadf474eda76cd2741f65a77a8)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/f6fddeb6eb7da625fd711ab371ff16512f431e8d)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/16414)\n- [Jira Issue](https://jira.spring.io/browse/SPR-12354)\n- [JVNDB](http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000054.html)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3578)\n- [Pivotal Security](https://pivotal.io/security/cve-2014-3578)\n- [Pivotal Security](http://www.pivotal.io/security/cve-2014-3578)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1131882)\n",
        "disclosureTime": "2014-09-05T17:16:58Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/springframework/util/StringUtils.java",
              "className": "StringUtils",
              "functionName": "cleanPath"
            },
            "version": [
              "[3.0.0.RELEASE, 3.2.9.RELEASE)",
              "[4.0.0.RELEASE, 4.0.5.RELEASE)"
            ]
          }
        ],
        "fixedIn": [
          "3.2.9.RELEASE",
          "4.0.5.RELEASE"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-31325",
        "identifiers": {
          "CWE": [
            "CWE-22"
          ],
          "CVE": [
            "CVE-2014-3578"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2021-02-01T12:09:21.542397Z",
        "moduleName": "org.springframework:spring-core",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2014-09-05T17:16:58Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/e3e71ba92a8b82dadf474eda76cd2741f65a77a8"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/f6fddeb6eb7da625fd711ab371ff16512f431e8d"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/16414"
          },
          {
            "title": "Jira Issue",
            "url": "https://jira.spring.io/browse/SPR-12354"
          },
          {
            "title": "JVNDB",
            "url": "http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000054.html"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3578"
          },
          {
            "title": "Pivotal Security",
            "url": "https://pivotal.io/security/cve-2014-3578"
          },
          {
            "title": "Pivotal Security",
            "url": "http://www.pivotal.io/security/cve-2014-3578"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Directory Traversal",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": null,
            "cvssV3BaseScore": null,
            "severity": "medium",
            "modificationTime": "2022-01-03T17:37:14.768247Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.springframework.util.StringUtils",
              "functionName": "cleanPath"
            },
            "version": [
              "[3.0.0.RELEASE, 3.2.9.RELEASE)",
              "[4.0.0.RELEASE, 4.0.5.RELEASE)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[3.0.0.RELEASE, 3.2.9.RELEASE)",
            "[4.0.0.RELEASE, 4.0.5.RELEASE)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-core@3.2.6.RELEASE"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.springframework:spring-core",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
        "alternativeIds": [],
        "creationTime": "2022-03-29T10:05:31.971026Z",
        "credit": [
          "4ra1n"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) by providing a specially crafted SpEL expression, that might result in an `OutOfMemoryError`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `org.springframework:spring-expression` to version 5.3.17, 5.2.20.RELEASE or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/28145)\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2022-22950)\n",
        "disclosureTime": "2022-03-29T09:51:43Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.3.17",
          "5.2.20.RELEASE"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828",
        "identifiers": {
          "CWE": [
            "CWE-400"
          ],
          "CVE": [
            "CVE-2022-22950"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-07-17T12:57:31.345773Z",
        "moduleName": "org.springframework:spring-expression",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-expression",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-03-29T14:24:08Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/28145"
          },
          {
            "title": "Pivotal Security Advisory",
            "url": "https://pivotal.io/security/cve-2022-22950"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": "This vulnerability is only applicable on systems using Spring Expression Language (SpEL)"
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 6.5,
            "severity": "medium",
            "modificationTime": "2022-06-23T01:11:13.680071Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[5.3.0,5.3.17)",
            "[,5.2.20.RELEASE)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-expression"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-expression@3.2.6.RELEASE"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.springframework:spring-expression",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H",
        "alternativeIds": [],
        "creationTime": "2022-03-30T21:42:31.436000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n[org.springframework:spring-beans](https://www.baeldung.com/spring-bean) is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.\n\nAffected versions of this package are vulnerable to Remote Code Execution via manipulation of `ClassLoader` that is achievable with a POST HTTP request. This could allow an attacker to execute a webshell on a victim's application (TomCat), or download arbitrary files from the server (Payara/Glassfish).\r\n\r\n**Note:** \r\n* Current public exploits require victim applications to be built with JRE version 9 (or above) and to be deployed on either Tomcat, Payara or Glassfish. \r\n* However, we have confirmed that it is technically possible for additional exploits to work under additional application configurations as well. \r\n* As such while we recommend users prioritise first remediating against the configuration described above, for full protection we also recommend upgrading all vulnerable versions to the fixed `spring-beans` version regardless of the application configuration.\r\n\r\n### Update Log \r\n* **31/03/2022 -** Severity was raised from 8.1 to 9.8\r\n* **08/04/2022 -** Advisory was updated to reflect that Snyk's security research team was able to author a working PoC of this vulnerability against applications that are deployed on Payara (which is based on Glassfish). \r\n\r\n\r\n## PoC\r\n```java\r\n1/ docker run -p 8888:8080 --rm --interactive --tty --name vm1 tomcat:9.0\r\n2/ ./mvnw install\r\n3/ docker cp target/handling-form-submission-complete.war vm1:/usr/local/tomcat/webapps\r\n4/ curl -X POST \\\r\n  -H \"pre:<%\" \\\r\n  -H \"post:;%>\" \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.pattern=%{pre}iSystem.out.println(123)%{post}i' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/handling-form-submission-complete' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.prefix=rce' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=' \\\r\n  http://localhost:8888/handling-form-submission-complete/greeting\r\n5/ curl http://localhost:8888/handling-form-submission-complete/rce.jsp\r\n```\n## Remediation\nUpgrade `org.springframework:spring-beans` to version 5.2.20, 5.3.18 or higher.\n## References\n- [CyberKendra Post](https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15)\n- [LunaSec Blog](https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/)\n- [Payara Blogpost](https://blog.payara.fish/payara-and-spring4shell)\n- [Payara PoC](https://github.com/CalumHutton/CVE-2022-22965-PoC_Payara)\n- [Snyk Blog - Technical Breakdown](https://snyk.io/blog/spring4shell-zero-day-rce-spring-framework-explained/)\n- [Snyk PoC](https://github.com/Kirill89/CVE-2022-22965-PoC)\n- [Spring Security Announcement](https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)\n- [Spring Tomcat Mitigation Advice](https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative)\n- [CISA - Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n",
        "disclosureTime": "2022-03-30T21:42:24Z",
        "exploit": "High",
        "functions": [
          {
            "functionId": {
              "filePath": "org/springframework/beans/CachedIntrospectionResults.java",
              "className": "CachedIntrospectionResults",
              "functionName": "<init>"
            },
            "version": [
              "[ ,5.2.20)",
              "[5.3.0, 5.3.18)"
            ]
          }
        ],
        "fixedIn": [
          "5.2.20",
          "5.3.18"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751",
        "identifiers": {
          "CWE": [
            "CWE-94"
          ],
          "CVE": [
            "CVE-2022-22965"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-08-12T15:25:01.081783Z",
        "moduleName": "org.springframework:spring-beans",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-beans",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-03-30T22:32:44Z",
        "references": [
          {
            "title": "CyberKendra Post",
            "url": "https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15"
          },
          {
            "title": "LunaSec Blog",
            "url": "https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/"
          },
          {
            "title": "Payara Blogpost",
            "url": "https://blog.payara.fish/payara-and-spring4shell"
          },
          {
            "title": "Payara PoC",
            "url": "https://github.com/CalumHutton/CVE-2022-22965-PoC_Payara"
          },
          {
            "title": "Snyk Blog - Technical Breakdown",
            "url": "https://snyk.io/blog/spring4shell-zero-day-rce-spring-framework-explained/"
          },
          {
            "title": "Snyk PoC",
            "url": "https://github.com/Kirill89/CVE-2022-22965-PoC"
          },
          {
            "title": "Spring Security Announcement",
            "url": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement"
          },
          {
            "title": "Spring Tomcat Mitigation Advice",
            "url": "https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative"
          },
          {
            "title": "CISA - Known Exploited Vulnerabilities",
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Remote Code Execution",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-07-26T01:11:22.743934Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.springframework.beans.CachedIntrospectionResults",
              "functionName": "<init>"
            },
            "version": [
              "[ ,5.2.20)",
              "[5.3.0, 5.3.18)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[ ,5.2.20)",
            "[5.3.0, 5.3.18)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-beans"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-beans@3.2.6.RELEASE"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.springframework:spring-beans",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
        "alternativeIds": [],
        "creationTime": "2022-05-12T08:45:35.744127Z",
        "credit": [
          "Rob Ryan"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.springframework:spring-beans](https://www.baeldung.com/spring-bean) is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) if it relies on data binding to set a `MultipartFile` or `javax.servlet.Part` to a field in a model object.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `org.springframework:spring-beans` to version 5.2.22.RELEASE, 5.3.20 or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583)\n- [Tanzu vmware](https://tanzu.vmware.com/security/cve-2022-22970)\n",
        "disclosureTime": "2022-05-12T08:17:10Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.2.22.RELEASE",
          "5.3.20"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2823313",
        "identifiers": {
          "CWE": [
            "CWE-400"
          ],
          "CVE": [
            "CVE-2022-22970"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-12T09:49:10.835416Z",
        "moduleName": "org.springframework:spring-beans",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-beans",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-05-12T09:49:10.833602Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583"
          },
          {
            "title": "Tanzu vmware",
            "url": "https://tanzu.vmware.com/security/cve-2022-22970"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-07-26T01:11:19.570522Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,5.2.22.RELEASE)",
            "[5.3.0,5.3.20)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-beans"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-beans@3.2.6.RELEASE"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.springframework:spring-beans",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P",
        "alternativeIds": [],
        "creationTime": "2022-04-14T11:54:10.207823Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 3.7,
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the patterns for `disallowedFields` on a `DataBinder`. As a result, a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including nested fields within the property path.\n## Remediation\nUpgrade `org.springframework:spring-context` to version 5.2.21, 5.3.19 or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/28333)\n- [PoC](https://github.com/MarcinGadz/spring-rce-poc)\n- [Spring Blog Post](https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968)\n- [Tanzu Advisory](https://tanzu.vmware.com/security/cve-2022-22968)\n",
        "disclosureTime": "2022-04-14T11:43:54Z",
        "exploit": "Proof of Concept",
        "functions": [],
        "fixedIn": [
          "5.2.21",
          "5.3.19"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2689634",
        "identifiers": {
          "CWE": [
            "CWE-178"
          ],
          "CVE": [
            "CVE-2022-22968"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-15T07:59:33.898723Z",
        "moduleName": "org.springframework:spring-context",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-context",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-04-14T12:09:40Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/28333"
          },
          {
            "title": "PoC",
            "url": "https://github.com/MarcinGadz/spring-rce-poc"
          },
          {
            "title": "Spring Blog Post",
            "url": "https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968"
          },
          {
            "title": "Tanzu Advisory",
            "url": "https://tanzu.vmware.com/security/cve-2022-22968"
          }
        ],
        "severity": "low",
        "socialTrendAlert": false,
        "title": "Improper Handling of Case Sensitivity",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-07-26T01:11:20.613128Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,5.2.21)",
            "[5.3.0, 5.3.19)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-context"
        },
        "severityWithCritical": "low",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.springframework:spring-context@3.2.6.RELEASE"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.springframework:spring-context",
        "version": "3.2.6.RELEASE"
      },
      {
        "id": "snyk:lic:maven:org.aspectj:aspectjweaver:EPL-1.0",
        "packageName": "org.aspectj:aspectjweaver",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-11T15:48:31.375Z",
        "description": "EPL-1.0 license",
        "language": "java",
        "license": "EPL-1.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T15:48:31.375Z",
        "title": "EPL-1.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.aspectj:aspectjweaver@1.8.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.aspectj:aspectjweaver",
        "version": "1.8.2"
      },
      {
        "id": "snyk:lic:maven:org.hibernate.common:hibernate-commons-annotations:LGPL-2.1",
        "packageName": "org.hibernate.common:hibernate-commons-annotations",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-11T02:03:20.921Z",
        "description": "LGPL-2.1 license",
        "language": "java",
        "license": "LGPL-2.1",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T02:03:20.921Z",
        "title": "LGPL-2.1 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "org.hibernate.common:hibernate-commons-annotations@4.0.5.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate.common:hibernate-commons-annotations",
        "version": "4.0.5.Final"
      },
      {
        "id": "snyk:lic:maven:org.hibernate.javax.persistence:hibernate-jpa-2.1-api:EPL-1.0",
        "packageName": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-11T03:29:28.476Z",
        "description": "EPL-1.0 license",
        "language": "java",
        "license": "EPL-1.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T03:29:28.476Z",
        "title": "EPL-1.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "org.hibernate.javax.persistence:hibernate-jpa-2.1-api@1.0.0.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
        "version": "1.0.0.Final"
      },
      {
        "id": "snyk:lic:maven:org.hibernate:hibernate-entitymanager:LGPL-2.0",
        "packageName": "org.hibernate:hibernate-entitymanager",
        "semver": {
          "vulnerable": [
            "[3.5.0.Beta-1, 5.3.1.Final)"
          ]
        },
        "creationTime": "2022-09-11T03:11:24.569Z",
        "description": "LGPL-2.0 license",
        "language": "java",
        "license": "LGPL-2.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T03:11:24.569Z",
        "title": "LGPL-2.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-entitymanager@4.3.7.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-entitymanager",
        "version": "4.3.7.Final"
      },
      {
        "id": "snyk:lic:maven:org.jboss.logging:jboss-logging:LGPL-2.1",
        "packageName": "org.jboss.logging:jboss-logging",
        "semver": {
          "vulnerable": [
            "[3.0.1.GA, 3.1.2.GA)"
          ]
        },
        "creationTime": "2022-09-10T14:43:45.479Z",
        "description": "LGPL-2.1 license",
        "language": "java",
        "license": "LGPL-2.1",
        "packageManager": "maven",
        "publicationTime": "2022-09-10T14:43:45.479Z",
        "title": "LGPL-2.1 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "org.hibernate:hibernate-validator@4.3.1.Final",
          "org.jboss.logging:jboss-logging@3.1.0.CR2"
        ],
        "upgradePath": [
          false,
          "org.hibernate:hibernate-validator@6.0.23.Final"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.jboss.logging:jboss-logging",
        "version": "3.1.0.CR2"
      }
    ],
    "ok": false,
    "dependencyCount": 39,
    "org": "kevin-s31-org",
    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.0\nignore: {}\npatch: {}\n",
    "isPrivate": true,
    "licensesPolicy": {
      "severities": {},
      "orgLicenseRules": {
        "AGPL-1.0": {
          "licenseType": "AGPL-1.0",
          "severity": "high",
          "instructions": ""
        },
        "AGPL-3.0": {
          "licenseType": "AGPL-3.0",
          "severity": "high",
          "instructions": ""
        },
        "Artistic-1.0": {
          "licenseType": "Artistic-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "Artistic-2.0": {
          "licenseType": "Artistic-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "CDDL-1.0": {
          "licenseType": "CDDL-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "CPOL-1.02": {
          "licenseType": "CPOL-1.02",
          "severity": "high",
          "instructions": ""
        },
        "EPL-1.0": {
          "licenseType": "EPL-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "GPL-2.0": {
          "licenseType": "GPL-2.0",
          "severity": "high",
          "instructions": ""
        },
        "GPL-3.0": {
          "licenseType": "GPL-3.0",
          "severity": "high",
          "instructions": ""
        },
        "LGPL-2.0": {
          "licenseType": "LGPL-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "LGPL-2.1": {
          "licenseType": "LGPL-2.1",
          "severity": "medium",
          "instructions": ""
        },
        "LGPL-3.0": {
          "licenseType": "LGPL-3.0",
          "severity": "medium",
          "instructions": ""
        },
        "MPL-1.1": {
          "licenseType": "MPL-1.1",
          "severity": "medium",
          "instructions": ""
        },
        "MPL-2.0": {
          "licenseType": "MPL-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "MS-RL": {
          "licenseType": "MS-RL",
          "severity": "medium",
          "instructions": ""
        },
        "SimPL-2.0": {
          "licenseType": "SimPL-2.0",
          "severity": "high",
          "instructions": ""
        }
      }
    },
    "packageManager": "maven",
    "ignoreSettings": {
      "adminOnly": false,
      "reasonRequired": false,
      "disregardFilesystemIgnores": false
    },
    "summary": "25 vulnerable dependency paths",
    "remediation": {
      "unresolved": [
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "alternativeIds": [],
          "creationTime": "2019-09-05T16:17:58.383761Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 9.8,
          "description": "## Overview\n\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection.\nvia the `extractXmlConfigFromInputStream` in `com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java` during initialization.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\r\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\r\n\r\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\r\n\r\nFor example, below is a sample XML document, containing an XML element- username.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n   <username>John</username>\r\n</xml>\r\n```\r\n\r\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n<!DOCTYPE foo [\r\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\r\n   <username>&xxe;</username>\r\n</xml>\r\n```\r\n\r\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n\n## Remediation\n\nThere is no fixed version for `c3p0:c3p0`.\n\n\n## References\n\n- [GitHub Commit](https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1)\n",
          "disclosureTime": "2018-12-24T13:29:00Z",
          "exploit": "Not Defined",
          "functions": [
            {
              "functionId": {
                "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
                "className": "C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "fixedIn": [],
          "id": "SNYK-JAVA-C3P0-461017",
          "identifiers": {
            "CWE": [
              "CWE-611"
            ],
            "CVE": [
              "CVE-2018-20433"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2020-12-14T14:41:01.987191Z",
          "moduleName": "c3p0:c3p0",
          "packageManager": "maven",
          "packageName": "c3p0:c3p0",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2019-07-21T14:22:18Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1"
            }
          ],
          "severity": "critical",
          "socialTrendAlert": false,
          "title": "XML External Entity (XXE) Injection",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "cvssV3BaseScore": 9.8,
              "severity": "critical",
              "modificationTime": "2022-01-03T16:25:31.174274Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "c3p0",
            "artifactId": "c3p0"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "c3p0:c3p0@0.9.1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "c3p0:c3p0",
          "version": "0.9.1.2",
          "severityWithCritical": "critical"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O",
          "alternativeIds": [],
          "creationTime": "2019-09-05T16:24:58.914446Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 7.5,
          "description": "## Overview\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to missing protections against recursive entity expansion when loading XML configurations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nThere is no fixed version for `c3p0:c3p0`.\n## References\n- [POC: Hackerone Report](https://hackerone.com/reports/509315)\n",
          "disclosureTime": "2019-04-22T22:18:26Z",
          "exploit": "Proof of Concept",
          "functions": [
            {
              "functionId": {
                "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
                "className": "C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "fixedIn": [],
          "id": "SNYK-JAVA-C3P0-461018",
          "identifiers": {
            "CWE": [
              "CWE-776"
            ],
            "GHSA": [
              "GHSA-84p2-vf58-xhxv"
            ],
            "CVE": [
              "CVE-2019-5427"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-04-24T11:13:58.306515Z",
          "moduleName": "c3p0:c3p0",
          "packageManager": "maven",
          "packageName": "c3p0:c3p0",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2019-04-22T22:18:26Z",
          "references": [
            {
              "title": "POC: Hackerone Report",
              "url": "https://hackerone.com/reports/509315"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "Denial of Service (DoS)",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "cvssV3BaseScore": 7.5,
              "severity": "high",
              "modificationTime": "2022-04-23T01:11:20.164193Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "c3p0",
            "artifactId": "c3p0"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "c3p0:c3p0@0.9.1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "c3p0:c3p0",
          "version": "0.9.1.2",
          "severityWithCritical": "high"
        },
        {
          "id": "snyk:lic:maven:c3p0:c3p0:LGPL-3.0",
          "packageName": "c3p0:c3p0",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-10T14:28:57.415Z",
          "description": "LGPL-3.0 license",
          "language": "java",
          "license": "LGPL-3.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-10T14:28:57.415Z",
          "title": "LGPL-3.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "c3p0:c3p0@0.9.1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "c3p0:c3p0",
          "version": "0.9.1.2",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
          "alternativeIds": [],
          "creationTime": "2019-04-10T16:07:04.634619Z",
          "credit": [
            "Mario Areias"
          ],
          "cvssScore": 7.5,
          "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection due to improper validation of the `QName` inputs.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387)\n- [GitHub Issue](https://github.com/dom4j/dom4j/issues/48)\n- [POC: Ihacktoprotect Blog](https://ihacktoprotect.com/post/dom4j-xml-injection/)\n",
          "disclosureTime": "2018-07-01T19:12:29Z",
          "exploit": "Proof of Concept",
          "functions": [
            {
              "functionId": {
                "filePath": "org/dom4j/Namespace.java",
                "className": "Namespace",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            },
            {
              "functionId": {
                "filePath": "org/dom4j/QName.java",
                "className": "QName",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            }
          ],
          "fixedIn": [],
          "id": "SNYK-JAVA-DOM4J-174153",
          "identifiers": {
            "CWE": [
              "CWE-611"
            ],
            "GHSA": [
              "GHSA-6pcc-3rfx-4gpm"
            ],
            "CVE": [
              "CVE-2018-1000632"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-05-22T12:44:25.928596Z",
          "moduleName": "dom4j:dom4j",
          "packageManager": "maven",
          "packageName": "dom4j:dom4j",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2018-08-21T14:16:13Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387"
            },
            {
              "title": "GitHub Issue",
              "url": "https://github.com/dom4j/dom4j/issues/48"
            },
            {
              "title": "POC: Ihacktoprotect Blog",
              "url": "https://ihacktoprotect.com/post/dom4j-xml-injection/"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "XML External Entity (XXE) Injection",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "SUSE",
              "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
              "cvssV3BaseScore": 6.1,
              "severity": "medium",
              "modificationTime": "2022-05-04T00:48:09.564645Z"
            },
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "cvssV3BaseScore": 7.5,
              "severity": "high",
              "modificationTime": "2022-01-03T16:12:35.769596Z"
            },
            {
              "assigner": "RHEL",
              "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "cvssV3BaseScore": 5.3,
              "severity": "medium",
              "modificationTime": "2022-05-31T14:35:13.279641Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "org.dom4j.Namespace",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            },
            {
              "functionId": {
                "className": "org.dom4j.QName",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "dom4j",
            "artifactId": "dom4j"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "dom4j:dom4j@1.6.1"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "dom4j:dom4j",
          "version": "1.6.1",
          "severityWithCritical": "high"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "alternativeIds": [],
          "creationTime": "2022-05-10T12:56:27.582369Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 7.4,
          "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection. By using the default `SaxReader()` provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/a822852)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1694235)\n",
          "disclosureTime": "2020-04-15T09:38:17Z",
          "exploit": "Not Defined",
          "functions": [],
          "fixedIn": [],
          "id": "SNYK-JAVA-DOM4J-2812975",
          "identifiers": {
            "CWE": [
              "CWE-611"
            ],
            "GHSA": [
              "GHSA-hwj3-m3p6-hj38"
            ],
            "CVE": [
              "CVE-2020-10683"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-05-10T12:56:27.582382Z",
          "moduleName": "dom4j:dom4j",
          "packageManager": "maven",
          "packageName": "dom4j:dom4j",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2020-04-16T15:22:50Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/dom4j/dom4j/commit/a822852"
            },
            {
              "title": "RedHat Bugzilla Bug",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694235"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "XML External Entity (XXE) Injection",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "cvssV3BaseScore": 9.8,
              "severity": "critical",
              "modificationTime": "2022-07-26T01:11:31.495013Z"
            },
            {
              "assigner": "RHEL",
              "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "cvssV3BaseScore": 7.4,
              "severity": "high",
              "modificationTime": "2022-05-31T14:51:07.029250Z"
            }
          ],
          "functions_new": [],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "dom4j",
            "artifactId": "dom4j"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "dom4j:dom4j@1.6.1"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "dom4j:dom4j",
          "version": "1.6.1",
          "severityWithCritical": "high"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "alternativeIds": [],
          "creationTime": "2017-02-22T07:28:19.341000Z",
          "credit": [
            "David Jorm"
          ],
          "cvssScore": 7.3,
          "description": "## Overview\n[javax.servlet:jstl](https://mvnrepository.com/artifact/javax.servlet/jstl) is a collection of useful JSP tags which encapsulates the core functionality common to many JSP applications.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection. Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a `<x:parse>` or `<x:transform>` JSTL XML tag.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `javax.servlet:jstl`.\n## References\n- [Apache Mail Archive](http://mail-archives.us.apache.org/mod_mbox/www-announce/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A@apache.org%3E)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0254)\n- [RedHat CVE Database](https://access.redhat.com/security/cve/CVE-2015-0254)\n",
          "disclosureTime": "2015-02-27T16:13:27Z",
          "exploit": "Not Defined",
          "functions": [],
          "fixedIn": [],
          "id": "SNYK-JAVA-JAVAXSERVLET-30449",
          "identifiers": {
            "CWE": [
              "CWE-94"
            ],
            "GHSA": [
              "GHSA-6x4w-8w53-xrvv"
            ],
            "CVE": [
              "CVE-2015-0254"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2020-12-14T14:40:54.105551Z",
          "moduleName": "javax.servlet:jstl",
          "packageManager": "maven",
          "packageName": "javax.servlet:jstl",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2015-02-27T16:51:55Z",
          "references": [
            {
              "title": "Apache Mail Archive",
              "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A@apache.org%3E"
            },
            {
              "title": "NVD",
              "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0254"
            },
            {
              "title": "RedHat CVE Database",
              "url": "https://access.redhat.com/security/cve/CVE-2015-0254"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "XML External Entity (XXE) Injection",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": null,
              "cvssV3BaseScore": null,
              "severity": "high",
              "modificationTime": "2022-01-03T17:28:38.191565Z"
            },
            {
              "assigner": "RHEL",
              "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
              "cvssV3BaseScore": 7.6,
              "severity": "high",
              "modificationTime": "2022-05-31T17:09:25.699843Z"
            }
          ],
          "functions_new": [],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "javax.servlet",
            "artifactId": "jstl"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "javax.servlet:jstl@1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "javax.servlet:jstl",
          "version": "1.2",
          "severityWithCritical": "high"
        },
        {
          "id": "snyk:lic:maven:javax.servlet:jstl:CDDL-1.0",
          "packageName": "javax.servlet:jstl",
          "semver": {
            "vulnerable": [
              "[1.2,)"
            ]
          },
          "creationTime": "2022-09-10T22:00:05.351Z",
          "description": "CDDL-1.0 license",
          "language": "java",
          "license": "CDDL-1.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-10T22:00:05.351Z",
          "title": "CDDL-1.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "javax.servlet:jstl@1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "javax.servlet:jstl",
          "version": "1.2",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:U",
          "alternativeIds": [],
          "creationTime": "2020-11-19T16:51:52.251545Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 8.2,
          "description": "## Overview\n[org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) is a library providing Object/Relational Mapping (ORM) support to applications, libraries, and frameworks.\n\nAffected versions of this package are vulnerable to SQL Injection. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.\n## Remediation\nUpgrade `org.hibernate:hibernate-core` to version 5.4.24.Final or higher.\n## References\n- [GitHub Commit](https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78)\n- [Redhat CVE Details](https://access.redhat.com/security/cve/cve-2020-25638)\n",
          "disclosureTime": "2020-11-19T16:51:45Z",
          "exploit": "Unproven",
          "functions": [
            {
              "functionId": {
                "filePath": "org/hibernate/loader/plan/exec/query/internal/SelectStatementBuilder.java",
                "className": "SelectStatementBuilder",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/Delete.java",
                "className": "Delete",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/Insert.java",
                "className": "Insert",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/InsertSelect.java",
                "className": "InsertSelect",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/QuerySelect.java",
                "className": "QuerySelect",
                "functionName": "toQueryString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/Select.java",
                "className": "Select",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/SimpleSelect.java",
                "className": "SimpleSelect",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/Update.java",
                "className": "Update",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            }
          ],
          "fixedIn": [
            "5.4.24.Final"
          ],
          "id": "SNYK-JAVA-ORGHIBERNATE-1041788",
          "identifiers": {
            "CWE": [
              "CWE-89"
            ],
            "CVE": [
              "CVE-2020-25638"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-07-18T12:56:04.506674Z",
          "moduleName": "org.hibernate:hibernate-core",
          "packageManager": "maven",
          "packageName": "org.hibernate:hibernate-core",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2020-11-19T16:57:14.572204Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78"
            },
            {
              "title": "Redhat CVE Details",
              "url": "https://access.redhat.com/security/cve/cve-2020-25638"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "SQL Injection",
          "insights": {
            "triageAdvice": "This vulnerability is only applicable on systems using JPA Criteria API"
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "cvssV3BaseScore": 7.4,
              "severity": "high",
              "modificationTime": "2022-07-26T01:11:35.094170Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "org.hibernate.loader.plan.exec.query.internal.SelectStatementBuilder",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.Delete",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.Insert",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.InsertSelect",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.QuerySelect",
                "functionName": "toQueryString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.Select",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.SimpleSelect",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.Update",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[,5.4.24.Final)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.hibernate",
            "artifactId": "hibernate-core"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate:hibernate-core",
          "version": "4.3.7.Final",
          "severityWithCritical": "high"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "alternativeIds": [],
          "creationTime": "2020-07-15T13:53:15.331818Z",
          "credit": [
            "Gail Badner"
          ],
          "cvssScore": 8.1,
          "description": "## Overview\n[org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) is a library providing Object/Relational Mapping (ORM) support to applications, libraries, and frameworks.\n\nAffected versions of this package are vulnerable to SQL Injection. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.\n## Remediation\nUpgrade `org.hibernate:hibernate-core` to version 5.3.18.Final, 5.4.18.Final or higher.\n## References\n- [GitHub Pull Request](https://github.com/hibernate/hibernate-orm/pull/3438)\n- [Jira Ticket](https://hibernate.atlassian.net/browse/HHH-14077)\n",
          "disclosureTime": "2020-06-18T13:46:30Z",
          "exploit": "Not Defined",
          "functions": [
            {
              "functionId": {
                "filePath": "org/hibernate/query/criteria/internal/expression/LiteralExpression.java",
                "className": "LiteralExpression",
                "functionName": "renderProjection"
              },
              "version": [
                "[5.1.18.Final ,5.4.18.Final)"
              ]
            }
          ],
          "fixedIn": [
            "5.3.18.Final",
            "5.4.18.Final"
          ],
          "id": "SNYK-JAVA-ORGHIBERNATE-584563",
          "identifiers": {
            "CWE": [
              "CWE-89"
            ],
            "CVE": [
              "CVE-2019-14900"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-07-18T12:57:02.888829Z",
          "moduleName": "org.hibernate:hibernate-core",
          "packageManager": "maven",
          "packageName": "org.hibernate:hibernate-core",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2020-07-15T16:40:12Z",
          "references": [
            {
              "title": "GitHub Pull Request",
              "url": "https://github.com/hibernate/hibernate-orm/pull/3438"
            },
            {
              "title": "Jira Ticket",
              "url": "https://hibernate.atlassian.net/browse/HHH-14077"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "SQL Injection",
          "insights": {
            "triageAdvice": "This vulnerability is only applicable on systems using JPA Criteria API"
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "cvssV3BaseScore": 6.5,
              "severity": "medium",
              "modificationTime": "2022-04-30T01:10:36.121203Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "org.hibernate.query.criteria.internal.expression.LiteralExpression",
                "functionName": "renderProjection"
              },
              "version": [
                "[5.1.18.Final ,5.4.18.Final)"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[,5.3.18.Final)",
              "[5.4.0.Final, 5.4.18.Final)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.hibernate",
            "artifactId": "hibernate-core"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate:hibernate-core",
          "version": "4.3.7.Final",
          "severityWithCritical": "high"
        },
        {
          "id": "snyk:lic:maven:org.hibernate:hibernate-core:LGPL-2.0",
          "packageName": "org.hibernate:hibernate-core",
          "semver": {
            "vulnerable": [
              "[3.3.0.CR1, 5.3.1.Final)"
            ]
          },
          "creationTime": "2022-09-11T12:51:18.861Z",
          "description": "LGPL-2.0 license",
          "language": "java",
          "license": "LGPL-2.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T12:51:18.861Z",
          "title": "LGPL-2.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate:hibernate-core",
          "version": "4.3.7.Final",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "alternativeIds": [],
          "creationTime": "2022-01-02T11:14:46.053186Z",
          "credit": [
            "Dennis Kennedy"
          ],
          "cvssScore": 4.3,
          "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Improper Output Neutralization for Logs when a user provides malicious input, causing insertion of additional log entries.\n## Remediation\nUpgrade `org.springframework:spring-core` to version 5.3.12, 5.2.18 or higher.\n## References\n- [Github Commit](https://github.com/spring-projects/spring-framework/commit/346b75580267dc5d8d257be198d5841ce4e1add5)\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2021-22096)\n",
          "disclosureTime": "2021-10-27T12:52:59Z",
          "exploit": "Not Defined",
          "functions": [],
          "fixedIn": [
            "5.3.12",
            "5.2.18"
          ],
          "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097",
          "identifiers": {
            "CWE": [
              "CWE-20"
            ],
            "CVE": [
              "CVE-2021-22096"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-01-02T11:14:46.378072Z",
          "moduleName": "org.springframework:spring-core",
          "packageManager": "maven",
          "packageName": "org.springframework:spring-core",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2021-10-27T16:55:13Z",
          "references": [
            {
              "title": "Github Commit",
              "url": "https://github.com/spring-projects/spring-framework/commit/346b75580267dc5d8d257be198d5841ce4e1add5"
            },
            {
              "title": "Pivotal Security Advisory",
              "url": "https://pivotal.io/security/cve-2021-22096"
            }
          ],
          "severity": "medium",
          "socialTrendAlert": false,
          "title": "Improper Output Neutralization for Logs",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
              "cvssV3BaseScore": 4.3,
              "severity": "medium",
              "modificationTime": "2022-04-29T01:10:51.241222Z"
            }
          ],
          "functions_new": [],
          "semver": {
            "vulnerable": [
              "[5.3.0,5.3.12)",
              "[,5.2.18)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.springframework",
            "artifactId": "spring-core"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.springframework:spring-context@3.2.6.RELEASE",
            "org.springframework:spring-core@3.2.6.RELEASE"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.springframework:spring-core",
          "version": "3.2.6.RELEASE",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "alternativeIds": [],
          "creationTime": "2022-01-06T12:31:26.181234Z",
          "credit": [
            "psytester"
          ],
          "cvssScore": 4.3,
          "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Improper Input Validation when a user provides malicious input, causing insertion of additional log entries.\n## Remediation\nUpgrade `org.springframework:spring-core` to version 5.2.19.RELEASE, 5.3.14 or higher.\n## References\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2021-22060)\n",
          "disclosureTime": "2022-01-06T11:18:34Z",
          "exploit": "Not Defined",
          "functions": [],
          "fixedIn": [
            "5.2.19.RELEASE",
            "5.3.14"
          ],
          "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2330878",
          "identifiers": {
            "CWE": [
              "CWE-20"
            ],
            "CVE": [
              "CVE-2021-22060"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-01-25T15:25:00.337700Z",
          "moduleName": "org.springframework:spring-core",
          "packageManager": "maven",
          "packageName": "org.springframework:spring-core",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2022-01-06T17:17:24.995166Z",
          "references": [
            {
              "title": "Pivotal Security Advisory",
              "url": "https://pivotal.io/security/cve-2021-22060"
            }
          ],
          "severity": "medium",
          "socialTrendAlert": false,
          "title": "Improper Input Validation",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
              "cvssV3BaseScore": 4.3,
              "severity": "medium",
              "modificationTime": "2022-05-14T01:11:17.670128Z"
            }
          ],
          "functions_new": [],
          "semver": {
            "vulnerable": [
              "[,5.2.19.RELEASE)",
              "[5.3.0,5.3.14)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.springframework",
            "artifactId": "spring-core"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.springframework:spring-context@3.2.6.RELEASE",
            "org.springframework:spring-core@3.2.6.RELEASE"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.springframework:spring-core",
          "version": "3.2.6.RELEASE",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "alternativeIds": [],
          "creationTime": "2017-02-22T07:28:31.465000Z",
          "credit": [
            "Takeshi Terada"
          ],
          "cvssScore": 5.3,
          "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Directory Traversal. It allows remote attackers to read arbitrary files via a crafted URL.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `org.springframework:spring-core` to version 3.2.9.RELEASE, 4.0.5.RELEASE or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/e3e71ba92a8b82dadf474eda76cd2741f65a77a8)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/f6fddeb6eb7da625fd711ab371ff16512f431e8d)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/16414)\n- [Jira Issue](https://jira.spring.io/browse/SPR-12354)\n- [JVNDB](http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000054.html)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3578)\n- [Pivotal Security](https://pivotal.io/security/cve-2014-3578)\n- [Pivotal Security](http://www.pivotal.io/security/cve-2014-3578)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1131882)\n",
          "disclosureTime": "2014-09-05T17:16:58Z",
          "exploit": "Not Defined",
          "functions": [
            {
              "functionId": {
                "filePath": "org/springframework/util/StringUtils.java",
                "className": "StringUtils",
                "functionName": "cleanPath"
              },
              "version": [
                "[3.0.0.RELEASE, 3.2.9.RELEASE)",
                "[4.0.0.RELEASE, 4.0.5.RELEASE)"
              ]
            }
          ],
          "fixedIn": [
            "3.2.9.RELEASE",
            "4.0.5.RELEASE"
          ],
          "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-31325",
          "identifiers": {
            "CWE": [
              "CWE-22"
            ],
            "CVE": [
              "CVE-2014-3578"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2021-02-01T12:09:21.542397Z",
          "moduleName": "org.springframework:spring-core",
          "packageManager": "maven",
          "packageName": "org.springframework:spring-core",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2014-09-05T17:16:58Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/spring-projects/spring-framework/commit/e3e71ba92a8b82dadf474eda76cd2741f65a77a8"
            },
            {
              "title": "GitHub Commit",
              "url": "https://github.com/spring-projects/spring-framework/commit/f6fddeb6eb7da625fd711ab371ff16512f431e8d"
            },
            {
              "title": "GitHub Issue",
              "url": "https://github.com/spring-projects/spring-framework/issues/16414"
            },
            {
              "title": "Jira Issue",
              "url": "https://jira.spring.io/browse/SPR-12354"
            },
            {
              "title": "JVNDB",
              "url": "http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000054.html"
            },
            {
              "title": "NVD",
              "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3578"
            },
            {
              "title": "Pivotal Security",
              "url": "https://pivotal.io/security/cve-2014-3578"
            },
            {
              "title": "Pivotal Security",
              "url": "http://www.pivotal.io/security/cve-2014-3578"
            },
            {
              "title": "RedHat Bugzilla Bug",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
            }
          ],
          "severity": "medium",
          "socialTrendAlert": false,
          "title": "Directory Traversal",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": null,
              "cvssV3BaseScore": null,
              "severity": "medium",
              "modificationTime": "2022-01-03T17:37:14.768247Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "org.springframework.util.StringUtils",
                "functionName": "cleanPath"
              },
              "version": [
                "[3.0.0.RELEASE, 3.2.9.RELEASE)",
                "[4.0.0.RELEASE, 4.0.5.RELEASE)"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[3.0.0.RELEASE, 3.2.9.RELEASE)",
              "[4.0.0.RELEASE, 4.0.5.RELEASE)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.springframework",
            "artifactId": "spring-core"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.springframework:spring-context@3.2.6.RELEASE",
            "org.springframework:spring-core@3.2.6.RELEASE"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.springframework:spring-core",
          "version": "3.2.6.RELEASE",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "alternativeIds": [],
          "creationTime": "2022-03-29T10:05:31.971026Z",
          "credit": [
            "4ra1n"
          ],
          "cvssScore": 5.3,
          "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) by providing a specially crafted SpEL expression, that might result in an `OutOfMemoryError`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `org.springframework:spring-expression` to version 5.3.17, 5.2.20.RELEASE or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/28145)\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2022-22950)\n",
          "disclosureTime": "2022-03-29T09:51:43Z",
          "exploit": "Not Defined",
          "functions": [],
          "fixedIn": [
            "5.3.17",
            "5.2.20.RELEASE"
          ],
          "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828",
          "identifiers": {
            "CWE": [
              "CWE-400"
            ],
            "CVE": [
              "CVE-2022-22950"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-07-17T12:57:31.345773Z",
          "moduleName": "org.springframework:spring-expression",
          "packageManager": "maven",
          "packageName": "org.springframework:spring-expression",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2022-03-29T14:24:08Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11"
            },
            {
              "title": "GitHub Issue",
              "url": "https://github.com/spring-projects/spring-framework/issues/28145"
            },
            {
              "title": "Pivotal Security Advisory",
              "url": "https://pivotal.io/security/cve-2022-22950"
            }
          ],
          "severity": "medium",
          "socialTrendAlert": false,
          "title": "Denial of Service (DoS)",
          "insights": {
            "triageAdvice": "This vulnerability is only applicable on systems using Spring Expression Language (SpEL)"
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "cvssV3BaseScore": 6.5,
              "severity": "medium",
              "modificationTime": "2022-06-23T01:11:13.680071Z"
            }
          ],
          "functions_new": [],
          "semver": {
            "vulnerable": [
              "[5.3.0,5.3.17)",
              "[,5.2.20.RELEASE)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.springframework",
            "artifactId": "spring-expression"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.springframework:spring-context@3.2.6.RELEASE",
            "org.springframework:spring-expression@3.2.6.RELEASE"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.springframework:spring-expression",
          "version": "3.2.6.RELEASE",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H",
          "alternativeIds": [],
          "creationTime": "2022-03-30T21:42:31.436000Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 9.8,
          "description": "## Overview\n[org.springframework:spring-beans](https://www.baeldung.com/spring-bean) is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.\n\nAffected versions of this package are vulnerable to Remote Code Execution via manipulation of `ClassLoader` that is achievable with a POST HTTP request. This could allow an attacker to execute a webshell on a victim's application (TomCat), or download arbitrary files from the server (Payara/Glassfish).\r\n\r\n**Note:** \r\n* Current public exploits require victim applications to be built with JRE version 9 (or above) and to be deployed on either Tomcat, Payara or Glassfish. \r\n* However, we have confirmed that it is technically possible for additional exploits to work under additional application configurations as well. \r\n* As such while we recommend users prioritise first remediating against the configuration described above, for full protection we also recommend upgrading all vulnerable versions to the fixed `spring-beans` version regardless of the application configuration.\r\n\r\n### Update Log \r\n* **31/03/2022 -** Severity was raised from 8.1 to 9.8\r\n* **08/04/2022 -** Advisory was updated to reflect that Snyk's security research team was able to author a working PoC of this vulnerability against applications that are deployed on Payara (which is based on Glassfish). \r\n\r\n\r\n## PoC\r\n```java\r\n1/ docker run -p 8888:8080 --rm --interactive --tty --name vm1 tomcat:9.0\r\n2/ ./mvnw install\r\n3/ docker cp target/handling-form-submission-complete.war vm1:/usr/local/tomcat/webapps\r\n4/ curl -X POST \\\r\n  -H \"pre:<%\" \\\r\n  -H \"post:;%>\" \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.pattern=%{pre}iSystem.out.println(123)%{post}i' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/handling-form-submission-complete' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.prefix=rce' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=' \\\r\n  http://localhost:8888/handling-form-submission-complete/greeting\r\n5/ curl http://localhost:8888/handling-form-submission-complete/rce.jsp\r\n```\n## Remediation\nUpgrade `org.springframework:spring-beans` to version 5.2.20, 5.3.18 or higher.\n## References\n- [CyberKendra Post](https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15)\n- [LunaSec Blog](https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/)\n- [Payara Blogpost](https://blog.payara.fish/payara-and-spring4shell)\n- [Payara PoC](https://github.com/CalumHutton/CVE-2022-22965-PoC_Payara)\n- [Snyk Blog - Technical Breakdown](https://snyk.io/blog/spring4shell-zero-day-rce-spring-framework-explained/)\n- [Snyk PoC](https://github.com/Kirill89/CVE-2022-22965-PoC)\n- [Spring Security Announcement](https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)\n- [Spring Tomcat Mitigation Advice](https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative)\n- [CISA - Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n",
          "disclosureTime": "2022-03-30T21:42:24Z",
          "exploit": "High",
          "functions": [
            {
              "functionId": {
                "filePath": "org/springframework/beans/CachedIntrospectionResults.java",
                "className": "CachedIntrospectionResults",
                "functionName": "<init>"
              },
              "version": [
                "[ ,5.2.20)",
                "[5.3.0, 5.3.18)"
              ]
            }
          ],
          "fixedIn": [
            "5.2.20",
            "5.3.18"
          ],
          "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751",
          "identifiers": {
            "CWE": [
              "CWE-94"
            ],
            "CVE": [
              "CVE-2022-22965"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-08-12T15:25:01.081783Z",
          "moduleName": "org.springframework:spring-beans",
          "packageManager": "maven",
          "packageName": "org.springframework:spring-beans",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2022-03-30T22:32:44Z",
          "references": [
            {
              "title": "CyberKendra Post",
              "url": "https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html"
            },
            {
              "title": "GitHub Commit",
              "url": "https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15"
            },
            {
              "title": "LunaSec Blog",
              "url": "https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/"
            },
            {
              "title": "Payara Blogpost",
              "url": "https://blog.payara.fish/payara-and-spring4shell"
            },
            {
              "title": "Payara PoC",
              "url": "https://github.com/CalumHutton/CVE-2022-22965-PoC_Payara"
            },
            {
              "title": "Snyk Blog - Technical Breakdown",
              "url": "https://snyk.io/blog/spring4shell-zero-day-rce-spring-framework-explained/"
            },
            {
              "title": "Snyk PoC",
              "url": "https://github.com/Kirill89/CVE-2022-22965-PoC"
            },
            {
              "title": "Spring Security Announcement",
              "url": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement"
            },
            {
              "title": "Spring Tomcat Mitigation Advice",
              "url": "https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative"
            },
            {
              "title": "CISA - Known Exploited Vulnerabilities",
              "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
            }
          ],
          "severity": "critical",
          "socialTrendAlert": false,
          "title": "Remote Code Execution",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "cvssV3BaseScore": 9.8,
              "severity": "critical",
              "modificationTime": "2022-07-26T01:11:22.743934Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "org.springframework.beans.CachedIntrospectionResults",
                "functionName": "<init>"
              },
              "version": [
                "[ ,5.2.20)",
                "[5.3.0, 5.3.18)"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[ ,5.2.20)",
              "[5.3.0, 5.3.18)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.springframework",
            "artifactId": "spring-beans"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.springframework:spring-context@3.2.6.RELEASE",
            "org.springframework:spring-beans@3.2.6.RELEASE"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.springframework:spring-beans",
          "version": "3.2.6.RELEASE",
          "severityWithCritical": "critical"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "alternativeIds": [],
          "creationTime": "2022-05-12T08:45:35.744127Z",
          "credit": [
            "Rob Ryan"
          ],
          "cvssScore": 5.3,
          "description": "## Overview\n[org.springframework:spring-beans](https://www.baeldung.com/spring-bean) is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) if it relies on data binding to set a `MultipartFile` or `javax.servlet.Part` to a field in a model object.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `org.springframework:spring-beans` to version 5.2.22.RELEASE, 5.3.20 or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583)\n- [Tanzu vmware](https://tanzu.vmware.com/security/cve-2022-22970)\n",
          "disclosureTime": "2022-05-12T08:17:10Z",
          "exploit": "Not Defined",
          "functions": [],
          "fixedIn": [
            "5.2.22.RELEASE",
            "5.3.20"
          ],
          "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2823313",
          "identifiers": {
            "CWE": [
              "CWE-400"
            ],
            "CVE": [
              "CVE-2022-22970"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-05-12T09:49:10.835416Z",
          "moduleName": "org.springframework:spring-beans",
          "packageManager": "maven",
          "packageName": "org.springframework:spring-beans",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2022-05-12T09:49:10.833602Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2"
            },
            {
              "title": "GitHub Commit",
              "url": "https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583"
            },
            {
              "title": "Tanzu vmware",
              "url": "https://tanzu.vmware.com/security/cve-2022-22970"
            }
          ],
          "severity": "medium",
          "socialTrendAlert": false,
          "title": "Denial of Service (DoS)",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "cvssV3BaseScore": 5.3,
              "severity": "medium",
              "modificationTime": "2022-07-26T01:11:19.570522Z"
            }
          ],
          "functions_new": [],
          "semver": {
            "vulnerable": [
              "[,5.2.22.RELEASE)",
              "[5.3.0,5.3.20)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.springframework",
            "artifactId": "spring-beans"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.springframework:spring-context@3.2.6.RELEASE",
            "org.springframework:spring-beans@3.2.6.RELEASE"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.springframework:spring-beans",
          "version": "3.2.6.RELEASE",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P",
          "alternativeIds": [],
          "creationTime": "2022-04-14T11:54:10.207823Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 3.7,
          "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the patterns for `disallowedFields` on a `DataBinder`. As a result, a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including nested fields within the property path.\n## Remediation\nUpgrade `org.springframework:spring-context` to version 5.2.21, 5.3.19 or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/28333)\n- [PoC](https://github.com/MarcinGadz/spring-rce-poc)\n- [Spring Blog Post](https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968)\n- [Tanzu Advisory](https://tanzu.vmware.com/security/cve-2022-22968)\n",
          "disclosureTime": "2022-04-14T11:43:54Z",
          "exploit": "Proof of Concept",
          "functions": [],
          "fixedIn": [
            "5.2.21",
            "5.3.19"
          ],
          "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2689634",
          "identifiers": {
            "CWE": [
              "CWE-178"
            ],
            "CVE": [
              "CVE-2022-22968"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-05-15T07:59:33.898723Z",
          "moduleName": "org.springframework:spring-context",
          "packageManager": "maven",
          "packageName": "org.springframework:spring-context",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2022-04-14T12:09:40Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea"
            },
            {
              "title": "GitHub Issue",
              "url": "https://github.com/spring-projects/spring-framework/issues/28333"
            },
            {
              "title": "PoC",
              "url": "https://github.com/MarcinGadz/spring-rce-poc"
            },
            {
              "title": "Spring Blog Post",
              "url": "https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968"
            },
            {
              "title": "Tanzu Advisory",
              "url": "https://tanzu.vmware.com/security/cve-2022-22968"
            }
          ],
          "severity": "low",
          "socialTrendAlert": false,
          "title": "Improper Handling of Case Sensitivity",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "cvssV3BaseScore": 5.3,
              "severity": "medium",
              "modificationTime": "2022-07-26T01:11:20.613128Z"
            }
          ],
          "functions_new": [],
          "semver": {
            "vulnerable": [
              "[,5.2.21)",
              "[5.3.0, 5.3.19)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.springframework",
            "artifactId": "spring-context"
          },
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.springframework:spring-context@3.2.6.RELEASE"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.springframework:spring-context",
          "version": "3.2.6.RELEASE",
          "severityWithCritical": "low"
        },
        {
          "id": "snyk:lic:maven:org.aspectj:aspectjweaver:EPL-1.0",
          "packageName": "org.aspectj:aspectjweaver",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-11T15:48:31.375Z",
          "description": "EPL-1.0 license",
          "language": "java",
          "license": "EPL-1.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T15:48:31.375Z",
          "title": "EPL-1.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.aspectj:aspectjweaver@1.8.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.aspectj:aspectjweaver",
          "version": "1.8.2",
          "severityWithCritical": "medium"
        },
        {
          "id": "snyk:lic:maven:org.hibernate.common:hibernate-commons-annotations:LGPL-2.1",
          "packageName": "org.hibernate.common:hibernate-commons-annotations",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-11T02:03:20.921Z",
          "description": "LGPL-2.1 license",
          "language": "java",
          "license": "LGPL-2.1",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T02:03:20.921Z",
          "title": "LGPL-2.1 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "org.hibernate.common:hibernate-commons-annotations@4.0.5.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate.common:hibernate-commons-annotations",
          "version": "4.0.5.Final",
          "severityWithCritical": "medium"
        },
        {
          "id": "snyk:lic:maven:org.hibernate.javax.persistence:hibernate-jpa-2.1-api:EPL-1.0",
          "packageName": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-11T03:29:28.476Z",
          "description": "EPL-1.0 license",
          "language": "java",
          "license": "EPL-1.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T03:29:28.476Z",
          "title": "EPL-1.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "org.hibernate.javax.persistence:hibernate-jpa-2.1-api@1.0.0.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
          "version": "1.0.0.Final",
          "severityWithCritical": "medium"
        },
        {
          "id": "snyk:lic:maven:org.hibernate:hibernate-entitymanager:LGPL-2.0",
          "packageName": "org.hibernate:hibernate-entitymanager",
          "semver": {
            "vulnerable": [
              "[3.5.0.Beta-1, 5.3.1.Final)"
            ]
          },
          "creationTime": "2022-09-11T03:11:24.569Z",
          "description": "LGPL-2.0 license",
          "language": "java",
          "license": "LGPL-2.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T03:11:24.569Z",
          "title": "LGPL-2.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-entitymanager@4.3.7.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate:hibernate-entitymanager",
          "version": "4.3.7.Final",
          "severityWithCritical": "medium"
        }
      ],
      "upgrade": {
        "org.hibernate:hibernate-validator@4.3.1.Final": {
          "upgradeTo": "org.hibernate:hibernate-validator@6.0.23.Final",
          "upgrades": [
            "org.hibernate:hibernate-validator@4.3.1.Final",
            "org.hibernate:hibernate-validator@4.3.1.Final",
            "org.hibernate:hibernate-validator@4.3.1.Final",
            "org.jboss.logging:jboss-logging@3.1.0.CR2"
          ],
          "vulns": [
            "SNYK-JAVA-ORGHIBERNATE-30098",
            "SNYK-JAVA-ORGHIBERNATE-568162",
            "SNYK-JAVA-ORGHIBERNATE-569100",
            "snyk:lic:maven:org.jboss.logging:jboss-logging:LGPL-2.1"
          ]
        }
      },
      "patch": {},
      "ignore": {},
      "pin": {}
    },
    "filesystemPolicy": false,
    "filtered": {
      "ignore": [],
      "patch": []
    },
    "uniqueCount": 25,
    "projectName": "io.github.snyk:todolist-web-common",
    "foundProjectCount": 3,
    "displayTargetFile": "todolist-web-common/pom.xml",
    "path": "/Users/ksuzy31/Kev-Stuff/Java-Goof/java-goof"
  },
  {
    "vulnerabilities": [
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2019-09-05T16:17:58.383761Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection.\nvia the `extractXmlConfigFromInputStream` in `com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java` during initialization.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\r\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\r\n\r\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\r\n\r\nFor example, below is a sample XML document, containing an XML element- username.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n   <username>John</username>\r\n</xml>\r\n```\r\n\r\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n<!DOCTYPE foo [\r\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\r\n   <username>&xxe;</username>\r\n</xml>\r\n```\r\n\r\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n\n## Remediation\n\nThere is no fixed version for `c3p0:c3p0`.\n\n\n## References\n\n- [GitHub Commit](https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1)\n",
        "disclosureTime": "2018-12-24T13:29:00Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
              "className": "C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "fixedIn": [],
        "id": "SNYK-JAVA-C3P0-461017",
        "identifiers": {
          "CWE": [
            "CWE-611"
          ],
          "CVE": [
            "CVE-2018-20433"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:01.987191Z",
        "moduleName": "c3p0:c3p0",
        "packageManager": "maven",
        "packageName": "c3p0:c3p0",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2019-07-21T14:22:18Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-01-03T16:25:31.174274Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "c3p0",
          "artifactId": "c3p0"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "c3p0:c3p0@0.9.1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "c3p0:c3p0",
        "version": "0.9.1.2"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O",
        "alternativeIds": [],
        "creationTime": "2019-09-05T16:24:58.914446Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to missing protections against recursive entity expansion when loading XML configurations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nThere is no fixed version for `c3p0:c3p0`.\n## References\n- [POC: Hackerone Report](https://hackerone.com/reports/509315)\n",
        "disclosureTime": "2019-04-22T22:18:26Z",
        "exploit": "Proof of Concept",
        "functions": [
          {
            "functionId": {
              "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
              "className": "C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "fixedIn": [],
        "id": "SNYK-JAVA-C3P0-461018",
        "identifiers": {
          "CWE": [
            "CWE-776"
          ],
          "GHSA": [
            "GHSA-84p2-vf58-xhxv"
          ],
          "CVE": [
            "CVE-2019-5427"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-04-24T11:13:58.306515Z",
        "moduleName": "c3p0:c3p0",
        "packageManager": "maven",
        "packageName": "c3p0:c3p0",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2019-04-22T22:18:26Z",
        "references": [
          {
            "title": "POC: Hackerone Report",
            "url": "https://hackerone.com/reports/509315"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-04-23T01:11:20.164193Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
              "functionName": "extractXmlConfigFromInputStream"
            },
            "version": [
              "[0.9.1,]"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "c3p0",
          "artifactId": "c3p0"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "c3p0:c3p0@0.9.1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "c3p0:c3p0",
        "version": "0.9.1.2"
      },
      {
        "id": "snyk:lic:maven:c3p0:c3p0:LGPL-3.0",
        "packageName": "c3p0:c3p0",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-10T14:28:57.415Z",
        "description": "LGPL-3.0 license",
        "language": "java",
        "license": "LGPL-3.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-10T14:28:57.415Z",
        "title": "LGPL-3.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "c3p0:c3p0@0.9.1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "c3p0:c3p0",
        "version": "0.9.1.2"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "alternativeIds": [],
        "creationTime": "2016-12-25T16:51:56Z",
        "credit": [
          "TERASOLUNA Framework Development Team"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[commons-fileupload:commons-fileupload](https://mvnrepository.com/artifact/commons-fileupload/commons-fileupload) is a component that provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). It allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `commons-fileupload:commons-fileupload` to version 1.3.2 or higher.\n## References\n- [Apache Mail Archive](http://mail-archives.us.apache.org/mod_mbox/www-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832@apache.org%3E)\n- [Apache-SVN](http://svn.apache.org/viewvc/commons/proper/fileupload/trunk/RELEASE-NOTES.txt?r1=1745717&r2=1749637&diff_format=h)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092)\n- [Github ChangeLog](https://github.com/apache/commons-fileupload/blob/b1498c9877d751f8bc4635a6f252ebdfcba28518/src/changes/changes.xml#L84)\n- [GitHub Commit](https://github.com/apache/tomcat80/commit/d752a415a875e888d8c8d0988dfbde95c2c6fb1d)\n- [GitHub Commit](https://github.com/apache/tomcat/commit/2c3553f3681baf775c50bb0b49ea61cb44ea914f)\n- [GitHub Commit](https://github.com/apache/tomcat/commit/8999f8243197a5f8297d0cb1a0d86ed175678a77)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1349475)\n",
        "disclosureTime": "2016-06-22T16:51:56Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "1.3.2"
        ],
        "id": "SNYK-JAVA-COMMONSFILEUPLOAD-30082",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2016-3092"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:21.950210Z",
        "moduleName": "commons-fileupload:commons-fileupload",
        "packageManager": "maven",
        "packageName": "commons-fileupload:commons-fileupload",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-12-25T16:51:56Z",
        "references": [
          {
            "title": "Apache Mail Archive",
            "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832@apache.org%3E"
          },
          {
            "title": "Apache-SVN",
            "url": "http://svn.apache.org/viewvc/commons/proper/fileupload/trunk/RELEASE-NOTES.txt?r1=1745717&r2=1749637&diff_format=h"
          },
          {
            "title": "CVE Details",
            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092"
          },
          {
            "title": "Github ChangeLog",
            "url": "https://github.com/apache/commons-fileupload/blob/b1498c9877d751f8bc4635a6f252ebdfcba28518/src/changes/changes.xml%23L84"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/tomcat80/commit/d752a415a875e888d8c8d0988dfbde95c2c6fb1d"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/tomcat/commit/2c3553f3681baf775c50bb0b49ea61cb44ea914f"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/tomcat/commit/8999f8243197a5f8297d0cb1a0d86ed175678a77"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349475"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T17:47:04.615007Z"
          },
          {
            "assigner": "RHEL",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-05-31T18:43:02.862979Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[1.3,1.3.2)"
          ]
        },
        "mavenModuleName": {
          "groupId": "commons-fileupload",
          "artifactId": "commons-fileupload"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "commons-fileupload:commons-fileupload@1.3.1"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.30",
          "commons-fileupload:commons-fileupload@1.3.2"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "commons-fileupload:commons-fileupload",
        "version": "1.3.1"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:18.753000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n[`commons-fileupload:commons-fileupload`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22commons-fileupload%22)\nThe Apache Commons FileUpload library contains a Java Object that, upon deserialization, can be manipulated to write or copy files in arbitrary locations. If integrated with [`ysoserial`](https://github.com/frohoff/ysoserial), it is possible to upload and execute binaries in a single deserialization call.\n\n# Details\nSerialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.\n\n_Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.\n\nJava deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a [popular library (Apache Commons Collection)](https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.\n\nAn attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.\n\n> Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).\n- Apache Blog\n\n## Remediation\nUpgrade `commons-fileupload` to version 1.3.3 or higher.\n\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000031)\n- [Tenable Security](http://www.tenable.com/security/research/tra-2016-12)\n- [Github ChangeLog](https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml#L65)\n- [Github Commit](https://github.com/apache/commons-fileupload/commit/388e824518697c2c8f9f83fd964621d9c2f8fc4c)\n",
        "disclosureTime": "2016-10-25T14:29:00Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/apache/commons/fileupload/disk/DiskFileItem.java",
              "className": "DiskFileItem",
              "functionName": "readObject"
            },
            "version": [
              "[1.1,1.3.3)"
            ]
          }
        ],
        "fixedIn": [
          "1.3.3"
        ],
        "id": "SNYK-JAVA-COMMONSFILEUPLOAD-30401",
        "identifiers": {
          "CWE": [
            "CWE-284"
          ],
          "CVE": [
            "CVE-2016-1000031"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:28.359180Z",
        "moduleName": "commons-fileupload:commons-fileupload",
        "packageManager": "maven",
        "packageName": "commons-fileupload:commons-fileupload",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-10-26T03:04:11.895000Z",
        "references": [
          {
            "title": "Github ChangeLog",
            "url": "https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml%23L65"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/commons-fileupload/commit/388e824518697c2c8f9f83fd964621d9c2f8fc4c"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000031"
          },
          {
            "title": "Tenable Security",
            "url": "http://www.tenable.com/security/research/tra-2016-12"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Arbitrary Code Execution",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-07-26T01:11:38.227729Z"
          },
          {
            "assigner": "SUSE",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-05-04T00:43:11.123709Z"
          },
          {
            "assigner": "RHEL",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "cvssV3BaseScore": 7.3,
            "severity": "high",
            "modificationTime": "2022-05-31T19:15:11.816569Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.apache.commons.fileupload.disk.DiskFileItem",
              "functionName": "readObject"
            },
            "version": [
              "[1.1,1.3.3)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[1.1,1.3.3)"
          ]
        },
        "mavenModuleName": {
          "groupId": "commons-fileupload",
          "artifactId": "commons-fileupload"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "commons-fileupload:commons-fileupload@1.3.1"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.37",
          "commons-fileupload:commons-fileupload@1.4"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "commons-fileupload:commons-fileupload",
        "version": "1.3.1"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2017-10-01T08:05:48.497000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 6.5,
        "description": "## Overview\r\n[`commons-fileupload:commons-fileupload`](https://commons.apache.org/proper/commons-fileupload/) provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.\r\n\r\nAffected versions of the package are vulnerable to Information Disclosure because the `InputStream` is not closed on exception.\r\n\r\n## Remediation\r\nUpgrade `commons-fileupload` to version 1.3.2 or higher.\r\n\r\n## References\r\n- [Github ChangeLog](https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml#L56)\r\n- [Github Commit](https://github.com/apache/commons-fileupload/commit/5b4881d7f75f439326f54fa554a9ca7de6d60814)",
        "disclosureTime": "2014-02-17T22:00:00Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/apache/commons/fileupload/FileUploadBase$FileItemIteratorImpl.java",
              "className": "FileUploadBase$FileItemIteratorImpl",
              "functionName": "<init>"
            },
            "version": [
              "[1.2.0 ,1.3.2)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/apache/commons/fileupload/FileUploadBase.java",
              "className": "FileUploadBase",
              "functionName": "parseRequest"
            },
            "version": [
              "[1.0-rc1,1.2.0)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/apache/commons/fileupload/FileUpload.java",
              "className": "FileUpload",
              "functionName": "parseRequest"
            },
            "version": [
              "[,1.0-rc1)"
            ]
          }
        ],
        "fixedIn": [
          "1.3.2"
        ],
        "id": "SNYK-JAVA-COMMONSFILEUPLOAD-31540",
        "identifiers": {
          "CWE": [
            "CWE-200"
          ],
          "CVE": []
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:37.686165Z",
        "moduleName": "commons-fileupload:commons-fileupload",
        "packageManager": "maven",
        "packageName": "commons-fileupload:commons-fileupload",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2017-02-17T08:05:48Z",
        "references": [
          {
            "title": "Github ChangeLog",
            "url": "https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml%23L56"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/commons-fileupload/commit/5b4881d7f75f439326f54fa554a9ca7de6d60814"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Information Exposure",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [],
        "functions_new": [
          {
            "functionId": {
              "className": "org.apache.commons.fileupload.FileUploadBase$FileItemIteratorImpl",
              "functionName": "<init>"
            },
            "version": [
              "[1.2.0 ,1.3.2)"
            ]
          },
          {
            "functionId": {
              "className": "org.apache.commons.fileupload.FileUploadBase",
              "functionName": "parseRequest"
            },
            "version": [
              "[1.0-rc1,1.2.0)"
            ]
          },
          {
            "functionId": {
              "className": "org.apache.commons.fileupload.FileUpload",
              "functionName": "parseRequest"
            },
            "version": [
              "[,1.0-rc1)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,1.3.2)"
          ]
        },
        "mavenModuleName": {
          "groupId": "commons-fileupload",
          "artifactId": "commons-fileupload"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "commons-fileupload:commons-fileupload@1.3.1"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.30",
          "commons-fileupload:commons-fileupload@1.3.2"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "commons-fileupload:commons-fileupload",
        "version": "1.3.1"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F",
        "alternativeIds": [],
        "creationTime": "2021-04-27T10:51:05.462338Z",
        "credit": [
          "Lukas Euler"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[commons-io:commons-io](https://search.maven.org/artifact/commons-io/commons-io) is a The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.\n\nAffected versions of this package are vulnerable to Directory Traversal via calling the method FileNameUtils.normalize using an improper string like `//../foo` or `\\\\..\\foo`, which may allow access to files in the parent directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `commons-io:commons-io` to version 2.7 or higher.\n## References\n- [GitHub Commit](https://github.com/apache/commons-io/commit/fe7543eee5cd4b2f9e78aa44c31031b68eba204d)\n- [Jira Issue](https://issues.apache.org/jira/browse/IO-556)\n- [PoC](https://github.com/AlAIAL90/CVE-2021-29425)\n",
        "disclosureTime": "2021-04-26T16:04:00Z",
        "exploit": "Functional",
        "functions": [],
        "fixedIn": [
          "2.7"
        ],
        "id": "SNYK-JAVA-COMMONSIO-1277109",
        "identifiers": {
          "CWE": [
            "CWE-22",
            "CWE-20"
          ],
          "GHSA": [
            "GHSA-gwrp-pvrq-jmwv"
          ],
          "CVE": [
            "CVE-2021-29425"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2021-12-01T15:25:00.738443Z",
        "moduleName": "commons-io:commons-io",
        "packageManager": "maven",
        "packageName": "commons-io:commons-io",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2021-04-27T14:26:12Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/commons-io/commit/fe7543eee5cd4b2f9e78aa44c31031b68eba204d"
          },
          {
            "title": "Jira Issue",
            "url": "https://issues.apache.org/jira/browse/IO-556"
          },
          {
            "title": "PoC",
            "url": "https://github.com/AlAIAL90/CVE-2021-29425"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Directory Traversal",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "SUSE",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "cvssV3BaseScore": 4.3,
            "severity": "medium",
            "modificationTime": "2022-05-03T22:22:20.737922Z"
          },
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "cvssV3BaseScore": 4.8,
            "severity": "medium",
            "modificationTime": "2022-07-26T01:11:30.184169Z"
          },
          {
            "assigner": "RHEL",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "cvssV3BaseScore": 4.8,
            "severity": "medium",
            "modificationTime": "2022-08-31T18:26:18.538285Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[0, 2.7)"
          ]
        },
        "mavenModuleName": {
          "groupId": "commons-io",
          "artifactId": "commons-io"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "commons-io:commons-io@2.2"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@6.0.0",
          "commons-io:commons-io@2.9.0"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "commons-io:commons-io",
        "version": "2.2"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
        "alternativeIds": [],
        "creationTime": "2019-04-10T16:07:04.634619Z",
        "credit": [
          "Mario Areias"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection due to improper validation of the `QName` inputs.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387)\n- [GitHub Issue](https://github.com/dom4j/dom4j/issues/48)\n- [POC: Ihacktoprotect Blog](https://ihacktoprotect.com/post/dom4j-xml-injection/)\n",
        "disclosureTime": "2018-07-01T19:12:29Z",
        "exploit": "Proof of Concept",
        "functions": [
          {
            "functionId": {
              "filePath": "org/dom4j/Namespace.java",
              "className": "Namespace",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          },
          {
            "functionId": {
              "filePath": "org/dom4j/QName.java",
              "className": "QName",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          }
        ],
        "fixedIn": [],
        "id": "SNYK-JAVA-DOM4J-174153",
        "identifiers": {
          "CWE": [
            "CWE-611"
          ],
          "GHSA": [
            "GHSA-6pcc-3rfx-4gpm"
          ],
          "CVE": [
            "CVE-2018-1000632"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-22T12:44:25.928596Z",
        "moduleName": "dom4j:dom4j",
        "packageManager": "maven",
        "packageName": "dom4j:dom4j",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2018-08-21T14:16:13Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/dom4j/dom4j/issues/48"
          },
          {
            "title": "POC: Ihacktoprotect Blog",
            "url": "https://ihacktoprotect.com/post/dom4j-xml-injection/"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "SUSE",
            "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "cvssV3BaseScore": 6.1,
            "severity": "medium",
            "modificationTime": "2022-05-04T00:48:09.564645Z"
          },
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T16:12:35.769596Z"
          },
          {
            "assigner": "RHEL",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-05-31T14:35:13.279641Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.dom4j.Namespace",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          },
          {
            "functionId": {
              "className": "org.dom4j.QName",
              "functionName": "<init>"
            },
            "version": [
              "[0,]"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "dom4j",
          "artifactId": "dom4j"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "dom4j:dom4j@1.6.1"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "dom4j:dom4j",
        "version": "1.6.1"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
        "alternativeIds": [],
        "creationTime": "2022-05-10T12:56:27.582369Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 7.4,
        "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection. By using the default `SaxReader()` provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/a822852)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1694235)\n",
        "disclosureTime": "2020-04-15T09:38:17Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [],
        "id": "SNYK-JAVA-DOM4J-2812975",
        "identifiers": {
          "CWE": [
            "CWE-611"
          ],
          "GHSA": [
            "GHSA-hwj3-m3p6-hj38"
          ],
          "CVE": [
            "CVE-2020-10683"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-10T12:56:27.582382Z",
        "moduleName": "dom4j:dom4j",
        "packageManager": "maven",
        "packageName": "dom4j:dom4j",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-04-16T15:22:50Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/dom4j/dom4j/commit/a822852"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694235"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-07-26T01:11:31.495013Z"
          },
          {
            "assigner": "RHEL",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "cvssV3BaseScore": 7.4,
            "severity": "high",
            "modificationTime": "2022-05-31T14:51:07.029250Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "dom4j",
          "artifactId": "dom4j"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "dom4j:dom4j@1.6.1"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "dom4j:dom4j",
        "version": "1.6.1"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:19.341000Z",
        "credit": [
          "David Jorm"
        ],
        "cvssScore": 7.3,
        "description": "## Overview\n[javax.servlet:jstl](https://mvnrepository.com/artifact/javax.servlet/jstl) is a collection of useful JSP tags which encapsulates the core functionality common to many JSP applications.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection. Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a `<x:parse>` or `<x:transform>` JSTL XML tag.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `javax.servlet:jstl`.\n## References\n- [Apache Mail Archive](http://mail-archives.us.apache.org/mod_mbox/www-announce/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A@apache.org%3E)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0254)\n- [RedHat CVE Database](https://access.redhat.com/security/cve/CVE-2015-0254)\n",
        "disclosureTime": "2015-02-27T16:13:27Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [],
        "id": "SNYK-JAVA-JAVAXSERVLET-30449",
        "identifiers": {
          "CWE": [
            "CWE-94"
          ],
          "GHSA": [
            "GHSA-6x4w-8w53-xrvv"
          ],
          "CVE": [
            "CVE-2015-0254"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:40:54.105551Z",
        "moduleName": "javax.servlet:jstl",
        "packageManager": "maven",
        "packageName": "javax.servlet:jstl",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2015-02-27T16:51:55Z",
        "references": [
          {
            "title": "Apache Mail Archive",
            "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A@apache.org%3E"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0254"
          },
          {
            "title": "RedHat CVE Database",
            "url": "https://access.redhat.com/security/cve/CVE-2015-0254"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": null,
            "cvssV3BaseScore": null,
            "severity": "high",
            "modificationTime": "2022-01-03T17:28:38.191565Z"
          },
          {
            "assigner": "RHEL",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
            "cvssV3BaseScore": 7.6,
            "severity": "high",
            "modificationTime": "2022-05-31T17:09:25.699843Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[0,]"
          ]
        },
        "mavenModuleName": {
          "groupId": "javax.servlet",
          "artifactId": "jstl"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "javax.servlet:jstl@1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "javax.servlet:jstl",
        "version": "1.2"
      },
      {
        "id": "snyk:lic:maven:javax.servlet:jstl:CDDL-1.0",
        "packageName": "javax.servlet:jstl",
        "semver": {
          "vulnerable": [
            "[1.2,)"
          ]
        },
        "creationTime": "2022-09-10T22:00:05.351Z",
        "description": "CDDL-1.0 license",
        "language": "java",
        "license": "CDDL-1.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-10T22:00:05.351Z",
        "title": "CDDL-1.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "javax.servlet:jstl@1.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "javax.servlet:jstl",
        "version": "1.2"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:19.659000Z",
        "credit": [
          "Tao Wang"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[`ognl:ognl`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22ognl%22) is a simple Expression Language (EL) for Java.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) attacks.\nApache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\r\n\r\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\r\n\r\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\r\n\r\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\r\n\r\nTwo common types of DoS vulnerabilities:\r\n\r\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\r\n\r\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `ognl:ognl` to version 3.0.12 or higher.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093)\n- [GitHub Commit](https://github.com/jkuhnert/ognl/commit/ae43073fbf38db8371ff4f8bf2a966ee3b5f7e92)\n",
        "disclosureTime": "2016-06-02T02:16:48.918000Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "3.0.12"
        ],
        "id": "SNYK-JAVA-OGNL-30474",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2016-3093"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:21.631160Z",
        "moduleName": "ognl:ognl",
        "packageManager": "maven",
        "packageName": "ognl:ognl",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-06-02T02:16:48.918000Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/jkuhnert/ognl/commit/ae43073fbf38db8371ff4f8bf2a966ee3b5f7e92"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-01-03T17:48:03.253270Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,3.0.12)"
          ]
        },
        "mavenModuleName": {
          "groupId": "ognl",
          "artifactId": "ognl"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "ognl:ognl@3.0.6"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.28",
          "ognl:ognl@3.0.13"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "ognl:ognl",
        "version": "3.0.6"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H",
        "alternativeIds": [],
        "creationTime": "2020-12-08T19:30:16.810323Z",
        "credit": [
          "Alvaro Munoz",
          "Masato Anzai"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Remote Code Execution (RCE). The vulnerability exists due to improper input validation when processing certain tag's attributes. The application performs double evaluation of the code if a developer applied forced OGNL evaluation by using the `%{...}` syntax. A remote attacker can send a specially crafted request to the application and execute arbitrary code on the target system.\r\n\r\nSuccessful exploitation of this vulnerability may result in complete compromise of vulnerable system.\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.5.26 or higher.\n## References\n- [Apache Security Advisory](https://cwiki.apache.org/confluence/display/WW/S2-061)\n- [GitHub Commit](https://github.com/apache/struts/commit/45667346629455f7ea125bff36bf9b763b7e8463)\n- [PoC](https://github.com/phil-fly/CVE-2020-17530)\n- [PoC](https://videos.hacking.land/2021/03/apache-struts-vulnerability-cve-2020.html)\n- [CISA - Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n",
        "disclosureTime": "2020-12-08T19:25:45Z",
        "exploit": "High",
        "functions": [],
        "fixedIn": [
          "2.5.26"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-1049003",
        "identifiers": {
          "CWE": [
            "CWE-94"
          ],
          "CVE": [
            "CVE-2020-17530"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-06-18T15:25:15.610281Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-12-08T19:25:43Z",
        "references": [
          {
            "title": "Apache Security Advisory",
            "url": "https://cwiki.apache.org/confluence/display/WW/S2-061"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/45667346629455f7ea125bff36bf9b763b7e8463"
          },
          {
            "title": "PoC",
            "url": "https://github.com/phil-fly/CVE-2020-17530"
          },
          {
            "title": "PoC",
            "url": "https://videos.hacking.land/2021/03/apache-struts-vulnerability-cve-2020.html"
          },
          {
            "title": "CISA - Known Exploited Vulnerabilities",
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Remote Code Execution (RCE)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-06-04T01:11:00.774260Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.0.0, 2.5.26)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.5.26"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
        "alternativeIds": [],
        "creationTime": "2022-04-12T20:32:06.687703Z",
        "credit": [
          "Chris McCown"
        ],
        "cvssScore": 8.1,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Remote Code Execution (RCE). The fix issued for [CVE-2020-17530](https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-1049003) was incomplete. Some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the `%{...} syntax`. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.5.30 or higher.\n## References\n- [GitHub Commit](https://github.com/apache/struts/commit/b2bfdc5c88a13e82d647e7ae836089a12ce001fe)\n- [GitHub Security Lab - Double Evaluation in Struts](https://securitylab.github.com/research/apache-struts-double-evaluation/)\n- [Struts Security Advisory](https://cwiki.apache.org/confluence/display/WW/S2-062)\n- [Write Up & PoC](https://mc0wn.blogspot.com/2021/04/exploiting-struts-rce-on-2526.html)\n",
        "disclosureTime": "2022-04-12T20:27:34Z",
        "exploit": "Proof of Concept",
        "functions": [],
        "fixedIn": [
          "2.5.30"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-2635340",
        "identifiers": {
          "CWE": [
            "CWE-94"
          ],
          "CVE": [
            "CVE-2021-31805"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-06-05T15:25:01.347758Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-04-12T20:33:08Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/b2bfdc5c88a13e82d647e7ae836089a12ce001fe"
          },
          {
            "title": "GitHub Security Lab - Double Evaluation in Struts",
            "url": "https://securitylab.github.com/research/apache-struts-double-evaluation/"
          },
          {
            "title": "Struts Security Advisory",
            "url": "https://cwiki.apache.org/confluence/display/WW/S2-062"
          },
          {
            "title": "Write Up & PoC",
            "url": "https://mc0wn.blogspot.com/2021/04/exploiting-struts-rce-on-2526.html"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Remote Code Execution (RCE)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-07-26T01:11:24.593025Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.0.0,2.5.30)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.5.30"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
        "alternativeIds": [],
        "creationTime": "2016-12-25T16:51:56Z",
        "credit": [
          "Viettel Information Security Center"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n`ValueStack` defines special `top` object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings.\n\n## References\n- [Vulnerability Summary](http://struts.apache.org/docs/s2-026.html)\n",
        "disclosureTime": "2015-07-01T16:51:56Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.24.1"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30060",
        "identifiers": {
          "CWE": [
            "CWE-284"
          ],
          "CVE": [
            "CVE-2015-5209"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:27.404745Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2015-07-01T16:51:56Z",
        "references": [
          {
            "title": "Vulnerability Summary",
            "url": "http://struts.apache.org/docs/s2-026.html"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Manipulation of Struts' internals",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T17:40:48.340105Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.0.0, 2.3.24.1)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.24.1"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C",
        "alternativeIds": [],
        "creationTime": "2017-03-19T10:28:21.873000Z",
        "credit": [
          "Nike Zheng"
        ],
        "cvssScore": 10,
        "description": "## Overview\r\n[`org.apache.struts:struts2-core`](https://cwiki.apache.org/confluence/display/WW/Home) is an elegant, extensible framework for building enterprise-ready Java web applications.\r\n\r\nAffected versions of the package are vulnerable to Arbitrary Command Execution while uploading files with the Jakarta Multipart parser. This particular vulnerability can be exploited by an attacker by sending a crafted request to upload a file to the vulnerable server that uses a Jakarta-based plugin to process the upload request.\r\n\r\nThe attacker can then send malicious code in the `Content-Type`, `Content-Disposition` or `Content-Length` HTTP headers, which will then be executed by the vulnerable server. [A proof of concept](https://github.com/tengzhangchao/Struts2_045-Poc) that demonstrates the attack scenario is publicly available and the vulnerability is being [actively exploited in the wild](https://www.theregister.co.uk/2017/03/09/apache_under_attack_patch_for_zero_day_available/).\r\n\r\nAlthough maintainers of the open source project immediately patched the vulnerability, Struts servers that have yet to install the update remain under attack by hackers who exploit it to inject commands of their choice.\r\n\r\nThis attack can be achieved without authentication. To make matters worse, web applications don't necessarily need to successfully upload a malicious file to exploit this vulnerability, as just the presence of the vulnerable Struts library within an application is enough to exploit the vulnerability.\r\n\r\n## Remediation\r\nUpgrade `org.apache.struts:struts2-core` to version 2.3.32, 2.5.10.1 or higher.\n\n## References\n- [CISA - Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638)\n- [Exploit DB](https://exploit-db.com/exploits/41614)\n- [Exploit DB](https://www.exploit-db.com/exploits/41570)\n- [Exploit DB](https://www.exploit-db.com/exploits/41570/)\n- [GitHub Commit](https://github.com/rapid7/metasploit-framework/pull/8072/commits/fc0f63e77471baa40057effaaa8be0f205adc6b7)\n- [GitHub Issue](https://github.com/rapid7/metasploit-framework/issues/8064)\n- [GitHub PR](https://github.com/rapid7/metasploit-framework/pull/8072)\n- [PoC](https://github.com/tengzhangchao/Struts2_045-Poc)\n- [Struts Wiki](https://cwiki.apache.org/confluence/display/WW/S2-045)\n- [Talos Intelligence Blog](http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html)\n",
        "disclosureTime": "2017-03-05T22:00:00Z",
        "exploit": "High",
        "functions": [
          {
            "functionId": {
              "filePath": "org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java",
              "className": "JakartaMultiPartRequest",
              "functionName": "buildErrorMessage"
            },
            "version": [
              "[2.3.5, 2.3.32)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/apache/struts2/interceptor/FileUploadInterceptor.java",
              "className": "FileUploadInterceptor",
              "functionName": "intercept"
            },
            "version": [
              "[2.5.0, 2.5.10.1)"
            ]
          }
        ],
        "fixedIn": [
          "2.3.32",
          "2.5.10.1"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30207",
        "identifiers": {
          "CWE": [
            "CWE-94"
          ],
          "GHSA": [
            "GHSA-j77q-2qqg-6989"
          ],
          "CVE": [
            "CVE-2017-5638"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-06-15T15:36:03.900765Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2017-03-21T15:30:44Z",
        "references": [
          {
            "title": "CVE Details",
            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638"
          },
          {
            "title": "Exploit DB",
            "url": "https://exploit-db.com/exploits/41614"
          },
          {
            "title": "Exploit DB",
            "url": "https://www.exploit-db.com/exploits/41570/"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/rapid7/metasploit-framework/pull/8072/commits/fc0f63e77471baa40057effaaa8be0f205adc6b7"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/rapid7/metasploit-framework/issues/8064"
          },
          {
            "title": "GitHub PR",
            "url": "https://github.com/rapid7/metasploit-framework/pull/8072"
          },
          {
            "title": "PoC",
            "url": "https://github.com/tengzhangchao/Struts2_045-Poc"
          },
          {
            "title": "Struts Wiki",
            "url": "https://cwiki.apache.org/confluence/display/WW/S2-045"
          },
          {
            "title": "Talos Intelligence Blog",
            "url": "http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html"
          },
          {
            "title": "Exploit DB",
            "url": "https://www.exploit-db.com/exploits/41570"
          },
          {
            "title": "CISA - Known Exploited Vulnerabilities",
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Arbitrary Code Execution",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "cvssV3BaseScore": 10,
            "severity": "critical",
            "modificationTime": "2022-01-03T16:28:10.532387Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.apache.struts2.dispatcher.multipart.JakartaMultiPartRequest",
              "functionName": "buildErrorMessage"
            },
            "version": [
              "[2.3.5, 2.3.32)"
            ]
          },
          {
            "functionId": {
              "className": "org.apache.struts2.interceptor.FileUploadInterceptor",
              "functionName": "intercept"
            },
            "version": [
              "[2.5.0, 2.5.10.1)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[2.3.7, 2.3.32)",
            "[2.5.0, 2.5.10.1)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.32"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.315000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 8.1,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Command Injection. When Dynamic Method Invocation was enabled, a remote attackers could execute arbitrary code via the prefix method, related to chained expressions.\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.20.2, 2.3.24.2, 2.3.28.1 or higher.\n## References\n- [Exploit DB](https://exploit-db.com/exploits/39756)\n- [GitHub Commit](https://github.com/apache/struts/commit/f238cf4f1091be19fbcfd086b042c86a1bcaa7fc)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3081)\n- [Exploit DB](https://www.exploit-db.com/exploits/39756)\n",
        "disclosureTime": "2016-04-22T04:32:51Z",
        "exploit": "High",
        "functions": [],
        "fixedIn": [
          "2.3.20.2",
          "2.3.24.2",
          "2.3.28.1"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30770",
        "identifiers": {
          "CWE": [
            "CWE-77"
          ],
          "CVE": [
            "CVE-2016-3081"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-06-15T12:10:56.353788Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-04-22T04:32:51Z",
        "references": [
          {
            "title": "Exploit DB",
            "url": "https://exploit-db.com/exploits/39756"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/f238cf4f1091be19fbcfd086b042c86a1bcaa7fc"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3081"
          },
          {
            "title": "Exploit DB",
            "url": "https://www.exploit-db.com/exploits/39756"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Command Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 8.1,
            "severity": "high",
            "modificationTime": "2022-01-03T17:48:29.381509Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.0.0, 2.3.20.2)",
            "[2.3.24, 2.3.24.2)",
            "[2.3.28, 2.3.28.1)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.20.3"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.327000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22) is a free open-source solution for creating Java web applications.\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution. It allows remote attackers to execute arbitrary code via the stylesheet location parameter.\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.20.2, 2.3.24.2, 2.3.28.1 or higher.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3082)",
        "disclosureTime": "2016-04-22T02:36:52.273000Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.20.2",
          "2.3.24.2",
          "2.3.28.1"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30771",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2016-3082"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:22.111854Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-04-22T02:36:52.273000Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/6bd694b7980494c12d49ca1bf39f12aec3e03e2f"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3082"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Arbitrary Code Execution",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-01-03T17:48:01.870979Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2,2.3.20.2)",
            "[2.3.24,2.3.24.2)",
            "[2.3.28,2.3.28.1)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.20.3"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.339000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\r\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\r\nApache Struts 2.3.20.x before 2.3.20.3, 2.3.24.x before 2.3.24.3, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.\r\n\r\n## References\r\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3087)",
        "disclosureTime": "2016-06-02T00:40:36Z",
        "exploit": "High",
        "functions": [],
        "fixedIn": [
          "2.3.20.2",
          "2.3.24.3",
          "2.3.28.1"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30772",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2016-3087"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-06-15T12:10:56.279813Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-06-02T00:40:36Z",
        "references": [
          {
            "title": "Exploit DB",
            "url": "https://exploit-db.com/exploits/39919"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/6bd694b7980494c12d49ca1bf39f12aec3e03e2f"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/98d2692e434fe7f4d445ade24fe2c9860de1c13f"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3087"
          },
          {
            "title": "Exploit DB",
            "url": "https://www.exploit-db.com/exploits/39919"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Arbitrary Command Execution",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-01-03T17:47:10.107428Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2,2.3.20.2)",
            "[2.3.24,2.3.24.3)",
            "[2.3.28,2.3.28.1)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.20.3"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.353000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 6.1,
        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nCross-site Scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4003)",
        "disclosureTime": "2016-03-16T06:52:13.014000Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.28"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30773",
        "identifiers": {
          "CWE": [
            "CWE-79"
          ],
          "CVE": [
            "CVE-2016-4003"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:16.878654Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-03-16T06:52:13.014000Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/5421930b49822606792f36653b17d3d95ef106f9"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/72471d7075681bea52046645ad7aa34e9c53751e"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/a89bbe22cd2461748d595a89a254de888a415e6c"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4003"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Cross-site Scripting (XSS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "cvssV3BaseScore": 6.1,
            "severity": "medium",
            "modificationTime": "2022-01-03T17:49:28.285857Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,2.3.28)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.28"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.364000Z",
        "credit": [
          "Takeshi Terada"
        ],
        "cvssScore": 8.8,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). It mishandles token validation, which allows remote attackers to conduct CSRF attacks via unspecified vectors.\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.29 or higher.\n## References\n- [Apache Struts Security Bulletin](https://struts.apache.org/docs/s2-038.html)\n- [GitHub Commit](https://github.com/apache/struts/commit/b28b78c062f0bf3c79793a25aab8c9b6c12bce6e)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4430)\n",
        "disclosureTime": "2016-06-20T07:00:37Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.29"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30774",
        "identifiers": {
          "CWE": [
            "CWE-352"
          ],
          "CVE": [
            "CVE-2016-4430"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:32.894091Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-06-20T07:00:37Z",
        "references": [
          {
            "title": "Apache Struts Security Bulletin",
            "url": "https://struts.apache.org/docs/s2-038.html"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/b28b78c062f0bf3c79793a25aab8c9b6c12bce6e"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4430"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Cross-site Request Forgery (CSRF)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 8.8,
            "severity": "high",
            "modificationTime": "2022-01-03T17:49:47.466760Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.3.20,2.3.29)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.29"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.377000Z",
        "credit": [
          "Takeshi Terada"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Access Restriction Bypass. It allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.29 or higher.\n## References\n- [Apache Struts Security Bulletin](https://struts.apache.org/docs/s2-040.html)\n- [GitHub Commit](https://github.com/apache/struts/commit/b28b78c062f0bf3c79793a25aab8c9b6c12bce6e)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4431)\n",
        "disclosureTime": "2016-06-21T04:49:27Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.29"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30775",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2016-4431"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:21.627364Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-06-21T04:49:27Z",
        "references": [
          {
            "title": "Apache Struts Security Bulletin",
            "url": "https://struts.apache.org/docs/s2-040.html"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/b28b78c062f0bf3c79793a25aab8c9b6c12bce6e"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4431"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Access Restriction Bypass",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T17:49:39.850477Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.3.20,2.3.29)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.29"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.390000Z",
        "credit": [
          "Takeshi Terada"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Access Restriction Bypass. It allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.29 or higher.\n## References\n- [GitHub Commit](https://github.com/apache/struts/commit/b28b78c062f0bf3c79793a25aab8c9b6c12bce6e)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433)\n",
        "disclosureTime": "2016-06-21T01:33:07Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.29"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30776",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2016-4433"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:22.123582Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-06-21T01:33:07Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/b28b78c062f0bf3c79793a25aab8c9b6c12bce6e"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Access Restriction Bypass",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T17:50:02.475956Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.3.20, 2.3.29)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.29"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.415000Z",
        "credit": [
          "Takeshi Terada"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nAffected versions of the package are vulnerable to Directory Traversal.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\r\n\r\nDirectory Traversal vulnerabilities can be generally divided into two types:\r\n\r\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\r\n\r\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\r\n\r\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\r\n\r\n```\r\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\r\n```\r\n**Note** `%2e` is the URL encoded version of `.` (dot).\r\n\r\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \r\n\r\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\r\n\r\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\r\n\r\n```\r\n2018-04-15 22:04:29 .....           19           19  good.txt\r\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\r\n```\n\n\n## References\n- [Apache Security Advisory](http://struts.apache.org/docs/s2-042.html)\n",
        "disclosureTime": "2016-10-19T01:09:09.263000Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.31"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30778",
        "identifiers": {
          "CWE": [
            "CWE-94"
          ],
          "CVE": [
            "CVE-2016-6795"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:19.439675Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-10-19T01:09:09.263000Z",
        "references": [
          {
            "title": "Apache Security Advisory",
            "url": "http://struts.apache.org/docs/s2-042.html"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/030ffa33543f8953306ed0c0dc815c7fb74d7129"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/8e67b9144aa643769b261e2492cb561e04d016ab"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Directory Traversal",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-01-03T17:51:29.730824Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.3.20,2.3.31)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.31"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:R",
        "alternativeIds": [],
        "creationTime": "2017-09-06T17:28:23.339000Z",
        "credit": [
          "LGTM Security Team"
        ],
        "cvssScore": 8.1,
        "description": "## Overview\r\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\r\n\r\nThe REST Plugin in affected versions use a `XStreamHandler` with an instance of XStream for deserialization without any type filtering. By design, there are few limits to the type of objects XStream can handle. This flexibility comes at a price. The XML generated or consumed by XStream includes all information required to build Java objects of almost any type. The provided XML data is used by XStream to unmarshal Java objects. An attacker could use this flaw to execute arbitrary code or conduct further attacks.\r\n\r\n[A working exploit](https://github.com/rapid7/metasploit-framework/commit/5ea83fee5ee8c23ad95608b7e2022db5b48340ef) is publicly available and [is actively](https://www.imperva.com/blog/2017/09/cve-2017-9805-analysis-of-apache-struts-rce-vulnerability-in-rest-plugin/) exploited in the wild.\r\n\r\nYou can read more about this vulnerability [on our blog](https://snyk.io/blog/equifax-breach-vulnerable-open-source-libraries/).\r\n\r\n# Details\r\nSerialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.\r\n\r\n_Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker control the state or the flow of the execution. \r\n\r\nJava deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a [popular library (Apache Commons Collection)](https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.\r\n\r\nAn attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.\r\n\r\n> Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).\r\n- Apache Blog\r\n\r\n\r\n## Remediation\r\nDevelopers are strongly advised to upgrade their _Apache Struts_ components to version `2.3.34`, `2.5.13` or higher.\r\n\r\nIt is possible that some REST actions stop working because of applied default restrictions on available classes. In this case please investigate the new interfaces that were introduced to allow class restrictions per action, those interfaces are:\r\n* org.apache.struts2.rest.handler.AllowedClasses\r\n* org.apache.struts2.rest.handler.AllowedClassNames\r\n* org.apache.struts2.rest.handler.XStreamPermissionProvider\r\n\r\nIf for some reason upgrading is not an option, consider the following workarounds:\r\n1. Disable handling XML pages and requests to such pages\r\n```xml\r\n<constant name=\"struts.action.extension\" value=\"xhtml,,json\" />\r\n```\r\n\r\n2. Override getContentType in XStreamHandler\r\n```java\r\n public class MyXStreamHandler extends XStreamHandler { \r\n   public String getContentType() {\r\n     return \"not-existing-content-type-@;/&%$#@\";\r\n   }\r\n }\r\n```\r\n\r\n3. Register the handler by overriding the one provided by the framework in your struts.xml\r\n```xml\r\n<bean type=\"org.apache.struts2.rest.handler.ContentTypeHandler\" name=\"myXStreamHandmer\" class=\"com.company.MyXStreamHandler\"/>\r\n<constant name=\"struts.rest.handlerOverride.xml\" value=\"myXStreamHandler\"/>\r\n```\r\n\r\n## References\r\n- [LGTM Advisory](https://lgtm.com/blog/apache_struts_CVE-2017-9805_announcement)\r\n- [LGTM Vulnerability Details](https://lgtm.com/blog/apache_struts_CVE-2017-9805)\r\n- [Apache Struts Statement on Equifax Security Breach](https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax)\r\n- [Apache Security Bulletin](https://cwiki.apache.org/confluence/display/WW/S2-052)",
        "disclosureTime": "2017-09-05T17:28:23Z",
        "exploit": "High",
        "functions": [],
        "fixedIn": [
          "2.3.34",
          "2.5.13"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-31495",
        "identifiers": {
          "CWE": [
            "CWE-20",
            "CWE-502"
          ],
          "CVE": [
            "CVE-2017-9805"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-06-15T15:36:05.474852Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2017-09-06T17:28:23Z",
        "references": [
          {
            "title": "Apache Security Bulletin",
            "url": "https://cwiki.apache.org/confluence/display/WW/S2-052"
          },
          {
            "title": "Apache Struts Statement on Equifax Security Breach",
            "url": "https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax"
          },
          {
            "title": "Exploit DB",
            "url": "https://www.exploit-db.com/exploits/42627"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/19494718865f2fb7da5ea363de3822f87fbda26"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/6dd6e5cfb7b5e020abffe7e8091bd63fe97c10a"
          },
          {
            "title": "LGTM Advisory",
            "url": "https://lgtm.com/blog/apache_struts_CVE-2017-9805_announcement"
          },
          {
            "title": "LGTM Vulnerability Details",
            "url": "https://lgtm.com/blog/apache_struts_CVE-2017-9805"
          },
          {
            "title": "CISA - Known Exploited Vulnerabilities",
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Arbitrary Command Execution",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 8.1,
            "severity": "high",
            "modificationTime": "2022-01-03T16:32:20.071957Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,2.3.34)",
            "[2.4,2.5.13)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.34"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "alternativeIds": [],
        "creationTime": "2017-09-12T12:47:32.905000Z",
        "credit": [
          "Yasser Zamani"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) attacks.\nWhen using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack.\n\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\r\n\r\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\r\n\r\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\r\n\r\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\r\n\r\nTwo common types of DoS vulnerabilities:\r\n\r\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\r\n\r\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.33, 2.5.12 or higher.\n\n## References\n- [Struts Security Bulletin](http://struts.apache.org/docs/s2-049.html)\n- [Struts Announcements Mailing List](https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d@%3Cannouncements.struts.apache.org%3E)\n",
        "disclosureTime": "2017-07-13T15:29:00Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.33",
          "2.5.12"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-31500",
        "identifiers": {
          "CWE": [
            "CWE-400"
          ],
          "CVE": [
            "CVE-2017-9787"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:37.394099Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2017-09-12T12:47:32.905000Z",
        "references": [
          {
            "title": "Apache Security Advisory",
            "url": "https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d@%3Cannouncements.struts.apache.org%3E"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/086b63735527d4bb0c1dd0d86a7c0374b825ff2"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/0d6442bab5b44d93c4c2e63c5335f0a331333b9"
          },
          {
            "title": "Struts Security Bulletin",
            "url": "http://struts.apache.org/docs/s2-049.html"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T16:32:06.402783Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.3.7,2.3.33)",
            "[2.5,2.5.12)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.33"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "alternativeIds": [],
        "creationTime": "2017-09-12T12:47:32.905000Z",
        "credit": [
          "Adam Cazzolla",
          "Jonathan Bullock"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This is due to an incomplete fix for [CVE-2017-7672](https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-31499). If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\r\n\r\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\r\n\r\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\r\n\r\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\r\n\r\nTwo common types of DoS vulnerabilities:\r\n\r\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\r\n\r\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.34, 2.5.13 or higher.\n\n## References\n- [Struts Security Bulletin](http://struts.apache.org/docs/s2-050.html)\n",
        "disclosureTime": "2017-08-23T21:00:00Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.34",
          "2.5.13"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-31501",
        "identifiers": {
          "CWE": [
            "CWE-400"
          ],
          "CVE": [
            "CVE-2017-9804"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:35.468699Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2017-09-12T12:47:32.905000Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/3fddfb6eb562d597c935084e9e81d43ed6bcd02"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/418a20c0594f23764fe29ced400c1219239899a"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/744c1f409d983641af3e8e3b573c2f2d2c2c6d9"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/8a04e80f01350c90f053d71366d5e0c2186fded"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/9d47af6ffa355977b5acc713e6d1f25fac260a2"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/a05259ed69a5a48379aa91650e4cd1cb4bd6e5a"
          },
          {
            "title": "Struts Security Bulletin",
            "url": "http://struts.apache.org/docs/s2-050.html"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T16:31:59.222975Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.3.7,2.3.34)",
            "[2.5,2.5.13)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.34"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "alternativeIds": [],
        "creationTime": "2017-09-12T12:47:32.905000Z",
        "credit": [
          "Huijun Chen",
          "Xiaolong Zhu"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Denial of Service (ReDoS) attacks. The REST Plugin is using outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\r\n\r\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\r\n\r\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\r\n\r\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\r\n\r\nTwo common types of DoS vulnerabilities:\r\n\r\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\r\n\r\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.34, 2.5.13 or higher.\n\n## References\n- [Struts Security Bulletin](http://struts.apache.org/docs/s2-051.html)\n",
        "disclosureTime": "2017-08-23T21:00:00Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.34",
          "2.5.13"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-31502",
        "identifiers": {
          "CWE": [
            "CWE-400"
          ],
          "CVE": [
            "CVE-2017-9793"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:35.329255Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2017-09-12T12:47:32.905000Z",
        "references": [
          {
            "title": "Struts Security Bulletin",
            "url": "http://struts.apache.org/docs/s2-051.html"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T16:32:17.978509Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.3.7,2.3.34)",
            "[2.5,2.5.13)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.34"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F",
        "alternativeIds": [],
        "creationTime": "2017-09-06T17:28:23.339000Z",
        "credit": [
          "Lupin",
          "David Greene",
          "Roland McIntosh"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\r\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\r\n\r\nAffected versions of this package are vulnerable to Arbitrary Code Execution. An unauthenticated attack may be able to exploit this \r\nWhen using expression literals or forcing expression in Freemarker tags (see example below) and using request values can lead to RCE attack.\r\n\r\n```xml\r\n<@s.hidden name=\"redirectUri\" value=redirectUri />\r\n<@s.hidden name=\"redirectUri\" value=\"${redirectUri}\" />\r\n<@s.hidden name=\"${redirectUri}\"/>\r\n```\r\n\r\nIn both cases a writable property is used in the value attribute and in both cases this is threatened as an expression by Freemarker. Please be aware that using Struts expression evaluation style is safe:\r\n\r\n```\r\n<@s.hidden name=\"redirectUri\" value=\"%{redirectUri}\" />\r\n<@s.hidden name=\"%{redirectUri}\"/>\r\n```\r\n\r\n## Remediation\r\nDevelopers are strongly advised to upgrade their _Apache Struts_ components to version `2.3.34`, `2.5.12` or higher.\r\n\r\n## References\r\n- [Apache Security Bulletin](https://cwiki.apache.org/confluence/display/WW/S2-053)",
        "disclosureTime": "2017-09-05T17:28:23Z",
        "exploit": "Functional",
        "functions": [],
        "fixedIn": [
          "2.3.34",
          "2.5.12"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-31503",
        "identifiers": {
          "CWE": [
            "CWE-20",
            "CWE-502"
          ],
          "CVE": [
            "CVE-2017-12611"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-06T12:35:09.318906Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2017-09-06T17:28:23Z",
        "references": [
          {
            "title": "Apache Security Bulletin",
            "url": "https://cwiki.apache.org/confluence/display/WW/S2-053"
          },
          {
            "title": "Exploit",
            "url": "https://github.com/brianwrf/S2-053-CVE-2017-12611"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/2306f5f7fad7f0157f216f34331238feb0539fa"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/637ad1c3707266c33daabb18d7754e795e6681f"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Arbitrary Code Execution",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-01-03T16:16:18.143147Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,2.3.34)",
            "[2.4,2.5.12)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.34"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C",
        "alternativeIds": [],
        "creationTime": "2018-08-22T00:00:00Z",
        "credit": [
          "Man Yue Mo"
        ],
        "cvssScore": 8.1,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Remote Code Execution. When the namespace value is not set for a result defined in underlying xml configurations, and in same time, its upper action(s) configurations have no or wildcard namespace, an attacker may be able to conduct a remote code execution attack. They could also use the opportunity when using a url tag which does not have a value and action set and in same time, its upper action(s) configurations have no or wildcard namespace.\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.35, 2.5.17 or higher.\n## References\n- [Exploit DB](https://exploit-db.com/exploits/45367)\n- [Exploit DB](https://www.exploit-db.com/exploits/45367)\n- [GitHub Commit](https://github.com/apache/struts/commit/b3bad5ea44f3fd9edb2cb491192c5900f46d45d3)\n- [Lgtm Blog](https://lgtm.com/blog/apache_struts_CVE-2018-11776)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1620019)\n- [Struts2 Security Bulletin](https://cwiki.apache.org/confluence/display/WW/S2-057)\n- [CISA - Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n",
        "disclosureTime": "2018-08-17T00:00:00Z",
        "exploit": "High",
        "functions": [
          {
            "functionId": {
              "filePath": "com/opensymphony/xwork2/ActionChainResult.java",
              "className": "ActionChainResult",
              "functionName": "execute"
            },
            "version": [
              "[2.3.0, 2.3.35)",
              "[2.5.0, 2.5.17)"
            ]
          }
        ],
        "fixedIn": [
          "2.3.35",
          "2.5.17"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-32477",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2018-11776"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-07-02T15:25:00.849625Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2018-08-22T11:53:44Z",
        "references": [
          {
            "title": "Exploit DB",
            "url": "https://exploit-db.com/exploits/45367"
          },
          {
            "title": "Exploit DB",
            "url": "https://www.exploit-db.com/exploits/45367"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/b3bad5ea44f3fd9edb2cb491192c5900f46d45d3"
          },
          {
            "title": "Lgtm Blog",
            "url": "https://lgtm.com/blog/apache_struts_CVE-2018-11776"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1620019"
          },
          {
            "title": "Struts2 Security Bulletin",
            "url": "https://cwiki.apache.org/confluence/display/WW/S2-057"
          },
          {
            "title": "CISA - Known Exploited Vulnerabilities",
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Remote Code Execution",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 8.1,
            "severity": "high",
            "modificationTime": "2022-01-03T16:15:36.550004Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "com.opensymphony.xwork2.ActionChainResult",
              "functionName": "execute"
            },
            "version": [
              "[2.3.0, 2.3.35)",
              "[2.5.0, 2.5.17)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[2.3.0, 2.3.35)",
            "[2.5.0, 2.5.17)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.35"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2019-07-16T11:14:42.540198Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Improper Action Name Cleanup. It allowed attackers to have unspecified impact via vectors related to improper action name clean up.\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.29, 2.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/apache/struts/commit/237432512df0e27013f7c7b9ab59fdce44ca34a5)\n- [GitHub Commit](https://github.com/apache/struts/commit/27ca165ddbf81c84bafbd083b99a18d89cc49ca7)\n",
        "disclosureTime": "2016-09-19T05:25:51Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.29",
          "2.5.1"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-451610",
        "identifiers": {
          "CWE": [
            "CWE-459"
          ],
          "CVE": [
            "CVE-2016-4436"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:40:50.534712Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-09-19T05:25:51Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/237432512df0e27013f7c7b9ab59fdce44ca34a5"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/27ca165ddbf81c84bafbd083b99a18d89cc49ca7"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Improper Action Name Cleanup",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-01-03T17:49:58.328217Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.0.0, 2.3.29)",
            "[2.5, 2.5.1)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.29"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
        "alternativeIds": [],
        "creationTime": "2019-08-23T13:23:19.812650Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). The URLValidator class allows remote attackers to cause a denial of service via a null value for a URL field.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.29, 2.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/apache/struts/commit/a0fdca138feec2c2e94eb75ca1f8b76678b4d152)\n- [GitHub Commit](https://github.com/apache/struts/commit/eccc31ebce5430f9e91b9684c63eaaf885e603f9)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465)\n",
        "disclosureTime": "2016-06-20T07:45:43Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.29",
          "2.5.1"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-460223",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2016-4465"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:21.666403Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-06-20T07:45:43Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/a0fdca138feec2c2e94eb75ca1f8b76678b4d152"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/eccc31ebce5430f9e91b9684c63eaaf885e603f9"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Regular Expression Denial of Service (ReDoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-01-03T17:49:40.365051Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.3.20, 2.3.29)",
            "[2.5,2.5.1)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.29"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
        "alternativeIds": [],
        "creationTime": "2020-08-21T14:31:35.397242Z",
        "credit": [
          "Matthias Kaiser"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Remote Code Execution (RCE). Forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.5.22 or higher.\n## References\n- [Exploit](https://www.exploit-db.com/exploits/49068)\n- [Proof Of Concept](https://github.com/PrinceFPF/CVE-2019-0230)\n- [Security Bulletin](https://cwiki.apache.org/confluence/display/WW/S2-059)\n",
        "disclosureTime": "2020-08-11T14:14:01Z",
        "exploit": "Functional",
        "functions": [],
        "fixedIn": [
          "2.5.22"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-608097",
        "identifiers": {
          "CWE": [
            "CWE-94"
          ],
          "CVE": [
            "CVE-2019-0230"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-06-14T04:10:04.998948Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-08-21T14:06:54Z",
        "references": [
          {
            "title": "Exploit",
            "url": "https://www.exploit-db.com/exploits/49068"
          },
          {
            "title": "Proof Of Concept",
            "url": "https://github.com/PrinceFPF/CVE-2019-0230"
          },
          {
            "title": "Security Bulletin",
            "url": "https://cwiki.apache.org/confluence/display/WW/S2-059"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Remote Code Execution (RCE)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-04-19T01:11:22.235559Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.0.0, 2.5.22)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.5.22"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
        "alternativeIds": [],
        "creationTime": "2020-08-21T14:39:32.053413Z",
        "credit": [
          "Takeshi Terada of Mitsui Bussan Secure Directions",
          "Inc"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). When a file upload is performed to an `Action` that exposes the file with a getter, an attacker may manipulate the request such that the working copy of the uploaded file is set to read-only. As a result, subsequent actions on the file will fail with an error. It might also be possible to set the Servlet container's temp directory to read-only, such that subsequent upload actions will fail.\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.5.22 or higher.\n## References\n- [Security Bulletin](https://cwiki.apache.org/confluence/display/WW/S2-060)\n",
        "disclosureTime": "2020-08-11T14:36:56Z",
        "exploit": "Proof of Concept",
        "functions": [],
        "fixedIn": [
          "2.5.22"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-608098",
        "identifiers": {
          "CWE": [
            "CWE-400"
          ],
          "CVE": [
            "CVE-2019-0233"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-09-15T15:25:13.795068Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-08-21T14:36:29Z",
        "references": [
          {
            "title": "Security Bulletin",
            "url": "https://cwiki.apache.org/confluence/display/WW/S2-060"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-04-19T01:11:21.367759Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.0.0, 2.5.22)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.5.22"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2020-09-04T15:56:51.451242Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 8.8,
        "description": "## Overview\n[org.apache.struts:struts2-core](https://github.com/apache/struts) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Unrestricted Upload of File with Dangerous Type. A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.5 or higher.\n## References\n- [Bug Report](https://issues.apache.org/jira/browse/WW-5055)\n- [GitHub Commit](https://github.com/apache/struts/commit/4271682d2b944e9022e4e4c499df43e0ce7e58fd)\n",
        "disclosureTime": "2019-12-05T15:43:54Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.5"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTS-609765",
        "identifiers": {
          "CWE": [
            "CWE-434"
          ],
          "CVE": [
            "CVE-2012-1592"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-09-10T21:57:48.283494Z",
        "moduleName": "org.apache.struts:struts2-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts:struts2-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-09-04T15:56:53Z",
        "references": [
          {
            "title": "Bug Report",
            "url": "https://issues.apache.org/jira/browse/WW-5055"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/4271682d2b944e9022e4e4c499df43e0ce7e58fd"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Unrestricted Upload of File with Dangerous Type",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 8.8,
            "severity": "high",
            "modificationTime": "2022-01-03T17:24:36.261112Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,2.5)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts",
          "artifactId": "struts2-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.5"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts:struts2-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.673000Z",
        "credit": [
          "rskvp93"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nAffected versions of the package are vulnerable to Parameter Alteration. ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings\n\n\n## References\n- [Apache Security Advisory](https://struts.apache.org/docs/s2-026.html)\n",
        "disclosureTime": "2015-09-28T16:59:30Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.24.1"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798",
        "identifiers": {
          "CWE": [
            "CWE-235"
          ],
          "CVE": [
            "CVE-2015-5209"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:33.555147Z",
        "moduleName": "org.apache.struts.xwork:xwork-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts.xwork:xwork-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2015-09-28T16:59:30Z",
        "references": [
          {
            "title": "Apache Security Advisory",
            "url": "https://struts.apache.org/docs/s2-026.html"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Parameter Alteration",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T17:40:48.340105Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2,2.3.24.1)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts.xwork",
          "artifactId": "xwork-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "org.apache.struts.xwork:xwork-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.24.1",
          "org.apache.struts.xwork:xwork-core@2.3.24.1"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts.xwork:xwork-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.686000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 8.8,
        "description": "## Overview\n[org.apache.struts.xwork:xwork-core](https://mvnrepository.com/artifact/org.apache.struts.xwork/xwork-core) is a generic command pattern framework. It forms the core of Struts 2.\n\nAffected versions of this package are vulnerable to Improper Input Validation via a `%{}` sequence in a tag attribute, aka forced double OGNL evaluation.\n## Remediation\nUpgrade `org.apache.struts.xwork:xwork-core` to version 2.3.28 or higher.\n## References\n- [GitHub Commit](https://github.com/apache/struts/commit/15857a69e7baf3675804495a5954cd0756ac8364)\n",
        "disclosureTime": "2016-03-16T05:58:06Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.28"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2016-0785"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:21.599903Z",
        "moduleName": "org.apache.struts.xwork:xwork-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts.xwork:xwork-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-03-16T05:58:06Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/15857a69e7baf3675804495a5954cd0756ac8364"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Improper Input Validation",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 8.8,
            "severity": "high",
            "modificationTime": "2022-01-03T17:41:17.795568Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2,2.3.28)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts.xwork",
          "artifactId": "xwork-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "org.apache.struts.xwork:xwork-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.28",
          "org.apache.struts.xwork:xwork-core@2.3.28"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts.xwork:xwork-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.701000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 6.1,
        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nApache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2162)",
        "disclosureTime": "2016-03-16T07:51:26.242000Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.25"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800",
        "identifiers": {
          "CWE": [
            "CWE-79"
          ],
          "CVE": [
            "CVE-2016-2162"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:15.631664Z",
        "moduleName": "org.apache.struts.xwork:xwork-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts.xwork:xwork-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-03-16T07:51:26.242000Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/fc2179cf1ac9fbfb61e3430fa88b641d87253327"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2162"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Cross-site Scripting (XSS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "cvssV3BaseScore": 6.1,
            "severity": "medium",
            "modificationTime": "2022-01-03T17:45:57.433360Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2,2.3.25)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts.xwork",
          "artifactId": "xwork-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "org.apache.struts.xwork:xwork-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.28",
          "org.apache.struts.xwork:xwork-core@2.3.28"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts.xwork:xwork-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.713000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nApache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093)",
        "disclosureTime": "2016-06-02T02:16:48.918000Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [],
        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2016-3093"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:21.048060Z",
        "moduleName": "org.apache.struts.xwork:xwork-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts.xwork:xwork-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-06-02T02:16:48.918000Z",
        "references": [
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Improper Input Validation",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-01-03T17:48:03.253270Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2,2.3.24.1]"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts.xwork",
          "artifactId": "xwork-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "org.apache.struts.xwork:xwork-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.24.3",
          "org.apache.struts.xwork:xwork-core@2.3.24.3"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts.xwork:xwork-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.724000Z",
        "credit": [
          "Takeshi Terada"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[org.apache.struts.xwork:xwork-core](https://mvnrepository.com/artifact/org.apache.struts.xwork/xwork-core) is a generic command pattern framework. It forms the core of Struts 2.\n\nAffected versions of this package are vulnerable to Access Restriction Bypass. It allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.\n## Remediation\n## References\n- [GitHub Commit](https://github.com/apache/struts/commit/b28b78c062f0bf3c79793a25aab8c9b6c12bce6e)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433)\n",
        "disclosureTime": "2016-06-21T01:33:07Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [],
        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2016-4433"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:22.123582Z",
        "moduleName": "org.apache.struts.xwork:xwork-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts.xwork:xwork-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-06-21T01:33:07Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/b28b78c062f0bf3c79793a25aab8c9b6c12bce6e"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Access Restriction Bypass",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "cvssV3BaseScore": 7.5,
            "severity": "high",
            "modificationTime": "2022-01-03T17:50:02.475956Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.3.20,2.3.28.1]"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts.xwork",
          "artifactId": "xwork-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "org.apache.struts.xwork:xwork-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.29",
          "org.apache.struts.xwork:xwork-core@2.3.29"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts.xwork:xwork-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.738000Z",
        "credit": [
          "Alvaro Munoz"
        ],
        "cvssScore": 8.8,
        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nAffected versions of the package are vulnerable to Remote code Execution. The Apache Struts frameworks when forced, performs double evaluation of attributes' values assigned to certain tags so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered.\n\n## References\n- [Apache Security Advisory](https://struts.apache.org/docs/s2-036.html)\n",
        "disclosureTime": "2016-11-14T07:48:03.440000Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [],
        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803",
        "identifiers": {
          "CWE": [
            "CWE-264"
          ],
          "CVE": [
            "CVE-2016-4461"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:24.441818Z",
        "moduleName": "org.apache.struts.xwork:xwork-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts.xwork:xwork-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-11-14T07:48:03.440000Z",
        "references": [
          {
            "title": "Apache Security Advisory",
            "url": "https://struts.apache.org/docs/s2-036.html"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Arbitrary Code Execution",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 8.8,
            "severity": "high",
            "modificationTime": "2022-01-03T17:49:30.734760Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.2.1,2.3.28.1]"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts.xwork",
          "artifactId": "xwork-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "org.apache.struts.xwork:xwork-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.29",
          "org.apache.struts.xwork:xwork-core@2.3.29"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts.xwork:xwork-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:23.751000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.apache.struts.xwork:xwork-core](https://mvnrepository.com/artifact/org.apache.struts.xwork/xwork-core) is a generic command pattern framework. It forms the core of Struts 2.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). The URLValidator class allows remote attackers to cause a denial of service via a null value for a URL field.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `org.apache.struts.xwork:xwork-core` to version 2.3.29 or higher.\n## References\n- [GitHub Commit](https://github.com/apache/struts/commit/a0fdca138feec2c2e94eb75ca1f8b76678b4d152)\n- [GitHub Commit](https://github.com/apache/struts/commit/eccc31ebce5430f9e91b9684c63eaaf885e603f9)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465)\n",
        "disclosureTime": "2016-06-20T07:45:43Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.29"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2016-4465"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:21.666403Z",
        "moduleName": "org.apache.struts.xwork:xwork-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts.xwork:xwork-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-06-20T07:45:43Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/a0fdca138feec2c2e94eb75ca1f8b76678b4d152"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/eccc31ebce5430f9e91b9684c63eaaf885e603f9"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Regular Expression Denial of Service (ReDoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-01-03T17:49:40.365051Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.3.20, 2.3.29)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts.xwork",
          "artifactId": "xwork-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "org.apache.struts.xwork:xwork-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.29",
          "org.apache.struts.xwork:xwork-core@2.3.29"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts.xwork:xwork-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C",
        "alternativeIds": [],
        "creationTime": "2019-07-16T11:38:49.236917Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 8.1,
        "description": "## Overview\n[org.apache.struts.xwork:xwork-core](https://mvnrepository.com/artifact/org.apache.struts.xwork/xwork-core) is a generic command pattern framework. It forms the core of Struts 2.\n\nAffected versions of this package are vulnerable to Command Injection. When Dynamic Method Invocation was enabled, a remote attackers could execute arbitrary code via the prefix method, related to chained expressions.\n## Remediation\nUpgrade `org.apache.struts.xwork:xwork-core` to version 2.3.20.2, 2.3.24.2, 2.3.28.1 or higher.\n## References\n- [Exploit DB](https://exploit-db.com/exploits/39756)\n- [GitHub Commit](https://github.com/apache/struts/commit/f238cf4f1091be19fbcfd086b042c86a1bcaa7fc)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3081)\n- [Exploit DB](https://www.exploit-db.com/exploits/39756)\n",
        "disclosureTime": "2016-04-22T04:32:51Z",
        "exploit": "High",
        "functions": [],
        "fixedIn": [
          "2.3.20.2",
          "2.3.24.2",
          "2.3.28.1"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-451611",
        "identifiers": {
          "CWE": [
            "CWE-77"
          ],
          "CVE": [
            "CVE-2016-3081"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-06-15T12:10:56.353788Z",
        "moduleName": "org.apache.struts.xwork:xwork-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts.xwork:xwork-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-04-22T04:32:51Z",
        "references": [
          {
            "title": "Exploit DB",
            "url": "https://exploit-db.com/exploits/39756"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/f238cf4f1091be19fbcfd086b042c86a1bcaa7fc"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3081"
          },
          {
            "title": "Exploit DB",
            "url": "https://www.exploit-db.com/exploits/39756"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Command Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 8.1,
            "severity": "high",
            "modificationTime": "2022-01-03T17:48:29.381509Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.0.0, 2.3.20.2)",
            "[2.3.24, 2.3.24.2)",
            "[2.3.28, 2.3.28.1)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts.xwork",
          "artifactId": "xwork-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "org.apache.struts.xwork:xwork-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.20.3",
          "org.apache.struts.xwork:xwork-core@2.3.20.3"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts.xwork:xwork-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
        "alternativeIds": [],
        "creationTime": "2019-10-27T13:46:24.359760Z",
        "credit": [
          "Jasper Rosenberg"
        ],
        "cvssScore": 7.3,
        "description": "## Overview\n[org.apache.struts.xwork:xwork-core](https://mvnrepository.com/artifact/org.apache.struts.xwork/xwork-core) is a generic command pattern framework. It forms the core of Struts 2.\n\nAffected versions of this package are vulnerable to Insecure Defaults. The default exclude patterns (excludeParams) allow remote attackers to \"compromise internal state of an application\" via unspecified vectors.\n## Remediation\nUpgrade `org.apache.struts.xwork:xwork-core` to version 2.3.20.1 or higher.\n## References\n- [GitHub Commit](https://github.com/apache/struts/commit/5ebc0643b55d728a6713a82559a594d875452cd8)\n- [GitHub Commit](https://github.com/apache/struts/commit/d832747d647df343ed07a58b1b5e540a05a4d51b)\n- [Jira Issue](https://issues.apache.org/jira/browse/WW-4486)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1831)\n- [Struts Security Advisory](https://struts.apache.org/docs/s2-024.html)\n- [Vulnerability Summary](http://struts.apache.org/docs/s2-024.html)\n",
        "disclosureTime": "2015-05-11T16:51:55Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "2.3.20.1"
        ],
        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-474418",
        "identifiers": {
          "CWE": [
            "CWE-453"
          ],
          "CVE": [
            "CVE-2015-1831"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:29.098176Z",
        "moduleName": "org.apache.struts.xwork:xwork-core",
        "packageManager": "maven",
        "packageName": "org.apache.struts.xwork:xwork-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2015-05-11T16:51:55Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/5ebc0643b55d728a6713a82559a594d875452cd8"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/apache/struts/commit/d832747d647df343ed07a58b1b5e540a05a4d51b"
          },
          {
            "title": "Jira Issue",
            "url": "https://issues.apache.org/jira/browse/WW-4486"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1831"
          },
          {
            "title": "Struts Security Advisory",
            "url": "https://struts.apache.org/docs/s2-024.html"
          },
          {
            "title": "Vulnerability Summary",
            "url": "http://struts.apache.org/docs/s2-024.html"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Insecure Defaults",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": null,
            "cvssV3BaseScore": null,
            "severity": "high",
            "modificationTime": "2022-01-03T17:33:33.258583Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[2.3.20,2.3.20.1)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.apache.struts.xwork",
          "artifactId": "xwork-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "org.apache.struts.xwork:xwork-core@2.3.20"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.3.20.1",
          "org.apache.struts.xwork:xwork-core@2.3.20.1"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.apache.struts.xwork:xwork-core",
        "version": "2.3.20"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
        "alternativeIds": [],
        "creationTime": "2021-02-19T11:41:17.941362Z",
        "credit": [
          "Ackcent"
        ],
        "cvssScore": 7.5,
        "description": "## Overview\n[org.freemarker:freemarker](https://github.com/apache/freemarker) is a \"template engine\"; a generic tool to generate text output (anything from HTML to auto generated source code) based on templates.\n\nAffected versions of this package are vulnerable to Server-side Template Injection (SSTI). By allowing user input into `java.security.ProtectionDomain.getClassLoader`, templates will get access to the java classloader. This can be further leveraged for file system access and code execution. A low-privileged user is sufficient for exploitation of this vulnerability.\n## Remediation\nUpgrade `org.freemarker:freemarker` to version 2.3.30 or higher.\n## References\n- [GitHub PR](https://github.com/apache/freemarker/pull/62)\n- [Jira Issue](https://issues.apache.org/jira/browse/FREEMARKER-124)\n- [Research Blogpost](https://ackcent.com/in-depth-freemarker-template-injection/)\n",
        "disclosureTime": "2020-04-09T11:33:30Z",
        "exploit": "Proof of Concept",
        "functions": [],
        "fixedIn": [
          "2.3.30"
        ],
        "id": "SNYK-JAVA-ORGFREEMARKER-1076795",
        "identifiers": {
          "CWE": [
            "CWE-94"
          ],
          "CVE": []
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2021-08-04T13:47:10.521914Z",
        "moduleName": "org.freemarker:freemarker",
        "packageManager": "maven",
        "packageName": "org.freemarker:freemarker",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2021-02-19T15:54:24Z",
        "references": [
          {
            "title": "GitHub PR",
            "url": "https://github.com/apache/freemarker/pull/62"
          },
          {
            "title": "Jira Issue",
            "url": "https://issues.apache.org/jira/browse/FREEMARKER-124"
          },
          {
            "title": "Research Blogpost",
            "url": "https://ackcent.com/in-depth-freemarker-template-injection/"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Server-side Template Injection (SSTI)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,2.3.30)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.freemarker",
          "artifactId": "freemarker"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.apache.struts:struts2-core@2.3.20",
          "org.freemarker:freemarker@2.3.19"
        ],
        "upgradePath": [
          false,
          "org.apache.struts:struts2-core@2.5.25",
          "org.freemarker:freemarker@2.3.30"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.freemarker:freemarker",
        "version": "2.3.19"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:U",
        "alternativeIds": [],
        "creationTime": "2020-11-19T16:51:52.251545Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 8.2,
        "description": "## Overview\n[org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) is a library providing Object/Relational Mapping (ORM) support to applications, libraries, and frameworks.\n\nAffected versions of this package are vulnerable to SQL Injection. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.\n## Remediation\nUpgrade `org.hibernate:hibernate-core` to version 5.4.24.Final or higher.\n## References\n- [GitHub Commit](https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78)\n- [Redhat CVE Details](https://access.redhat.com/security/cve/cve-2020-25638)\n",
        "disclosureTime": "2020-11-19T16:51:45Z",
        "exploit": "Unproven",
        "functions": [
          {
            "functionId": {
              "filePath": "org/hibernate/loader/plan/exec/query/internal/SelectStatementBuilder.java",
              "className": "SelectStatementBuilder",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Delete.java",
              "className": "Delete",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Insert.java",
              "className": "Insert",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/InsertSelect.java",
              "className": "InsertSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/QuerySelect.java",
              "className": "QuerySelect",
              "functionName": "toQueryString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Select.java",
              "className": "Select",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/SimpleSelect.java",
              "className": "SimpleSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "filePath": "org/hibernate/sql/Update.java",
              "className": "Update",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          }
        ],
        "fixedIn": [
          "5.4.24.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-1041788",
        "identifiers": {
          "CWE": [
            "CWE-89"
          ],
          "CVE": [
            "CVE-2020-25638"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-07-18T12:56:04.506674Z",
        "moduleName": "org.hibernate:hibernate-core",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-11-19T16:57:14.572204Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78"
          },
          {
            "title": "Redhat CVE Details",
            "url": "https://access.redhat.com/security/cve/cve-2020-25638"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "SQL Injection",
        "insights": {
          "triageAdvice": "This vulnerability is only applicable on systems using JPA Criteria API"
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "cvssV3BaseScore": 7.4,
            "severity": "high",
            "modificationTime": "2022-07-26T01:11:35.094170Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.hibernate.loader.plan.exec.query.internal.SelectStatementBuilder",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Delete",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Insert",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.InsertSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.QuerySelect",
              "functionName": "toQueryString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Select",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.SimpleSelect",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          },
          {
            "functionId": {
              "className": "org.hibernate.sql.Update",
              "functionName": "toStatementString"
            },
            "version": [
              "[,5.4.24.Final)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,5.4.24.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-core",
        "version": "4.3.7.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2020-07-15T13:53:15.331818Z",
        "credit": [
          "Gail Badner"
        ],
        "cvssScore": 8.1,
        "description": "## Overview\n[org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) is a library providing Object/Relational Mapping (ORM) support to applications, libraries, and frameworks.\n\nAffected versions of this package are vulnerable to SQL Injection. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.\n## Remediation\nUpgrade `org.hibernate:hibernate-core` to version 5.3.18.Final, 5.4.18.Final or higher.\n## References\n- [GitHub Pull Request](https://github.com/hibernate/hibernate-orm/pull/3438)\n- [Jira Ticket](https://hibernate.atlassian.net/browse/HHH-14077)\n",
        "disclosureTime": "2020-06-18T13:46:30Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/hibernate/query/criteria/internal/expression/LiteralExpression.java",
              "className": "LiteralExpression",
              "functionName": "renderProjection"
            },
            "version": [
              "[5.1.18.Final ,5.4.18.Final)"
            ]
          }
        ],
        "fixedIn": [
          "5.3.18.Final",
          "5.4.18.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-584563",
        "identifiers": {
          "CWE": [
            "CWE-89"
          ],
          "CVE": [
            "CVE-2019-14900"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-07-18T12:57:02.888829Z",
        "moduleName": "org.hibernate:hibernate-core",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-07-15T16:40:12Z",
        "references": [
          {
            "title": "GitHub Pull Request",
            "url": "https://github.com/hibernate/hibernate-orm/pull/3438"
          },
          {
            "title": "Jira Ticket",
            "url": "https://hibernate.atlassian.net/browse/HHH-14077"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "SQL Injection",
        "insights": {
          "triageAdvice": "This vulnerability is only applicable on systems using JPA Criteria API"
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "cvssV3BaseScore": 6.5,
            "severity": "medium",
            "modificationTime": "2022-04-30T01:10:36.121203Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.hibernate.query.criteria.internal.expression.LiteralExpression",
              "functionName": "renderProjection"
            },
            "version": [
              "[5.1.18.Final ,5.4.18.Final)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,5.3.18.Final)",
            "[5.4.0.Final, 5.4.18.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-core"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-core",
        "version": "4.3.7.Final"
      },
      {
        "id": "snyk:lic:maven:org.hibernate:hibernate-core:LGPL-2.0",
        "packageName": "org.hibernate:hibernate-core",
        "semver": {
          "vulnerable": [
            "[3.3.0.CR1, 5.3.1.Final)"
          ]
        },
        "creationTime": "2022-09-11T12:51:18.861Z",
        "description": "LGPL-2.0 license",
        "language": "java",
        "license": "LGPL-2.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T12:51:18.861Z",
        "title": "LGPL-2.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-core",
        "version": "4.3.7.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2016-12-25T16:51:53Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.hibernate:hibernate-validator](https://mvnrepository.com/artifact/org.hibernate/hibernate-validator) is a Hibernate Validator Engine Relocation Artifact.\n\nAffected versions of this package are vulnerable to JSM bypass via ReflectionHelper. ReflectionHelper (`org.hibernate.validator.util.ReflectionHelper`) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.\n## Remediation\nUpgrade `org.hibernate:hibernate-validator` to version 4.3.2.Final, 5.1.2.Final or higher.\n## References\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/2c95d4ea0ef20977be249e31a4a4f4f4f71c945d)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/67fdff14831c035c25e098fe14bd86523d17f726)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/7e7131939a4361a7cad3e77ab89a8462132c561c)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/c489416f699a46859c134796b3ccfea41ef3ce52)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/c9525ca544b1281e2b7c7347e86e87c86dc1dc6e)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/e8c42b689df8c6752d635d02c6518da3fece3870)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/f97c2021a03c825abdeca1692f5be51e77e76a8f)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/fd4eaed7fb930db6a5e4c03742b4b3adcfecc90e)\n- [Jira Issue](https://hibernate.atlassian.net/browse/HV-912)\n- [Redhat Bugzilla](https://bugzilla.redhat.com/CVE-2014-3558)\n",
        "disclosureTime": "2014-07-17T16:51:53Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "4.3.2.Final",
          "5.1.2.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-30098",
        "identifiers": {
          "CWE": [
            "CWE-592"
          ],
          "CVE": [
            "CVE-2014-3558"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:02.614281Z",
        "moduleName": "org.hibernate:hibernate-validator",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-validator",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2014-07-17T16:51:53Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/2c95d4ea0ef20977be249e31a4a4f4f4f71c945d"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/67fdff14831c035c25e098fe14bd86523d17f726"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/7e7131939a4361a7cad3e77ab89a8462132c561c"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/c489416f699a46859c134796b3ccfea41ef3ce52"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/c9525ca544b1281e2b7c7347e86e87c86dc1dc6e"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/e8c42b689df8c6752d635d02c6518da3fece3870"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/f97c2021a03c825abdeca1692f5be51e77e76a8f"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/fd4eaed7fb930db6a5e4c03742b4b3adcfecc90e"
          },
          {
            "title": "Jira Issue",
            "url": "https://hibernate.atlassian.net/browse/HV-912"
          },
          {
            "title": "Redhat Bugzilla",
            "url": "https://bugzilla.redhat.com/CVE-2014-3558"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "JSM bypass via ReflectionHelper",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": null,
            "cvssV3BaseScore": null,
            "severity": "medium",
            "modificationTime": "2022-01-03T17:36:59.992374Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[4.1.0.Beta1, 4.3.2.Final)",
            "[5.0.0.Final,5.1.2.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-validator"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "org.hibernate:hibernate-validator@4.3.1.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-validator",
        "version": "4.3.1.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2020-05-05T12:05:58.541980Z",
        "credit": [
          "Alvaro Muñoz"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.hibernate:hibernate-validator](https://mvnrepository.com/artifact/org.hibernate/hibernate-validator) is a Hibernate Validator Engine Relocation Artifact.\n\nAffected versions of this package are vulnerable to Improper Input Validation. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.\n## Remediation\nUpgrade `org.hibernate:hibernate-validator` to version 6.0.19.Final, 6.1.3.Final or higher.\n## References\n- [GitHub PR](https://github.com/hibernate/hibernate-validator/pull/1071)\n- [Jira Issue](https://hibernate.atlassian.net/browse/HV-1758)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1805501)\n",
        "disclosureTime": "2020-05-05T00:00:00Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/hibernate/validator/internal/engine/ValidatorImpl.java",
              "className": "ValidatorImpl",
              "functionName": "validate"
            },
            "version": [
              "[,6.0.19.Final)",
              "[6.1.0,6.1.3.Final)"
            ]
          }
        ],
        "fixedIn": [
          "6.0.19.Final",
          "6.1.3.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-568162",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "GHSA": [
            "GHSA-rmrm-75hp-phr2"
          ],
          "CVE": [
            "CVE-2020-10693"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2021-07-06T14:08:58.015029Z",
        "moduleName": "org.hibernate:hibernate-validator",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-validator",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-05-05T16:32:46Z",
        "references": [
          {
            "title": "GitHub PR",
            "url": "https://github.com/hibernate/hibernate-validator/pull/1071"
          },
          {
            "title": "Jira Issue",
            "url": "https://hibernate.atlassian.net/browse/HV-1758"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805501"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Improper Input Validation",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-05-11T01:11:03.963914Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.hibernate.validator.internal.engine.ValidatorImpl",
              "functionName": "validate"
            },
            "version": [
              "[,6.0.19.Final)",
              "[6.1.0,6.1.3.Final)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,6.0.19.Final)",
            "[6.1.0,6.1.3.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-validator"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "org.hibernate:hibernate-validator@4.3.1.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-validator",
        "version": "4.3.1.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:R",
        "alternativeIds": [],
        "creationTime": "2020-05-14T16:07:06.897969Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 6.5,
        "description": "## Overview\n[org.hibernate:hibernate-validator](https://mvnrepository.com/artifact/org.hibernate/hibernate-validator) is a Hibernate Validator Engine Relocation Artifact.\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS). The `SafeHtml` validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.\n## Details\n\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\n\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\n\nInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\n\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\n \nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \n\n### Types of attacks\nThere are a few methods by which XSS can be manipulated:\n\n|Type|Origin|Description|\n|--|--|--|\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\n\n### Affected environments\nThe following environments are susceptible to an XSS attack:\n\n* Web servers\n* Application servers\n* Web application environments\n\n### How to prevent\nThis section describes the top best practices designed to specifically protect your code: \n\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \n* Give users the option to disable client-side scripts.\n* Redirect invalid requests.\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n## Remediation\nUpgrade `org.hibernate:hibernate-validator` to version 6.0.18.Final, 6.1.0.Final or higher.\n## References\n- [Apache Security Advisory](https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf@%3Cnotifications.accumulo.apache.org%3E)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee)\n- [Hibernator Security Release Blog](https://in.relation.to/2019/11/20/hibernate-validator-610-6018-released/)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219)\n",
        "disclosureTime": "2018-10-18T14:55:21Z",
        "exploit": "Unproven",
        "functions": [
          {
            "functionId": {
              "filePath": "org/hibernate/validator/internal/constraintvalidators/hv/SafeHtmlValidator.java",
              "className": "SafeHtmlValidator",
              "functionName": "getFragmentAsDocument"
            },
            "version": [
              "[,6.0.18.Final)",
              "[6.1.0.Alpha1,6.1.0.Final)"
            ]
          }
        ],
        "fixedIn": [
          "6.0.18.Final",
          "6.1.0.Final"
        ],
        "id": "SNYK-JAVA-ORGHIBERNATE-569100",
        "identifiers": {
          "CWE": [
            "CWE-79"
          ],
          "CVE": [
            "CVE-2019-10219"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:02.408899Z",
        "moduleName": "org.hibernate:hibernate-validator",
        "packageManager": "maven",
        "packageName": "org.hibernate:hibernate-validator",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-01-09T14:55:12Z",
        "references": [
          {
            "title": "Apache Security Advisory",
            "url": "https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf@%3Cnotifications.accumulo.apache.org%3E"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee"
          },
          {
            "title": "Hibernator Security Release Blog",
            "url": "https://in.relation.to/2019/11/20/hibernate-validator-610-6018-released/"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Cross-site Scripting (XSS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "cvssV3BaseScore": 6.1,
            "severity": "medium",
            "modificationTime": "2022-05-24T01:11:23.425351Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator",
              "functionName": "getFragmentAsDocument"
            },
            "version": [
              "[,6.0.18.Final)",
              "[6.1.0.Alpha1,6.1.0.Final)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,6.0.18.Final)",
            "[6.1.0.Alpha1,6.1.0.Final)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.hibernate",
          "artifactId": "hibernate-validator"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "org.hibernate:hibernate-validator@4.3.1.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-validator",
        "version": "4.3.1.Final"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2020-09-18T14:36:44.859594Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 8.6,
        "description": "## Overview\n[org.springframework:spring-web](https://github.com/spring-projects/spring-framework) is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.\n\nAffected versions of this package are vulnerable to Improper Input Validation. The protections against Reflected File Download attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a `jsessionid` path parameter.\n## Remediation\nUpgrade `org.springframework:spring-web` to version 4.3.29.RELEASE, 5.0.19.RELEASE, 5.1.18.RELEASE, 5.2.9.RELEASE or higher.\n## References\n- [CVE-2015-5211](https://tanzu.vmware.com/security/cve-2015-5211)\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2020-5421)\n",
        "disclosureTime": "2020-09-18T14:23:55Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/springframework/web/util/WebUtils.java",
              "className": "WebUtils",
              "functionName": "parseMatrixVariables"
            },
            "version": [
              "[3.2.0.RELEASE,4.3.29.RELEASE)",
              "[5.0.0.RELEASE, 5.0.19.RELEASE)",
              "[5.1.0.RELEASE, 5.1.18.RELEASE)",
              "[5.2.0.RELEASE, 5.2.9.RELEASE)"
            ]
          }
        ],
        "fixedIn": [
          "4.3.29.RELEASE",
          "5.0.19.RELEASE",
          "5.1.18.RELEASE",
          "5.2.9.RELEASE"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-1009832",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2020-5421"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-11-01T15:06:12.285684Z",
        "moduleName": "org.springframework:spring-web",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-web",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2020-09-18T16:17:53Z",
        "references": [
          {
            "title": "CVE-2015-5211",
            "url": "https://tanzu.vmware.com/security/cve-2015-5211"
          },
          {
            "title": "Pivotal Security Advisory",
            "url": "https://pivotal.io/security/cve-2020-5421"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Improper Input Validation",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N",
            "cvssV3BaseScore": 6.5,
            "severity": "medium",
            "modificationTime": "2022-06-24T01:10:58.163847Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.springframework.web.util.WebUtils",
              "functionName": "parseMatrixVariables"
            },
            "version": [
              "[3.2.0.RELEASE,4.3.29.RELEASE)",
              "[5.0.0.RELEASE, 5.0.19.RELEASE)",
              "[5.1.0.RELEASE, 5.1.18.RELEASE)",
              "[5.2.0.RELEASE, 5.2.9.RELEASE)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[3.2.0.RELEASE,4.3.29.RELEASE)",
            "[5.0.0.RELEASE, 5.0.19.RELEASE)",
            "[5.1.0.RELEASE, 5.1.18.RELEASE)",
            "[5.2.0.RELEASE, 5.2.9.RELEASE)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-web"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@4.3.29.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-web",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2016-12-25T16:51:52Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 8.8,
        "description": "## Overview\n[org.springframework:spring-web](https://github.com/spring-projects/spring-framework) is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection. This is due to not disabling the resolution of URI references by default in a DTD declaration. This occurs only when processing user provided XML documents.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nUpgrade `org.springframework:spring-web` to version 3.2.9.RELEASE, 4.0.5.RELEASE or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/8e096aeef55287dc829484996c9330cf755891a1)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/c6503ebbf7c9e21ff022c58706dbac5417b2b5eb)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/16390)\n- [Pivotal Security](http://www.gopivotal.com/security/cve-2014-0225)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0225)\n",
        "disclosureTime": "2016-12-25T16:51:52Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/springframework/http/converter/xml/SourceHttpMessageConverter.java",
              "className": "SourceHttpMessageConverter",
              "functionName": "readDOMSource"
            },
            "version": [
              "[3,3.2.8.RELEASE]",
              "[4,4.0.4.RELEASE]"
            ]
          },
          {
            "functionId": {
              "filePath": "org/springframework/http/converter/xml/SourceHttpMessageConverter.java",
              "className": "SourceHttpMessageConverter",
              "functionName": "readSAXSource"
            },
            "version": [
              "[3,3.2.8.RELEASE]",
              "[4,4.0.4.RELEASE]"
            ]
          }
        ],
        "fixedIn": [
          "3.2.9.RELEASE",
          "4.0.5.RELEASE"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-30163",
        "identifiers": {
          "CWE": [
            "CWE-611"
          ],
          "CVE": [
            "CVE-2014-0225"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:40:52.333290Z",
        "moduleName": "org.springframework:spring-web",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-web",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-12-25T16:51:52Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/8e096aeef55287dc829484996c9330cf755891a1"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/c6503ebbf7c9e21ff022c58706dbac5417b2b5eb"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/16390"
          },
          {
            "title": "Pivotal Security",
            "url": "http://www.gopivotal.com/security/cve-2014-0225"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0225"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "XML External Entity (XXE) Injection",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 8.8,
            "severity": "high",
            "modificationTime": "2022-04-12T01:10:35.473726Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.springframework.http.converter.xml.SourceHttpMessageConverter",
              "functionName": "readDOMSource"
            },
            "version": [
              "[3,3.2.8.RELEASE]",
              "[4,4.0.4.RELEASE]"
            ]
          },
          {
            "functionId": {
              "className": "org.springframework.http.converter.xml.SourceHttpMessageConverter",
              "functionName": "readSAXSource"
            },
            "version": [
              "[3,3.2.8.RELEASE]",
              "[4,4.0.4.RELEASE]"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[3.0.0.RELEASE,3.2.9.RELEASE)",
            "[4.0.0.RELEASE,4.0.5.RELEASE)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-web"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@3.2.9.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-web",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
        "alternativeIds": [],
        "creationTime": "2016-12-25T16:51:55Z",
        "credit": [
          "Toshiaki Maki"
        ],
        "cvssScore": 5.5,
        "description": "## Overview\n[org.springframework:spring-web](https://github.com/spring-projects/spring-framework) is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). It does not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `org.springframework:spring-web` to version 3.2.14.RELEASE, 4.1.7.RELEASE or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/5a711c05ec750f069235597173084c2ee796242)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/17727)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3192)\n- [Pivotal Security](http://pivotal.io/security/cve-2015-3192)\n",
        "disclosureTime": "2015-10-16T05:57:41Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "3.2.14.RELEASE",
          "4.1.7.RELEASE"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-30164",
        "identifiers": {
          "CWE": [
            "CWE-119"
          ],
          "CVE": [
            "CVE-2015-3192"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:12.060449Z",
        "moduleName": "org.springframework:spring-web",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-web",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-12-25T16:51:55Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/5a711c05ec750f069235597173084c2ee796242"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/17727"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3192"
          },
          {
            "title": "Pivotal Security",
            "url": "http://pivotal.io/security/cve-2015-3192"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 5.5,
            "severity": "medium",
            "modificationTime": "2022-04-12T01:10:36.047114Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[3.2.0.RELEASE, 3.2.14.RELEASE)",
            "[4.0.0.RELEASE, 4.1.7.RELEASE)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-web"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@3.2.14.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-web",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
        "alternativeIds": [],
        "creationTime": "2016-12-25T16:51:56Z",
        "credit": [
          "Alvaro Muñoz"
        ],
        "cvssScore": 8.6,
        "description": "## Overview\n\n[org.springframework:spring-web](https://github.com/spring-projects/spring-framework) package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.\n\n\nAffected versions of this package are vulnerable to Reflected File Download\nvia a crafted URL with a batch script extension, resulting in the response being downloaded rather than rendered.\n\n## Remediation\n\nUpgrade `org.springframework:spring-web` to version 3.2.15.RELEASE, 4.1.8.RELEASE, 4.2.2.RELEASE or higher.\n\n\n## References\n\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/03f547eb9868f48f44d59b56067d4ac4740672c3)\n\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/2bd1daa75ee0b8ec33608ca6ab065ef3e1815543)\n\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/a95c3d820dbc4c3ae752f1b3ee22ee860b162402)\n\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/18124)\n\n- [Oren Hafif Blog](https://www.trustwave.com/Resources/SpiderLabs-Blog/Reflected-File-Download---A-New-Web-Attack-Vector/)\n\n- [Pivotal Security](http://pivotal.io/security/cve-2015-5211)\n\n- [RedHat CVE Database](https://access.redhat.com/security/cve/cve-2015-5211)\n",
        "disclosureTime": "2015-10-15T16:51:56Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "3.2.15.RELEASE",
          "4.1.8.RELEASE",
          "4.2.2.RELEASE"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-30165",
        "identifiers": {
          "CWE": [
            "CWE-494"
          ],
          "CVE": [
            "CVE-2015-5211"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:40:58.964575Z",
        "moduleName": "org.springframework:spring-web",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-web",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2016-12-25T16:51:56Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/03f547eb9868f48f44d59b56067d4ac4740672c3"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/2bd1daa75ee0b8ec33608ca6ab065ef3e1815543"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/a95c3d820dbc4c3ae752f1b3ee22ee860b162402"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/18124"
          },
          {
            "title": "Oren Hafif Blog",
            "url": "https://www.trustwave.com/Resources/SpiderLabs-Blog/Reflected-File-Download---A-New-Web-Attack-Vector/"
          },
          {
            "title": "Pivotal Security",
            "url": "http://pivotal.io/security/cve-2015-5211"
          },
          {
            "title": "RedHat CVE Database",
            "url": "https://access.redhat.com/security/cve/cve-2015-5211"
          }
        ],
        "severity": "high",
        "socialTrendAlert": false,
        "title": "Reflected File Download",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.6,
            "severity": "critical",
            "modificationTime": "2022-06-05T13:10:38.145566Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[3.2.0.RELEASE, 3.2.15.RELEASE)",
            "[4.0.0.RELEASE, 4.1.8.RELEASE)",
            "[4.2.0.RELEASE, 4.2.2.RELEASE)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-web"
        },
        "severityWithCritical": "high",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@3.2.15.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-web",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:31.538000Z",
        "credit": [
          "Spase Markovski"
        ],
        "cvssScore": 6.3,
        "description": "## Overview\r\n[`org.springframework:spring-web`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-web%22)\r\nAffected versions of this package do not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  \r\n\r\n**NOTE:** this vulnerability exists because of an incomplete fix for [CVE-2013-4152](https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-31330), [CVE-2013-7315](https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-30162), and [CVE-2013-6429](https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-30160).\r\n\r\n## References\r\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0054)",
        "disclosureTime": "2014-04-17T14:55:00Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "3.2.8.RELEASE",
          "4.0.2.RELEASE"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-31331",
        "identifiers": {
          "CWE": [
            "CWE-352"
          ],
          "CVE": [
            "CVE-2014-0054"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2020-12-14T14:41:33.790566Z",
        "moduleName": "org.springframework:spring-web",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-web",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2014-06-06T21:43:43Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/edba32b3093703d5e9ed42b5b8ec23ecc1998398%23diff-1f3f1d5cdab9ac92d1ca5ec7def8f131"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/fb0683c066e74e9667d6cd8c5fa01f674c68c3be%23diff-1f3f1d5cdab9ac92d1ca5ec7def8f131"
          },
          {
            "title": "Jira Issue",
            "url": "https://jira.spring.io/browse/SPR-11376"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0054"
          },
          {
            "title": "Pivotal Security",
            "url": "http://www.pivotal.io/security/cve-2014-0054"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Cross-site Request Forgery (CSRF)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": null,
            "cvssV3BaseScore": null,
            "severity": "medium",
            "modificationTime": "2022-04-12T01:10:36.267191Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[3.0.0.RELEASE,3.2.8.RELEASE)",
            "[4.0.0.RELEASE,4.0.2.RELEASE)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-web"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@3.2.8.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-web",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2022-01-02T11:14:46.053186Z",
        "credit": [
          "Dennis Kennedy"
        ],
        "cvssScore": 4.3,
        "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Improper Output Neutralization for Logs when a user provides malicious input, causing insertion of additional log entries.\n## Remediation\nUpgrade `org.springframework:spring-core` to version 5.3.12, 5.2.18 or higher.\n## References\n- [Github Commit](https://github.com/spring-projects/spring-framework/commit/346b75580267dc5d8d257be198d5841ce4e1add5)\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2021-22096)\n",
        "disclosureTime": "2021-10-27T12:52:59Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.3.12",
          "5.2.18"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2021-22096"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-01-02T11:14:46.378072Z",
        "moduleName": "org.springframework:spring-core",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2021-10-27T16:55:13Z",
        "references": [
          {
            "title": "Github Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/346b75580267dc5d8d257be198d5841ce4e1add5"
          },
          {
            "title": "Pivotal Security Advisory",
            "url": "https://pivotal.io/security/cve-2021-22096"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Improper Output Neutralization for Logs",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 4.3,
            "severity": "medium",
            "modificationTime": "2022-04-29T01:10:51.241222Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[5.3.0,5.3.12)",
            "[,5.2.18)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE",
          "org.springframework:spring-core@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@5.2.18.RELEASE",
          "org.springframework:spring-core@5.2.18.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-core",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
        "alternativeIds": [],
        "creationTime": "2022-01-06T12:31:26.181234Z",
        "credit": [
          "psytester"
        ],
        "cvssScore": 4.3,
        "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Improper Input Validation when a user provides malicious input, causing insertion of additional log entries.\n## Remediation\nUpgrade `org.springframework:spring-core` to version 5.2.19.RELEASE, 5.3.14 or higher.\n## References\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2021-22060)\n",
        "disclosureTime": "2022-01-06T11:18:34Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.2.19.RELEASE",
          "5.3.14"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2330878",
        "identifiers": {
          "CWE": [
            "CWE-20"
          ],
          "CVE": [
            "CVE-2021-22060"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-01-25T15:25:00.337700Z",
        "moduleName": "org.springframework:spring-core",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-01-06T17:17:24.995166Z",
        "references": [
          {
            "title": "Pivotal Security Advisory",
            "url": "https://pivotal.io/security/cve-2021-22060"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Improper Input Validation",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 4.3,
            "severity": "medium",
            "modificationTime": "2022-05-14T01:11:17.670128Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,5.2.19.RELEASE)",
            "[5.3.0,5.3.14)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE",
          "org.springframework:spring-core@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@5.2.19.RELEASE",
          "org.springframework:spring-core@5.2.19.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-core",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
        "alternativeIds": [],
        "creationTime": "2017-02-22T07:28:31.465000Z",
        "credit": [
          "Takeshi Terada"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Directory Traversal. It allows remote attackers to read arbitrary files via a crafted URL.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `org.springframework:spring-core` to version 3.2.9.RELEASE, 4.0.5.RELEASE or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/e3e71ba92a8b82dadf474eda76cd2741f65a77a8)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/f6fddeb6eb7da625fd711ab371ff16512f431e8d)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/16414)\n- [Jira Issue](https://jira.spring.io/browse/SPR-12354)\n- [JVNDB](http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000054.html)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3578)\n- [Pivotal Security](https://pivotal.io/security/cve-2014-3578)\n- [Pivotal Security](http://www.pivotal.io/security/cve-2014-3578)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1131882)\n",
        "disclosureTime": "2014-09-05T17:16:58Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/springframework/util/StringUtils.java",
              "className": "StringUtils",
              "functionName": "cleanPath"
            },
            "version": [
              "[3.0.0.RELEASE, 3.2.9.RELEASE)",
              "[4.0.0.RELEASE, 4.0.5.RELEASE)"
            ]
          }
        ],
        "fixedIn": [
          "3.2.9.RELEASE",
          "4.0.5.RELEASE"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-31325",
        "identifiers": {
          "CWE": [
            "CWE-22"
          ],
          "CVE": [
            "CVE-2014-3578"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2021-02-01T12:09:21.542397Z",
        "moduleName": "org.springframework:spring-core",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-core",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2014-09-05T17:16:58Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/e3e71ba92a8b82dadf474eda76cd2741f65a77a8"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/f6fddeb6eb7da625fd711ab371ff16512f431e8d"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/16414"
          },
          {
            "title": "Jira Issue",
            "url": "https://jira.spring.io/browse/SPR-12354"
          },
          {
            "title": "JVNDB",
            "url": "http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000054.html"
          },
          {
            "title": "NVD",
            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3578"
          },
          {
            "title": "Pivotal Security",
            "url": "https://pivotal.io/security/cve-2014-3578"
          },
          {
            "title": "Pivotal Security",
            "url": "http://www.pivotal.io/security/cve-2014-3578"
          },
          {
            "title": "RedHat Bugzilla Bug",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131882"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Directory Traversal",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": null,
            "cvssV3BaseScore": null,
            "severity": "medium",
            "modificationTime": "2022-01-03T17:37:14.768247Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.springframework.util.StringUtils",
              "functionName": "cleanPath"
            },
            "version": [
              "[3.0.0.RELEASE, 3.2.9.RELEASE)",
              "[4.0.0.RELEASE, 4.0.5.RELEASE)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[3.0.0.RELEASE, 3.2.9.RELEASE)",
            "[4.0.0.RELEASE, 4.0.5.RELEASE)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-core"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE",
          "org.springframework:spring-core@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@3.2.9.RELEASE",
          "org.springframework:spring-core@3.2.9.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-core",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
        "alternativeIds": [],
        "creationTime": "2022-03-29T10:05:31.971026Z",
        "credit": [
          "4ra1n"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) by providing a specially crafted SpEL expression, that might result in an `OutOfMemoryError`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `org.springframework:spring-expression` to version 5.3.17, 5.2.20.RELEASE or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/28145)\n- [Pivotal Security Advisory](https://pivotal.io/security/cve-2022-22950)\n",
        "disclosureTime": "2022-03-29T09:51:43Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.3.17",
          "5.2.20.RELEASE"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828",
        "identifiers": {
          "CWE": [
            "CWE-400"
          ],
          "CVE": [
            "CVE-2022-22950"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-07-17T12:57:31.345773Z",
        "moduleName": "org.springframework:spring-expression",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-expression",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-03-29T14:24:08Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/28145"
          },
          {
            "title": "Pivotal Security Advisory",
            "url": "https://pivotal.io/security/cve-2022-22950"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": "This vulnerability is only applicable on systems using Spring Expression Language (SpEL)"
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 6.5,
            "severity": "medium",
            "modificationTime": "2022-06-23T01:11:13.680071Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[5.3.0,5.3.17)",
            "[,5.2.20.RELEASE)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-expression"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE",
          "org.springframework:spring-context@3.2.6.RELEASE",
          "org.springframework:spring-expression@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@5.0.0.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-expression",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H",
        "alternativeIds": [],
        "creationTime": "2022-03-30T21:42:31.436000Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 9.8,
        "description": "## Overview\n[org.springframework:spring-beans](https://www.baeldung.com/spring-bean) is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.\n\nAffected versions of this package are vulnerable to Remote Code Execution via manipulation of `ClassLoader` that is achievable with a POST HTTP request. This could allow an attacker to execute a webshell on a victim's application (TomCat), or download arbitrary files from the server (Payara/Glassfish).\r\n\r\n**Note:** \r\n* Current public exploits require victim applications to be built with JRE version 9 (or above) and to be deployed on either Tomcat, Payara or Glassfish. \r\n* However, we have confirmed that it is technically possible for additional exploits to work under additional application configurations as well. \r\n* As such while we recommend users prioritise first remediating against the configuration described above, for full protection we also recommend upgrading all vulnerable versions to the fixed `spring-beans` version regardless of the application configuration.\r\n\r\n### Update Log \r\n* **31/03/2022 -** Severity was raised from 8.1 to 9.8\r\n* **08/04/2022 -** Advisory was updated to reflect that Snyk's security research team was able to author a working PoC of this vulnerability against applications that are deployed on Payara (which is based on Glassfish). \r\n\r\n\r\n## PoC\r\n```java\r\n1/ docker run -p 8888:8080 --rm --interactive --tty --name vm1 tomcat:9.0\r\n2/ ./mvnw install\r\n3/ docker cp target/handling-form-submission-complete.war vm1:/usr/local/tomcat/webapps\r\n4/ curl -X POST \\\r\n  -H \"pre:<%\" \\\r\n  -H \"post:;%>\" \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.pattern=%{pre}iSystem.out.println(123)%{post}i' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/handling-form-submission-complete' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.prefix=rce' \\\r\n  -F 'class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=' \\\r\n  http://localhost:8888/handling-form-submission-complete/greeting\r\n5/ curl http://localhost:8888/handling-form-submission-complete/rce.jsp\r\n```\n## Remediation\nUpgrade `org.springframework:spring-beans` to version 5.2.20, 5.3.18 or higher.\n## References\n- [CyberKendra Post](https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15)\n- [LunaSec Blog](https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/)\n- [Payara Blogpost](https://blog.payara.fish/payara-and-spring4shell)\n- [Payara PoC](https://github.com/CalumHutton/CVE-2022-22965-PoC_Payara)\n- [Snyk Blog - Technical Breakdown](https://snyk.io/blog/spring4shell-zero-day-rce-spring-framework-explained/)\n- [Snyk PoC](https://github.com/Kirill89/CVE-2022-22965-PoC)\n- [Spring Security Announcement](https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)\n- [Spring Tomcat Mitigation Advice](https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative)\n- [CISA - Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n",
        "disclosureTime": "2022-03-30T21:42:24Z",
        "exploit": "High",
        "functions": [
          {
            "functionId": {
              "filePath": "org/springframework/beans/CachedIntrospectionResults.java",
              "className": "CachedIntrospectionResults",
              "functionName": "<init>"
            },
            "version": [
              "[ ,5.2.20)",
              "[5.3.0, 5.3.18)"
            ]
          }
        ],
        "fixedIn": [
          "5.2.20",
          "5.3.18"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751",
        "identifiers": {
          "CWE": [
            "CWE-94"
          ],
          "CVE": [
            "CVE-2022-22965"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-08-12T15:25:01.081783Z",
        "moduleName": "org.springframework:spring-beans",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-beans",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-03-30T22:32:44Z",
        "references": [
          {
            "title": "CyberKendra Post",
            "url": "https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15"
          },
          {
            "title": "LunaSec Blog",
            "url": "https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/"
          },
          {
            "title": "Payara Blogpost",
            "url": "https://blog.payara.fish/payara-and-spring4shell"
          },
          {
            "title": "Payara PoC",
            "url": "https://github.com/CalumHutton/CVE-2022-22965-PoC_Payara"
          },
          {
            "title": "Snyk Blog - Technical Breakdown",
            "url": "https://snyk.io/blog/spring4shell-zero-day-rce-spring-framework-explained/"
          },
          {
            "title": "Snyk PoC",
            "url": "https://github.com/Kirill89/CVE-2022-22965-PoC"
          },
          {
            "title": "Spring Security Announcement",
            "url": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement"
          },
          {
            "title": "Spring Tomcat Mitigation Advice",
            "url": "https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative"
          },
          {
            "title": "CISA - Known Exploited Vulnerabilities",
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
          }
        ],
        "severity": "critical",
        "socialTrendAlert": false,
        "title": "Remote Code Execution",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "severity": "critical",
            "modificationTime": "2022-07-26T01:11:22.743934Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.springframework.beans.CachedIntrospectionResults",
              "functionName": "<init>"
            },
            "version": [
              "[ ,5.2.20)",
              "[5.3.0, 5.3.18)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[ ,5.2.20)",
            "[5.3.0, 5.3.18)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-beans"
        },
        "severityWithCritical": "critical",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE",
          "org.springframework:spring-beans@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@5.2.20.RELEASE",
          "org.springframework:spring-beans@5.2.20.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-beans",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
        "alternativeIds": [],
        "creationTime": "2022-05-12T08:45:35.744127Z",
        "credit": [
          "Rob Ryan"
        ],
        "cvssScore": 5.3,
        "description": "## Overview\n[org.springframework:spring-beans](https://www.baeldung.com/spring-bean) is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) if it relies on data binding to set a `MultipartFile` or `javax.servlet.Part` to a field in a model object.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `org.springframework:spring-beans` to version 5.2.22.RELEASE, 5.3.20 or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2)\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583)\n- [Tanzu vmware](https://tanzu.vmware.com/security/cve-2022-22970)\n",
        "disclosureTime": "2022-05-12T08:17:10Z",
        "exploit": "Not Defined",
        "functions": [],
        "fixedIn": [
          "5.2.22.RELEASE",
          "5.3.20"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2823313",
        "identifiers": {
          "CWE": [
            "CWE-400"
          ],
          "CVE": [
            "CVE-2022-22970"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-12T09:49:10.835416Z",
        "moduleName": "org.springframework:spring-beans",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-beans",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-05-12T09:49:10.833602Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2"
          },
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583"
          },
          {
            "title": "Tanzu vmware",
            "url": "https://tanzu.vmware.com/security/cve-2022-22970"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Denial of Service (DoS)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-07-26T01:11:19.570522Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,5.2.22.RELEASE)",
            "[5.3.0,5.3.20)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-beans"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE",
          "org.springframework:spring-beans@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@5.2.22.RELEASE",
          "org.springframework:spring-beans@5.2.22.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-beans",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P",
        "alternativeIds": [],
        "creationTime": "2022-04-14T11:54:10.207823Z",
        "credit": [
          "Unknown"
        ],
        "cvssScore": 3.7,
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the patterns for `disallowedFields` on a `DataBinder`. As a result, a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including nested fields within the property path.\n## Remediation\nUpgrade `org.springframework:spring-context` to version 5.2.21, 5.3.19 or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea)\n- [GitHub Issue](https://github.com/spring-projects/spring-framework/issues/28333)\n- [PoC](https://github.com/MarcinGadz/spring-rce-poc)\n- [Spring Blog Post](https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968)\n- [Tanzu Advisory](https://tanzu.vmware.com/security/cve-2022-22968)\n",
        "disclosureTime": "2022-04-14T11:43:54Z",
        "exploit": "Proof of Concept",
        "functions": [],
        "fixedIn": [
          "5.2.21",
          "5.3.19"
        ],
        "id": "SNYK-JAVA-ORGSPRINGFRAMEWORK-2689634",
        "identifiers": {
          "CWE": [
            "CWE-178"
          ],
          "CVE": [
            "CVE-2022-22968"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-05-15T07:59:33.898723Z",
        "moduleName": "org.springframework:spring-context",
        "packageManager": "maven",
        "packageName": "org.springframework:spring-context",
        "patches": [],
        "proprietary": false,
        "publicationTime": "2022-04-14T12:09:40Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea"
          },
          {
            "title": "GitHub Issue",
            "url": "https://github.com/spring-projects/spring-framework/issues/28333"
          },
          {
            "title": "PoC",
            "url": "https://github.com/MarcinGadz/spring-rce-poc"
          },
          {
            "title": "Spring Blog Post",
            "url": "https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968"
          },
          {
            "title": "Tanzu Advisory",
            "url": "https://tanzu.vmware.com/security/cve-2022-22968"
          }
        ],
        "severity": "low",
        "socialTrendAlert": false,
        "title": "Improper Handling of Case Sensitivity",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 5.3,
            "severity": "medium",
            "modificationTime": "2022-07-26T01:11:20.613128Z"
          }
        ],
        "functions_new": [],
        "semver": {
          "vulnerable": [
            "[,5.2.21)",
            "[5.3.0, 5.3.19)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.springframework",
          "artifactId": "spring-context"
        },
        "severityWithCritical": "low",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.springframework:spring-web@3.2.6.RELEASE",
          "org.springframework:spring-context@3.2.6.RELEASE"
        ],
        "upgradePath": [
          false,
          "org.springframework:spring-web@5.0.0.RELEASE"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.springframework:spring-context",
        "version": "3.2.6.RELEASE"
      },
      {
        "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
        "alternativeIds": [],
        "creationTime": "2018-05-30T12:32:02.349000Z",
        "credit": [
          "Snyk Security research Team"
        ],
        "cvssScore": 5.5,
        "description": "## Overview\r\n[`org.zeroturnaround:zt-zip`](https://github.com/zeroturnaround/zt-zip) is a library that helps to create, modify or extract ZIP archives.\r\n\r\nAffected versions of the package are vulnerable to Arbitrary File Write via Archive Extraction (AKA \"Zip Slip\").\r\n\r\nIt is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a \"../../file.exe\" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\r\n\r\nThe following is an example of a zip archive with one benign file and one malicious file. Extracting the malicous file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\r\n\r\n```\r\n\r\n+2018-04-15 22:04:29 ..... 19 19 good.txt\r\n\r\n+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\r\n\r\n```\r\n\r\n## Vulnerable Method\r\nThis vulnerability appears in method `process` under class name `Unpacker` in `org/zeroturnaround/zip/ZipUtil.java` [[1]](https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff)\r\n\r\n\r\n## Remediation\r\nUpgrade `org.zeroturnaround:zt-zip` to version 1.13 or higher.\n\n## References\n- [GitHub Commit](https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff)\n- [Zip Slip Advisory](https://github.com/snyk/zip-slip-vulnerability)\n- [Zip Slip Advisory](https://security.snyk.io/research/zip-slip-vulnerability)\n",
        "disclosureTime": "2018-04-17T21:00:00Z",
        "exploit": "Not Defined",
        "functions": [
          {
            "functionId": {
              "filePath": "org/zeroturnaround/zip/ZipUtil$Unpacker.java",
              "className": "ZipUtil$Unpacker",
              "functionName": "process"
            },
            "version": [
              "[,1.13)"
            ]
          }
        ],
        "fixedIn": [
          "1.13"
        ],
        "id": "SNYK-JAVA-ORGZEROTURNAROUND-31681",
        "identifiers": {
          "CWE": [
            "CWE-29"
          ],
          "CVE": [
            "CVE-2018-1002201"
          ]
        },
        "language": "java",
        "malicious": false,
        "modificationTime": "2022-08-25T12:19:52.295190Z",
        "moduleName": "org.zeroturnaround:zt-zip",
        "packageManager": "maven",
        "packageName": "org.zeroturnaround:zt-zip",
        "patches": [],
        "proprietary": true,
        "publicationTime": "2018-05-31T07:32:02Z",
        "references": [
          {
            "title": "GitHub Commit",
            "url": "https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff"
          },
          {
            "title": "Zip Slip Advisory",
            "url": "https://github.com/snyk/zip-slip-vulnerability"
          },
          {
            "title": "Zip Slip Advisory",
            "url": "https://security.snyk.io/research/zip-slip-vulnerability"
          }
        ],
        "severity": "medium",
        "socialTrendAlert": false,
        "title": "Arbitrary File Write via Archive Extraction (Zip Slip)",
        "insights": {
          "triageAdvice": null
        },
        "cvssDetails": [
          {
            "assigner": "NVD",
            "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "cvssV3BaseScore": 5.5,
            "severity": "medium",
            "modificationTime": "2022-01-03T16:12:45.656740Z"
          }
        ],
        "functions_new": [
          {
            "functionId": {
              "className": "org.zeroturnaround.zip.ZipUtil$Unpacker",
              "functionName": "process"
            },
            "version": [
              "[,1.13)"
            ]
          }
        ],
        "semver": {
          "vulnerable": [
            "[,1.13)"
          ]
        },
        "mavenModuleName": {
          "groupId": "org.zeroturnaround",
          "artifactId": "zt-zip"
        },
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "org.zeroturnaround:zt-zip@1.12"
        ],
        "upgradePath": [
          false,
          "org.zeroturnaround:zt-zip@1.13"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "name": "org.zeroturnaround:zt-zip",
        "version": "1.12"
      },
      {
        "id": "snyk:lic:maven:org.aspectj:aspectjweaver:EPL-1.0",
        "packageName": "org.aspectj:aspectjweaver",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-11T15:48:31.375Z",
        "description": "EPL-1.0 license",
        "language": "java",
        "license": "EPL-1.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T15:48:31.375Z",
        "title": "EPL-1.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.aspectj:aspectjweaver@1.8.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.aspectj:aspectjweaver",
        "version": "1.8.2"
      },
      {
        "id": "snyk:lic:maven:org.hibernate.common:hibernate-commons-annotations:LGPL-2.1",
        "packageName": "org.hibernate.common:hibernate-commons-annotations",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-11T02:03:20.921Z",
        "description": "LGPL-2.1 license",
        "language": "java",
        "license": "LGPL-2.1",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T02:03:20.921Z",
        "title": "LGPL-2.1 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "org.hibernate.common:hibernate-commons-annotations@4.0.5.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate.common:hibernate-commons-annotations",
        "version": "4.0.5.Final"
      },
      {
        "id": "snyk:lic:maven:org.hibernate.javax.persistence:hibernate-jpa-2.1-api:EPL-1.0",
        "packageName": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
        "semver": {
          "vulnerable": [
            "[0,)"
          ]
        },
        "creationTime": "2022-09-11T03:29:28.476Z",
        "description": "EPL-1.0 license",
        "language": "java",
        "license": "EPL-1.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T03:29:28.476Z",
        "title": "EPL-1.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-core@4.3.7.Final",
          "org.hibernate.javax.persistence:hibernate-jpa-2.1-api@1.0.0.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
        "version": "1.0.0.Final"
      },
      {
        "id": "snyk:lic:maven:org.hibernate:hibernate-entitymanager:LGPL-2.0",
        "packageName": "org.hibernate:hibernate-entitymanager",
        "semver": {
          "vulnerable": [
            "[3.5.0.Beta-1, 5.3.1.Final)"
          ]
        },
        "creationTime": "2022-09-11T03:11:24.569Z",
        "description": "LGPL-2.0 license",
        "language": "java",
        "license": "LGPL-2.0",
        "packageManager": "maven",
        "publicationTime": "2022-09-11T03:11:24.569Z",
        "title": "LGPL-2.0 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "io.github.snyk:todolist-core@1.0-SNAPSHOT",
          "org.hibernate:hibernate-entitymanager@4.3.7.Final"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.hibernate:hibernate-entitymanager",
        "version": "4.3.7.Final"
      },
      {
        "id": "snyk:lic:maven:org.jboss.logging:jboss-logging:LGPL-2.1",
        "packageName": "org.jboss.logging:jboss-logging",
        "semver": {
          "vulnerable": [
            "[3.0.1.GA, 3.1.2.GA)"
          ]
        },
        "creationTime": "2022-09-10T14:43:45.479Z",
        "description": "LGPL-2.1 license",
        "language": "java",
        "license": "LGPL-2.1",
        "packageManager": "maven",
        "publicationTime": "2022-09-10T14:43:45.479Z",
        "title": "LGPL-2.1 license",
        "type": "license",
        "severity": "medium",
        "severityWithCritical": "medium",
        "from": [
          "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
          "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
          "org.hibernate:hibernate-validator@4.3.1.Final",
          "org.jboss.logging:jboss-logging@3.1.0.CR2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "name": "org.jboss.logging:jboss-logging",
        "version": "3.1.0.CR2"
      }
    ],
    "ok": false,
    "dependencyCount": 55,
    "org": "kevin-s31-org",
    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.0\nignore: {}\npatch: {}\n",
    "isPrivate": true,
    "licensesPolicy": {
      "severities": {},
      "orgLicenseRules": {
        "AGPL-1.0": {
          "licenseType": "AGPL-1.0",
          "severity": "high",
          "instructions": ""
        },
        "AGPL-3.0": {
          "licenseType": "AGPL-3.0",
          "severity": "high",
          "instructions": ""
        },
        "Artistic-1.0": {
          "licenseType": "Artistic-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "Artistic-2.0": {
          "licenseType": "Artistic-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "CDDL-1.0": {
          "licenseType": "CDDL-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "CPOL-1.02": {
          "licenseType": "CPOL-1.02",
          "severity": "high",
          "instructions": ""
        },
        "EPL-1.0": {
          "licenseType": "EPL-1.0",
          "severity": "medium",
          "instructions": ""
        },
        "GPL-2.0": {
          "licenseType": "GPL-2.0",
          "severity": "high",
          "instructions": ""
        },
        "GPL-3.0": {
          "licenseType": "GPL-3.0",
          "severity": "high",
          "instructions": ""
        },
        "LGPL-2.0": {
          "licenseType": "LGPL-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "LGPL-2.1": {
          "licenseType": "LGPL-2.1",
          "severity": "medium",
          "instructions": ""
        },
        "LGPL-3.0": {
          "licenseType": "LGPL-3.0",
          "severity": "medium",
          "instructions": ""
        },
        "MPL-1.1": {
          "licenseType": "MPL-1.1",
          "severity": "medium",
          "instructions": ""
        },
        "MPL-2.0": {
          "licenseType": "MPL-2.0",
          "severity": "medium",
          "instructions": ""
        },
        "MS-RL": {
          "licenseType": "MS-RL",
          "severity": "medium",
          "instructions": ""
        },
        "SimPL-2.0": {
          "licenseType": "SimPL-2.0",
          "severity": "high",
          "instructions": ""
        }
      }
    },
    "packageManager": "maven",
    "ignoreSettings": {
      "adminOnly": false,
      "reasonRequired": false,
      "disregardFilesystemIgnores": false
    },
    "summary": "69 vulnerable dependency paths",
    "remediation": {
      "unresolved": [
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "alternativeIds": [],
          "creationTime": "2019-09-05T16:17:58.383761Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 9.8,
          "description": "## Overview\n\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection.\nvia the `extractXmlConfigFromInputStream` in `com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java` during initialization.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\r\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\r\n\r\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\r\n\r\nFor example, below is a sample XML document, containing an XML element- username.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n   <username>John</username>\r\n</xml>\r\n```\r\n\r\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\r\n\r\n```xml\r\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\r\n<!DOCTYPE foo [\r\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\r\n   <username>&xxe;</username>\r\n</xml>\r\n```\r\n\r\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n\n## Remediation\n\nThere is no fixed version for `c3p0:c3p0`.\n\n\n## References\n\n- [GitHub Commit](https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1)\n",
          "disclosureTime": "2018-12-24T13:29:00Z",
          "exploit": "Not Defined",
          "functions": [
            {
              "functionId": {
                "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
                "className": "C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "fixedIn": [],
          "id": "SNYK-JAVA-C3P0-461017",
          "identifiers": {
            "CWE": [
              "CWE-611"
            ],
            "CVE": [
              "CVE-2018-20433"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2020-12-14T14:41:01.987191Z",
          "moduleName": "c3p0:c3p0",
          "packageManager": "maven",
          "packageName": "c3p0:c3p0",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2019-07-21T14:22:18Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/swaldman/c3p0/commit/7dfdda63f42759a5ec9b63d725b7412f74adb3e1"
            }
          ],
          "severity": "critical",
          "socialTrendAlert": false,
          "title": "XML External Entity (XXE) Injection",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "cvssV3BaseScore": 9.8,
              "severity": "critical",
              "modificationTime": "2022-01-03T16:25:31.174274Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "c3p0",
            "artifactId": "c3p0"
          },
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "c3p0:c3p0@0.9.1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "c3p0:c3p0",
          "version": "0.9.1.2",
          "severityWithCritical": "critical"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O",
          "alternativeIds": [],
          "creationTime": "2019-09-05T16:24:58.914446Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 7.5,
          "description": "## Overview\n[c3p0:c3p0](https://mvnrepository.com/artifact/c3p0/c3p0) is a lIbrary for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension. Note: This library is no longer maintained and has migrated to the artifact \r\n\"com.mchange:c3p0\"\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to missing protections against recursive entity expansion when loading XML configurations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nThere is no fixed version for `c3p0:c3p0`.\n## References\n- [POC: Hackerone Report](https://hackerone.com/reports/509315)\n",
          "disclosureTime": "2019-04-22T22:18:26Z",
          "exploit": "Proof of Concept",
          "functions": [
            {
              "functionId": {
                "filePath": "com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java",
                "className": "C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "fixedIn": [],
          "id": "SNYK-JAVA-C3P0-461018",
          "identifiers": {
            "CWE": [
              "CWE-776"
            ],
            "GHSA": [
              "GHSA-84p2-vf58-xhxv"
            ],
            "CVE": [
              "CVE-2019-5427"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-04-24T11:13:58.306515Z",
          "moduleName": "c3p0:c3p0",
          "packageManager": "maven",
          "packageName": "c3p0:c3p0",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2019-04-22T22:18:26Z",
          "references": [
            {
              "title": "POC: Hackerone Report",
              "url": "https://hackerone.com/reports/509315"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "Denial of Service (DoS)",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "cvssV3BaseScore": 7.5,
              "severity": "high",
              "modificationTime": "2022-04-23T01:11:20.164193Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils",
                "functionName": "extractXmlConfigFromInputStream"
              },
              "version": [
                "[0.9.1,]"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "c3p0",
            "artifactId": "c3p0"
          },
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "c3p0:c3p0@0.9.1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "c3p0:c3p0",
          "version": "0.9.1.2",
          "severityWithCritical": "high"
        },
        {
          "id": "snyk:lic:maven:c3p0:c3p0:LGPL-3.0",
          "packageName": "c3p0:c3p0",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-10T14:28:57.415Z",
          "description": "LGPL-3.0 license",
          "language": "java",
          "license": "LGPL-3.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-10T14:28:57.415Z",
          "title": "LGPL-3.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "c3p0:c3p0@0.9.1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "c3p0:c3p0",
          "version": "0.9.1.2",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
          "alternativeIds": [],
          "creationTime": "2019-04-10T16:07:04.634619Z",
          "credit": [
            "Mario Areias"
          ],
          "cvssScore": 7.5,
          "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection due to improper validation of the `QName` inputs.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387)\n- [GitHub Issue](https://github.com/dom4j/dom4j/issues/48)\n- [POC: Ihacktoprotect Blog](https://ihacktoprotect.com/post/dom4j-xml-injection/)\n",
          "disclosureTime": "2018-07-01T19:12:29Z",
          "exploit": "Proof of Concept",
          "functions": [
            {
              "functionId": {
                "filePath": "org/dom4j/Namespace.java",
                "className": "Namespace",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            },
            {
              "functionId": {
                "filePath": "org/dom4j/QName.java",
                "className": "QName",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            }
          ],
          "fixedIn": [],
          "id": "SNYK-JAVA-DOM4J-174153",
          "identifiers": {
            "CWE": [
              "CWE-611"
            ],
            "GHSA": [
              "GHSA-6pcc-3rfx-4gpm"
            ],
            "CVE": [
              "CVE-2018-1000632"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-05-22T12:44:25.928596Z",
          "moduleName": "dom4j:dom4j",
          "packageManager": "maven",
          "packageName": "dom4j:dom4j",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2018-08-21T14:16:13Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387"
            },
            {
              "title": "GitHub Issue",
              "url": "https://github.com/dom4j/dom4j/issues/48"
            },
            {
              "title": "POC: Ihacktoprotect Blog",
              "url": "https://ihacktoprotect.com/post/dom4j-xml-injection/"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "XML External Entity (XXE) Injection",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "SUSE",
              "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
              "cvssV3BaseScore": 6.1,
              "severity": "medium",
              "modificationTime": "2022-05-04T00:48:09.564645Z"
            },
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "cvssV3BaseScore": 7.5,
              "severity": "high",
              "modificationTime": "2022-01-03T16:12:35.769596Z"
            },
            {
              "assigner": "RHEL",
              "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "cvssV3BaseScore": 5.3,
              "severity": "medium",
              "modificationTime": "2022-05-31T14:35:13.279641Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "org.dom4j.Namespace",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            },
            {
              "functionId": {
                "className": "org.dom4j.QName",
                "functionName": "<init>"
              },
              "version": [
                "[0,]"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "dom4j",
            "artifactId": "dom4j"
          },
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "dom4j:dom4j@1.6.1"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "dom4j:dom4j",
          "version": "1.6.1",
          "severityWithCritical": "high"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "alternativeIds": [],
          "creationTime": "2022-05-10T12:56:27.582369Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 7.4,
          "description": "## Overview\n[dom4j:dom4j](https://github.com/dom4j/dom4j) is a flexible XML framework for Java. *Note*: this artifact has been deprecated for `org.dom4j:dom4j`.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection. By using the default `SaxReader()` provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `dom4j:dom4j`.\n## References\n- [GitHub Commit](https://github.com/dom4j/dom4j/commit/a822852)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1694235)\n",
          "disclosureTime": "2020-04-15T09:38:17Z",
          "exploit": "Not Defined",
          "functions": [],
          "fixedIn": [],
          "id": "SNYK-JAVA-DOM4J-2812975",
          "identifiers": {
            "CWE": [
              "CWE-611"
            ],
            "GHSA": [
              "GHSA-hwj3-m3p6-hj38"
            ],
            "CVE": [
              "CVE-2020-10683"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-05-10T12:56:27.582382Z",
          "moduleName": "dom4j:dom4j",
          "packageManager": "maven",
          "packageName": "dom4j:dom4j",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2020-04-16T15:22:50Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/dom4j/dom4j/commit/a822852"
            },
            {
              "title": "RedHat Bugzilla Bug",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694235"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "XML External Entity (XXE) Injection",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "cvssV3BaseScore": 9.8,
              "severity": "critical",
              "modificationTime": "2022-07-26T01:11:31.495013Z"
            },
            {
              "assigner": "RHEL",
              "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "cvssV3BaseScore": 7.4,
              "severity": "high",
              "modificationTime": "2022-05-31T14:51:07.029250Z"
            }
          ],
          "functions_new": [],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "dom4j",
            "artifactId": "dom4j"
          },
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "dom4j:dom4j@1.6.1"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "dom4j:dom4j",
          "version": "1.6.1",
          "severityWithCritical": "high"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "alternativeIds": [],
          "creationTime": "2017-02-22T07:28:19.341000Z",
          "credit": [
            "David Jorm"
          ],
          "cvssScore": 7.3,
          "description": "## Overview\n[javax.servlet:jstl](https://mvnrepository.com/artifact/javax.servlet/jstl) is a collection of useful JSP tags which encapsulates the core functionality common to many JSP applications.\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection. Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a `<x:parse>` or `<x:transform>` JSTL XML tag.\n\n## Details\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```\n<xml>\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nThere is no fixed version for `javax.servlet:jstl`.\n## References\n- [Apache Mail Archive](http://mail-archives.us.apache.org/mod_mbox/www-announce/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A@apache.org%3E)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0254)\n- [RedHat CVE Database](https://access.redhat.com/security/cve/CVE-2015-0254)\n",
          "disclosureTime": "2015-02-27T16:13:27Z",
          "exploit": "Not Defined",
          "functions": [],
          "fixedIn": [],
          "id": "SNYK-JAVA-JAVAXSERVLET-30449",
          "identifiers": {
            "CWE": [
              "CWE-94"
            ],
            "GHSA": [
              "GHSA-6x4w-8w53-xrvv"
            ],
            "CVE": [
              "CVE-2015-0254"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2020-12-14T14:40:54.105551Z",
          "moduleName": "javax.servlet:jstl",
          "packageManager": "maven",
          "packageName": "javax.servlet:jstl",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2015-02-27T16:51:55Z",
          "references": [
            {
              "title": "Apache Mail Archive",
              "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A@apache.org%3E"
            },
            {
              "title": "NVD",
              "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0254"
            },
            {
              "title": "RedHat CVE Database",
              "url": "https://access.redhat.com/security/cve/CVE-2015-0254"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "XML External Entity (XXE) Injection",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": null,
              "cvssV3BaseScore": null,
              "severity": "high",
              "modificationTime": "2022-01-03T17:28:38.191565Z"
            },
            {
              "assigner": "RHEL",
              "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
              "cvssV3BaseScore": 7.6,
              "severity": "high",
              "modificationTime": "2022-05-31T17:09:25.699843Z"
            }
          ],
          "functions_new": [],
          "semver": {
            "vulnerable": [
              "[0,]"
            ]
          },
          "mavenModuleName": {
            "groupId": "javax.servlet",
            "artifactId": "jstl"
          },
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "javax.servlet:jstl@1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "javax.servlet:jstl",
          "version": "1.2",
          "severityWithCritical": "high"
        },
        {
          "id": "snyk:lic:maven:javax.servlet:jstl:CDDL-1.0",
          "packageName": "javax.servlet:jstl",
          "semver": {
            "vulnerable": [
              "[1.2,)"
            ]
          },
          "creationTime": "2022-09-10T22:00:05.351Z",
          "description": "CDDL-1.0 license",
          "language": "java",
          "license": "CDDL-1.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-10T22:00:05.351Z",
          "title": "CDDL-1.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "javax.servlet:jstl@1.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "javax.servlet:jstl",
          "version": "1.2",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:U",
          "alternativeIds": [],
          "creationTime": "2020-11-19T16:51:52.251545Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 8.2,
          "description": "## Overview\n[org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) is a library providing Object/Relational Mapping (ORM) support to applications, libraries, and frameworks.\n\nAffected versions of this package are vulnerable to SQL Injection. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.\n## Remediation\nUpgrade `org.hibernate:hibernate-core` to version 5.4.24.Final or higher.\n## References\n- [GitHub Commit](https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78)\n- [Redhat CVE Details](https://access.redhat.com/security/cve/cve-2020-25638)\n",
          "disclosureTime": "2020-11-19T16:51:45Z",
          "exploit": "Unproven",
          "functions": [
            {
              "functionId": {
                "filePath": "org/hibernate/loader/plan/exec/query/internal/SelectStatementBuilder.java",
                "className": "SelectStatementBuilder",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/Delete.java",
                "className": "Delete",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/Insert.java",
                "className": "Insert",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/InsertSelect.java",
                "className": "InsertSelect",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/QuerySelect.java",
                "className": "QuerySelect",
                "functionName": "toQueryString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/Select.java",
                "className": "Select",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/SimpleSelect.java",
                "className": "SimpleSelect",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "filePath": "org/hibernate/sql/Update.java",
                "className": "Update",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            }
          ],
          "fixedIn": [
            "5.4.24.Final"
          ],
          "id": "SNYK-JAVA-ORGHIBERNATE-1041788",
          "identifiers": {
            "CWE": [
              "CWE-89"
            ],
            "CVE": [
              "CVE-2020-25638"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-07-18T12:56:04.506674Z",
          "moduleName": "org.hibernate:hibernate-core",
          "packageManager": "maven",
          "packageName": "org.hibernate:hibernate-core",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2020-11-19T16:57:14.572204Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78"
            },
            {
              "title": "Redhat CVE Details",
              "url": "https://access.redhat.com/security/cve/cve-2020-25638"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "SQL Injection",
          "insights": {
            "triageAdvice": "This vulnerability is only applicable on systems using JPA Criteria API"
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "cvssV3BaseScore": 7.4,
              "severity": "high",
              "modificationTime": "2022-07-26T01:11:35.094170Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "org.hibernate.loader.plan.exec.query.internal.SelectStatementBuilder",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.Delete",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.Insert",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.InsertSelect",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.QuerySelect",
                "functionName": "toQueryString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.Select",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.SimpleSelect",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            },
            {
              "functionId": {
                "className": "org.hibernate.sql.Update",
                "functionName": "toStatementString"
              },
              "version": [
                "[,5.4.24.Final)"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[,5.4.24.Final)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.hibernate",
            "artifactId": "hibernate-core"
          },
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate:hibernate-core",
          "version": "4.3.7.Final",
          "severityWithCritical": "high"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "alternativeIds": [],
          "creationTime": "2020-07-15T13:53:15.331818Z",
          "credit": [
            "Gail Badner"
          ],
          "cvssScore": 8.1,
          "description": "## Overview\n[org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) is a library providing Object/Relational Mapping (ORM) support to applications, libraries, and frameworks.\n\nAffected versions of this package are vulnerable to SQL Injection. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.\n## Remediation\nUpgrade `org.hibernate:hibernate-core` to version 5.3.18.Final, 5.4.18.Final or higher.\n## References\n- [GitHub Pull Request](https://github.com/hibernate/hibernate-orm/pull/3438)\n- [Jira Ticket](https://hibernate.atlassian.net/browse/HHH-14077)\n",
          "disclosureTime": "2020-06-18T13:46:30Z",
          "exploit": "Not Defined",
          "functions": [
            {
              "functionId": {
                "filePath": "org/hibernate/query/criteria/internal/expression/LiteralExpression.java",
                "className": "LiteralExpression",
                "functionName": "renderProjection"
              },
              "version": [
                "[5.1.18.Final ,5.4.18.Final)"
              ]
            }
          ],
          "fixedIn": [
            "5.3.18.Final",
            "5.4.18.Final"
          ],
          "id": "SNYK-JAVA-ORGHIBERNATE-584563",
          "identifiers": {
            "CWE": [
              "CWE-89"
            ],
            "CVE": [
              "CVE-2019-14900"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2022-07-18T12:57:02.888829Z",
          "moduleName": "org.hibernate:hibernate-core",
          "packageManager": "maven",
          "packageName": "org.hibernate:hibernate-core",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2020-07-15T16:40:12Z",
          "references": [
            {
              "title": "GitHub Pull Request",
              "url": "https://github.com/hibernate/hibernate-orm/pull/3438"
            },
            {
              "title": "Jira Ticket",
              "url": "https://hibernate.atlassian.net/browse/HHH-14077"
            }
          ],
          "severity": "high",
          "socialTrendAlert": false,
          "title": "SQL Injection",
          "insights": {
            "triageAdvice": "This vulnerability is only applicable on systems using JPA Criteria API"
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "cvssV3BaseScore": 6.5,
              "severity": "medium",
              "modificationTime": "2022-04-30T01:10:36.121203Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "org.hibernate.query.criteria.internal.expression.LiteralExpression",
                "functionName": "renderProjection"
              },
              "version": [
                "[5.1.18.Final ,5.4.18.Final)"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[,5.3.18.Final)",
              "[5.4.0.Final, 5.4.18.Final)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.hibernate",
            "artifactId": "hibernate-core"
          },
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate:hibernate-core",
          "version": "4.3.7.Final",
          "severityWithCritical": "high"
        },
        {
          "id": "snyk:lic:maven:org.hibernate:hibernate-core:LGPL-2.0",
          "packageName": "org.hibernate:hibernate-core",
          "semver": {
            "vulnerable": [
              "[3.3.0.CR1, 5.3.1.Final)"
            ]
          },
          "creationTime": "2022-09-11T12:51:18.861Z",
          "description": "LGPL-2.0 license",
          "language": "java",
          "license": "LGPL-2.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T12:51:18.861Z",
          "title": "LGPL-2.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate:hibernate-core",
          "version": "4.3.7.Final",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "alternativeIds": [],
          "creationTime": "2016-12-25T16:51:53Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 5.3,
          "description": "## Overview\n[org.hibernate:hibernate-validator](https://mvnrepository.com/artifact/org.hibernate/hibernate-validator) is a Hibernate Validator Engine Relocation Artifact.\n\nAffected versions of this package are vulnerable to JSM bypass via ReflectionHelper. ReflectionHelper (`org.hibernate.validator.util.ReflectionHelper`) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.\n## Remediation\nUpgrade `org.hibernate:hibernate-validator` to version 4.3.2.Final, 5.1.2.Final or higher.\n## References\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/2c95d4ea0ef20977be249e31a4a4f4f4f71c945d)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/67fdff14831c035c25e098fe14bd86523d17f726)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/7e7131939a4361a7cad3e77ab89a8462132c561c)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/c489416f699a46859c134796b3ccfea41ef3ce52)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/c9525ca544b1281e2b7c7347e86e87c86dc1dc6e)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/e8c42b689df8c6752d635d02c6518da3fece3870)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/f97c2021a03c825abdeca1692f5be51e77e76a8f)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/fd4eaed7fb930db6a5e4c03742b4b3adcfecc90e)\n- [Jira Issue](https://hibernate.atlassian.net/browse/HV-912)\n- [Redhat Bugzilla](https://bugzilla.redhat.com/CVE-2014-3558)\n",
          "disclosureTime": "2014-07-17T16:51:53Z",
          "exploit": "Not Defined",
          "functions": [],
          "fixedIn": [
            "4.3.2.Final",
            "5.1.2.Final"
          ],
          "id": "SNYK-JAVA-ORGHIBERNATE-30098",
          "identifiers": {
            "CWE": [
              "CWE-592"
            ],
            "CVE": [
              "CVE-2014-3558"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2020-12-14T14:41:02.614281Z",
          "moduleName": "org.hibernate:hibernate-validator",
          "packageManager": "maven",
          "packageName": "org.hibernate:hibernate-validator",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2014-07-17T16:51:53Z",
          "references": [
            {
              "title": "GitHub Commit",
              "url": "https://github.com/hibernate/hibernate-validator/commit/2c95d4ea0ef20977be249e31a4a4f4f4f71c945d"
            },
            {
              "title": "GitHub Commit",
              "url": "https://github.com/hibernate/hibernate-validator/commit/67fdff14831c035c25e098fe14bd86523d17f726"
            },
            {
              "title": "GitHub Commit",
              "url": "https://github.com/hibernate/hibernate-validator/commit/7e7131939a4361a7cad3e77ab89a8462132c561c"
            },
            {
              "title": "GitHub Commit",
              "url": "https://github.com/hibernate/hibernate-validator/commit/c489416f699a46859c134796b3ccfea41ef3ce52"
            },
            {
              "title": "GitHub Commit",
              "url": "https://github.com/hibernate/hibernate-validator/commit/c9525ca544b1281e2b7c7347e86e87c86dc1dc6e"
            },
            {
              "title": "GitHub Commit",
              "url": "https://github.com/hibernate/hibernate-validator/commit/e8c42b689df8c6752d635d02c6518da3fece3870"
            },
            {
              "title": "GitHub Commit",
              "url": "https://github.com/hibernate/hibernate-validator/commit/f97c2021a03c825abdeca1692f5be51e77e76a8f"
            },
            {
              "title": "GitHub Commit",
              "url": "https://github.com/hibernate/hibernate-validator/commit/fd4eaed7fb930db6a5e4c03742b4b3adcfecc90e"
            },
            {
              "title": "Jira Issue",
              "url": "https://hibernate.atlassian.net/browse/HV-912"
            },
            {
              "title": "Redhat Bugzilla",
              "url": "https://bugzilla.redhat.com/CVE-2014-3558"
            }
          ],
          "severity": "medium",
          "socialTrendAlert": false,
          "title": "JSM bypass via ReflectionHelper",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": null,
              "cvssV3BaseScore": null,
              "severity": "medium",
              "modificationTime": "2022-01-03T17:36:59.992374Z"
            }
          ],
          "functions_new": [],
          "semver": {
            "vulnerable": [
              "[4.1.0.Beta1, 4.3.2.Final)",
              "[5.0.0.Final,5.1.2.Final)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.hibernate",
            "artifactId": "hibernate-validator"
          },
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "org.hibernate:hibernate-validator@4.3.1.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate:hibernate-validator",
          "version": "4.3.1.Final",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "alternativeIds": [],
          "creationTime": "2020-05-05T12:05:58.541980Z",
          "credit": [
            "Alvaro Muñoz"
          ],
          "cvssScore": 5.3,
          "description": "## Overview\n[org.hibernate:hibernate-validator](https://mvnrepository.com/artifact/org.hibernate/hibernate-validator) is a Hibernate Validator Engine Relocation Artifact.\n\nAffected versions of this package are vulnerable to Improper Input Validation. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.\n## Remediation\nUpgrade `org.hibernate:hibernate-validator` to version 6.0.19.Final, 6.1.3.Final or higher.\n## References\n- [GitHub PR](https://github.com/hibernate/hibernate-validator/pull/1071)\n- [Jira Issue](https://hibernate.atlassian.net/browse/HV-1758)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1805501)\n",
          "disclosureTime": "2020-05-05T00:00:00Z",
          "exploit": "Not Defined",
          "functions": [
            {
              "functionId": {
                "filePath": "org/hibernate/validator/internal/engine/ValidatorImpl.java",
                "className": "ValidatorImpl",
                "functionName": "validate"
              },
              "version": [
                "[,6.0.19.Final)",
                "[6.1.0,6.1.3.Final)"
              ]
            }
          ],
          "fixedIn": [
            "6.0.19.Final",
            "6.1.3.Final"
          ],
          "id": "SNYK-JAVA-ORGHIBERNATE-568162",
          "identifiers": {
            "CWE": [
              "CWE-20"
            ],
            "GHSA": [
              "GHSA-rmrm-75hp-phr2"
            ],
            "CVE": [
              "CVE-2020-10693"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2021-07-06T14:08:58.015029Z",
          "moduleName": "org.hibernate:hibernate-validator",
          "packageManager": "maven",
          "packageName": "org.hibernate:hibernate-validator",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2020-05-05T16:32:46Z",
          "references": [
            {
              "title": "GitHub PR",
              "url": "https://github.com/hibernate/hibernate-validator/pull/1071"
            },
            {
              "title": "Jira Issue",
              "url": "https://hibernate.atlassian.net/browse/HV-1758"
            },
            {
              "title": "RedHat Bugzilla Bug",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805501"
            }
          ],
          "severity": "medium",
          "socialTrendAlert": false,
          "title": "Improper Input Validation",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "cvssV3BaseScore": 5.3,
              "severity": "medium",
              "modificationTime": "2022-05-11T01:11:03.963914Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "org.hibernate.validator.internal.engine.ValidatorImpl",
                "functionName": "validate"
              },
              "version": [
                "[,6.0.19.Final)",
                "[6.1.0,6.1.3.Final)"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[,6.0.19.Final)",
              "[6.1.0,6.1.3.Final)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.hibernate",
            "artifactId": "hibernate-validator"
          },
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "org.hibernate:hibernate-validator@4.3.1.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate:hibernate-validator",
          "version": "4.3.1.Final",
          "severityWithCritical": "medium"
        },
        {
          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:R",
          "alternativeIds": [],
          "creationTime": "2020-05-14T16:07:06.897969Z",
          "credit": [
            "Unknown"
          ],
          "cvssScore": 6.5,
          "description": "## Overview\n[org.hibernate:hibernate-validator](https://mvnrepository.com/artifact/org.hibernate/hibernate-validator) is a Hibernate Validator Engine Relocation Artifact.\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS). The `SafeHtml` validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.\n## Details\n\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\n\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\n\nInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\n\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\n \nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \n\n### Types of attacks\nThere are a few methods by which XSS can be manipulated:\n\n|Type|Origin|Description|\n|--|--|--|\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\n\n### Affected environments\nThe following environments are susceptible to an XSS attack:\n\n* Web servers\n* Application servers\n* Web application environments\n\n### How to prevent\nThis section describes the top best practices designed to specifically protect your code: \n\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \n* Give users the option to disable client-side scripts.\n* Redirect invalid requests.\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n## Remediation\nUpgrade `org.hibernate:hibernate-validator` to version 6.0.18.Final, 6.1.0.Final or higher.\n## References\n- [Apache Security Advisory](https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf@%3Cnotifications.accumulo.apache.org%3E)\n- [GitHub Commit](https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee)\n- [Hibernator Security Release Blog](https://in.relation.to/2019/11/20/hibernate-validator-610-6018-released/)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219)\n",
          "disclosureTime": "2018-10-18T14:55:21Z",
          "exploit": "Unproven",
          "functions": [
            {
              "functionId": {
                "filePath": "org/hibernate/validator/internal/constraintvalidators/hv/SafeHtmlValidator.java",
                "className": "SafeHtmlValidator",
                "functionName": "getFragmentAsDocument"
              },
              "version": [
                "[,6.0.18.Final)",
                "[6.1.0.Alpha1,6.1.0.Final)"
              ]
            }
          ],
          "fixedIn": [
            "6.0.18.Final",
            "6.1.0.Final"
          ],
          "id": "SNYK-JAVA-ORGHIBERNATE-569100",
          "identifiers": {
            "CWE": [
              "CWE-79"
            ],
            "CVE": [
              "CVE-2019-10219"
            ]
          },
          "language": "java",
          "malicious": false,
          "modificationTime": "2020-12-14T14:41:02.408899Z",
          "moduleName": "org.hibernate:hibernate-validator",
          "packageManager": "maven",
          "packageName": "org.hibernate:hibernate-validator",
          "patches": [],
          "proprietary": false,
          "publicationTime": "2020-01-09T14:55:12Z",
          "references": [
            {
              "title": "Apache Security Advisory",
              "url": "https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf@%3Cnotifications.accumulo.apache.org%3E"
            },
            {
              "title": "GitHub Commit",
              "url": "https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee"
            },
            {
              "title": "Hibernator Security Release Blog",
              "url": "https://in.relation.to/2019/11/20/hibernate-validator-610-6018-released/"
            },
            {
              "title": "RedHat Bugzilla Bug",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219"
            }
          ],
          "severity": "medium",
          "socialTrendAlert": false,
          "title": "Cross-site Scripting (XSS)",
          "insights": {
            "triageAdvice": null
          },
          "cvssDetails": [
            {
              "assigner": "NVD",
              "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "cvssV3BaseScore": 6.1,
              "severity": "medium",
              "modificationTime": "2022-05-24T01:11:23.425351Z"
            }
          ],
          "functions_new": [
            {
              "functionId": {
                "className": "org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator",
                "functionName": "getFragmentAsDocument"
              },
              "version": [
                "[,6.0.18.Final)",
                "[6.1.0.Alpha1,6.1.0.Final)"
              ]
            }
          ],
          "semver": {
            "vulnerable": [
              "[,6.0.18.Final)",
              "[6.1.0.Alpha1,6.1.0.Final)"
            ]
          },
          "mavenModuleName": {
            "groupId": "org.hibernate",
            "artifactId": "hibernate-validator"
          },
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "org.hibernate:hibernate-validator@4.3.1.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate:hibernate-validator",
          "version": "4.3.1.Final",
          "severityWithCritical": "medium"
        },
        {
          "id": "snyk:lic:maven:org.aspectj:aspectjweaver:EPL-1.0",
          "packageName": "org.aspectj:aspectjweaver",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-11T15:48:31.375Z",
          "description": "EPL-1.0 license",
          "language": "java",
          "license": "EPL-1.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T15:48:31.375Z",
          "title": "EPL-1.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.aspectj:aspectjweaver@1.8.2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.aspectj:aspectjweaver",
          "version": "1.8.2",
          "severityWithCritical": "medium"
        },
        {
          "id": "snyk:lic:maven:org.hibernate.common:hibernate-commons-annotations:LGPL-2.1",
          "packageName": "org.hibernate.common:hibernate-commons-annotations",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-11T02:03:20.921Z",
          "description": "LGPL-2.1 license",
          "language": "java",
          "license": "LGPL-2.1",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T02:03:20.921Z",
          "title": "LGPL-2.1 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "org.hibernate.common:hibernate-commons-annotations@4.0.5.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate.common:hibernate-commons-annotations",
          "version": "4.0.5.Final",
          "severityWithCritical": "medium"
        },
        {
          "id": "snyk:lic:maven:org.hibernate.javax.persistence:hibernate-jpa-2.1-api:EPL-1.0",
          "packageName": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
          "semver": {
            "vulnerable": [
              "[0,)"
            ]
          },
          "creationTime": "2022-09-11T03:29:28.476Z",
          "description": "EPL-1.0 license",
          "language": "java",
          "license": "EPL-1.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T03:29:28.476Z",
          "title": "EPL-1.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-core@4.3.7.Final",
            "org.hibernate.javax.persistence:hibernate-jpa-2.1-api@1.0.0.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate.javax.persistence:hibernate-jpa-2.1-api",
          "version": "1.0.0.Final",
          "severityWithCritical": "medium"
        },
        {
          "id": "snyk:lic:maven:org.hibernate:hibernate-entitymanager:LGPL-2.0",
          "packageName": "org.hibernate:hibernate-entitymanager",
          "semver": {
            "vulnerable": [
              "[3.5.0.Beta-1, 5.3.1.Final)"
            ]
          },
          "creationTime": "2022-09-11T03:11:24.569Z",
          "description": "LGPL-2.0 license",
          "language": "java",
          "license": "LGPL-2.0",
          "packageManager": "maven",
          "publicationTime": "2022-09-11T03:11:24.569Z",
          "title": "LGPL-2.0 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "io.github.snyk:todolist-core@1.0-SNAPSHOT",
            "org.hibernate:hibernate-entitymanager@4.3.7.Final"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.hibernate:hibernate-entitymanager",
          "version": "4.3.7.Final",
          "severityWithCritical": "medium"
        },
        {
          "id": "snyk:lic:maven:org.jboss.logging:jboss-logging:LGPL-2.1",
          "packageName": "org.jboss.logging:jboss-logging",
          "semver": {
            "vulnerable": [
              "[3.0.1.GA, 3.1.2.GA)"
            ]
          },
          "creationTime": "2022-09-10T14:43:45.479Z",
          "description": "LGPL-2.1 license",
          "language": "java",
          "license": "LGPL-2.1",
          "packageManager": "maven",
          "publicationTime": "2022-09-10T14:43:45.479Z",
          "title": "LGPL-2.1 license",
          "type": "license",
          "severity": "medium",
          "from": [
            "io.github.snyk:todolist-web-struts@1.0-SNAPSHOT",
            "io.github.snyk:todolist-web-common@1.0-SNAPSHOT",
            "org.hibernate:hibernate-validator@4.3.1.Final",
            "org.jboss.logging:jboss-logging@3.1.0.CR2"
          ],
          "upgradePath": [],
          "isUpgradable": false,
          "isPatchable": false,
          "isPinnable": false,
          "isRuntime": false,
          "name": "org.jboss.logging:jboss-logging",
          "version": "3.1.0.CR2",
          "severityWithCritical": "medium"
        }
      ],
      "upgrade": {
        "org.apache.struts:struts2-core@2.3.20": {
          "upgradeTo": "org.apache.struts:struts2-core@6.0.0",
          "upgrades": [
            "commons-io:commons-io@2.2",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.freemarker:freemarker@2.3.19",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "commons-fileupload:commons-fileupload@1.3.1",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "commons-fileupload:commons-fileupload@1.3.1",
            "commons-fileupload:commons-fileupload@1.3.1",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts.xwork:xwork-core@2.3.20",
            "org.apache.struts.xwork:xwork-core@2.3.20",
            "org.apache.struts.xwork:xwork-core@2.3.20",
            "ognl:ognl@3.0.6",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts.xwork:xwork-core@2.3.20",
            "org.apache.struts.xwork:xwork-core@2.3.20",
            "org.apache.struts.xwork:xwork-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts.xwork:xwork-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts:struts2-core@2.3.20",
            "org.apache.struts.xwork:xwork-core@2.3.20",
            "org.apache.struts.xwork:xwork-core@2.3.20"
          ],
          "vulns": [
            "SNYK-JAVA-COMMONSIO-1277109",
            "SNYK-JAVA-ORGAPACHESTRUTS-2635340",
            "SNYK-JAVA-ORGAPACHESTRUTS-1049003",
            "SNYK-JAVA-ORGFREEMARKER-1076795",
            "SNYK-JAVA-ORGAPACHESTRUTS-608097",
            "SNYK-JAVA-ORGAPACHESTRUTS-608098",
            "SNYK-JAVA-ORGAPACHESTRUTS-609765",
            "SNYK-JAVA-COMMONSFILEUPLOAD-30401",
            "SNYK-JAVA-ORGAPACHESTRUTS-32477",
            "SNYK-JAVA-ORGAPACHESTRUTS-31495",
            "SNYK-JAVA-ORGAPACHESTRUTS-31501",
            "SNYK-JAVA-ORGAPACHESTRUTS-31502",
            "SNYK-JAVA-ORGAPACHESTRUTS-31503",
            "SNYK-JAVA-ORGAPACHESTRUTS-31500",
            "SNYK-JAVA-ORGAPACHESTRUTS-30207",
            "SNYK-JAVA-ORGAPACHESTRUTS-30778",
            "SNYK-JAVA-COMMONSFILEUPLOAD-30082",
            "SNYK-JAVA-COMMONSFILEUPLOAD-31540",
            "SNYK-JAVA-ORGAPACHESTRUTS-30774",
            "SNYK-JAVA-ORGAPACHESTRUTS-30775",
            "SNYK-JAVA-ORGAPACHESTRUTS-30776",
            "SNYK-JAVA-ORGAPACHESTRUTS-451610",
            "SNYK-JAVA-ORGAPACHESTRUTS-460223",
            "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802",
            "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803",
            "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804",
            "SNYK-JAVA-OGNL-30474",
            "SNYK-JAVA-ORGAPACHESTRUTS-30773",
            "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799",
            "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800",
            "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801",
            "SNYK-JAVA-ORGAPACHESTRUTS-30060",
            "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798",
            "SNYK-JAVA-ORGAPACHESTRUTS-30770",
            "SNYK-JAVA-ORGAPACHESTRUTS-30771",
            "SNYK-JAVA-ORGAPACHESTRUTS-30772",
            "SNYK-JAVA-ORGAPACHESTRUTSXWORK-451611",
            "SNYK-JAVA-ORGAPACHESTRUTSXWORK-474418"
          ]
        },
        "org.springframework:spring-web@3.2.6.RELEASE": {
          "upgradeTo": "org.springframework:spring-web@5.2.22.RELEASE",
          "upgrades": [
            "org.springframework:spring-beans@3.2.6.RELEASE",
            "org.springframework:spring-beans@3.2.6.RELEASE",
            "org.springframework:spring-core@3.2.6.RELEASE",
            "org.springframework:spring-core@3.2.6.RELEASE",
            "org.springframework:spring-expression@3.2.6.RELEASE",
            "org.springframework:spring-context@3.2.6.RELEASE",
            "org.springframework:spring-web@3.2.6.RELEASE",
            "org.springframework:spring-web@3.2.6.RELEASE",
            "org.springframework:spring-web@3.2.6.RELEASE",
            "org.springframework:spring-web@3.2.6.RELEASE",
            "org.springframework:spring-core@3.2.6.RELEASE",
            "org.springframework:spring-web@3.2.6.RELEASE"
          ],
          "vulns": [
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2823313",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2330878",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-2689634",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-1009832",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-30165",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-30164",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-30163",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-31325",
            "SNYK-JAVA-ORGSPRINGFRAMEWORK-31331"
          ]
        },
        "org.zeroturnaround:zt-zip@1.12": {
          "upgradeTo": "org.zeroturnaround:zt-zip@1.13",
          "upgrades": [
            "org.zeroturnaround:zt-zip@1.12"
          ],
          "vulns": [
            "SNYK-JAVA-ORGZEROTURNAROUND-31681"
          ]
        }
      },
      "patch": {},
      "ignore": {},
      "pin": {}
    },
    "filesystemPolicy": false,
    "filtered": {
      "ignore": [],
      "patch": []
    },
    "uniqueCount": 69,
    "projectName": "io.github.snyk:todolist-web-struts",
    "foundProjectCount": 3,
    "displayTargetFile": "todolist-web-struts/pom.xml",
    "path": "/Users/ksuzy31/Kev-Stuff/Java-Goof/java-goof"
  }
]