{"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json","version": "2.1.0","runs": [{"tool": {"driver": {"name": "dependency-check","version": "9.0.9","informationUri": "https://jeremylong.github.io/DependencyCheck/","rules": [{"id": "CVE-2019-17359","shortDescription": {"text": "high severity - CVE-2019-17359 Allocation of Resources Without Limits or Throttling vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64."},"help": {"text": "","markdown": "For more information see [CVE-2019-17359](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17359).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "NONE","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "PARTIAL","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 7.5,"security-severity": "7.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2022-45688","shortDescription": {"text": "high severity - CVE-2022-45688 Out-of-bounds Write vulnerability in pkg:maven\/org.json\/json@20220320"},"fullDescription": {"text": "A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data."},"help": {"text": "","markdown": "For more information see [CVE-2022-45688](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-45688).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 7.5,"security-severity": "7.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2023-5072","shortDescription": {"text": "high severity - CVE-2023-5072 Allocation of Resources Without Limits or Throttling vulnerability in pkg:maven\/org.json\/json@20220320"},"fullDescription": {"text": "Denial of Service  in JSON-Java versions up to and including 20230618. \uFFFD\uFFFDA bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.\uFFFD\uFFFD\n"},"help": {"text": "","markdown": "For more information see [CVE-2023-5072](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-5072).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 7.5,"security-severity": "7.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2016-1000344","shortDescription": {"text": "high severity - CVE-2016-1000344 Cryptographic Issues vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider."},"help": {"text": "","markdown": "For more information see [CVE-2016-1000344](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000344).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.8,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "PARTIAL","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 7.4,"security-severity": "7.4","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "HIGH","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "HIGH","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "2.2","cvssv3_impactScore": "5.2","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2017-13098","shortDescription": {"text": "medium severity - CVE-2017-13098 Observable Discrepancy vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as \"ROBOT.\""},"help": {"text": "","markdown": "For more information see [CVE-2017-13098](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13098).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 4.3,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 5.9,"security-severity": "5.9","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "HIGH","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.2","cvssv3_impactScore": "3.6","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2016-1000343","shortDescription": {"text": "high severity - CVE-2016-1000343 Cryptographic Issues vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator."},"help": {"text": "","markdown": "For more information see [CVE-2016-1000343](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000343).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 7.5,"security-severity": "7.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "3.6","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2016-1000346","shortDescription": {"text": "low severity - CVE-2016-1000346 Key Management Errors vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation."},"help": {"text": "","markdown": "For more information see [CVE-2016-1000346](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000346).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 4.3,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 3.7,"security-severity": "3.7","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "HIGH","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "LOW","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "LOW","cvssv3_exploitabilityScore": "2.2","cvssv3_impactScore": "1.4","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2016-1000345","shortDescription": {"text": "medium severity - CVE-2016-1000345 7PK - Time and State vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES\/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding."},"help": {"text": "","markdown": "For more information see [CVE-2016-1000345](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000345).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 4.3,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 5.9,"security-severity": "5.9","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "HIGH","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.2","cvssv3_impactScore": "3.6","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2016-1000342","shortDescription": {"text": "high severity - CVE-2016-1000342 Improper Verification of Cryptographic Signature vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure."},"help": {"text": "","markdown": "For more information see [CVE-2016-1000342](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000342).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "NONE","cvssv2_integrityImpact": "PARTIAL","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 7.5,"security-severity": "7.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "HIGH","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "3.6","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2016-1000341","shortDescription": {"text": "medium severity - CVE-2016-1000341 7PK - Time and State vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well."},"help": {"text": "","markdown": "For more information see [CVE-2016-1000341](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000341).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 4.3,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 5.9,"security-severity": "5.9","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "HIGH","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.2","cvssv3_impactScore": "3.6","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2022-31159","shortDescription": {"text": "medium severity - CVE-2022-31159 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pkg:maven\/com.amazonaws\/aws-java-sdk-core@1.11.415"},"fullDescription": {"text": "The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. This issue\uFFFD\uFFFD\uFFFDs scope is limited to directories whose name prefix matches the destinationDirectory. E.g. for destination directory`\/tmp\/foo`, the actor can cause a download to `\/tmp\/foo-bar`, but not `\/tmp\/bar`. If `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory` is used to download an untrusted buckets contents, the contents of that bucket can be written outside of the intended destination directory. Version 1.12.261 contains a patch for this issue. As a workaround, when calling `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory`, pass a `KeyFilter` that forbids `S3ObjectSummary` objects that `getKey` method return a string containing the substring `..` ."},"help": {"text": "","markdown": "For more information see [CVE-2022-31159](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-31159).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 6.5,"security-severity": "6.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "LOW","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.8","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2024-21634","shortDescription": {"text": "high severity - CVE-2024-21634 Allocation of Resources Without Limits or Throttling vulnerability in pkg:maven\/software.amazon.ion\/ion-java@1.0.2"},"fullDescription": {"text": "Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in\uFFFD\uFFFD`ion-java`\uFFFD\uFFFDfor applications that use\uFFFD\uFFFD`ion-java`\uFFFD\uFFFDto deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the\uFFFD\uFFFD`IonValue`\uFFFD\uFFFDmodel and then invoke certain\uFFFD\uFFFD`IonValue`\uFFFD\uFFFDmethods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and\/or processed using the\uFFFD\uFFFD`IonValue`\uFFFD\uFFFDmodel, results in a\uFFFD\uFFFD`StackOverflowError`\uFFFD\uFFFDoriginating from the\uFFFD\uFFFD`ion-java`\uFFFD\uFFFDlibrary. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with."},"help": {"text": "","markdown": "For more information see [CVE-2024-21634](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21634).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 7.5,"security-severity": "7.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2007-6721","shortDescription": {"text": "high severity - CVE-2007-6721 vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to \"a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes.\""},"help": {"text": "","markdown": "For more information see [CVE-2007-6721](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-6721).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 10.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "COMPLETE","cvssv2_integrityImpact": "COMPLETE","cvssv2_availabilityImpact": "COMPLETE","cvssv2_severity": "HIGH","source": "NVD"}},{"id": "CVE-2023-33202","shortDescription": {"text": "medium severity - CVE-2023-33202 Uncontrolled Resource Consumption vulnerability in pkg:maven\/org.bouncycastle\/bctsp-jdk14@1.38"},"fullDescription": {"text": "Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)"},"help": {"text": "","markdown": "For more information see [CVE-2023-33202](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-33202).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 5.5,"security-severity": "5.5","cvssv3_attackVector": "LOCAL","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "REQUIRED","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "1.8","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2020-5410","shortDescription": {"text": "high severity - CVE-2020-5410 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pkg:maven\/org.springframework.cloud\/spring-cloud-aws-autoconfigure@2.1.3.RELEASE *Known Exploited Vulnerability*"},"fullDescription": {"text": "CISA Known Exploited Vulnerability\nVendor\/Project: VMware Tanzu\nProduct: Spring Cloud Configuration (Config) Server\nVulnerability Name: VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability\nDate Added: 2022-03-25\nShort Description: Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.\nRequired Action: Apply updates per vendor instructions.\nDue Date2022-04-15\n\nSpring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack."},"help": {"text": "","markdown": "For more information see [CVE-2020-5410](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-5410).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 7.5,"security-severity": "7.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2023-28360","shortDescription": {"text": "medium severity - CVE-2023-28360 vulnerability in pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"},"fullDescription": {"text": "An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file there was no download safety check dialog presented to the user."},"help": {"text": "","markdown": "For more information see [CVE-2023-28360](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28360).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 4.3,"security-severity": "4.3","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "LOW","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "LOW","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.8","cvssv3_impactScore": "1.4","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2013-1624","shortDescription": {"text": "medium severity - CVE-2013-1624 Cryptographic Issues vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169."},"help": {"text": "","markdown": "For more information see [CVE-2013-1624](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1624).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 4.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "HIGH","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "PARTIAL","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","source": "NVD"}},{"id": "CVE-2020-26939","shortDescription": {"text": "medium severity - CVE-2020-26939 Observable Discrepancy vulnerability in pkg:maven\/bouncycastle\/bcmail-jdk14@138"},"fullDescription": {"text": "In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption."},"help": {"text": "","markdown": "For more information see [CVE-2020-26939](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26939).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 5.3,"security-severity": "5.3","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "LOW","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "1.4","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2022-24197","shortDescription": {"text": "medium severity - CVE-2022-24197 Out-of-bounds Write vulnerability in pkg:maven\/com.lowagie\/itext@2.1.7"},"fullDescription": {"text": "iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file."},"help": {"text": "","markdown": "For more information see [CVE-2022-24197](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24197).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 4.3,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "NONE","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "PARTIAL","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 6.5,"security-severity": "6.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "REQUIRED","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.8","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2022-24196","shortDescription": {"text": "medium severity - CVE-2022-24196 Allocation of Resources Without Limits or Throttling vulnerability in pkg:maven\/com.lowagie\/itext@2.1.7"},"fullDescription": {"text": "iText v7.1.17, up to (exluding)\": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file."},"help": {"text": "","markdown": "For more information see [CVE-2022-24196](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24196).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 4.3,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "NONE","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "PARTIAL","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 6.5,"security-severity": "6.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "REQUIRED","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.8","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2020-8276","shortDescription": {"text": "medium severity - CVE-2020-8276 Cleartext Storage of Sensitive Information vulnerability in pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"},"fullDescription": {"text": "The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an incognito window, including Tor windows. The intended behavior was to log the timestamp for incognito windows excluding Tor windows. Note that if a user has P3A enabled, the timestamp is not sent to Brave's server, but rather a value from:Used in last 24hUsed in last week but not 24hUsed in last 28 days but not weekEver used but not in last 28 daysNever usedThe privacy risk is low because a local attacker with disk access cannot tell if the timestamp corresponds to a Tor window or a non-Tor incognito window."},"help": {"text": "","markdown": "For more information see [CVE-2020-8276](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8276).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 2.1,"cvssv2_accessVector": "LOCAL","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "LOW","cvssv3_baseScore": 5.5,"security-severity": "5.5","cvssv3_attackVector": "LOCAL","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "LOW","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "1.8","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2022-47932","shortDescription": {"text": "medium severity - CVE-2022-47932 vulnerability in pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"},"fullDescription": {"text": "Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:\/\/ or ipns:\/\/ URL. This vulnerability is caused by an incomplete fix for CVE-2022-47933."},"help": {"text": "","markdown": "For more information see [CVE-2022-47932](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47932).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 6.5,"security-severity": "6.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "REQUIRED","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.8","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2016-1000339","shortDescription": {"text": "medium severity - CVE-2016-1000339 Cryptographic Issues vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate."},"help": {"text": "","markdown": "For more information see [CVE-2016-1000339](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000339).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 5.3,"security-severity": "5.3","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "LOW","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "1.4","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2022-47933","shortDescription": {"text": "medium severity - CVE-2022-47933 Improper Handling of Exceptional Conditions vulnerability in pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"},"fullDescription": {"text": "Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequest_IPFSRedirectWork() in ipfs_redirect_network_delegate_helper.cc."},"help": {"text": "","markdown": "For more information see [CVE-2022-47933](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47933).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 6.5,"security-severity": "6.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "REQUIRED","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.8","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2016-1000338","shortDescription": {"text": "high severity - CVE-2016-1000338 Improper Verification of Cryptographic Signature vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure."},"help": {"text": "","markdown": "For more information see [CVE-2016-1000338](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000338).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "NONE","cvssv2_integrityImpact": "PARTIAL","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 7.5,"security-severity": "7.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "HIGH","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "3.6","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2022-47934","shortDescription": {"text": "medium severity - CVE-2022-47934 vulnerability in pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"},"fullDescription": {"text": "Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:\/\/ or ipns:\/\/ URL. This is caused by an incomplete fix for CVE-2022-47932 and CVE-2022-47934."},"help": {"text": "","markdown": "For more information see [CVE-2022-47934](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-47934).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 6.5,"security-severity": "6.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "REQUIRED","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.8","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2023-51074","shortDescription": {"text": "medium severity - CVE-2023-51074 vulnerability in pkg:maven\/com.jayway.jsonpath\/json-path@2.8.0"},"fullDescription": {"text": "json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method."},"help": {"text": "","markdown": "For more information see [CVE-2023-51074](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51074).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 5.3,"security-severity": "5.3","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "LOW","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "1.4","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2018-5382","shortDescription": {"text": "medium severity - CVE-2018-5382 Use of a Broken or Risky Cryptographic Algorithm vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type \"BKS-V1\" was introduced in 1.49. It should be noted that the use of \"BKS-V1\" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself."},"help": {"text": "","markdown": "For more information see [CVE-2018-5382](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5382).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 3.6,"cvssv2_accessVector": "LOCAL","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "PARTIAL","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "LOW","cvssv3_baseScore": 4.4,"security-severity": "4.4","cvssv3_attackVector": "LOCAL","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "LOW","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "LOW","cvssv3_integrityImpact": "LOW","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "1.8","cvssv3_impactScore": "2.5","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2021-22929","shortDescription": {"text": "medium severity - CVE-2021-22929 Insertion of Sensitive Information into Log File vulnerability in pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"},"fullDescription": {"text": "An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log."},"help": {"text": "","markdown": "For more information see [CVE-2021-22929](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-22929).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 3.6,"cvssv2_accessVector": "LOCAL","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "PARTIAL","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "LOW","cvssv3_baseScore": 6.1,"security-severity": "6.1","cvssv3_attackVector": "LOCAL","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "LOW","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "LOW","cvssv3_integrityImpact": "HIGH","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "1.8","cvssv3_impactScore": "4.2","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2023-22102","shortDescription": {"text": "high severity - CVE-2023-22102 vulnerability in pkg:maven\/com.mysql\/mysql-connector-j@8.0.32"},"fullDescription": {"text": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector\/J).  Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H)."},"help": {"text": "","markdown": "For more information see [CVE-2023-22102](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-22102).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 8.3,"security-severity": "8.3","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "HIGH","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "REQUIRED","cvssv3_scope": "CHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "HIGH","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "1.6","cvssv3_impactScore": "6.0","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2020-28052","shortDescription": {"text": "high severity - CVE-2020-28052 vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different."},"help": {"text": "","markdown": "For more information see [CVE-2020-28052](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28052).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 6.8,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "PARTIAL","cvssv2_availabilityImpact": "PARTIAL","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 8.1,"security-severity": "8.1","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "HIGH","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "HIGH","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "2.2","cvssv3_impactScore": "5.9","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2020-13956","shortDescription": {"text": "medium severity - CVE-2020-13956 vulnerability in pkg:maven\/org.apache.httpcomponents\/httpclient@4.5.5"},"fullDescription": {"text": "Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution."},"help": {"text": "","markdown": "For more information see [CVE-2020-13956](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13956).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "NONE","cvssv2_integrityImpact": "PARTIAL","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 5.3,"security-severity": "5.3","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "LOW","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "1.4","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2016-1000352","shortDescription": {"text": "high severity - CVE-2016-1000352 Cryptographic Issues vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider."},"help": {"text": "","markdown": "For more information see [CVE-2016-1000352](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000352).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.8,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "PARTIAL","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 7.4,"security-severity": "7.4","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "HIGH","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "HIGH","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "2.2","cvssv3_impactScore": "5.2","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2022-30334","shortDescription": {"text": "medium severity - CVE-2022-30334 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"},"fullDescription": {"text": "Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave, the Brave documentation still advises \"Note that Private Windows with Tor Connectivity in Brave are just regular private windows that use Tor as a proxy. Brave does NOT implement most of the privacy protections from Tor Browser.\""},"help": {"text": "","markdown": "For more information see [CVE-2022-30334](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-30334).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 5.3,"security-severity": "5.3","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "LOW","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "3.9","cvssv3_impactScore": "1.4","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2016-2427","shortDescription": {"text": "medium severity - CVE-2016-2427 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug 26234568.  NOTE: The vendor disputes the existence of this potential issue in Android, stating \"This CVE was raised in error: it referred to the authentication tag size in GCM, whose default according to ASN.1 encoding (12 bytes) can lead to vulnerabilities. After careful consideration, it was decided that the insecure default value of 12 bytes was a default only for the encoding and not default anywhere else in Android, and hence no vulnerability existed."},"help": {"text": "","markdown": "For more information see [CVE-2016-2427](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2427).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 4.3,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 5.5,"security-severity": "5.5","cvssv3_attackVector": "LOCAL","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "REQUIRED","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "1.8","cvssv3_impactScore": "3.6","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2020-5405","shortDescription": {"text": "medium severity - CVE-2020-5405 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pkg:maven\/org.springframework.cloud\/spring-cloud-aws-autoconfigure@2.1.3.RELEASE"},"fullDescription": {"text": "Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack."},"help": {"text": "","markdown": "For more information see [CVE-2020-5405](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-5405).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 4.3,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "NONE","cvssv2_integrityImpact": "PARTIAL","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 6.5,"security-severity": "6.5","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "REQUIRED","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "HIGH","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.8","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2020-15522","shortDescription": {"text": "medium severity - CVE-2020-15522 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures."},"help": {"text": "","markdown": "For more information see [CVE-2020-15522](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15522).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 4.3,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 5.9,"security-severity": "5.9","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "HIGH","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "NONE","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "2.2","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2023-35116","shortDescription": {"text": "medium severity - CVE-2023-35116 Allocation of Resources Without Limits or Throttling vulnerability in pkg:maven\/com.fasterxml.jackson.core\/jackson-databind@2.15.3"},"fullDescription": {"text": "jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker."},"help": {"text": "","markdown": "For more information see [CVE-2023-35116](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-35116).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv3_baseScore": 4.7,"security-severity": "4.7","cvssv3_attackVector": "LOCAL","cvssv3_attackComplexity": "HIGH","cvssv3_privilegesRequired": "LOW","cvssv3_userInteraction": "NONE","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "NONE","cvssv3_integrityImpact": "NONE","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "MEDIUM","cvssv3_exploitabilityScore": "1.0","cvssv3_impactScore": "3.6","cvssv3_version": "_3_1","source": "NVD"}},{"id": "CVE-2017-9096","shortDescription": {"text": "high severity - CVE-2017-9096 Improper Restriction of XML External Entity Reference vulnerability in pkg:maven\/com.lowagie\/itext@2.1.7"},"fullDescription": {"text": "The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF."},"help": {"text": "","markdown": "For more information see [CVE-2017-9096](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9096).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 6.8,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "MEDIUM","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "PARTIAL","cvssv2_availabilityImpact": "PARTIAL","cvssv2_severity": "MEDIUM","cvssv3_baseScore": 8.8,"security-severity": "8.8","cvssv3_attackVector": "NETWORK","cvssv3_attackComplexity": "LOW","cvssv3_privilegesRequired": "NONE","cvssv3_userInteraction": "REQUIRED","cvssv3_scope": "UNCHANGED","cvssv3_confidentialityImpact": "HIGH","cvssv3_integrityImpact": "HIGH","cvssv3_availabilityImpact": "HIGH","cvssv3_baseSeverity": "HIGH","cvssv3_exploitabilityScore": "2.8","cvssv3_impactScore": "5.9","cvssv3_version": "_3_0","source": "NVD"}},{"id": "CVE-2015-7940","shortDescription": {"text": "medium severity - CVE-2015-7940 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in pkg:maven\/bouncycastle\/bcprov-jdk14@138"},"fullDescription": {"text": "The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an \"invalid curve attack.\""},"help": {"text": "","markdown": "For more information see [CVE-2015-7940](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7940).\n\n\nIf this is a false positive - consider using the HTML report to generate a suppression file. For more information see [How dependency-check works](https://jeremylong.github.io/DependencyCheck/general/internals.html), [How to read the HTML report](https://jeremylong.github.io/DependencyCheck/general/thereport.html), and [Suppressing false positives](https://jeremylong.github.io/DependencyCheck/general/suppression.html)."},"properties": {"cvssv2_score": 5.0,"cvssv2_accessVector": "NETWORK","cvssv2_accessComplexity": "LOW","cvssv2_authenticationr": "NONE","cvssv2_confidentialityImpact": "PARTIAL","cvssv2_integrityImpact": "NONE","cvssv2_availabilityImpact": "NONE","cvssv2_severity": "MEDIUM","source": "NVD"}}],"properties": {"disclaimer": "Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.","nvd": "This product uses the NVD API but is not endorsed or certified by the NVD. This report contains data retrieved from the National Vulnerability Database: https://nvd.nist.gov","cisa": "This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog","npm": "This report may contain data retrieved from the the Github Advisory Database (via NPM Audit API): https://github.com/advisories/","retirejs": "This report may contain data retrieved from the RetireJS community: https://retirejs.github.io/retire.js/","ossindex": "This report may contain data retrieved from the Sonatype OSS Index: https://ossindex.sonatype.org","NVD API Last Checked": "2024-03-08T11:43:45+0530","NVD API Last Modified": "2024-03-08T05:15:08Z"}}},"artifacts": [{"description": {"text": "\n        HdrHistogram supports the recording and analyzing sampled data value\n        counts across a configurable integer value range with configurable value\n        precision within the range. Value precision is expressed as the number of\n        significant digits in the value recording, and provides control over value\n        quantization behavior across the value range and the subsequent value\n        resolution at any given level.\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/hdrhistogram\/HdrHistogram\/2.1.12\/HdrHistogram-2.1.12.jar"},"hashes": {"md5": "4b1acf3448b750cb485da7e37384fcd8","sha1": "6eb7552156e0d517ae80cc2247be1427c8d90452","sha256": "9b47fbae444feaac4b7e04f0ea294569e4bc282bc69d8c2ce2ac3f23577281e2"},"properties": {"license": "Public Domain, per Creative Commons CC0: http:\/\/creativecommons.org\/publicdomain\/zero\/1.0\/\nBSD-2-Clause: https:\/\/opensource.org\/licenses\/BSD-2-Clause","id1": "pkg:maven\/org.hdrhistogram\/HdrHistogram@2.1.12"}},{"description": {"text": "Ultimate JDBC Connection Pool"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/zaxxer\/HikariCP\/5.0.1\/HikariCP-5.0.1.jar"},"hashes": {"md5": "3bc96d2ce8285470da11ec41bff6129f","sha1": "a74c7f0a37046846e88d54f7cb6ea6d565c65f9c","sha256": "26d492397e6775b4296737a8919bf04047afe5827fdd2c08b4557595436b3a2b"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id2": "pkg:maven\/com.zaxxer\/HikariCP@5.0.1"}},{"description": {"text": "\n        LatencyUtils is a package that provides latency recording and reporting utilities.\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/latencyutils\/LatencyUtils\/2.0.3\/LatencyUtils-2.0.3.jar"},"hashes": {"md5": "2ad12e1ef7614cecfb0483fa9ac6da73","sha1": "769c0b82cb2421c8256300e907298a9410a2a3d3","sha256": "a32a9ffa06b2f4e01c5360f8f9df7bc5d9454a5d373cd8f361347fa5a57165ec"},"properties": {"license": "Public Domain, per Creative Commons CC0: http:\/\/creativecommons.org\/publicdomain\/zero\/1.0\/","id3": "pkg:maven\/org.latencyutils\/LatencyUtils@2.0.3","vid1": "cpe:2.3:a:utils_project:utils:2.0.3:*:*:*:*:*:*:*"}},{"description": {"text": "Java reflect give poor performance on getter setter an constructor calls, accessors-smart use ASM to speed up those calls."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/net\/minidev\/accessors-smart\/2.5.0\/accessors-smart-2.5.0.jar"},"hashes": {"md5": "fc814b28882dd9f2552eda21add0698f","sha1": "aca011492dfe9c26f4e0659028a4fe0970829dd8","sha256": "12314fc6881d66a413fd66370787adba16e504fbf7e138690b0f3952e3fbd321"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id4": "pkg:maven\/net.minidev\/accessors-smart@2.5.0"}},{"description": {"text": "The JavaBeans(TM) Activation Framework is used by the JavaMail(TM) API to manage MIME data"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/javax\/activation\/activation\/1.1.1\/activation-1.1.1.jar"},"hashes": {"md5": "46a37512971d8eca81c3fcf245bf07d2","sha1": "485de3a253e23f645037828c07f1d7f1af40763a","sha256": "ae475120e9fcd99b4b00b38329bd61cdc5eb754eee03fe66c01f50e137724f99"},"properties": {"license": "COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0: https:\/\/glassfish.dev.java.net\/public\/CDDLv1.0.html","id5": "pkg:maven\/javax.activation\/activation@1.1.1","vid2": "cpe:2.3:a:oracle:java_se:1.1.1:*:*:*:*:*:*:*"}},{"description": {"text": "The RabbitMQ Java client library allows Java applications to interface with RabbitMQ."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/rabbitmq\/amqp-client\/5.19.0\/amqp-client-5.19.0.jar"},"hashes": {"md5": "66dd87e201ca617388a786db0edf6be2","sha1": "6bd68c3cdf2662a9fbff8de5b9ef2b0fb1e6fe57","sha256": "d2c7a35031bf7f101b9cfcb5f58b201201b1f8232b6608171db7befe3a2b860d"},"properties": {"license": "AL 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.html\nGPL v2: https:\/\/www.gnu.org\/licenses\/gpl-2.0.txt\nMPL 2.0: https:\/\/www.mozilla.org\/en-US\/MPL\/2.0\/","id6": "pkg:maven\/com.rabbitmq\/amqp-client@5.19.0","vid3": "cpe:2.3:a:vmware:rabbitmq:5.19.0:*:*:*:*:*:*:*","vid4": "cpe:2.3:a:vmware:rabbitmq_java_client:5.19.0:*:*:*:*:*:*:*"}},{"description": {"text": "AOP Alliance"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/aopalliance\/aopalliance\/1.0\/aopalliance-1.0.jar"},"hashes": {"md5": "04177054e180d09e3998808efa0401c7","sha1": "0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8","sha256": "0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08"},"properties": {"license": "Public Domain","id7": "pkg:maven\/aopalliance\/aopalliance@1.0"}},{"description": {"text": "ASM, a very small and fast Java bytecode manipulation framework"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/ow2\/asm\/asm\/9.3\/asm-9.3.jar"},"hashes": {"md5": "e1c3b96035117ab516ffe0de9bd696e0","sha1": "8e6300ef51c1d801a7ed62d07cd221aca3a90640","sha256": "1263369b59e29c943918de11d6d6152e2ec6085ce63e5710516f8c67d368e4bc"},"properties": {"license": "BSD-3-Clause: https:\/\/asm.ow2.io\/license.html","id8": "pkg:maven\/org.ow2.asm\/asm@9.3"}},{"description": {"text": "The AspectJ weaver applies aspects to Java classes. It can be used as a Java agent in order to apply load-time\n\t\tweaving (LTW) during class-loading and also contains the AspectJ runtime classes."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/aspectj\/aspectjweaver\/1.9.21\/aspectjweaver-1.9.21.jar"},"hashes": {"md5": "5ad410e23382a98266021f68afbbbfc1","sha1": "beaabaea95c7f3330f415c72ee0ffe79b51d172f","sha256": "cc3397d9d3a114894756fc67779941f5f04b06e32e41aa9408564c671a1504ba"},"properties": {"license": "Eclipse Public License - v 2.0: https:\/\/www.eclipse.org\/org\/documents\/epl-2.0\/EPL-2.0.txt","id9": "pkg:maven\/org.aspectj\/aspectjweaver@1.9.21"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/netfoundry\/authorization\/2.5.0\/authorization-2.5.0-client.jar"},"hashes": {"md5": "828500de112e915aa84dff479db791a6","sha1": "858840de0a3140dfa39dab2836ec4459e7063d51","sha256": "d1dfc1f27017771e7eb016a26f74c130b02616c00953f3d94c2823d336c0ee99"},"properties": {"id10": "pkg:maven\/io.netfoundry\/authorization@2.5.0","vid5": "cpe:2.3:a:service_project:service:2.5.0:*:*:*:*:*:*:*"}},{"description": {"text": "The AWS SDK for Java - Core module holds the classes that are used by the individual service clients to interact with Amazon Web Services. Users need to depend on aws-java-sdk artifact for accessing individual client classes."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/amazonaws\/aws-java-sdk-core\/1.11.415\/aws-java-sdk-core-1.11.415.jar"},"hashes": {"md5": "ab40e2f3862cb47b134ccba08ce31f29","sha1": "9e9bd0bfd6173dbe603ef3a386a3b604f62b06d2","sha256": "bea087c5e4cd4fad559e50439ac50cc7464e26c570d8e0469ba6542af4297fc9"},"properties": {"id11": "pkg:maven\/com.amazonaws\/aws-java-sdk-core@1.11.415","vid6": "cpe:2.3:a:amazon:aws-sdk-java:1.11.415:*:*:*:*:*:*:*"}},{"description": {"text": "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the newly released J2ME) with the additional infrastructure to conform the algorithms to the JCE framework."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcmail-jdk14\/138\/bcmail-jdk14-138.jar"},"hashes": {"md5": "e2c72e958b82b9373c13739c9f14009c","sha1": "14ff2dfec8578f5f6838c4d6a77a86789afe5382","sha256": "389f405cfa66b26004484733937a22624782a5d86456e0c35e007b60ebc8e359"},"properties": {"license": "Bouncy Castle License: http:\/\/www.bouncycastle.org\/licence.html","id12": "pkg:maven\/bouncycastle\/bcmail-jdk14@138","id13": "pkg:maven\/org.bouncycastle\/bcmail-jdk14@1.38","vid7": "cpe:2.3:a:bouncycastle:bouncy_castle_for_java:138:*:*:*:*:*:*:*","vid8": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:*:*:*:*:*:*:*:*"}},{"description": {"text": "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the newly released J2ME) with the additional infrastructure to conform the algorithms to the JCE framework."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar"},"hashes": {"md5": "2cb031d0966bfebbdb7c60f799b24dc9","sha1": "de366c3243a586eb3c0e2bcde1ed9bb1bfb985ff","sha256": "d60b88c5d1932de8d98edd5a3ae2d5d5647793de3eb6157015807ee523cd2bee"},"properties": {"license": "Bouncy Castle License: http:\/\/www.bouncycastle.org\/licence.html","id14": "pkg:maven\/bouncycastle\/bcprov-jdk14@138","id15": "pkg:maven\/org.bouncycastle\/bcprov-jdk14@1.38","vid9": "cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:*:*:*:*:*:*:*:*","vid10": "cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:*:*:*:*:*:*:*:*","vid11": "cpe:2.3:a:bouncycastle:bouncy_castle_for_java:138:*:*:*:*:*:*:*","vid12": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:*:*:*:*:*:*:*:*","vid13": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:*:*:*:*:*:*:*:*","vid14": "cpe:2.3:a:bouncycastle:the_bouncy_castle_crypto_package_for_java:*:*:*:*:*:*:*:*"}},{"description": {"text": "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/bouncycastle\/bcprov-jdk18on\/1.74\/bcprov-jdk18on-1.74.jar"},"hashes": {"md5": "b441bbeeb92a6eac2f7da72cec7928ad","sha1": "8753dedf57165efdb1a7a69a90fe49a77353efb9","sha256": "56ede1472d78dc47b8a16fc5e90c02b9eeb970b55d8b5b8bfe760311907821e9"},"properties": {"license": "Bouncy Castle Licence: https:\/\/www.bouncycastle.org\/licence.html","id16": "pkg:maven\/org.bouncycastle\/bcprov-jdk18on@1.74","vid15": "cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.74:*:*:*:*:*:*:*","vid16": "cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:1.74:*:*:*:*:*:*:*","vid17": "cpe:2.3:a:bouncycastle:bouncy_castle_for_java:1.74:*:*:*:*:*:*:*","vid18": "cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.74:*:*:*:*:*:*:*","vid19": "cpe:2.3:a:bouncycastle:the_bouncy_castle_crypto_package_for_java:1.74:*:*:*:*:*:*:*"}},{"description": {"text": "The Bouncy Castle Java API for handling the Time Stamp Protocol (TSP). This jar contains the TSP API for JDK 1.4. The APIs can be used in conjunction with a JCE\/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/bouncycastle\/bctsp-jdk14\/1.38\/bctsp-jdk14-1.38.jar"},"hashes": {"md5": "7eb22fff640e0631b6af47ebd6de4924","sha1": "4821122f8390d15f4b5ee652621e2a2bb1f1bf16","sha256": "ecbbe4d19c256e4dbfec3454b82b4d24b149f90f3f9c90e6aaef229463cd4da8"},"properties": {"license": "Bouncy Castle Licence: http:\/\/www.bouncycastle.org\/licence.html","id17": "pkg:maven\/org.bouncycastle\/bctsp-jdk14@1.38","vid20": "cpe:2.3:a:bouncycastle:bouncy_castle_for_java:1.38:*:*:*:*:*:*:*"}},{"description": {"text": "Brave: Core Libary"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/zipkin\/brave\/brave\/5.16.0\/brave-5.16.0.jar"},"hashes": {"md5": "776aa6c193375be04565cfe649446635","sha1": "43b7ffb77b1e8b6db8dade125d9ed65369d00733","sha256": "6c871c1259bfd1f4b3924858df8ecfa1a66a2c9df01c6c063104f123fbcbfb35"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id18": "pkg:maven\/io.zipkin.brave\/brave@5.16.0","vid21": "cpe:2.3:a:brave:brave:5.16.0:*:*:*:*:*:*:*"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/zipkin\/aws\/brave-propagation-aws\/0.23.5\/brave-propagation-aws-0.23.5.jar"},"hashes": {"md5": "e70b8c05fdcce8494d180d10cc5fcb8a","sha1": "94dafc941dac5a7bf686292d3a3aebd579dec45c","sha256": "ea9fab5cd43ac7854bad195f3a05626be8e046811a844c3a592295d522c0fc41"},"properties": {"id19": "pkg:maven\/io.zipkin.aws\/brave-propagation-aws@0.23.5","vid22": "cpe:2.3:a:web_project:web:0.23.5:*:*:*:*:*:*:*"}},{"description": {"text": "\n        Byte Buddy is a Java library for creating Java classes at run time.\n        This artifact is a build of Byte Buddy with all ASM dependencies repackaged into its own name space.\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/net\/bytebuddy\/byte-buddy\/1.14.11\/byte-buddy-1.14.11.jar"},"hashes": {"md5": "c28e36075a114b176953fc10a5370be7","sha1": "725602eb7c8c56b51b9c21f273f9df5c909d9e7d","sha256": "62ae28187ed2b062813da6a9d567bfee733c341582699b62dd980230729a0313"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id20": "pkg:maven\/net.bytebuddy\/byte-buddy@1.14.11"}},{"description": {"text": "a JDBC Connection pooling \/ Statement caching library"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/mchange\/c3p0\/0.9.5.5\/c3p0-0.9.5.5.jar"},"hashes": {"md5": "9fc982b4b179e44cec986ea86fe1bff7","sha1": "37dfc3021e5589d65ff2ae0becf811510b87ab01","sha256": "96cec5ddfe2f08b8407125d8228eb0392121e1bf2239ca621bb19228b67f741a"},"properties": {"license": "GNU Lesser General Public License, Version 2.1: http:\/\/www.gnu.org\/licenses\/lgpl-2.1.html\nEclipse Public License, Version 1.0: http:\/\/www.eclipse.org\/org\/documents\/epl-v10.php","id21": "pkg:maven\/com.mchange\/c3p0@0.9.5.5","vid23": "cpe:2.3:a:mchange:c3p0:0.9.5.5:*:*:*:*:*:*:*"}},{"description": {"text": "\n     The Apache Commons Codec package contains simple encoder and decoders for\n     various formats such as Base64 and Hexadecimal.  In addition to these\n     widely used encoders and decoders, the codec package also maintains a\n     collection of phonetic encoding utilities.\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/chargebee\/chargebee-java\/2.17.0\/chargebee-java-2.17.0.jar\/META-INF\/maven\/commons-codec\/commons-codec\/pom.xml"},"hashes": {"md5": "cbaa396d7b6a2483227c60d834bf9c28","sha1": "c08f2dcdbba1a9466f3f9fa05e669fd61c3a47b7","sha256": "c86ee198a35a3715487860f419cbf642e7e4d9e8714777947dbe6a4e3a20ab58"},"properties": {"id22": "pkg:maven\/commons-codec\/commons-codec@1.15"}},{"description": {"text": "Java client library for ChargeBee API"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/chargebee\/chargebee-java\/2.17.0\/chargebee-java-2.17.0.jar"},"hashes": {"md5": "397301a32ab69f3f79e3a02daa3d5080","sha1": "d0c2c4dd90421ec2e5fd1d6af7319a7ac17f24bc","sha256": "163aef30e27c0bcbcf7caf1623f3bc9bdedfbda02c41fdc6bfe39429dbef56cc"},"properties": {"id23": "pkg:maven\/com.chargebee\/chargebee-java@2.17.0"}},{"description": {"text": "checker-qual contains annotations (type qualifiers) that a programmer\nwrites to specify Java code for type-checking by the Checker Framework.\n"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/checkerframework\/checker-qual\/3.41.0\/checker-qual-3.41.0.jar"},"hashes": {"md5": "3187e97ad396c881e9e9f98456e8d878","sha1": "08be6df7f1e9bccb19f8f351b3651f0bac2f5e0c","sha256": "2f9f245bf68e4259d610894f2406dc1f6363dc639302bd566e8272e4f4541172"},"properties": {"license": "The MIT License: http:\/\/opensource.org\/licenses\/MIT","id24": "pkg:maven\/org.checkerframework\/checker-qual@3.41.0"}},{"description": {"text": "The uber-fast, ultra-lightweight classpath and module scanner for JVM languages."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/github\/classgraph\/classgraph\/4.8.83\/classgraph-4.8.83.jar"},"hashes": {"md5": "cbc2329992d63ef0100735a2a1956238","sha1": "07be289f451cedf9e35ed97caba3953226b4e6d9","sha256": "54d1fb342ed49ea606dfa647879c893eeac61b05d0cdf3207ed9a7591d93335b"},"properties": {"license": "The MIT License (MIT): http:\/\/opensource.org\/licenses\/MIT","id25": "pkg:maven\/io.github.classgraph\/classgraph@4.8.83"}},{"description": {"text": "Library for introspecting types with full generic information\n        including resolving of field and method types.\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/fasterxml\/classmate\/1.6.0\/classmate-1.6.0.jar"},"hashes": {"md5": "9e5d937cfab5e40ccbd2c626e242794b","sha1": "91affab6f84a2182fce5dd72a8d01bc14346dddd","sha256": "d2fcbd956837a57a1c600dda118d5634136cbd673f30852251e4f0de28fd4ebf"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id26": "pkg:maven\/com.fasterxml\/classmate@1.6.0"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/netfoundry\/common-util-framework\/3.0.1\/common-util-framework-3.0.1.jar"},"hashes": {"md5": "749d8e21d0eb16bb5d38b7bffd33fc10","sha1": "98b6b79d22140b9718c793b7d489a6eace5105c2","sha256": "a8d609f5c223125808800904313f3273553eb25a5e19bc6471f1a818fdf4fac8"},"properties": {"id27": "pkg:maven\/io.netfoundry\/common-util-framework@3.0.1"}},{"description": {"text": "Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/commons-beanutils\/commons-beanutils\/1.9.4\/commons-beanutils-1.9.4.jar"},"hashes": {"md5": "07dc532ee316fe1f2f0323e9bd2f8df4","sha1": "d52b9abcd97f38c81342bb7e7ae1eee9b73cba51","sha256": "7d938c81789028045c08c065e94be75fc280527620d5bd62b519d5838532368a"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id28": "pkg:maven\/commons-beanutils\/commons-beanutils@1.9.4","vid24": "cpe:2.3:a:apache:commons_beanutils:1.9.4:*:*:*:*:*:*:*"}},{"description": {"text": "\n     The Apache Commons Codec package contains simple encoder and decoders for\n     various formats such as Base64 and Hexadecimal.  In addition to these\n     widely used encoders and decoders, the codec package also maintains a\n     collection of phonetic encoding utilities.\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/commons-codec\/commons-codec\/1.16.0\/commons-codec-1.16.0.jar"},"hashes": {"md5": "6e26920fa7228891980890cce06b718c","sha1": "4e3eb3d79888d76b54e28b350915b5dc3919c9de","sha256": "56595fb20b0b85bc91d0d503dad50bb7f1b9afc0eed5dffa6cbb25929000484d"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id29": "pkg:maven\/commons-codec\/commons-codec@1.16.0"}},{"description": {"text": "Types that extend and augment the Java Collections Framework."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/commons-collections\/commons-collections\/3.2.2\/commons-collections-3.2.2.jar"},"hashes": {"md5": "f54a8510f834a1a57166970bfc982e94","sha1": "8ad72fe39fa8c91eaaf12aadb21e0c3661fe26d5","sha256": "eeeae917917144a68a741d4c0dff66aa5c5c5fd85593ff217bced3fc8ca783b8"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id30": "pkg:maven\/commons-collections\/commons-collections@3.2.2","vid25": "cpe:2.3:a:apache:commons_collections:3.2.2:*:*:*:*:*:*:*"}},{"description": {"text": "The Apache Commons Collections package contains types that extend and augment the Java Collections Framework."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/commons\/commons-collections4\/4.4\/commons-collections4-4.4.jar"},"hashes": {"md5": "4a37023740719b391f10030362c86be6","sha1": "62ebe7544cb7164d87e0637a2a6a2bdc981395e8","sha256": "1df8b9430b5c8ed143d7815e403e33ef5371b2400aadbe9bda0883762e0846d1"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id31": "pkg:maven\/org.apache.commons\/commons-collections4@4.4","vid26": "cpe:2.3:a:apache:commons_collections:4.4:*:*:*:*:*:*:*"}},{"description": {"text": "\n    The Digester package lets you configure an XML to Java object mapping module\n    which triggers certain actions called rules whenever a particular \n    pattern of nested XML elements is recognized.\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/commons-digester\/commons-digester\/2.1\/commons-digester-2.1.jar"},"hashes": {"md5": "528445033f22da28f5047b6abcd1c7c9","sha1": "73a8001e7a54a255eef0f03521ec1805dc738ca0","sha256": "e0b2b980a84fc6533c5ce291f1917b32c507f62bcad64198fff44368c2196a3d"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id32": "pkg:maven\/commons-digester\/commons-digester@2.1"}},{"description": {"text": "\nThe Apache Commons IO library contains utility classes, stream implementations, file filters,\nfile comparators, endian transformation classes, and much more.\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/commons-io\/commons-io\/2.11.0\/commons-io-2.11.0.jar"},"hashes": {"md5": "3b4b7ccfaeceeac240b804839ee1a1ca","sha1": "a2503f302b11ebde7ebc3df41daebe0e4eea3689","sha256": "961b2f6d87dbacc5d54abf45ab7a6e2495f89b75598962d8c723cea9bc210908"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id33": "pkg:maven\/commons-io\/commons-io@2.11.0","vid27": "cpe:2.3:a:apache:commons_io:2.11.0:*:*:*:*:*:*:*"}},{"description": {"text": "\n  Apache Commons Lang, a package of Java utility classes for the\n  classes that are in java.lang's hierarchy, or are considered to be so\n  standard as to justify existence in java.lang.\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/commons\/commons-lang3\/3.13.0\/commons-lang3-3.13.0.jar"},"hashes": {"md5": "3435b913691a5c1b173485a49850b1a8","sha1": "b7263237aa89c1f99b327197c41d0669707a462e","sha256": "82f528cf718c7a3c2f30fc5bc784e3c6a0a10b17605dadb9e16c82ede11e6064"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id34": "pkg:maven\/org.apache.commons\/commons-lang3@3.13.0"}},{"description": {"text": "Apache Commons Logging is a thin adapter allowing configurable bridging to other,\n    well known logging systems."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/commons-logging\/commons-logging\/1.2\/commons-logging-1.2.jar"},"hashes": {"md5": "040b4b4d8eac886f6b4a2a3bd2f31b00","sha1": "4bfc12adfe4842bf07b657f0369c4cb522955686","sha256": "daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id35": "pkg:maven\/commons-logging\/commons-logging@1.2"}},{"description": {"text": "The Apache Commons Object Pooling Library."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/commons\/commons-pool2\/2.12.0\/commons-pool2-2.12.0.jar"},"hashes": {"md5": "0516bf5ac1549e8ba78f6b7c49d09ed2","sha1": "458563f69fbdaebf7daadfe10dc3a22e42a7de50","sha256": "6d3bd18df8410f3e31b031aca582cc109342358a62a2759ebd0c4cdf30d06f8b"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id36": "pkg:maven\/org.apache.commons\/commons-pool2@2.12.0"}},{"description": {"text": "\n    Apache Commons Validator provides the building blocks for both client side validation and server side data validation.\n    It may be used standalone or with a framework like Struts.\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/commons-validator\/commons-validator\/1.7\/commons-validator-1.7.jar"},"hashes": {"md5": "4b6f22de69432bc03254b47310d59651","sha1": "76069c915de3787f3ddd8726a56f47a95bfcbb0e","sha256": "4d74f4ce4fb68b2617edad086df6defdf9338467d2377d2c62e69038e1c4f02f"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id37": "pkg:maven\/commons-validator\/commons-validator@1.7"}},{"description": {"text": "A library that assists with context propagation across different types of context mechanisms such as ThreadLocal, Reactor Context etc."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/context-propagation\/1.1.0\/context-propagation-1.1.0.jar"},"hashes": {"md5": "28f0a2dbc7efec367d0adbe4b545c646","sha1": "734b4802eb272066f9c1ec4d460388b470e21eca","sha256": "694e84b00996c34bc58da9846f86cbd7aa29756c66bd41705a64579cbadc7c48"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id38": "pkg:maven\/io.micrometer\/context-propagation@1.1.0"}},{"description": {"text": "Eclipse Compiler for Java(TM)"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/eclipse\/jdt\/ecj\/3.21.0\/ecj-3.21.0.jar"},"hashes": {"md5": "4d1404f81be38fdf9186c9556c4ad3e9","sha1": "d06974eec06892e5594bdb8fbbc95cd81f1c57b2","sha256": "9082211f48782750093f07822d1ae481e8ece250449578f372334da626ccdead"},"properties": {"license": "Eclipse Public License - v 2.0: https:\/\/www.eclipse.org\/legal\/epl-2.0\/","id39": "pkg:maven\/org.eclipse.jdt\/ecj@3.21.0"}},{"description": {"text": "The world's only more-or-less-2822-compliant Java-based email address extractor \/ verifier"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/github\/bbottema\/emailaddress-rfc2822\/1.1.0\/emailaddress-rfc2822-1.1.0.jar"},"hashes": {"md5": "c1b6f6c9b89926290a30f20e3eea3216","sha1": "4bdc83098d7413ffaf112e4db32cf68394ad49f5","sha256": "ee08d2584c6842ad83714d54a2e33aeee61f8c1da43d6c9cce4bd8e2c07b36b3"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id40": "pkg:maven\/com.github.bbottema\/emailaddress-rfc2822@1.1.0"}},{"description": {"text": "Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/google\/errorprone\/error_prone_annotations\/2.23.0\/error_prone_annotations-2.23.0.jar"},"hashes": {"md5": "b3ea764beb68c9b44cf57c1b5a5608b2","sha1": "43a27853b6c7d54893e0b1997c2c778c347179eb","sha256": "ec6f39f068b6ff9ac323c68e28b9299f8c0a80ca512dccb1d4a70f40ac3ec054"},"properties": {"license": "Apache 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id41": "pkg:maven\/com.google.errorprone\/error_prone_annotations@2.23.0"}},{"description": {"text": "\n    Contains\n    com.google.common.util.concurrent.internal.InternalFutureFailureAccess and\n    InternalFutures. Most users will never need to use this artifact. Its\n    classes are conceptually a part of Guava, but they're in this separate\n    artifact so that Android libraries can use them without pulling in all of\n    Guava (just as they can use ListenableFuture by depending on the\n    listenablefuture artifact).\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/google\/guava\/failureaccess\/1.0.2\/failureaccess-1.0.2.jar"},"hashes": {"md5": "3f75955b49b6758fd6d1e1bd9bf777b3","sha1": "c4a06a64e650562f30b7bf9aaec1bfed43aca12b","sha256": "8a8f81cf9b359e3f6dfa691a1e776985c061ef2f223c9b2c80753e1b458e8064"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id42": "pkg:maven\/com.google.guava\/failureaccess@1.0.2"}},{"description": {"text": "Flyway: Database Migrations Made Easy."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/flywaydb\/flyway-core\/9.22.3\/flyway-core-9.22.3.jar"},"hashes": {"md5": "5cdd908d4f13ea3b385ab2a32307f704","sha1": "76519923a547892f0108b99d1e7b06dcb4727ecd","sha256": "dc6b0410c173c2a5d48269ac3031123452e379b60282eadc0b3d3cd1b55aac89"},"properties": {"license": "https:\/\/flywaydb.org\/licenses\/flyway-community","id43": "pkg:maven\/org.flywaydb\/flyway-core@9.22.3"}},{"description": {"text": "Flyway: Database Migrations Made Easy."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/flywaydb\/flyway-mysql\/9.22.3\/flyway-mysql-9.22.3.jar"},"hashes": {"md5": "d6c33e80ec261d743ea3f9e527a4f7f8","sha1": "240fd8e565ab937fac63cb096fa8b52c10e7d23b","sha256": "081bcd0eaa90979088cce9aa1c8277e271f976dfec9973585e079b489e3b38cc"},"properties": {"license": "https:\/\/flywaydb.org\/licenses\/flyway-community","id44": "pkg:maven\/org.flywaydb\/flyway-mysql@9.22.3"}},{"description": {"text": "Gson JSON library"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/google\/code\/gson\/gson\/2.10.1\/gson-2.10.1.jar"},"hashes": {"md5": "df6097815738cb31fc56391553210843","sha1": "b3add478d4382b78ea20b1671390a858002feb6c","sha256": "4241c14a7727c34feea6507ec801318a3d4a90f070e4525681079fb94ee4c593"},"properties": {"license": "Apache-2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id45": "pkg:maven\/com.google.code.gson\/gson@2.10.1","vid28": "cpe:2.3:a:google:gson:2.10.1:*:*:*:*:*:*:*"}},{"description": {"text": "\n    Guava is a suite of core and expanded libraries that include\n    utility classes, Google's collections, I\/O classes, and\n    much more.\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/google\/guava\/guava\/33.0.0-jre\/guava-33.0.0-jre.jar"},"hashes": {"md5": "5d8aefac09131c3a74d6dab4b01bcff6","sha1": "161ba27964a62f241533807a46b8711b13c1d94b","sha256": "f4d85c3e4d411694337cb873abea09b242b664bb013320be6105327c45991537"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id46": "pkg:maven\/com.google.guava\/guava@33.0.0-jre","vid29": "cpe:2.3:a:google:guava:33.0.0:*:*:*:*:*:*:*"}},{"description": {"text": "H2 Database Engine"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/h2database\/h2\/2.2.224\/h2-2.2.224.jar"},"hashes": {"md5": "769d5a85d19ccc2b06620f8c81d6d8f8","sha1": "7bdade27d8cd197d9b5ce9dc251f41d2edc5f7ad","sha256": "b9d8f19358ada82a4f6eb5b174c6cfe320a375b5a9cb5a4fe456d623e6e55497"},"properties": {"license": "MPL 2.0: https:\/\/www.mozilla.org\/en-US\/MPL\/2.0\/\nEPL 1.0: https:\/\/opensource.org\/licenses\/eclipse-1.0.php","id47": "pkg:maven\/com.h2database\/h2@2.2.224","vid30": "cpe:2.3:a:h2database:h2:2.2.224:*:*:*:*:*:*:*"}},{"description": {"text": "Hibernate's Jakarta Bean Validation reference implementation."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/hibernate\/validator\/hibernate-validator\/8.0.1.Final\/hibernate-validator-8.0.1.Final.jar"},"hashes": {"md5": "66985b6bf8da17611031e2421c235241","sha1": "e49e116b3d3928060599b176b3538bb848718e95","sha256": "8c1244a498231091fe723d9666a93444ee9f93607245c6b29829dc5fe57a335c"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id48": "pkg:maven\/org.hibernate.validator\/hibernate-validator@8.0.1.Final","vid31": "cpe:2.3:a:redhat:hibernate_validator:8.0.1:*:*:*:*:*:*:*"}},{"description": {"text": "\n   Apache HttpComponents Client\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/httpcomponents\/httpclient\/4.5.5\/httpclient-4.5.5.jar"},"hashes": {"md5": "97e7e5b135476b7d25a5ab31e1ea4922","sha1": "1603dfd56ebcd583ccdf337b6c3984ac55d89e58","sha256": "7e97724443ad2a25ad8c73183431d47cc7946271bcbbdfa91a8a17522a566573"},"properties": {"id49": "pkg:maven\/org.apache.httpcomponents\/httpclient@4.5.5","vid32": "cpe:2.3:a:apache:httpclient:4.5.5:*:*:*:*:*:*:*"}},{"description": {"text": "Apache HttpComponents Client"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/httpcomponents\/client5\/httpclient5\/5.2.3\/httpclient5-5.2.3.jar"},"hashes": {"md5": "c036d52256bc36c5f474e64b18a55cb9","sha1": "5d753a99d299756998a08c488f2efdf9cf26198e","sha256": "7cf4c7e60338aa334e8699f2423af1c93bdc3a3121f2df22378d61222fa5910c"},"properties": {"id50": "pkg:maven\/org.apache.httpcomponents.client5\/httpclient5@5.2.3","vid33": "cpe:2.3:a:apache:httpclient:5.2.3:*:*:*:*:*:*:*"}},{"description": {"text": "\n   Apache HttpComponents Core (blocking I\/O)\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/httpcomponents\/httpcore\/4.4.16\/httpcore-4.4.16.jar"},"hashes": {"md5": "28d2cd9bf8789fd2ec774fb88436ebd1","sha1": "51cf043c87253c9f58b539c9f7e44c8894223850","sha256": "6c9b3dd142a09dc468e23ad39aad6f75a0f2b85125104469f026e52a474e464f"},"properties": {"id51": "pkg:maven\/org.apache.httpcomponents\/httpcore@4.4.16"}},{"description": {"text": "Apache HttpComponents HTTP\/1.1 core components"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/httpcomponents\/core5\/httpcore5\/5.2.4\/httpcore5-5.2.4.jar"},"hashes": {"md5": "5a3d417ea4e65e0f74194263dc5c6c43","sha1": "34d8332b975f9e9a8298efe4c883ec43d45b7059","sha256": "a7f62496113f66f9e27c26b84c44f5ce4555c6270083cdf2d45f255336cd52af"},"properties": {"id52": "pkg:maven\/org.apache.httpcomponents.core5\/httpcore5@5.2.4"}},{"description": {"text": "Apache HttpComponents HTTP\/2 Core Components"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/httpcomponents\/core5\/httpcore5-h2\/5.2\/httpcore5-h2-5.2.jar"},"hashes": {"md5": "272112133e0dd0559efdd8f5e615a344","sha1": "698bd8c759ccc7fd7398f3179ff45d0e5a7ccc16","sha256": "5a087fb8c619979d492a83546f351ddadf32b28cc6a32923229f3fc777171578"},"properties": {"id53": "pkg:maven\/org.apache.httpcomponents.core5\/httpcore5-h2@5.2"}},{"description": {"text": "\n    A Java implementation of the Amazon Ion data notation.\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/software\/amazon\/ion\/ion-java\/1.0.2\/ion-java-1.0.2.jar"},"hashes": {"md5": "3f07f5df418af9ea2ebe80c3d6eccac4","sha1": "ee9dacea7726e495f8352b81c12c23834ffbc564","sha256": "0d127b205a1fce0abc2a3757a041748651bc66c15cf4c059bac5833b27d471a5"},"properties": {"license": "The Apache License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id54": "pkg:maven\/software.amazon.ion\/ion-java@1.0.2","vid34": "cpe:2.3:a:amazon:ion:1.0.2:*:*:*:*:*:*:*"}},{"description": {"text": "iText, a free Java-PDF library"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/lowagie\/itext\/2.1.7\/itext-2.1.7.jar"},"hashes": {"md5": "7587a618197a065eac4a453d173d4ed6","sha1": "892bfb3e97074a61123b3b2d7caa2db112750864","sha256": "7d82c6b097a31cdf5a6d49a327bf582fdec7304da69308f9f6abf54aa9fd9055"},"properties": {"license": "Mozilla Public License: http:\/\/www.mozilla.org\/MPL\/MPL-1.1.html","id55": "pkg:maven\/com.lowagie\/itext@2.1.7","vid35": "cpe:2.3:a:itextpdf:itext:2.1.7:*:*:*:*:*:*:*"}},{"description": {"text": "\n    A set of annotations that provide additional information to the J2ObjC\n    translator to modify the result of translation.\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/google\/j2objc\/j2objc-annotations\/2.8\/j2objc-annotations-2.8.jar"},"hashes": {"md5": "c50af69b704dc91050efb98e0dff66d1","sha1": "c85270e307e7b822f1086b93689124b89768e273","sha256": "f02a95fa1a5e95edb3ed859fd0fb7df709d121a35290eff8b74dce2ab7f4d6ed"},"properties": {"license": "Apache License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id56": "pkg:maven\/com.google.j2objc\/j2objc-annotations@2.8"}},{"description": {"text": "Core Jackson processing abstractions (aka Streaming API), implementation for JSON"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/fasterxml\/jackson\/core\/jackson-core\/2.15.3\/jackson-core-2.15.3.jar"},"hashes": {"md5": "c86c75392bf138d54d2a219bb1d0cbcd","sha1": "60d600567c1862840397bf9ff5a92398edc5797b","sha256": "51fab7aad51ed588482edc507fd542747936c5094d1ab76ed21ddb63b96b610d"},"properties": {"license": "The Apache Software License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id57": "pkg:maven\/com.fasterxml.jackson.core\/jackson-core@2.15.3","vid36": "cpe:2.3:a:fasterxml:jackson-modules-java8:2.15.3:*:*:*:*:*:*:*"}},{"description": {"text": "General data-binding functionality for Jackson: works on core streaming API"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/fasterxml\/jackson\/core\/jackson-databind\/2.15.3\/jackson-databind-2.15.3.jar"},"hashes": {"md5": "5f453c55f127690fa8491ce347aa055c","sha1": "a734bc2c47a9453c4efa772461a3aeb273c010d9","sha256": "c3c53333a2172a80678bda1803e39cff45bec6ae3e9c7d4f44a81ec4e2ab18dc"},"properties": {"license": "The Apache Software License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id58": "pkg:maven\/com.fasterxml.jackson.core\/jackson-databind@2.15.3","vid37": "cpe:2.3:a:fasterxml:jackson-databind:2.15.3:*:*:*:*:*:*:*","vid38": "cpe:2.3:a:fasterxml:jackson-modules-java8:2.15.3:*:*:*:*:*:*:*"}},{"description": {"text": "Support for reading and writing Concise Binary Object Representation\n([CBOR](https:\/\/www.rfc-editor.org\/info\/rfc7049)\nencoded data using Jackson abstractions (streaming API, data binding, tree model)\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/fasterxml\/jackson\/dataformat\/jackson-dataformat-cbor\/2.15.3\/jackson-dataformat-cbor-2.15.3.jar"},"hashes": {"md5": "0e6ec765d6473a48face5d8e36cf69c4","sha1": "c30a4e69e760401a98b9fa458a4f2db6fe392d7f","sha256": "b8c7ae4a9d82e3fd0aecfd4599f42eaf503d0faf99e2f97abfb8b2c33bc09da7"},"properties": {"license": "The Apache Software License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id59": "pkg:maven\/com.fasterxml.jackson.dataformat\/jackson-dataformat-cbor@2.15.3","vid39": "cpe:2.3:a:fasterxml:jackson-dataformats-binary:2.15.3:*:*:*:*:*:*:*"}},{"description": {"text": "Data format extension for Jackson to offer\nalternative support for serializing POJOs as XML and deserializing XML as pojos.\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/fasterxml\/jackson\/dataformat\/jackson-dataformat-xml\/2.15.3\/jackson-dataformat-xml-2.15.3.jar"},"hashes": {"md5": "780f06a8e92cd975a5d14ea0a9d51c5e","sha1": "50f061b3ff15979ee0c784c657f5ea8ba7b920c5","sha256": "39a34531dca5fca75eb547663c300855c968c8faca6861d92eca9e9747af0416"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id60": "pkg:maven\/com.fasterxml.jackson.dataformat\/jackson-dataformat-xml@2.15.3","vid40": "cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.15.3:*:*:*:*:*:*:*"}},{"description": {"text": "Add-on module to support JSR-310 (Java 8 Date & Time API) data types."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/fasterxml\/jackson\/datatype\/jackson-datatype-jsr310\/2.14.2\/jackson-datatype-jsr310-2.14.2.jar"},"hashes": {"md5": "1d3433114ab756cc902462b04bc37501","sha1": "796518148a385b2728d44886cc0f8852eb8eeb53","sha256": "75651b65733ed94e4e28e4ba0817218d93e71e8a7f06f6ab3662752974d2bcae"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id61": "pkg:maven\/com.fasterxml.jackson.datatype\/jackson-datatype-jsr310@2.14.2","vid41": "cpe:2.3:a:fasterxml:jackson-modules-java8:2.14.2:*:*:*:*:*:*:*"}},{"description": {"text": "  Specification"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/jakarta\/activation\/jakarta.activation-api\/2.1.2\/jakarta.activation-api-2.1.2.jar"},"hashes": {"md5": "1af11450fafc7ee26c633d940286bc16","sha1": "640c0d5aff45dbff1e1a1bc09673ff3a02b1ba12","sha256": "f53f578dd0eb4170c195a4e215c59a38abfb4123dcb95dd902fef92876499fbb"},"properties": {"license": "EDL 1.0: http:\/\/www.eclipse.org\/org\/documents\/edl-v10.php","id62": "pkg:maven\/jakarta.activation\/jakarta.activation-api@2.1.2"}},{"description": {"text": "Jakarta Annotations API"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/jakarta\/annotation\/jakarta.annotation-api\/2.1.1\/jakarta.annotation-api-2.1.1.jar"},"hashes": {"md5": "5dac2f68e8288d0add4dc92cb161711d","sha1": "48b9bda22b091b1f48b13af03fe36db3be6e1ae3","sha256": "5f65fdaf424eee2b55e1d882ba9bb376be93fb09b37b808be6e22e8851c909fe"},"properties": {"license": "EPL 2.0: http:\/\/www.eclipse.org\/legal\/epl-2.0\nGPL2 w\/ CPE: https:\/\/www.gnu.org\/software\/classpath\/license.html","id63": "pkg:maven\/jakarta.annotation\/jakarta.annotation-api@2.1.1","vid42": "cpe:2.3:a:oracle:projects:2.1.1:*:*:*:*:*:*:*"}},{"description": {"text": "\n        Jakarta Bean Validation API\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/jakarta\/validation\/jakarta.validation-api\/3.0.2\/jakarta.validation-api-3.0.2.jar"},"hashes": {"md5": "3a1ee6efca3e41e3320599790f54c5eb","sha1": "92b6631659ba35ca09e44874d3eb936edfeee532","sha256": "291c25e6910cc6a7ebd96d4c6baebf6d7c37676c5482c2d96146e901b62c1fc9"},"properties": {"license": "Apache License 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id64": "pkg:maven\/jakarta.validation\/jakarta.validation-api@3.0.2"}},{"description": {"text": "Jakarta XML Binding API 4.0 Design Specification"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/jakarta\/xml\/bind\/jakarta.xml.bind-api\/4.0.1\/jakarta.xml.bind-api-4.0.1.jar"},"hashes": {"md5": "e62084f1afb23eccde6645bf3a9eb06f","sha1": "ca2330866cbc624c7e5ce982e121db1125d23e15","sha256": "287f3b6d0600082e0b60265d7de32be403ee7d7269369c9718d9424305b89d95"},"properties": {"license": "http:\/\/www.eclipse.org\/org\/documents\/edl-v10.php","id65": "pkg:maven\/jakarta.xml.bind\/jakarta.xml.bind-api@4.0.1"}},{"description": {"text": "Free Java Reporting Library"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/net\/sf\/jasperreports\/jasperreports\/6.20.0\/jasperreports-6.20.0.jar"},"hashes": {"md5": "55282691cdac9742d591461996158f9e","sha1": "d65d2fa366af7fa4238a7591717a6efa48d1b27e","sha256": "5c1281ffde9d90f3a1da0d57b9fe452451d2926f64c04f9bf271f90f7a020c07"},"properties": {"license": "GNU Lesser General Public License: http:\/\/jasperreports.sourceforge.net\/license.html","id66": "pkg:maven\/net.sf.jasperreports\/jasperreports@6.20.0","vid43": "cpe:2.3:a:tibco:jasperreports_library:6.20.0:*:*:*:*:*:*:*"}},{"description": {"text": "Java implementation of JSON Web Token (JWT)"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/auth0\/java-jwt\/4.4.0\/java-jwt-4.4.0.jar"},"hashes": {"md5": "7fe567995099e1ee3f45adbc2f3c18c5","sha1": "0e02407d19971bfa241441212901dd327a37722b","sha256": "173aab2a30727e5586e13055fb6c4e27112453f5d8cf1136b3369c674cbe011f"},"properties": {"license": "The MIT License (MIT): https:\/\/raw.githubusercontent.com\/auth0\/java-jwt\/master\/LICENSE","id67": "pkg:maven\/com.auth0\/java-jwt@4.4.0"}},{"description": {"text": "JavaBeans Activation Framework API jar"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/javax\/activation\/javax.activation-api\/1.2.0\/javax.activation-api-1.2.0.jar"},"hashes": {"md5": "5e50e56bcf4a3ef3bc758f69f7643c3b","sha1": "85262acf3ca9816f9537ca47d5adeabaead7cb16","sha256": "43fdef0b5b6ceb31b0424b208b930c74ab58fac2ceeb7b3f6fd3aeb8b5ca4393"},"properties": {"license": "https:\/\/github.com\/javaee\/activation\/blob\/master\/LICENSE.txt","id68": "pkg:maven\/javax.activation\/javax.activation-api@1.2.0"}},{"description": {"text": "JavaMail API"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/sun\/mail\/javax.mail\/1.6.2\/javax.mail-1.6.2.jar"},"hashes": {"md5": "0b81d022797740d72d21620781841374","sha1": "935151eb71beff17a2ffac15dd80184a99a0514f","sha256": "45b515e7104944c09e45b9c7bb1ce5dff640486374852dd2b2e80cc3752dfa11"},"properties": {"license": "https:\/\/javaee.github.io\/javamail\/LICENSE","id69": "pkg:maven\/com.sun.mail\/javax.mail@1.6.2"}},{"description": {"text": "The JBoss Logging Framework"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/jboss\/logging\/jboss-logging\/3.5.3.Final\/jboss-logging-3.5.3.Final.jar"},"hashes": {"md5": "ee7e24e94235c13f53392ecaa53f938c","sha1": "c88fc1d8a96d4c3491f55d4317458ccad53ca663","sha256": "7b119460de174195aca412dfed52ca0bbef0ece26c2d74301b6172cfadf4ff59"},"properties": {"license": "Apache License 2.0: https:\/\/repository.jboss.org\/licenses\/apache-2.0.txt","id70": "pkg:maven\/org.jboss.logging\/jboss-logging@3.5.3.Final"}},{"description": {"text": "JCL 1.2 implemented over SLF4J"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/slf4j\/jcl-over-slf4j\/2.0.11\/jcl-over-slf4j-2.0.11.jar"},"hashes": {"md5": "7ad2cbcec0efd8cfc8f3a6dfacfc5829","sha1": "f6226edb8c85f8c9f1f75ec4b0252c02f589478a","sha256": "55e96f9830d732c81f0709e9090f308798381be7dc5aa67dd423c02831b5b4bb"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id71": "pkg:maven\/org.slf4j\/jcl-over-slf4j@2.0.11"}},{"description": {"text": "\n    JCommon is a free general purpose Java class library that is used in\n    several projects at www.jfree.org, including JFreeChart and\n    JFreeReport.\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/jfree\/jcommon\/1.0.23\/jcommon-1.0.23.jar"},"hashes": {"md5": "1b059adc60fef2da40b7130f9a67f977","sha1": "a316f336ca996e0c6bec4e4fbd49be8f5e1c3968","sha256": "1e670402809484c71ec74d55b40022a4c4939c7911bd39ee5a0cfb3aaf56397c"},"properties": {"license": "GNU Lesser General Public Licence: http:\/\/www.gnu.org\/licenses\/lgpl.txt","id72": "pkg:maven\/org.jfree\/jcommon@1.0.23"}},{"description": {"text": "Jedis is a blazingly small and sane Redis java client."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/redis\/clients\/jedis\/5.0.2\/jedis-5.0.2.jar"},"hashes": {"md5": "1d217c8795ef14e8b85f24bfcdd2c432","sha1": "47d917ce322cef3fc1fbe7534f351e25d977e52b","sha256": "d5d3a8ca5e26aae999fc93bec6e65e27b85076f91029de605688d2a35143147f"},"properties": {"license": "MIT: https:\/\/github.com\/redis\/jedis\/blob\/master\/LICENSE","id73": "pkg:maven\/redis.clients\/jedis@5.0.2"}},{"description": {"text": "\n    JFreeChart is a class library, written in Java, for generating charts. \n    Utilising the Java2D APIs, it currently supports bar charts, pie charts, \n    line charts, XY-plots and time series plots.\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/jfree\/jfreechart\/1.0.19\/jfreechart-1.0.19.jar"},"hashes": {"md5": "4ff3762bd04a7239cfb98de542134bec","sha1": "ba9ee7dbb2e4c57a6901c79f614ed2dea9cc0e20","sha256": "153d077d6399776a45de97c555ad026eb6201d4bd8af86cfce7b8b4ccfa66263"},"properties": {"license": "GNU Lesser General Public Licence: http:\/\/www.gnu.org\/licenses\/lgpl.txt","id74": "pkg:maven\/org.jfree\/jfreechart@1.0.19","vid44": "cpe:2.3:a:time_project:time:1.0.19:*:*:*:*:*:*:*"}},{"description": {"text": "Implementation of the JMES Path JSON Query langauge for Java."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/amazonaws\/jmespath-java\/1.11.415\/jmespath-java-1.11.415.jar"},"hashes": {"md5": "9731e0256846253f1325c46dc0560208","sha1": "9331fc5c6ee158395303d326d4deda1a4a2a409f","sha256": "ba75744b12275fc8d6ad1c28b63340ea948c86dd2876e285bb21bbf7e633003a"},"properties": {"license": "Apache License, Version 2.0: https:\/\/aws.amazon.com\/apache2.0","id75": "pkg:maven\/com.amazonaws\/jmespath-java@1.11.415","vid45": "cpe:2.3:a:amazon:aws-sdk-java:1.11.415:*:*:*:*:*:*:*"}},{"description": {"text": "Date and time library to replace JDK date handling"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/joda-time\/joda-time\/2.8.1\/joda-time-2.8.1.jar"},"hashes": {"md5": "c23002a0fac3455e92551e7f24500fa4","sha1": "f5bfc718c95a7b1d3c371bb02a188a4df18361a9","sha256": "b4670b95f75957c974284c5f3ada966040be2578f643c5c6083d262162061fa2"},"properties": {"license": "Apache 2: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id76": "pkg:maven\/joda-time\/joda-time@2.8.1"}},{"description": {"text": "\n     The jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK).\n     It is written in Java and relies solely on the JCA APIs for cryptography.\n     Please see https:\/\/bitbucket.org\/b_c\/jose4j\/wiki\/Home for more info, examples, etc..\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/bitbucket\/b_c\/jose4j\/0.9.5\/jose4j-0.9.5.jar"},"hashes": {"md5": "fb939f8894b9509332ab43f40df3cc47","sha1": "e4ca26802488e6f16e24558d74ac8775a955fdd3","sha256": "808fb3166f3e67dad9811c331029ab1681242fd52b735bc3f33f281167fcc72e"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id77": "pkg:maven\/org.bitbucket.b_c\/jose4j@0.9.5","vid46": "cpe:2.3:a:jose4j_project:jose4j:0.9.5:*:*:*:*:*:*:*"}},{"description": {"text": "\n        JSON is a light-weight, language independent, data interchange format.\n        See http:\/\/www.JSON.org\/\n\n        The files in this package implement JSON encoders\/decoders in Java.\n        It also includes the capability to convert between JSON and XML, HTTP\n        headers, Cookies, and CDL.\n\n        This is a reference implementation. There is a large number of JSON packages\n        in Java. Perhaps someday the Java community will standardize on one. Until\n        then, choose carefully.\n\n        The license includes this restriction: \"The software shall be used for good,\n        not evil.\" If your conscience cannot live with that, then choose a different\n        package.\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/json\/json\/20220320\/json-20220320.jar"},"hashes": {"md5": "86978058a0b60d816e8c48da84c547e4","sha1": "06df2c050972619466f6dcef7654ef9bcc01dfd0","sha256": "1edf7fcea79a16b8dfdd3bc988ddec7f8908b1f7762fdf00d39acb037542747a"},"properties": {"license": "The JSON License: http:\/\/json.org\/license.html","id78": "pkg:maven\/org.json\/json@20220320","vid47": "cpe:2.3:a:json-java_project:json-java:20220320:*:*:*:*:*:*:*"}},{"description": {"text": "A library to query and verify JSON"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/jayway\/jsonpath\/json-path\/2.8.0\/json-path-2.8.0.jar"},"hashes": {"md5": "501b9f34e6a05c20dd74e6b40e066617","sha1": "b4ab3b7a9e425655a0ca65487bbbd6d7ddb75160","sha256": "9601707e95cd79fb98570a01ea8cfb857b5cde948744d6e0edf733c11002c95b"},"properties": {"license": "The Apache Software License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id79": "pkg:maven\/com.jayway.jsonpath\/json-path@2.8.0","vid48": "cpe:2.3:a:json-path:jayway_jsonpath:2.8.0:*:*:*:*:*:*:*"}},{"description": {"text": "JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/net\/minidev\/json-smart\/2.5.0\/json-smart-2.5.0.jar"},"hashes": {"md5": "af9b7eda9c435acaf22e840991c7b10f","sha1": "57a64f421b472849c40e77d2e7cce3a141b41e99","sha256": "432b9e545848c4141b80717b26e367f83bf33f19250a228ce75da6e967da2bc7"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id80": "pkg:maven\/net.minidev\/json-smart@2.5.0","vid49": "cpe:2.3:a:json-smart_project:json-smart:2.5.0:*:*:*:*:*:*:*","vid50": "cpe:2.3:a:json-smart_project:json-smart-v2:2.5.0:*:*:*:*:*:*:*"}},{"description": {"text": "JSqlParser parses an SQL statement and translate it into a hierarchy of Java classes.\n        The generated hierarchy can be navigated using the Visitor Pattern."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/github\/jsqlparser\/jsqlparser\/4.6\/jsqlparser-4.6.jar"},"hashes": {"md5": "c58d3425c8d1279dac04d7d53ae85eee","sha1": "a4d1bda17df913c8b3ff12d39e35e9efd3a4e01f","sha256": "61b02b8520fda987b7bc12878833b223234450e505de83c36e78abe6d69c0184"},"properties": {"license": "GNU Library or Lesser General Public License (LGPL) V2.1: http:\/\/www.gnu.org\/licenses\/lgpl-2.1.html\nThe Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id81": "pkg:maven\/com.github.jsqlparser\/jsqlparser@4.6"}},{"description": {"text": "JSR305 Annotations for Findbugs"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/google\/code\/findbugs\/jsr305\/3.0.2\/jsr305-3.0.2.jar"},"hashes": {"md5": "dd83accb899363c32b07d7a1b2e4ce40","sha1": "25ea2e8b0c338a877313bd4672d3fe056ea78f0d","sha256": "766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id82": "pkg:maven\/com.google.code.findbugs\/jsr305@3.0.2"}},{"description": {"text": "JUL to SLF4J bridge"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/slf4j\/jul-to-slf4j\/2.0.11\/jul-to-slf4j-2.0.11.jar"},"hashes": {"md5": "46568e80d6a97fd041864e033dfdf7d0","sha1": "279356f8e873b1a26badd8bbb3284b5c3b22c770","sha256": "67e605b1f3efd4efcb060e4c11a2e6d8d4dfd2262bba7916aeafa77eeb1bcf89"},"properties": {"license": "http:\/\/www.opensource.org\/licenses\/mit-license.php","id83": "pkg:maven\/org.slf4j\/jul-to-slf4j@2.0.11"}},{"description": {"text": "JSON Web Key Set parser library"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/auth0\/jwks-rsa\/0.22.1\/jwks-rsa-0.22.1.jar"},"hashes": {"md5": "ebd87432c934f2ab18192c6f603ac04a","sha1": "6da617499e4614b5c22a52cb142dfe376a9a4f00","sha256": "df67bbc7776a33c92edc01e02019feca0593b4d0e44a2c28d3205454ec20a08c"},"properties": {"license": "The MIT License (MIT): https:\/\/raw.githubusercontent.com\/auth0\/jwks-rsa-java\/master\/LICENSE","id84": "pkg:maven\/com.auth0\/jwks-rsa@0.22.1"}},{"description": {"text": "Advanced and thread-safe Java Redis client for synchronous, asynchronous,\n        and reactive usage. Supports Cluster, Sentinel, Pipelining, Auto-Reconnect, Codecs\n        and much more."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/lettuce\/lettuce-core\/6.3.1.RELEASE\/lettuce-core-6.3.1.RELEASE.jar"},"hashes": {"md5": "e322203ce2100887de386521db4ea66a","sha1": "831e550bb71e6a539bd471ad258f6be7590e9aba","sha256": "bc74138f8be5a2eac27a7a91fa076d012fc882a363d5b171e7f9d7fd481ae935"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id85": "pkg:maven\/io.lettuce\/lettuce-core@6.3.1.RELEASE"}},{"description": {"text": "\n    An empty artifact that Guava depends on to signal that it is providing\n    ListenableFuture -- but is also available in a second \"version\" that\n    contains com.google.common.util.concurrent.ListenableFuture class, without\n    any other Guava classes. The idea is:\n\n    - If users want only ListenableFuture, they depend on listenablefuture-1.0.\n\n    - If users want all of Guava, they depend on guava, which, as of Guava\n    27.0, depends on\n    listenablefuture-9999.0-empty-to-avoid-conflict-with-guava. The 9999.0-...\n    version number is enough for some build systems (notably, Gradle) to select\n    that empty artifact over the \"real\" listenablefuture-1.0 -- avoiding a\n    conflict with the copy of ListenableFuture in guava itself. If users are\n    using an older version of Guava or a build system other than Gradle, they\n    may see class conflicts. If so, they can solve them by manually excluding\n    the listenablefuture artifact or manually forcing their build systems to\n    use 9999.0-....\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/google\/guava\/listenablefuture\/9999.0-empty-to-avoid-conflict-with-guava\/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar"},"hashes": {"md5": "d094c22570d65e132c19cea5d352e381","sha1": "b421526c5f297295adef1c886e5246c39d4ac629","sha256": "b372a037d4230aa57fbeffdef30fd6123f9c0c2db85d0aced00c91b974f33f99"},"properties": {"id86": "pkg:maven\/com.google.guava\/listenablefuture@9999.0-empty-to-avoid-conflict-with-guava"}},{"description": {"text": "The Apache Log4j API"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/logging\/log4j\/log4j-api\/2.21.1\/log4j-api-2.21.1.jar"},"hashes": {"md5": "b5e9bf76dd128b37666ecd9a252b50ec","sha1": "74c65e87b9ce1694a01524e192d7be989ba70486","sha256": "1db48e180881bef1deb502022006a025a248d8f6a26186789b0c7ce487c602d6"},"properties": {"license": "Apache-2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id87": "pkg:maven\/org.apache.logging.log4j\/log4j-api@2.21.1","vid51": "cpe:2.3:a:apache:log4j:2.21.1:*:*:*:*:*:*:*"}},{"description": {"text": "The Apache Log4j binding between Log4j 2 API and SLF4J."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/logging\/log4j\/log4j-to-slf4j\/2.21.1\/log4j-to-slf4j-2.21.1.jar"},"hashes": {"md5": "00b957af4a40bea6a7bf61400b6ccf63","sha1": "d77b2ba81711ed596cd797cc2b5b5bd7409d841c","sha256": "de143c565ba78b0f2c0be58f132c7aec75e6e1a10845ebda5a4f17c2a35d9990"},"properties": {"license": "Apache-2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id88": "pkg:maven\/org.apache.logging.log4j\/log4j-to-slf4j@2.21.1"}},{"description": {"text": "logback-core module"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/ch\/qos\/logback\/logback-core\/1.4.14\/logback-core-1.4.14.jar"},"hashes": {"md5": "7367629d307fa3d0b82d76b9d3f1d09a","sha1": "4d3c2248219ac0effeb380ed4c5280a80bf395e8","sha256": "f8c2f05f42530b1852739507c1792f0080167850ed8f396444c6913d6617a293"},"properties": {"license": "http:\/\/www.eclipse.org\/legal\/epl-v10.html, http:\/\/www.gnu.org\/licenses\/old-licenses\/lgpl-2.1.html","id89": "pkg:maven\/ch.qos.logback\/logback-core@1.4.14","vid52": "cpe:2.3:a:qos:logback:1.4.14:*:*:*:*:*:*:*"}},{"description": {"text": "Provides logback encoders, layouts, and appenders to log in JSON and other formats supported by Jackson"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/net\/logstash\/logback\/logstash-logback-encoder\/7.4\/logstash-logback-encoder-7.4.jar"},"hashes": {"md5": "abdd5bc0a492e779ed7edb4757f698f9","sha1": "4573c7882277096adf58dd6485f38400b028aa93","sha256": "cd9f1f4365d5ca50fc593f0363b06432088474c836366c1d5ff7626b9b4182bf"},"properties": {"license": "Apache License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0\nMIT License: http:\/\/www.slf4j.org\/license.html","id90": "pkg:maven\/net.logstash.logback\/logstash-logback-encoder@7.4"}},{"description": {"text": "Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/projectlombok\/lombok\/1.18.30\/lombok-1.18.30.jar"},"hashes": {"md5": "14e90bb14cac804c1a6e2024e78f436d","sha1": "f195ee86e6c896ea47a1d39defbe20eb59cd149d","sha256": "14151b47582d570b4de16a147ece3bdbd19ace4aee5bde3a5578c87db9ecb998"},"properties": {"license": "The MIT License: https:\/\/projectlombok.org\/LICENSE","id91": "pkg:maven\/org.projectlombok\/lombok@1.18.30"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/projectlombok\/lombok\/1.18.30\/lombok-1.18.30.jar\/lombok\/launch\/mavenEcjBootstrapAgent.jar"},"hashes": {"md5": "2bc7812d729aa7f761f721c6f0620848","sha1": "e67209a53266080be85e8848c01fd15af98700c7","sha256": "63da6c6457ba6bfb61867cf644542464783adc57bbf36a7f0843c2822c288169"},"properties": {}},{"description": {"text": "An annotation processor for generating type-safe bean mappers"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/mapstruct\/mapstruct\/1.3.1.Final\/mapstruct-1.3.1.Final.jar"},"hashes": {"md5": "bcbcb2a13d6d7fbf8674f1eac5452b72","sha1": "6ab184bbc7a7029738277a244e4c535fcdc3f558","sha256": "567c4ce1145ee888716d4c1b00ef48b98256b22fbf0738be77ce1095e0fb9fcf"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id92": "pkg:maven\/org.mapstruct\/mapstruct@1.3.1.Final"}},{"description": {"text": "mchange-commons-java"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/mchange\/mchange-commons-java\/0.2.15\/mchange-commons-java-0.2.15.jar"},"hashes": {"md5": "97c4575d9d49d9afb71492e6bb4417da","sha1": "6ef5abe5f1b94ac45b7b5bad42d871da4fda6bbc","sha256": "2b8fce65e95a3e968d5ab3507e2833f43df3daee0635ee51c7ce33343bb3a21c"},"properties": {"license": "GNU Lesser General Public License, Version 2.1: http:\/\/www.gnu.org\/licenses\/lgpl-2.1.html\nEclipse Public License, Version 1.0: http:\/\/www.eclipse.org\/org\/documents\/epl-v10.html","id93": "pkg:maven\/com.mchange\/mchange-commons-java@0.2.15"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/netfoundry\/messaging-framework\/0.8.0\/messaging-framework-0.8.0.jar"},"hashes": {"md5": "f11ad6ce02da3606cdd6a6f196b71baf","sha1": "73a822c044f669e3cc8e81e566a4e45d5e949cf1","sha256": "c4594e38aa7da9d175b5949f932bbc1a74d59e00ca542c2e25b9acac2e22ea83"},"properties": {"id94": "pkg:maven\/io.netfoundry\/messaging-framework@0.8.0"}},{"description": {"text": "\n        Metrics is a Java library which gives you unparalleled insight into what your code does in\n        production. Metrics provides a powerful toolkit of ways to measure the behavior of critical\n        components in your production environment.\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/dropwizard\/metrics\/metrics-core\/4.2.23\/metrics-core-4.2.23.jar"},"hashes": {"md5": "d39055007f183ffbfc629b285ad882fd","sha1": "c2845d6c982cca81d403b4d2433da8ac250abf83","sha256": "3d2344250909a2196a36d5172a2c67bd6392bc3b2ee49c04b14c7cc8f8fb1068"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0.html","id95": "pkg:maven\/io.dropwizard.metrics\/metrics-core@4.2.23"}},{"description": {"text": "\n        A set of classes which allow you to report metrics via JMX.\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/dropwizard\/metrics\/metrics-jmx\/4.2.23\/metrics-jmx-4.2.23.jar"},"hashes": {"md5": "a752cbf7fb694d9d68a42dcfb411c961","sha1": "a004114e1c5ce0fbbad5ebd46f6406477450ea51","sha256": "9476dcf3d3a23d08fae6769ac72767658d096c26b0669376842a218ea7d78a80"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0.html","id96": "pkg:maven\/io.dropwizard.metrics\/metrics-jmx@4.2.23"}},{"description": {"text": "Module containing common code"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-commons\/1.12.2\/micrometer-commons-1.12.2.jar"},"hashes": {"md5": "dc4744dd14f640a3e96181831a97cfa2","sha1": "b44127d8ec7b3ef11a01912d1e6474e1167f3929","sha256": "feea1eb8302809b7a2d142de1d0de67ef329e02d01c7e5c680a76d7fc3e9309b"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id97": "pkg:maven\/io.micrometer\/micrometer-commons@1.12.2"}},{"description": {"text": "Core module of Micrometer containing instrumentation API and implementation"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-core\/1.12.2\/micrometer-core-1.12.2.jar"},"hashes": {"md5": "aac30b6b0837b7e39f8e781fd79d9743","sha1": "ad701a658e92a3122ee4b2418261daa6821e5b9d","sha256": "85178ee62a9a262b049a0bdf80225163d44f95777e4d1f6f769b66d7dc41c795"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id98": "pkg:maven\/io.micrometer\/micrometer-core@1.12.2"}},{"description": {"text": "Module for Jakarta 9+ based instrumentations"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-jakarta9\/1.12.2\/micrometer-jakarta9-1.12.2.jar"},"hashes": {"md5": "091d2d89a202461090f456c92fac8989","sha1": "381f991e01c257c0c49bf48ea75db759bcd3689a","sha256": "5ea3f9f50e31a41719bd4487816ff26afb052edaeb04ff66f2d600da4d385b28"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id99": "pkg:maven\/io.micrometer\/micrometer-jakarta9@1.12.2"}},{"description": {"text": "Module containing Observation related code"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-observation\/1.12.2\/micrometer-observation-1.12.2.jar"},"hashes": {"md5": "0cdc84d8f1e64ac7a8f9dee9b100f756","sha1": "e082b05a2527fc24ea6fbe4c4b7ae34653aace81","sha256": "1b7765023228e62570b68f69b2e4b3b3bcc390832c71f50726ee336b34f96941"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id100": "pkg:maven\/io.micrometer\/micrometer-observation@1.12.2"}},{"description": {"text": "Application monitoring instrumentation facade"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-registry-elastic\/1.12.2\/micrometer-registry-elastic-1.12.2.jar"},"hashes": {"md5": "83c08aa0c138c649daf53c29348be534","sha1": "4ef91b2a1b66f2e95601dcf60d4bc041304b4ac3","sha256": "6459094cd61598f57612a7b4d6b4cc59d2d78cfc6abac3f8b3a4f0ce889add72"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id101": "pkg:maven\/io.micrometer\/micrometer-registry-elastic@1.12.2"}},{"description": {"text": "Application monitoring instrumentation facade"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-registry-jmx\/1.12.2\/micrometer-registry-jmx-1.12.2.jar"},"hashes": {"md5": "80117238a70465e67774e61363ea9c46","sha1": "315b43791bcc53653d337cfadf56c3fe78f93646","sha256": "c56ef60d6c5fa8e9ebf033e13b3b8b5a275acd664ad5a4ef19872bc7c14c62f5"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id102": "pkg:maven\/io.micrometer\/micrometer-registry-jmx@1.12.2"}},{"description": {"text": "Facade over tracing concepts"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing\/1.2.2\/micrometer-tracing-1.2.2.jar"},"hashes": {"md5": "2d7f972cbd86d7171a30b77d5801881e","sha1": "d34e6014dcf2072aa044858aff8d6311cc4724a9","sha256": "47f013a0b3583a3e55e8cef986121cf3207bdd21ea1f3013533448dcb4d6aded"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id103": "pkg:maven\/io.micrometer\/micrometer-tracing@1.2.2"}},{"description": {"text": "Facade over tracing concepts"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar"},"hashes": {"md5": "bdd2c17ec5c2d59e880c535409c20d14","sha1": "19546fa2444d7383be593bb3939b1f0d079e4490","sha256": "8118f2adbaff06d1c9c66c980bdd8187ebc43bb0460fe491cf6be804ef6b2157"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id104": "pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2","vid53": "cpe:2.3:a:brave:brave:1.2.2:*:*:*:*:*:*:*"}},{"description": {"text": "\n        Byte Buddy is a Java library for creating Java classes at run time.\n        This artifact is a build of Byte Buddy with a remaining dependency onto ASM.\n        You should never depend on this module without repackaging Byte Buddy and ASM into your own namespace.\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/modelmapper\/modelmapper\/3.1.1\/modelmapper-3.1.1.jar\/META-INF\/maven\/net.bytebuddy\/byte-buddy-dep\/pom.xml"},"hashes": {"md5": "4c9f7a90717807197e842eb91d7ff17f","sha1": "916abc7a3ec19075f4d5b4f1300608dfa6d0fb29","sha256": "1b02e7e4700b29ab404ebb7707adcc2d1983df31aaf82ba9dcc9da69f1566a65"},"properties": {"id105": "pkg:maven\/net.bytebuddy\/byte-buddy-dep@1.12.3"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/modelmapper\/modelmapper\/3.1.1\/modelmapper-3.1.1.jar\/META-INF\/maven\/net.jodah\/typetools\/pom.xml"},"hashes": {"md5": "2566d2d0eaf7aa0b62add9fad8643244","sha1": "4c71f200014bfe04198c107c2c5bbfa369dabbf5","sha256": "b4106bdd827f868a7f1bfc7635eabafa41e476dca120b6f73248d7c899c11f75"},"properties": {"license": "Apache License, Version 2.0: http:\/\/apache.org\/licenses\/LICENSE-2.0","id106": "pkg:maven\/net.jodah\/typetools@0.6.3"}},{"description": {"text": "Simple, Intelligent, Object Mapping"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/modelmapper\/modelmapper\/3.1.1\/modelmapper-3.1.1.jar"},"hashes": {"md5": "12a4c3f30d613a2e2c662fe9b1602fad","sha1": "6636e94590e9d98e5e7db7e4fafcc15e9390e18d","sha256": "da850cff9b651d8150f7e2cdcf78e5aca14b2242c501ddbc05f3c55a6cd0172a"},"properties": {"license": "http:\/\/apache.org\/licenses\/LICENSE-2.0","id107": "pkg:maven\/org.modelmapper\/modelmapper@3.1.1"}},{"description": {"text": "JDBC Type 4 driver for MySQL."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/mysql\/mysql-connector-j\/8.0.32\/mysql-connector-j-8.0.32.jar"},"hashes": {"md5": "25bf3b3cd262065283962078dc82e99c","sha1": "41ec3f8cdaccf6c46a47d7cd628eeb59a926d9d4","sha256": "522329fe925980f02e5eb89b59d227245d345415ff0c08932a68c9765c13acc5"},"properties": {"license": "The GNU General Public License, v2 with Universal FOSS Exception, v1.0","id108": "pkg:maven\/com.mysql\/mysql-connector-j@8.0.32","vid54": "cpe:2.3:a:mysql:mysql:8.0.32:*:*:*:*:*:*:*","vid55": "cpe:2.3:a:oracle:mysql_connector\\\/j:8.0.32:*:*:*:*:*:*:*"}},{"description": {"text": "Java Concurrency Tools Core Library"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/netty\/netty-common\/4.1.105.Final\/netty-common-4.1.105.Final.jar\/META-INF\/maven\/org.jctools\/jctools-core\/pom.xml"},"hashes": {"md5": "08e7326c64d7fd6ae4ea32e7eb4e5b79","sha1": "9deceaba814dea198202b04fe0eec0d2dbf69ea9","sha256": "acaf1b4c366f6794a734288a2c003f16af90a9c479cf4d7daade689764e4fb47"},"properties": {"license": "Apache License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id109": "pkg:maven\/org.jctools\/jctools-core@3.1.0"}},{"description": {"text": "Netty is an asynchronous event-driven network application framework for    rapid development of maintainable high performance protocol servers and    clients."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/netty\/netty-transport\/4.1.105.Final\/netty-transport-4.1.105.Final.jar"},"hashes": {"md5": "d2aeb6f1491cc03d21a055d0ef255664","sha1": "5184e1308ed7d853d7061b4e21e47e8de43a28df","sha256": "be9b8a2f86685a876e469c904cb9fce53a1e826e178d44d2b1d92f6a99054737"},"properties": {"license": "https:\/\/www.apache.org\/licenses\/LICENSE-2.0","id110": "pkg:maven\/io.netty\/netty-transport@4.1.105.Final","vid56": "cpe:2.3:a:netty:netty:4.1.105:*:*:*:*:*:*:*"}},{"description": {"text": "A Protocol for Asynchronous Non-Blocking Data Sequence"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/reactivestreams\/reactive-streams\/1.0.4\/reactive-streams-1.0.4.jar"},"hashes": {"md5": "eda7978509c32d99166745cc144c99cd","sha1": "3864a1320d97d7b045f729a326e1e077661f31b7","sha256": "f75ca597789b3dac58f61857b9ac2e1034a68fa672db35055a8fb4509e325f28"},"properties": {"license": "MIT-0: https:\/\/spdx.org\/licenses\/MIT-0.html","id111": "pkg:maven\/org.reactivestreams\/reactive-streams@1.0.4"}},{"description": {"text": "Non-Blocking Reactive Foundation for the JVM"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/projectreactor\/reactor-core\/3.6.2\/reactor-core-3.6.2.jar"},"hashes": {"md5": "c7553524c90891b9adf11dda72356a96","sha1": "679ac38d031c154374182748491a177a76c890e1","sha256": "6e235f0be9732ebd6a42c585dfd53274065978bfbc28d721d7ecf487fde27b52"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id112": "pkg:maven\/io.projectreactor\/reactor-core@3.6.2"}},{"description": {"text": "\n    Rhino is an open-source implementation of JavaScript written entirely in Java.\n    It is typically embedded into Java applications to provide scripting to end users.\n    Full jar including tools, excluding the JSR-223 Script Engine wrapper.\n"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/mozilla\/rhino\/1.7.14\/rhino-1.7.14.jar"},"hashes": {"md5": "447e2bfd28fc15ecc185944db37dc9d8","sha1": "24d091b80d513846293c00350f46d85f71797aff","sha256": "c9290b0d801bf0dbbbc44338e0f769b7650a0c5d04e6bb1aeb85775c0211b003"},"properties": {"license": "Mozilla Public License, Version 2.0: http:\/\/www.mozilla.org\/MPL\/2.0\/index.txt","id113": "pkg:maven\/org.mozilla\/rhino@1.7.14"}},{"description": {"text": "Semantic versioning for Java apps."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/vdurmont\/semver4j\/3.1.0\/semver4j-3.1.0.jar"},"hashes": {"md5": "b39112afda0af7dba1f160f7284d402f","sha1": "0de1248f09dfe8df3b021c84e0642ee222cceb13","sha256": "0f33724dd012099f0737e3d9203e28f4a804435526998d4f5841993058651cb8"},"properties": {"license": "The MIT License: http:\/\/www.opensource.org\/licenses\/mit-license.php","id114": "pkg:maven\/com.vdurmont\/semver4j@3.1.0"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/net\/javacrumbs\/shedlock\/shedlock-core\/4.33.0\/shedlock-core-4.33.0.jar"},"hashes": {"md5": "1969cf08c4e5b87dabede00a79cb73be","sha1": "177be17986c66f214d187b9f401222a12bee1b8c","sha256": "fa9308cee2f126f125a3eb38f435caf760d2a263b5698e89b150f931fecf71eb"},"properties": {"id115": "pkg:maven\/net.javacrumbs.shedlock\/shedlock-core@4.33.0"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/net\/javacrumbs\/shedlock\/shedlock-provider-jdbc-template\/4.33.0\/shedlock-provider-jdbc-template-4.33.0.jar"},"hashes": {"md5": "7390fce07d36188f004a688f177a791d","sha1": "fda9e6eeadc4dfb4b9daaa627a353a2d85cfb568","sha256": "63c1c759600f6a21b5cf4c49136e2d53d1b53a51f2f7b25fe9b557283c3e8fb2"},"properties": {"id116": "pkg:maven\/net.javacrumbs.shedlock\/shedlock-provider-jdbc-template@4.33.0"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/net\/javacrumbs\/shedlock\/shedlock-provider-redis-spring\/4.33.0\/shedlock-provider-redis-spring-4.33.0.jar"},"hashes": {"md5": "17c27cd084f952801cad970dea464efe","sha1": "107ca2bc5dd039e4ba72091205090427836f5e45","sha256": "cf9613795237ee1b2274f1edef85c245b919a638aaa1dc95cc07227414e95dd9"},"properties": {"id117": "pkg:maven\/net.javacrumbs.shedlock\/shedlock-provider-redis-spring@4.33.0"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/net\/javacrumbs\/shedlock\/shedlock-spring\/4.33.0\/shedlock-spring-4.33.0.jar"},"hashes": {"md5": "f90d423131bd9ce24941e83b2e97f7aa","sha1": "b2d99fbae3a7b8e0f2e10a1613f692c69dfe3256","sha256": "66f0a5fae1625f739d27be233dc24609869ed0846d4b5c2c48c844bf9325d6d2"},"properties": {"id118": "pkg:maven\/net.javacrumbs.shedlock\/shedlock-spring@4.33.0"}},{"description": {"text": "A Java parser for Outlook messages (.msg files)"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/simplejavamail\/simple-java-mail\/5.0.1\/simple-java-mail-5.0.1.jar\/META-INF\/maven\/org.simplejavamail\/outlook-message-parser\/pom.xml"},"hashes": {"md5": "3ae3b0f966fb4a19f8cd5b93636d129c","sha1": "f9af45f694360d180eed89cb5618667056873658","sha256": "e35dea9268f02ab055114d6f498a60e6f4f8a77eb626df6867a85bd1588dce00"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id119": "pkg:maven\/org.simplejavamail\/outlook-message-parser@1.1.16"}},{"description": {"text": "Simple API, Complex Emails. A light weight wrapper for the JavaMail SMTP API"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/simplejavamail\/simple-java-mail\/5.0.1\/simple-java-mail-5.0.1.jar"},"hashes": {"md5": "a569d9bdb7c3388f5ea8a284b2ae84d8","sha1": "7974be85593c799eaff1d1a7821c15306725c601","sha256": "ca73fcbb5e530f605df954ceb1b73077a549a22b4b161a9b9c598614808b582b"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id120": "pkg:maven\/org.simplejavamail\/simple-java-mail@5.0.1"}},{"description": {"text": "The slf4j API"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/slf4j\/slf4j-api\/2.0.11\/slf4j-api-2.0.11.jar"},"hashes": {"md5": "90c46a2d4613049843c804867321e6a7","sha1": "ad96c3f8cf895e696dd35c2bc8e8ebe710be9e6d","sha256": "ce0e71d673acb9036bb55d0244b261cf033f8e4c1245f14f931dfb1937dd4c95"},"properties": {"license": "http:\/\/www.opensource.org\/licenses\/mit-license.php","id121": "pkg:maven\/org.slf4j\/slf4j-api@2.0.11"}},{"description": {"text": "YAML 1.1 parser and emitter for Java"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/yaml\/snakeyaml\/2.2\/snakeyaml-2.2.jar"},"hashes": {"md5": "d78aacf5f2de5b52f1a327470efd1ad7","sha1": "3af797a25458550a16bf89acc8e4ab2b7f2bfce0","sha256": "1467931448a0817696ae2805b7b8b20bfb082652bf9c4efaed528930dc49389b"},"properties": {"license": "Apache License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id122": "pkg:maven\/org.yaml\/snakeyaml@2.2","vid57": "cpe:2.3:a:snakeyaml_project:snakeyaml:2.2:*:*:*:*:*:*:*"}},{"description": {"text": "Spring AMQP Core"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/amqp\/spring-amqp\/3.1.1\/spring-amqp-3.1.1.jar"},"hashes": {"md5": "f32cbda31dc8bb06e1957641f80718e2","sha1": "75be7219bfe2fa5452a0db202e2b702523c64941","sha256": "e2f5593277796aad9e5ef02a1594daa473d4a06b45f53e6628d2172c453407a5"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id123": "pkg:maven\/org.springframework.amqp\/spring-amqp@3.1.1","vid58": "cpe:2.3:a:pivotal_software:spring_advanced_message_queuing_protocol:3.1.1:*:*:*:*:*:*:*","vid59": "cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:3.1.1:*:*:*:*:*:*:*"}},{"description": {"text": "Core domain for batch processing, expressing a domain of Jobs, Steps, Chunks, etc"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/batch\/spring-batch-core\/5.1.0\/spring-batch-core-5.1.0.jar"},"hashes": {"md5": "0ad541000e78a65c3bd0bd66bfc2e130","sha1": "3ab7f18437012f847b82967cef609d1a0c19041d","sha256": "74487346047036289b85b64fb2c5f6685e60b27a8e5c594e5b61ee197566f037"},"properties": {"license": "Apache 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id124": "pkg:maven\/org.springframework.batch\/spring-batch-core@5.1.0","vid60": "cpe:2.3:a:pivotal_software:spring_batch:5.1.0:*:*:*:*:*:*:*"}},{"description": {"text": "Spring Boot"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/boot\/spring-boot\/3.2.2\/spring-boot-3.2.2.jar"},"hashes": {"md5": "109bf8f30456d8147e458e66099b3dd1","sha1": "09f274d1bd822c4c57bb5b37ecae2380b980f567","sha256": "c3019200b71836bc5a0607b10000a1b8542bc9e53006f97a0d79cc10754e5792"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0","id125": "pkg:maven\/org.springframework.boot\/spring-boot@3.2.2","vid61": "cpe:2.3:a:vmware:spring_boot:3.2.2:*:*:*:*:*:*:*"}},{"description": {"text": "Starter for building web, including RESTful, applications using Spring MVC. Uses Tomcat as the default embedded container"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/boot\/spring-boot-starter-web\/3.2.2\/spring-boot-starter-web-3.2.2.jar"},"hashes": {"md5": "8141b43d6918f4ed2d3fc17310f9b3a9","sha1": "b89d213d9f49c3e6247b2503ac7d94b0ac8260f6","sha256": "e3a1bb3427484eec50ff5f050a9d183b39fa5140fb5f2f6da2f8d971fd43a03b"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0","id126": "pkg:maven\/org.springframework.boot\/spring-boot-starter-web@3.2.2","vid62": "cpe:2.3:a:vmware:spring_boot:3.2.2:*:*:*:*:*:*:*","vid63": "cpe:2.3:a:web_project:web:3.2.2:*:*:*:*:*:*:*"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-aws-autoconfigure\/2.1.3.RELEASE\/spring-cloud-aws-autoconfigure-2.1.3.RELEASE.jar"},"hashes": {"md5": "4e6cc8c6da2036bd25e642f6c8481a91","sha1": "39aecb058614da88cdf46b6207b4c0823f5495e9","sha256": "8f233da231c9dca0dfb2e816322421076db834f60f5d7432311250321e1c355a"},"properties": {"id127": "pkg:maven\/org.springframework.cloud\/spring-cloud-aws-autoconfigure@2.1.3.RELEASE","vid64": "cpe:2.3:a:vmware:spring_cloud_config:2.1.3:release:*:*:*:*:*:*"}},{"description": {"text": "Spring Cloud AWS Context"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-aws-context\/2.1.3.RELEASE\/spring-cloud-aws-context-2.1.3.RELEASE.jar"},"hashes": {"md5": "7245a26d2ca533244afde4f1bcc23451","sha1": "585ed8558e1843c35a85e7bac629b7fed02ef910","sha256": "ae851c38aea5b3b1ee359a47c69a0cbe5f6b782b7b652b1a46b4c085c65e78ed"},"properties": {"id128": "pkg:maven\/org.springframework.cloud\/spring-cloud-aws-context@2.1.3.RELEASE"}},{"description": {"text": "Spring Cloud AWS Core"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-aws-core\/2.1.3.RELEASE\/spring-cloud-aws-core-2.1.3.RELEASE.jar"},"hashes": {"md5": "22afa04c250f11987f1c98dc377b080e","sha1": "4172aed3456a679e3f56526042c50badfd6a5606","sha256": "998727cbcd649e0458655cce24672be5f1181ef27070defa607f9c6169aa3d6a"},"properties": {"id129": "pkg:maven\/org.springframework.cloud\/spring-cloud-aws-core@2.1.3.RELEASE"}},{"description": {"text": "Spring Cloud AWS Messaging"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-aws-messaging\/2.1.3.RELEASE\/spring-cloud-aws-messaging-2.1.3.RELEASE.jar"},"hashes": {"md5": "9168c1a5cf5910caf7ff97a69373206a","sha1": "45d55a674a8e57f4c8c8f7c57d79bfd48edb4b7f","sha256": "3d90299f3feb9b04a9ccdefdf94f67ad7231158a193478c089cb089bc71141bc"},"properties": {"id130": "pkg:maven\/org.springframework.cloud\/spring-cloud-aws-messaging@2.1.3.RELEASE"}},{"description": {"text": "Spring Cloud Commons"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-commons\/4.1.0\/spring-cloud-commons-4.1.0.jar"},"hashes": {"md5": "41ff1904dbdca2f586b9221153d07106","sha1": "4b9d72e2e8326de7d200d54111e924e5be73db54","sha256": "f824a6a4cf7f449517232aa00df2b94ffd060c35cc2dee8ab0e01bf3aea2b4b5"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0","id131": "pkg:maven\/org.springframework.cloud\/spring-cloud-commons@4.1.0"}},{"description": {"text": "This project is a Spring configuration client."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-config-client\/4.1.0\/spring-cloud-config-client-4.1.0.jar"},"hashes": {"md5": "206106544fc2d53f7c9250a31f239be5","sha1": "8cd0713ef875da182193399640c01a126133befc","sha256": "b723cfacba6ffe293385a628b2ae0f7de2628bf3d540703d42421dc4255f38d8"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0","id132": "pkg:maven\/org.springframework.cloud\/spring-cloud-config-client@4.1.0","vid65": "cpe:2.3:a:vmware:spring_cloud_config:4.1.0:*:*:*:*:*:*:*"}},{"description": {"text": "Spring Cloud Context"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-context\/4.1.0\/spring-cloud-context-4.1.0.jar"},"hashes": {"md5": "c07a6d8d8e3ee3829172e1dd4a38e7c5","sha1": "32c784465c4bbc3ba64646940923ec2ed99e6762","sha256": "d1a6f59ef134c6062c40d0c36387f8b9eb77849481abe9372f29042c32ce0f29"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0","id133": "pkg:maven\/org.springframework.cloud\/spring-cloud-context@4.1.0"}},{"description": {"text": "Spring Cloud Starter"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-starter\/4.1.0\/spring-cloud-starter-4.1.0.jar"},"hashes": {"md5": "e70ef2076331cfc4ff9c7d08d9b545af","sha1": "8558f5e64af9abbab030ff25654cbbc9d6892d72","sha256": "73dc31e113e0ce746c654bb575e0f95e72f82f6d9ff8ee6854b80c436e9d3747"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0","id134": "pkg:maven\/org.springframework.cloud\/spring-cloud-starter@4.1.0"}},{"description": {"text": "Spring Cloud AWS Starter"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-starter-aws\/2.1.3.RELEASE\/spring-cloud-starter-aws-2.1.3.RELEASE.jar"},"hashes": {"md5": "ad3c489bc0f44565d07e2261b72bc765","sha1": "b9956e24b23156e906493de5764b1e5464add576","sha256": "443d3768ff604024faa14bf15d5258b2cdc26a2924aa4dab5877ffa9a23cfcb6"},"properties": {"id135": "pkg:maven\/org.springframework.cloud\/spring-cloud-starter-aws@2.1.3.RELEASE"}},{"description": {"text": "Spring Core"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/spring-core\/6.1.3\/spring-core-6.1.3.jar"},"hashes": {"md5": "e7b5c956c8e58730ba7617978ac515d3","sha1": "a002e96e780954cc3ac4cd70fd3bb16accdc47ed","sha256": "f4448994a1eb4892b805020e7952aa96a8e3f101b7093a632635d2b0bab887eb"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0","id136": "pkg:maven\/org.springframework\/spring-core@6.1.3","vid66": "cpe:2.3:a:pivotal_software:spring_framework:6.1.3:*:*:*:*:*:*:*","vid67": "cpe:2.3:a:springsource:spring_framework:6.1.3:*:*:*:*:*:*:*","vid68": "cpe:2.3:a:vmware:spring_framework:6.1.3:*:*:*:*:*:*:*"}},{"description": {"text": "Core Spring concepts underpinning every Spring Data module."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/data\/spring-data-commons\/3.2.2\/spring-data-commons-3.2.2.jar"},"hashes": {"md5": "1ea459c663ed3aa5352ec0636b8228cb","sha1": "9b0b0f5f5bc793463a81171d6889809abc14b19b","sha256": "10e53bc7bad5144a6cb78b929da3a0b1399150e92f6054417ff2ed60eca4fe04"},"properties": {"id137": "pkg:maven\/org.springframework.data\/spring-data-commons@3.2.2","vid69": "cpe:2.3:a:pivotal_software:spring_data_commons:3.2.2:*:*:*:*:*:*:*"}},{"description": {"text": "Spring Data module for JDBC repositories."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/data\/spring-data-jdbc\/3.2.2\/spring-data-jdbc-3.2.2.jar"},"hashes": {"md5": "e1fca22b5c17bcee275e910ef26a788d","sha1": "72ec388bb0ab037fc2242cd220910555d5d7133d","sha256": "cc7db1a44d03f5a024a184ba5c3bf54fe68df65eae6afcdb2c7980a139cc426c"},"properties": {"id138": "pkg:maven\/org.springframework.data\/spring-data-jdbc@3.2.2"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/data\/spring-data-keyvalue\/3.2.2\/spring-data-keyvalue-3.2.2.jar"},"hashes": {"md5": "25e43ef139007eef11f760b7c648652d","sha1": "ae0536877aab56c7e27acb291f631a62cdd1b197","sha256": "ea568c1860e45db9e4ffd2de103bf756389872c0ce0ba2e6dd2f466f2e8499a7"},"properties": {"id139": "pkg:maven\/org.springframework.data\/spring-data-keyvalue@3.2.2"}},{"description": {"text": "Spring Data module for Redis"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/data\/spring-data-redis\/3.2.2\/spring-data-redis-3.2.2.jar"},"hashes": {"md5": "d7f81c92a4d1dce8f6e0263b42c38336","sha1": "bb3f53e122e9a9762dac75b993c788ad3a190342","sha256": "feac56dd400ce334717fb4b15c8ac199f5e4f489259a23da5310b1bda3eaeb0b"},"properties": {"id140": "pkg:maven\/org.springframework.data\/spring-data-redis@3.2.2"}},{"description": {"text": "Spring Data Relational support"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/data\/spring-data-relational\/3.2.2\/spring-data-relational-3.2.2.jar"},"hashes": {"md5": "c2ad8e90e420b508ae0b8754ccfd2228","sha1": "f4c61d4d8a3dbc6687c3c5bb01dd7434e082d8db","sha256": "c8f1e31f794c91db653d33eb1d4b4c17ea8de4d731b378737c138ecc4a7b88f7"},"properties": {"id141": "pkg:maven\/org.springframework.data\/spring-data-relational@3.2.2"}},{"description": {"text": "\n\t\tLibrary to support implementing representations for\n\t\thyper-text driven REST web services.\n\t"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/hateoas\/spring-hateoas\/2.2.0\/spring-hateoas-2.2.0.jar"},"hashes": {"md5": "a9ea555cbc22726cc745ecfbecac5e7f","sha1": "0ed2b27f280d2662ccde2b92fd474ef4aa393119","sha256": "931fbf953931748a10fa96235e58dc357a8454794f436ca5cf81ec38bc91df02"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0","id142": "pkg:maven\/org.springframework.hateoas\/spring-hateoas@2.2.0","vid70": "cpe:2.3:a:vmware:spring_hateoas:2.2.0:*:*:*:*:*:*:*"}},{"description": {"text": "Core plugin infrastructure"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/plugin\/spring-plugin-core\/2.0.0.RELEASE\/spring-plugin-core-2.0.0.RELEASE.jar"},"hashes": {"md5": "a89cd7b77db3ed7d0c9ea71ee9784e2e","sha1": "95fc8c13037630f4aba9c51141f535becec00fe6","sha256": "6e6d026d6b572495533692173a264c6959f48d5ef7f3d6faf4555a577d4a38d2"},"properties": {"id143": "pkg:maven\/org.springframework.plugin\/spring-plugin-core@2.0.0.RELEASE"}},{"description": {"text": "Extension package for metadata based plugins"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/plugin\/spring-plugin-metadata\/2.0.0.RELEASE\/spring-plugin-metadata-2.0.0.RELEASE.jar"},"hashes": {"md5": "6ca48881279237978de209a68c25599f","sha1": "6fb3a1fc0f05dc826687b7686ad8a5960ecdd57c","sha256": "174c6d6ead34d2493efe0c101aec7051d6c8793ca6c4202f271dee9cd7658498"},"properties": {"id144": "pkg:maven\/org.springframework.plugin\/spring-plugin-metadata@2.0.0.RELEASE"}},{"description": {"text": "\n\t\tSpring Retry provides an abstraction around retrying failed operations, with an\n\t\temphasis on declarative control of the process and policy-based behaviour that is\n\t\teasy to extend and customize. For instance, you can configure a plain POJO\n\t\toperation to retry if it fails, based on the type of exception, and with a fixed\n\t\tor exponential backoff.\n\t"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/retry\/spring-retry\/2.0.5\/spring-retry-2.0.5.jar"},"hashes": {"md5": "ad497992a2e52dd87e8a027550fb0ad4","sha1": "6aa0cd18f611ee83dc1d8e5052485e9669088253","sha256": "99c9c9c12683b8a2e0a3307c6719790e0c93098886a09599f399d0febb3294ba"},"properties": {"license": "Apache 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id145": "pkg:maven\/org.springframework.retry\/spring-retry@2.0.5"}},{"description": {"text": "Spring Security"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/security\/spring-security-crypto\/6.2.1\/spring-security-crypto-6.2.1.jar"},"hashes": {"md5": "3b76db12e0661ea929c45559e3612203","sha1": "d7c4f4e8fe5ae84dd1da76094ee8a0a7e214923d","sha256": "34e7e56af73caa4b1d71bc57a6006777fa1c5b590cea405bd962172cd42c47d4"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0","id146": "pkg:maven\/org.springframework.security\/spring-security-crypto@6.2.1","vid71": "cpe:2.3:a:pivotal_software:spring_security:6.2.1:*:*:*:*:*:*:*","vid72": "cpe:2.3:a:vmware:spring_security:6.2.1:*:*:*:*:*:*:*"}},{"description": {"text": "Spring Security RSA is a small utility library for RSA ciphers.\n\tIt belongs to the family of Spring Security crypto libraries that handle encoding and decoding text as\n\ta general, useful thing to be able to do."},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/security\/spring-security-rsa\/1.1.1\/spring-security-rsa-1.1.1.jar"},"hashes": {"md5": "2b224a86808c00174cc6ee0bdb484feb","sha1": "8fc6284711440b16c3ecaa0fe2f163ffdb0a5027","sha256": "42da6c52851c885bee72a03d112858cfd1d763e4b9e231ca89b7b7317382d814"},"properties": {"license": "Apache 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id147": "pkg:maven\/org.springframework.security\/spring-security-rsa@1.1.1"}},{"description": {"text": "Spring Web"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/spring-web\/6.1.3\/spring-web-6.1.3.jar"},"hashes": {"md5": "db6ad06e3a6786e1c67afaf7d9b1b8a7","sha1": "cc3459b4abd436331608ddb6424886875f7086ab","sha256": "7c79d4815954d279a744e04892abb9e13ab730dc25db5813f0b1aef2c04bc818"},"properties": {"license": "Apache License, Version 2.0: https:\/\/www.apache.org\/licenses\/LICENSE-2.0","id148": "pkg:maven\/org.springframework\/spring-web@6.1.3","vid73": "cpe:2.3:a:pivotal_software:spring_framework:6.1.3:*:*:*:*:*:*:*","vid74": "cpe:2.3:a:springsource:spring_framework:6.1.3:*:*:*:*:*:*:*","vid75": "cpe:2.3:a:vmware:spring_framework:6.1.3:*:*:*:*:*:*:*","vid76": "cpe:2.3:a:web_project:web:6.1.3:*:*:*:*:*:*:*"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springdoc\/springdoc-openapi-starter-common\/2.1.0\/springdoc-openapi-starter-common-2.1.0.jar"},"hashes": {"md5": "ee90d7a519422c0be605f826dd3597e8","sha1": "5c66d613cf1a505be1a8b92e60a481dea2c9552c","sha256": "1aef1950e2a99d1adb58d3b78bfce04e3475e905b49b119c6a47ed5122a6a56d"},"properties": {"id149": "pkg:maven\/org.springdoc\/springdoc-openapi-starter-common@2.1.0"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springdoc\/springdoc-openapi-starter-webmvc-api\/2.1.0\/springdoc-openapi-starter-webmvc-api-2.1.0.jar"},"hashes": {"md5": "447bbfc2181d6554a9feaf9316357219","sha1": "966fa4ae5e4fbd559062df6b7cb2ec2e9cf23a20","sha256": "d4745d8d17172b1e11b338c460fb01d0a869adbd4ebd22f2979ee90db1f3c56b"},"properties": {"id150": "pkg:maven\/org.springdoc\/springdoc-openapi-starter-webmvc-api@2.1.0"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springdoc\/springdoc-openapi-starter-webmvc-ui\/2.1.0\/springdoc-openapi-starter-webmvc-ui-2.1.0.jar"},"hashes": {"md5": "fef53ec4ef05e2a0d29fe7762b71e26a","sha1": "f31615e90b61d18a46a701d5c10e9e505a49a984","sha256": "b20ccbf0529bb08a91c205ee223f89f2a8838897e9fd0647fe6a9caeca63b074"},"properties": {"id151": "pkg:maven\/org.springdoc\/springdoc-openapi-starter-webmvc-ui@2.1.0"}},{"description": {"text": "JSON API documentation for spring based applications"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/springfox\/springfox-core\/3.0.0\/springfox-core-3.0.0.jar"},"hashes": {"md5": "177e816438eea19529ca6c9423c9fdfc","sha1": "7c3367ce577c8acd9bf64c74488c9269253516c9","sha256": "284c2422bec76129550e63d911adf73813cba0c4a60dd7b66efb23b99969df3f"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id152": "pkg:maven\/io.springfox\/springfox-core@3.0.0"}},{"description": {"text": "JSON API documentation for spring based applications"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/springfox\/springfox-schema\/3.0.0\/springfox-schema-3.0.0.jar"},"hashes": {"md5": "15221503ce9eabdea1ed5c497ee08eea","sha1": "32c5d6965617830ef6480fadb9030008945bcd9c","sha256": "8ec39395e11faf454c084b5ed5ddea692b9705860b0b9e6720b7b958fb9fb6a6"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id153": "pkg:maven\/io.springfox\/springfox-schema@3.0.0"}},{"description": {"text": "JSON API documentation for spring based applications"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/springfox\/springfox-spi\/3.0.0\/springfox-spi-3.0.0.jar"},"hashes": {"md5": "011a5c2e6f8d203358beb981a1137971","sha1": "bae0b820d4b5a922063d34a42aaf4f763308b828","sha256": "0bc4e5186f423a69096315660fc7134b79c90b87e3195d415cc01227c39d7066"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id154": "pkg:maven\/io.springfox\/springfox-spi@3.0.0"}},{"description": {"text": "JSON API documentation for spring based applications"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/springfox\/springfox-spring-web\/3.0.0\/springfox-spring-web-3.0.0.jar"},"hashes": {"md5": "4d5902809c88fc4a728583f899479873","sha1": "a76f2fbe805bfd2798e20dc8f2cfbfad554d52da","sha256": "48e2759084518989cda935e0b2f99c1e6fa6d70f037996454bc5cd4b9074d671"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id155": "pkg:maven\/io.springfox\/springfox-spring-web@3.0.0","vid77": "cpe:2.3:a:web_project:web:3.0.0:*:*:*:*:*:*:*"}},{"description": {"text": "JSON API documentation for spring based applications"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/springfox\/springfox-spring-webflux\/3.0.0\/springfox-spring-webflux-3.0.0.jar"},"hashes": {"md5": "1cbb459b5a24a079befd6750f5c4df1e","sha1": "efccbcfe1d23f2ba520bd87cc156bf2b81f3568e","sha256": "d1c92ac9451d1537bec3806ef9b85ce434977a591659d3bedeab02156965b491"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id156": "pkg:maven\/io.springfox\/springfox-spring-webflux@3.0.0"}},{"description": {"text": "JSON API documentation for spring based applications"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/springfox\/springfox-spring-webmvc\/3.0.0\/springfox-spring-webmvc-3.0.0.jar"},"hashes": {"md5": "8eb674eefd9c462ad6e9c0320ed8463a","sha1": "7ed22363fdfd651cd811c0b2391f16bddb91db8b","sha256": "84074711feb4e9d13f82274171550a5fe1386674a89f228669996fa9e298cd47"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id157": "pkg:maven\/io.springfox\/springfox-spring-webmvc@3.0.0"}},{"description": {"text": "JSON API documentation for spring based applications"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/springfox\/springfox-swagger-common\/3.0.0\/springfox-swagger-common-3.0.0.jar"},"hashes": {"md5": "9561d63837e1c9c92788ec8a1f9f77f6","sha1": "2e2fae840984cfcabfd50e1b4b1c23422135ba12","sha256": "fc7b489fa8664e5b6426ec65034d2760b28d560ede570040316b1fec08411f2a"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id158": "pkg:maven\/io.springfox\/springfox-swagger-common@3.0.0"}},{"description": {"text": "JSON API documentation for spring based applications"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/springfox\/springfox-swagger-ui\/3.0.0\/springfox-swagger-ui-3.0.0.jar"},"hashes": {"md5": "5f0f33ea8f709abf2465a31644fe0afb","sha1": "1e665fbe22148f7c36fa8a08e515a0047cd4390b","sha256": "40c2556b0c14e06602d23b6fbbad60ab6712e21e63636099035bb1a433cee478"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id159": "pkg:maven\/io.springfox\/springfox-swagger-ui@3.0.0"}},{"description": {"text": "JSON API documentation for spring based applications"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/springfox\/springfox-swagger2\/3.0.0\/springfox-swagger2-3.0.0.jar"},"hashes": {"md5": "eedf7bdba06b0f68907cbf56fac33e6b","sha1": "7bcb18d496576eff76ef7bb72684e149cbb75c1d","sha256": "3be97aec137799b6826ea6647e587ca09759bcc01481e0fb6926147cae1dd6d6"},"properties": {"license": "The Apache Software License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id160": "pkg:maven\/io.springfox\/springfox-swagger2@3.0.0"}},{"description": {"text": "tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API.\n  "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/codehaus\/woodstox\/stax2-api\/4.2.1\/stax2-api-4.2.1.jar"},"hashes": {"md5": "af8377bc7882332e22456616a9f164f6","sha1": "a3f7325c52240418c2ba257b103c3c550e140c83","sha256": "678567e48b51a42c65c699f266539ad3d676d4b1a5b0ad7d89ece8b9d5772579"},"properties": {"license": "The BSD License: http:\/\/www.opensource.org\/licenses\/bsd-license.php","id161": "pkg:maven\/org.codehaus.woodstox\/stax2-api@4.2.1"}},{"description": {"text": "Super CSV is a fast, programmer-friendly, free CSV package for Java"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/net\/sf\/supercsv\/super-csv\/2.4.0\/super-csv-2.4.0.jar"},"hashes": {"md5": "51a4f852a7f9a1a73a0be3cf8ede99df","sha1": "017f8708c929029dde48bc298deaf3c7ae2452d3","sha256": "cb3cc48f3cb521a6eb90b2984f98935dce4f184d43ff4aba052f4749a4131d4c"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.html","id162": "pkg:maven\/net.sf.supercsv\/super-csv@2.4.0"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/swagger\/swagger-annotations\/1.5.20\/swagger-annotations-1.5.20.jar"},"hashes": {"md5": "619f94ec2cfa0276622657810eada472","sha1": "16051f93ce11ca489a5313775d825f82fcc2cd6c","sha256": "69dee1ef78137a3ac5f9716193224049eab41b83fc6b845c2522efceb0af0273"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.html","id163": "pkg:maven\/io.swagger\/swagger-annotations@1.5.20"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/swagger\/core\/v3\/swagger-annotations\/2.1.2\/swagger-annotations-2.1.2.jar"},"hashes": {"md5": "629255d4a51b8228e519d8c308b24286","sha1": "d407a33aa71444802c640080eb4d5f499b027f96","sha256": "6f442341699cdbcdd74246b82fee96a0c09f0145f48063f17b5b693e3aa40b1a"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.html","id164": "pkg:maven\/io.swagger.core.v3\/swagger-annotations@2.1.2","vid78": "cpe:2.3:a:http-swagger_project:http-swagger:2.1.2:*:*:*:*:*:*:*"}},{"description": {"text": "swagger-core"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/swagger\/core\/v3\/swagger-core-jakarta\/2.2.9\/swagger-core-jakarta-2.2.9.jar"},"hashes": {"md5": "1c5e325330f3a3956fad8cf89707403d","sha1": "c6a36f687fb5fc7160469b8b69463e270024e3e2","sha256": "38a9bd5e8384839f55b4d1c4ca241e7bf85224ec9bcaa3070a1d085402e3e961"},"properties": {"license": "\"Apache License 2.0\";link=\"http:\/\/www.apache.org\/licenses\/LICENSE-2.0.html\"","id165": "pkg:maven\/io.swagger.core.v3\/swagger-core-jakarta@2.2.9","id166": "pkg:maven\/io.swagger.core.v3\/swagger-core@2.2.9","vid79": "cpe:2.3:a:http-swagger_project:http-swagger:2.2.9:*:*:*:*:*:*:*"}},{"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/swagger\/swagger-models\/1.5.20\/swagger-models-1.5.20.jar"},"hashes": {"md5": "9a816507533880637936bee8c27b238e","sha1": "fb3a23bad80c5ed84db9dd150db2cba699531458","sha256": "0adbb590fc665f17594f8bc7acce6871ed5602c8a50d0ad5419e3b72efaef639"},"properties": {"license": "http:\/\/www.apache.org\/licenses\/LICENSE-2.0.html","id167": "pkg:maven\/io.swagger\/swagger-models@1.5.20"}},{"description": {"text": "WebJar for Swagger UI"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/webjars\/swagger-ui\/4.18.2\/swagger-ui-4.18.2.jar"},"hashes": {"md5": "00baf3c40c3914937c6e8b0a5933b33a","sha1": "2347d066b71cd3d20789b6d143829680b3123d81","sha256": "b052e715aba12f58f4ce430ed0df69ffe8d4ca7a5e22f48fbe924e956dc16fa4"},"properties": {"license": "Apache 2.0: https:\/\/github.com\/swagger-api\/swagger-ui","id168": "pkg:maven\/org.webjars\/swagger-ui@4.18.2"}},{"description": {"text": "Core Tomcat implementation"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/tomcat\/embed\/tomcat-embed-core\/10.1.18\/tomcat-embed-core-10.1.18.jar"},"hashes": {"md5": "adcbf0783a58388fc37a999b67549de4","sha1": "bff6c34649d1dd7b509e819794d73ba795947dcf","sha256": "496a6ac8e0c410db54cf169f87016161dc9e6a5d509ba9af1f3ac0ce0b5b6a35"},"properties": {"license": "Apache License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id169": "pkg:maven\/org.apache.tomcat.embed\/tomcat-embed-core@10.1.18","vid80": "cpe:2.3:a:apache:tomcat:10.1.18:*:*:*:*:*:*:*","vid81": "cpe:2.3:a:apache_tomcat:apache_tomcat:10.1.18:*:*:*:*:*:*:*"}},{"description": {"text": "Core Tomcat implementation"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/tomcat\/embed\/tomcat-embed-el\/10.1.18\/tomcat-embed-el-10.1.18.jar"},"hashes": {"md5": "2f2cd1dc00096f3a4ae47153777595bc","sha1": "b2c4dc05abd363c63b245523bb071727aa2f1046","sha256": "2ca4d6bd5e1d60ce0846314112541da030634006855f6b1a871879ffe1a9ca86"},"properties": {"license": "Apache License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id170": "pkg:maven\/org.apache.tomcat.embed\/tomcat-embed-el@10.1.18"}},{"description": {"text": "Unknown version of isorelax library used in JAXB project"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/fasterxml\/woodstox\/woodstox-core\/6.5.1\/woodstox-core-6.5.1.jar\/META-INF\/maven\/com.sun.xml.bind.jaxb\/isorelax\/pom.xml"},"hashes": {"md5": "6fbb4bc95fbf2072bc6e3b790553fe81","sha1": "314ec72948d5c1fc71d553cbbd7a130caa6f9f13","sha256": "cda6451d0231a973352b592ff950e39224ba6ba1a2f35eeab66511b5c225dff1"},"properties": {"id171": "pkg:maven\/com.sun.xml.bind.jaxb\/isorelax@20090621"}},{"description": {"text": "XML Schema datatypes library"},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/fasterxml\/woodstox\/woodstox-core\/6.5.1\/woodstox-core-6.5.1.jar\/META-INF\/maven\/net.java.dev.msv\/xsdlib\/pom.xml"},"hashes": {"md5": "aaf872ed9d1aabee25e03c2a132ffd8e","sha1": "47f218a999411ed028f089d59ebef8f14e0fe914","sha256": "d6e83c124436049d83238fc532a26c5d8ccd7e4ab10eba6d96043c850ac82f3c"},"properties": {"id172": "pkg:maven\/net.java.dev.msv\/xsdlib@2013.6.1","vid82": "cpe:2.3:a:xml_library_project:xml_library:2013.6.1:*:*:*:*:*:*:*"}},{"description": {"text": "Woodstox is a high-performance XML processor that implements Stax (JSR-173),\nSAX2 and Stax2 APIs\n    "},"location": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/fasterxml\/woodstox\/woodstox-core\/6.5.1\/woodstox-core-6.5.1.jar"},"hashes": {"md5": "961dd4b2afedf95293dfdd8adfc8f211","sha1": "c6e52e84fe959e69a243c83ec7d24cd889444ddf","sha256": "c928d60665c6415fb1c39775cf95cfc44f7f4580cf5ab01b1c380ebffd76887f"},"properties": {"license": "The Apache License, Version 2.0: http:\/\/www.apache.org\/licenses\/LICENSE-2.0.txt","id173": "pkg:maven\/com.fasterxml.woodstox\/woodstox-core@6.5.1","vid83": "cpe:2.3:a:fasterxml:woodstox:6.5.1:*:*:*:*:*:*:*"}}],"results": [ {"ruleId": "CVE-2022-31159","level": "warning","message": {"text": "CVE-2022-31159 - The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. This issue\uFFFD\uFFFD\uFFFDs scope is limited to directories whose name prefix matches the destinationDirectory. E.g. for destination directory`\/tmp\/foo`, the actor can cause a download to `\/tmp\/foo-bar`, but not `\/tmp\/bar`. If `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory` is used to download an untrusted buckets contents, the contents of that bucket can be written outside of the intended destination directory. Version 1.12.261 contains a patch for this issue. As a workaround, when calling `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory`, pass a `KeyFilter` that forbids `S3ObjectSummary` objects that `getKey` method return a string containing the substring `..` ."},"partialFingerprints": {"vulnerabilityHash": "fd667ebf21ec71fc177190e45ce74b60"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/amazonaws\/aws-java-sdk-core\/1.11.415\/aws-java-sdk-core-1.11.415.jar","index": 10 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/com.amazonaws\/aws-java-sdk-core@1.11.415"}]}]}, {"ruleId": "CVE-2020-26939","level": "warning","message": {"text": "CVE-2020-26939 - In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption."},"partialFingerprints": {"vulnerabilityHash": "8d56b23b28330ca17ed65a7e25f4525d"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcmail-jdk14\/138\/bcmail-jdk14-138.jar","index": 11 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcmail-jdk14@138"}]}]}, {"ruleId": "CVE-2007-6721","level": "warning","message": {"text": "CVE-2007-6721 - The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to \"a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes.\""},"partialFingerprints": {"vulnerabilityHash": "05454fdf91bcc10fb57eb7fd7888a236"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2020-28052","level": "warning","message": {"text": "CVE-2020-28052 - An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different."},"partialFingerprints": {"vulnerabilityHash": "5689d7ed93b3c31601f8b95003466609"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2016-1000338","level": "warning","message": {"text": "CVE-2016-1000338 - In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure."},"partialFingerprints": {"vulnerabilityHash": "6ba2d28d4d914759a75b33f4bc8ab07b"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2016-1000342","level": "warning","message": {"text": "CVE-2016-1000342 - In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure."},"partialFingerprints": {"vulnerabilityHash": "e1e1445a230511b6adaa6480ecd25e6b"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2016-1000343","level": "warning","message": {"text": "CVE-2016-1000343 - In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator."},"partialFingerprints": {"vulnerabilityHash": "a56e3a7d3f0d735b7dabb619ab7ac1a6"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2019-17359","level": "warning","message": {"text": "CVE-2019-17359 - The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64."},"partialFingerprints": {"vulnerabilityHash": "698fd1f9487988a08b8f160c3e94f282"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2016-1000344","level": "warning","message": {"text": "CVE-2016-1000344 - In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider."},"partialFingerprints": {"vulnerabilityHash": "a4a5516684a839ffb6cfdeabc42b5018"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2016-1000352","level": "warning","message": {"text": "CVE-2016-1000352 - In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider."},"partialFingerprints": {"vulnerabilityHash": "0a3892ba804d9b2c26721d82dd5097c2"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2016-1000341","level": "warning","message": {"text": "CVE-2016-1000341 - In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well."},"partialFingerprints": {"vulnerabilityHash": "1c00d327424a0e06221715269e49204b"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2016-1000345","level": "warning","message": {"text": "CVE-2016-1000345 - In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES\/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding."},"partialFingerprints": {"vulnerabilityHash": "745f52f16ca553c3435f7031a646dc5e"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2017-13098","level": "warning","message": {"text": "CVE-2017-13098 - BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as \"ROBOT.\""},"partialFingerprints": {"vulnerabilityHash": "f3ee9e13d931fab7ad29b0491e8a940e"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2020-15522","level": "warning","message": {"text": "CVE-2020-15522 - Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures."},"partialFingerprints": {"vulnerabilityHash": "bc1161ce43aa130ad02d973f7721f7ef"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2016-2427","level": "warning","message": {"text": "CVE-2016-2427 - The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug 26234568.  NOTE: The vendor disputes the existence of this potential issue in Android, stating \"This CVE was raised in error: it referred to the authentication tag size in GCM, whose default according to ASN.1 encoding (12 bytes) can lead to vulnerabilities. After careful consideration, it was decided that the insecure default value of 12 bytes was a default only for the encoding and not default anywhere else in Android, and hence no vulnerability existed."},"partialFingerprints": {"vulnerabilityHash": "d0c3fa77d181040a5f50e2f45e4b6ff7"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2016-1000339","level": "warning","message": {"text": "CVE-2016-1000339 - In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate."},"partialFingerprints": {"vulnerabilityHash": "4400fc55d0a84db2dc4299b4d3a9d180"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2020-26939","level": "warning","message": {"text": "CVE-2020-26939 - In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption."},"partialFingerprints": {"vulnerabilityHash": "8d56b23b28330ca17ed65a7e25f4525d"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2015-7940","level": "warning","message": {"text": "CVE-2015-7940 - The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an \"invalid curve attack.\""},"partialFingerprints": {"vulnerabilityHash": "da85dc17d1669e4d272c28a0af440e17"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2018-5382","level": "warning","message": {"text": "CVE-2018-5382 - The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type \"BKS-V1\" was introduced in 1.49. It should be noted that the use of \"BKS-V1\" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself."},"partialFingerprints": {"vulnerabilityHash": "bb8aaae5d4e89754aa2b9966817c5489"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2013-1624","level": "warning","message": {"text": "CVE-2013-1624 - The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169."},"partialFingerprints": {"vulnerabilityHash": "b5a9f69cb2823bba1e0a469a9ef14a95"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2016-1000346","level": "warning","message": {"text": "CVE-2016-1000346 - In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation."},"partialFingerprints": {"vulnerabilityHash": "b30659f47c5e70e3426654f8178306ed"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/bouncycastle\/bcprov-jdk14\/138\/bcprov-jdk14-138.jar","index": 12 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/bouncycastle\/bcprov-jdk14@138"}]}]}, {"ruleId": "CVE-2023-33202","level": "warning","message": {"text": "CVE-2023-33202 - Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)"},"partialFingerprints": {"vulnerabilityHash": "12f13cc55129cee73b5d638cf7991f1e"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/bouncycastle\/bctsp-jdk14\/1.38\/bctsp-jdk14-1.38.jar","index": 14 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/org.bouncycastle\/bctsp-jdk14@1.38"}]}]}, {"ruleId": "CVE-2020-13956","level": "warning","message": {"text": "CVE-2020-13956 - Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution."},"partialFingerprints": {"vulnerabilityHash": "e478ff2e4c2b61261dfc66ff281e524d"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/apache\/httpcomponents\/httpclient\/4.5.5\/httpclient-4.5.5.jar","index": 46 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/org.apache.httpcomponents\/httpclient@4.5.5"}]}]}, {"ruleId": "CVE-2024-21634","level": "warning","message": {"text": "CVE-2024-21634 - Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in\uFFFD\uFFFD`ion-java`\uFFFD\uFFFDfor applications that use\uFFFD\uFFFD`ion-java`\uFFFD\uFFFDto deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the\uFFFD\uFFFD`IonValue`\uFFFD\uFFFDmodel and then invoke certain\uFFFD\uFFFD`IonValue`\uFFFD\uFFFDmethods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and\/or processed using the\uFFFD\uFFFD`IonValue`\uFFFD\uFFFDmodel, results in a\uFFFD\uFFFD`StackOverflowError`\uFFFD\uFFFDoriginating from the\uFFFD\uFFFD`ion-java`\uFFFD\uFFFDlibrary. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with."},"partialFingerprints": {"vulnerabilityHash": "0793b1ff7a6756aa9a4a7645eaa8801f"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/software\/amazon\/ion\/ion-java\/1.0.2\/ion-java-1.0.2.jar","index": 51 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/software.amazon.ion\/ion-java@1.0.2"}]}]}, {"ruleId": "CVE-2017-9096","level": "warning","message": {"text": "CVE-2017-9096 - The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF."},"partialFingerprints": {"vulnerabilityHash": "12b27f5828157baebd3dd17713aec454"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/lowagie\/itext\/2.1.7\/itext-2.1.7.jar","index": 52 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/com.lowagie\/itext@2.1.7"}]}]}, {"ruleId": "CVE-2022-24196","level": "warning","message": {"text": "CVE-2022-24196 - iText v7.1.17, up to (exluding)\": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file."},"partialFingerprints": {"vulnerabilityHash": "ef08f15c7fd8657e5ec948eab4e48801"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/lowagie\/itext\/2.1.7\/itext-2.1.7.jar","index": 52 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/com.lowagie\/itext@2.1.7"}]}]}, {"ruleId": "CVE-2022-24197","level": "warning","message": {"text": "CVE-2022-24197 - iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file."},"partialFingerprints": {"vulnerabilityHash": "c9a20d68c62481d7ebd76d5d8e3bf12d"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/lowagie\/itext\/2.1.7\/itext-2.1.7.jar","index": 52 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/com.lowagie\/itext@2.1.7"}]}]}, {"ruleId": "CVE-2023-35116","level": "warning","message": {"text": "CVE-2023-35116 - jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker."},"partialFingerprints": {"vulnerabilityHash": "72e9794d7a449f0fbbe4dd7392dfe376"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/fasterxml\/jackson\/core\/jackson-databind\/2.15.3\/jackson-databind-2.15.3.jar","index": 55 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/com.fasterxml.jackson.core\/jackson-databind@2.15.3"}]}]}, {"ruleId": "CVE-2022-31159","level": "warning","message": {"text": "CVE-2022-31159 - The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. This issue\uFFFD\uFFFD\uFFFDs scope is limited to directories whose name prefix matches the destinationDirectory. E.g. for destination directory`\/tmp\/foo`, the actor can cause a download to `\/tmp\/foo-bar`, but not `\/tmp\/bar`. If `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory` is used to download an untrusted buckets contents, the contents of that bucket can be written outside of the intended destination directory. Version 1.12.261 contains a patch for this issue. As a workaround, when calling `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory`, pass a `KeyFilter` that forbids `S3ObjectSummary` objects that `getKey` method return a string containing the substring `..` ."},"partialFingerprints": {"vulnerabilityHash": "fd667ebf21ec71fc177190e45ce74b60"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/amazonaws\/jmespath-java\/1.11.415\/jmespath-java-1.11.415.jar","index": 72 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/com.amazonaws\/jmespath-java@1.11.415"}]}]}, {"ruleId": "CVE-2022-45688","level": "warning","message": {"text": "CVE-2022-45688 - A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data."},"partialFingerprints": {"vulnerabilityHash": "9076910d0913a1181d1939178cf0d381"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/json\/json\/20220320\/json-20220320.jar","index": 75 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/org.json\/json@20220320"}]}]}, {"ruleId": "CVE-2023-5072","level": "warning","message": {"text": "CVE-2023-5072 - Denial of Service  in JSON-Java versions up to and including 20230618. \uFFFD\uFFFDA bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.\uFFFD\uFFFD\n"},"partialFingerprints": {"vulnerabilityHash": "5171a5638f23180740c511477d32c293"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/json\/json\/20220320\/json-20220320.jar","index": 75 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/org.json\/json@20220320"}]}]}, {"ruleId": "CVE-2023-51074","level": "warning","message": {"text": "CVE-2023-51074 - json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method."},"partialFingerprints": {"vulnerabilityHash": "0306bbbbfeddcf3fc4b90e9e7f5cc18d"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/jayway\/jsonpath\/json-path\/2.8.0\/json-path-2.8.0.jar","index": 76 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/com.jayway.jsonpath\/json-path@2.8.0"}]}]}, {"ruleId": "CVE-2022-47932","level": "warning","message": {"text": "CVE-2022-47932 - Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:\/\/ or ipns:\/\/ URL. This vulnerability is caused by an incomplete fix for CVE-2022-47933."},"partialFingerprints": {"vulnerabilityHash": "994a6a01e11a310cc7f56688077858f5"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","index": 102 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"}]}]}, {"ruleId": "CVE-2022-47933","level": "warning","message": {"text": "CVE-2022-47933 - Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequest_IPFSRedirectWork() in ipfs_redirect_network_delegate_helper.cc."},"partialFingerprints": {"vulnerabilityHash": "39f40eab185e89edd407d2148e367818"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","index": 102 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"}]}]}, {"ruleId": "CVE-2022-47934","level": "warning","message": {"text": "CVE-2022-47934 - Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:\/\/ or ipns:\/\/ URL. This is caused by an incomplete fix for CVE-2022-47932 and CVE-2022-47934."},"partialFingerprints": {"vulnerabilityHash": "5dd5d45f4b6a5363483bbff32fcee7ab"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","index": 102 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"}]}]}, {"ruleId": "CVE-2021-22929","level": "warning","message": {"text": "CVE-2021-22929 - An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log."},"partialFingerprints": {"vulnerabilityHash": "7008b592ddf4cb56fe08715627518f65"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","index": 102 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"}]}]}, {"ruleId": "CVE-2020-8276","level": "warning","message": {"text": "CVE-2020-8276 - The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an incognito window, including Tor windows. The intended behavior was to log the timestamp for incognito windows excluding Tor windows. Note that if a user has P3A enabled, the timestamp is not sent to Brave's server, but rather a value from:Used in last 24hUsed in last week but not 24hUsed in last 28 days but not weekEver used but not in last 28 daysNever usedThe privacy risk is low because a local attacker with disk access cannot tell if the timestamp corresponds to a Tor window or a non-Tor incognito window."},"partialFingerprints": {"vulnerabilityHash": "52c47fa63a16c7609a7988b08bc4e297"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","index": 102 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"}]}]}, {"ruleId": "CVE-2022-30334","level": "warning","message": {"text": "CVE-2022-30334 - Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave, the Brave documentation still advises \"Note that Private Windows with Tor Connectivity in Brave are just regular private windows that use Tor as a proxy. Brave does NOT implement most of the privacy protections from Tor Browser.\""},"partialFingerprints": {"vulnerabilityHash": "b8dfd613bce70023dd0099b183cbca8a"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","index": 102 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"}]}]}, {"ruleId": "CVE-2023-28360","level": "warning","message": {"text": "CVE-2023-28360 - An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file there was no download safety check dialog presented to the user."},"partialFingerprints": {"vulnerabilityHash": "0fb420e7b3cd855edd579cad550c3645"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/io\/micrometer\/micrometer-tracing-bridge-brave\/1.2.2\/micrometer-tracing-bridge-brave-1.2.2.jar","index": 102 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/io.micrometer\/micrometer-tracing-bridge-brave@1.2.2"}]}]}, {"ruleId": "CVE-2023-22102","level": "warning","message": {"text": "CVE-2023-22102 - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector\/J).  Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H)."},"partialFingerprints": {"vulnerabilityHash": "c8a7c4e26dd98079b1a6b65b7dfbe6ef"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/com\/mysql\/mysql-connector-j\/8.0.32\/mysql-connector-j-8.0.32.jar","index": 106 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/com.mysql\/mysql-connector-j@8.0.32"}]}]}, {"ruleId": "CVE-2020-5410","level": "warning","message": {"text": "CVE-2020-5410 - Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack."},"partialFingerprints": {"vulnerabilityHash": "3b04af18df624e2d4941fa9641ad58be"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-aws-autoconfigure\/2.1.3.RELEASE\/spring-cloud-aws-autoconfigure-2.1.3.RELEASE.jar","index": 125 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/org.springframework.cloud\/spring-cloud-aws-autoconfigure@2.1.3.RELEASE"}]}]}, {"ruleId": "CVE-2020-5405","level": "warning","message": {"text": "CVE-2020-5405 - Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack."},"partialFingerprints": {"vulnerabilityHash": "b8e586ebc1e0824e36d24d310cd6eea5"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "file://\/Users\/prashantsavadi\/.m2\/repository\/org\/springframework\/cloud\/spring-cloud-aws-autoconfigure\/2.1.3.RELEASE\/spring-cloud-aws-autoconfigure-2.1.3.RELEASE.jar","index": 125 }},"logicalLocations": [{"fullyQualifiedName": "pkg:maven\/org.springframework.cloud\/spring-cloud-aws-autoconfigure@2.1.3.RELEASE"}]}]}]}]}