Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: JWT Validator - Vertx

uk.co.spudsoft:jwt-validator-vertx:0.0.44

Scan Information (show all):

Summary

Display: Showing Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
error_prone_annotations-2.36.0.jarpkg:maven/com.google.errorprone/error_prone_annotations@2.36.0 029
failureaccess-1.0.3.jarpkg:maven/com.google.guava/failureaccess@1.0.3 032
guava-33.4.8-jre.jarcpe:2.3:a:google:guava:33.4.8:*:*:*:*:*:*:*pkg:maven/com.google.guava/guava@33.4.8-jre 0Highest25
j2objc-annotations-3.0.0.jarpkg:maven/com.google.j2objc/j2objc-annotations@3.0.0 033
jackson-core-2.19.0.jarcpe:2.3:a:fasterxml:jackson-modules-java8:2.19.0:*:*:*:*:*:*:*pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.0 0Low47
jackson-databind-2.19.0.jarcpe:2.3:a:fasterxml:jackson-databind:2.19.0:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-modules-java8:2.19.0:*:*:*:*:*:*:*		pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0 0Highest41
jackson-dataformat-yaml-2.19.0.jarcpe:2.3:a:fasterxml:jackson-dataformat-xml:2.19.0:*:*:*:*:*:*:*pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml@2.19.0 0Highest39
jspecify-1.0.0.jarpkg:maven/org.jspecify/jspecify@1.0.0 032
listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jarpkg:maven/com.google.guava/listenablefuture@9999.0-empty-to-avoid-conflict-with-guava 013
netty-common-4.2.1.Final.jar (shaded: org.jctools:jctools-core:4.0.5)pkg:maven/org.jctools/jctools-core@4.0.5 09
netty-transport-4.2.1.Final.jarcpe:2.3:a:netty:netty:4.2.1:*:*:*:*:*:*:*pkg:maven/io.netty/netty-transport@4.2.1.Final 0Highest35
slf4j-api-2.1.0-alpha1.jarpkg:maven/org.slf4j/slf4j-api@2.1.0-alpha1 027
snakeyaml-2.4.jarcpe:2.3:a:snakeyaml_project:snakeyaml:2.4:*:*:*:*:*:*:*pkg:maven/org.yaml/snakeyaml@2.4 0Highest42
vertx-auth-common-5.0.0.jarpkg:maven/io.vertx/vertx-auth-common@5.0.0 027
vertx-codegen-5.0.0.jarpkg:maven/io.vertx/vertx-codegen@5.0.0 027
vertx-codegen-api-5.0.0.jarpkg:maven/io.vertx/vertx-codegen-api@5.0.0 027
vertx-codegen-json-5.0.0.jarpkg:maven/io.vertx/vertx-codegen-json@5.0.0 029
vertx-codegen-processor-5.0.0.jarpkg:maven/io.vertx/vertx-codegen-processor@5.0.0 029
vertx-core-5.0.0.jarcpe:2.3:a:eclipse:vert.x:5.0.0:*:*:*:*:*:*:*pkg:maven/io.vertx/vertx-core@5.0.0 0High29
vertx-web-5.0.0.jarcpe:2.3:a:web_project:web:5.0.0:*:*:*:*:*:*:*pkg:maven/io.vertx/vertx-web@5.0.0 0Highest27

Dependencies (vulnerable)

error_prone_annotations-2.36.0.jar

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/errorprone/error_prone_annotations/2.36.0/error_prone_annotations-2.36.0.jar
MD5: 0e48e5ba2cd0a8d8d09bad849b99f6a6
SHA1: 227d4d4957ccc3dc5761bd897e3a0ee587e750a7
SHA256:77440e270b0bc9a249903c5a076c36a722c4886ca4f42675f2903a1c53ed61a5
Referenced In Project/Scope: JWT Validator - Vertx:compile
error_prone_annotations-2.36.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.google.guava/guava@33.4.8-jre

Identifiers

failureaccess-1.0.3.jar

Description:

    Contains
    com.google.common.util.concurrent.internal.InternalFutureFailureAccess and
    InternalFutures. Most users will never need to use this artifact. Its
    classes are conceptually a part of Guava, but they're in this separate
    artifact so that Android libraries can use them without pulling in all of
    Guava (just as they can use ListenableFuture by depending on the
    listenablefuture artifact).

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/guava/failureaccess/1.0.3/failureaccess-1.0.3.jar
MD5: 29a782e90f6b37218b18bb880d2a8f4a
SHA1: aeaffd00d57023a2c947393ed251f0354f0985fc
SHA256:cbfc3906b19b8f55dd7cfd6dfe0aa4532e834250d7f080bd8d211a3e246b59cb
Referenced In Project/Scope: JWT Validator - Vertx:compile
failureaccess-1.0.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.google.guava/guava@33.4.8-jre

Identifiers

guava-33.4.8-jre.jar

Description:

    Guava is a suite of core and expanded libraries that include
    utility classes, Google's collections, I/O classes, and
    much more.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/guava/guava/33.4.8-jre/guava-33.4.8-jre.jar
MD5: 72920caab34426c5815e3b00f80e3b01
SHA1: e70a3268e6cd3e7d458aa15787ce6811c34e96ae
SHA256:f3d7f57f67fd622f4d468dfdd692b3a5e3909246c28017ac3263405f0fe617ed
Referenced In Project/Scope: JWT Validator - Vertx:compile
guava-33.4.8-jre.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.44

Identifiers

j2objc-annotations-3.0.0.jar

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/j2objc/j2objc-annotations/3.0.0/j2objc-annotations-3.0.0.jar
MD5: f59529b29202a5baf37f491ea5ec8627
SHA1: 7399e65dd7e9ff3404f4535b2f017093bdb134c7
SHA256:88241573467ddca44ffd4d74aa04c2bbfd11bf7c17e0c342c94c9de7a70a7c64
Referenced In Project/Scope: JWT Validator - Vertx:compile
j2objc-annotations-3.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.google.guava/guava@33.4.8-jre

Identifiers

jackson-core-2.19.0.jar

Description:

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.19.0/jackson-core-2.19.0.jar
MD5: d741d9cff5a56cb6f1307abe947fb7c1
SHA1: a90640e59ea42632a8e331ff1d6b706cf306050a
SHA256:da8e859bac94874528116a25f20c68560e4287acbf27628711b8a4f96b028430
Referenced In Project/Scope: JWT Validator - Vertx:compile
jackson-core-2.19.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0

Identifiers

jackson-databind-2.19.0.jar

Description:

General data-binding functionality for Jackson: works on core streaming API

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.19.0/jackson-databind-2.19.0.jar
MD5: 0bf98314940eeb0cd056277e4bd377b5
SHA1: b3f7506f6414fb04760561eec11a0880165c2a4a
SHA256:ceda311f476c3b18e1d2b240c94e2dcb9c8d44e70f8afa9facab88bac4ddc03a
Referenced In Project/Scope: JWT Validator - Vertx:compile
jackson-databind-2.19.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.44

Identifiers

jackson-dataformat-yaml-2.19.0.jar

Description:

Support for reading and writing YAML-encoded data via Jackson abstractions.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.19.0/jackson-dataformat-yaml-2.19.0.jar
MD5: 8d55f25db2f8ecbb08f27dfc1928c467
SHA1: 2d735ab4ecebf5c2bf248d4036fd4ba6d73d0cc1
SHA256:46e54dcbd39d4d12cda18ec9276e7b888e08fc765ea0c77e71662306f0d4abc4
Referenced In Project/Scope: JWT Validator - Vertx:compile
jackson-dataformat-yaml-2.19.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.44

Identifiers

jspecify-1.0.0.jar

Description:

An artifact of well-named and well-specified annotations to power static analysis checks

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar
MD5: 9133aba420d0ca3b001dbb6ae9992cf6
SHA1: 7425a601c1c7ec76645a78d22b8c6a627edee507
SHA256:1fad6e6be7557781e4d33729d49ae1cdc8fdda6fe477bb0cc68ce351eafdfbab
Referenced In Project/Scope: JWT Validator - Vertx:compile
jspecify-1.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.google.guava/guava@33.4.8-jre

Identifiers

listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar

Description:

    An empty artifact that Guava depends on to signal that it is providing
    ListenableFuture -- but is also available in a second "version" that
    contains com.google.common.util.concurrent.ListenableFuture class, without
    any other Guava classes. The idea is:

    - If users want only ListenableFuture, they depend on listenablefuture-1.0.

    - If users want all of Guava, they depend on guava, which, as of Guava
    27.0, depends on
    listenablefuture-9999.0-empty-to-avoid-conflict-with-guava. The 9999.0-...
    version number is enough for some build systems (notably, Gradle) to select
    that empty artifact over the "real" listenablefuture-1.0 -- avoiding a
    conflict with the copy of ListenableFuture in guava itself. If users are
    using an older version of Guava or a build system other than Gradle, they
    may see class conflicts. If so, they can solve them by manually excluding
    the listenablefuture artifact or manually forcing their build systems to
    use 9999.0-....

File Path: /home/runner/.m2/repository/com/google/guava/listenablefuture/9999.0-empty-to-avoid-conflict-with-guava/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
MD5: d094c22570d65e132c19cea5d352e381
SHA1: b421526c5f297295adef1c886e5246c39d4ac629
SHA256:b372a037d4230aa57fbeffdef30fd6123f9c0c2db85d0aced00c91b974f33f99
Referenced In Project/Scope: JWT Validator - Vertx:compile
listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.google.guava/guava@33.4.8-jre

Identifiers

netty-common-4.2.1.Final.jar (shaded: org.jctools:jctools-core:4.0.5)

Description:

Java Concurrency Tools Core Library

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/io/netty/netty-common/4.2.1.Final/netty-common-4.2.1.Final.jar/META-INF/maven/org.jctools/jctools-core/pom.xml
MD5: 5d5135397b920a7dcbca5c1fb0576cf2
SHA1: eaa05d6ad937464312a2681a3236c0e06602bbb7
SHA256:a69897b8ff0c2198b4b8cd7d4f93fde6d42b8e9dbfc95553585e27587b24e211
Referenced In Project/Scope: JWT Validator - Vertx:compile

Identifiers

netty-transport-4.2.1.Final.jar

Description:

Netty is an asynchronous event-driven network application framework for    rapid development of maintainable high performance protocol servers and    clients.

License:

https://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/io/netty/netty-transport/4.2.1.Final/netty-transport-4.2.1.Final.jar
MD5: 5f4f941fdb4afb156bec58ab23a2cafd
SHA1: 5c9140fffd02fe833a570dfd00c3dced88c72abd
SHA256:ba9fd45598fa05605d2a5014d6f47112e4392ba2b912cd1e3786e4851b397cf7
Referenced In Project/Scope: JWT Validator - Vertx:compile
netty-transport-4.2.1.Final.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/io.vertx/vertx-web@5.0.0

Identifiers

slf4j-api-2.1.0-alpha1.jar

Description:

The slf4j API

License:

http://www.opensource.org/licenses/mit-license.php
File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/2.1.0-alpha1/slf4j-api-2.1.0-alpha1.jar
MD5: 22d0512f94f321721b28b3365b2d7ea1
SHA1: 4e2525fc4327cc553c52e3937427c7cf2114735f
SHA256:9ab7ffa646202b499d05995a3ec82f31bccb7a50345c1514d8cb42ec8ccea353
Referenced In Project/Scope: JWT Validator - Vertx:compile
slf4j-api-2.1.0-alpha1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.44

Identifiers

snakeyaml-2.4.jar

Description:

YAML 1.1 parser and emitter for Java

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/yaml/snakeyaml/2.4/snakeyaml-2.4.jar
MD5: 29410ee3a987e3bff7b847933c591972
SHA1: e0666b825b796f85521f02360e77f4c92c5a7a07
SHA256:ef779af5d29a9dde8cc70ce0341f5c6f7735e23edff9685ceaa9d35359b7bb7f
Referenced In Project/Scope: JWT Validator - Vertx:compile
snakeyaml-2.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml@2.19.0

Identifiers

vertx-auth-common-5.0.0.jar

File Path: /home/runner/.m2/repository/io/vertx/vertx-auth-common/5.0.0/vertx-auth-common-5.0.0.jar
MD5: 564df1667f4065cbcdceac6ef99972a8
SHA1: a028174fb1e476c0eab47db8cdc10d262012a85d
SHA256:4f7b41c5c838c9280d63062b2ff2773dd508a67e7634f536ae7340eb168a71eb
Referenced In Project/Scope: JWT Validator - Vertx:compile
vertx-auth-common-5.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.44

Identifiers

vertx-codegen-5.0.0.jar

File Path: /home/runner/.m2/repository/io/vertx/vertx-codegen/5.0.0/vertx-codegen-5.0.0.jar
MD5: 52d110e8dddcdf1dbd7edf48f80d9b51
SHA1: d37e6428b4276ae89a8259ea25aca4bf1f57de91
SHA256:a4546014de95f4ec1c8a0046822d0ff4284014d29088668c4faff1fdae275fee
Referenced In Project/Scope: JWT Validator - Vertx:compile
vertx-codegen-5.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.44

Identifiers

vertx-codegen-api-5.0.0.jar

File Path: /home/runner/.m2/repository/io/vertx/vertx-codegen-api/5.0.0/vertx-codegen-api-5.0.0.jar
MD5: 5a48df30ea60cfbbf49528f655868d16
SHA1: 1797fdfa6e16ff2bffe7e3146ee0517042425b69
SHA256:998548b95921d9f4bcda9a010631cba10ed7ac8087093d291cb521f8e8717f0d
Referenced In Project/Scope: JWT Validator - Vertx:compile
vertx-codegen-api-5.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/io.vertx/vertx-codegen@5.0.0

Identifiers

vertx-codegen-json-5.0.0.jar

File Path: /home/runner/.m2/repository/io/vertx/vertx-codegen-json/5.0.0/vertx-codegen-json-5.0.0.jar
MD5: 5d0202fe7ec3932f15a59b7d5776ee47
SHA1: 303d0cc7e1aba312900bf059f41a03a598a847dc
SHA256:e4306cbfbf7bc49ebead95eccd68cd05c738c6d874cf0f8c7953556b6de1f41d
Referenced In Project/Scope: JWT Validator - Vertx:compile
vertx-codegen-json-5.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/io.vertx/vertx-codegen@5.0.0

Identifiers

vertx-codegen-processor-5.0.0.jar

File Path: /home/runner/.m2/repository/io/vertx/vertx-codegen-processor/5.0.0/vertx-codegen-processor-5.0.0.jar
MD5: ff7d6b8c1a48dc378244ffcbdcbbf0e8
SHA1: 17483f9c561706693417452a1e25c5d84e2f98f4
SHA256:d303d043d383abd8eabcd8c50e321cd926013dcb5d773b58e4334566352e29e6
Referenced In Project/Scope: JWT Validator - Vertx:compile
vertx-codegen-processor-5.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/io.vertx/vertx-codegen@5.0.0

Identifiers

vertx-core-5.0.0.jar

File Path: /home/runner/.m2/repository/io/vertx/vertx-core/5.0.0/vertx-core-5.0.0.jar
MD5: 42782d16a945f53cca5a2b913e2d82bc
SHA1: 346e313b821e1e5e871d782be7e051f70541010f
SHA256:28431e4e611474d9468d78c747c3da2fbba909e8c6bc8dd8d080d9cb5c1bd752
Referenced In Project/Scope: JWT Validator - Vertx:compile
vertx-core-5.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/io.vertx/vertx-web@5.0.0

Identifiers

vertx-web-5.0.0.jar

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
Eclipse Public License - v 2.0: http://www.eclipse.org/legal/epl-v20.html
File Path: /home/runner/.m2/repository/io/vertx/vertx-web/5.0.0/vertx-web-5.0.0.jar
MD5: 0dddce1c4fef077d974b2039b67d6908
SHA1: c7f632b70bcdd4946d9a0364096f42ff07b02a90
SHA256:b1f27dd7a3a00a5fb30d6c338d2e3c1754fb3c2fdb8de22bfb9a1e27b4c39722
Referenced In Project/Scope: JWT Validator - Vertx:compile
vertx-web-5.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.44

Identifiers



This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.