Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: JWT Validator - Vertx

uk.co.spudsoft:jwt-validator-vertx:0.0.46

Scan Information (show all):

Summary

Summary of Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
error_prone_annotations-2.36.0.jarpkg:maven/com.google.errorprone/error_prone_annotations@2.36.0 029
failureaccess-1.0.3.jarpkg:maven/com.google.guava/failureaccess@1.0.3 032
guava-33.4.8-jre.jarcpe:2.3:a:google:guava:33.4.8:*:*:*:*:*:*:*pkg:maven/com.google.guava/guava@33.4.8-jre 0Highest25
j2objc-annotations-3.0.0.jarpkg:maven/com.google.j2objc/j2objc-annotations@3.0.0 033
jackson-annotations-2.20.jarcpe:2.3:a:fasterxml:jackson-modules-java8:2.20:*:*:*:*:*:*:*pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.20 0Low36
jackson-core-2.20.0.jarcpe:2.3:a:fasterxml:jackson-modules-java8:2.20.0:*:*:*:*:*:*:*pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.0 0Low47
jackson-databind-2.20.0.jarcpe:2.3:a:fasterxml:jackson-databind:2.20.0:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-modules-java8:2.20.0:*:*:*:*:*:*:*		pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.0 0Highest41
jackson-dataformat-yaml-2.20.0.jarcpe:2.3:a:fasterxml:jackson-dataformat-xml:2.20.0:*:*:*:*:*:*:*pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml@2.20.0 0Highest39
jspecify-1.0.0.jarpkg:maven/org.jspecify/jspecify@1.0.0 032
listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jarpkg:maven/com.google.guava/listenablefuture@9999.0-empty-to-avoid-conflict-with-guava 013
netty-common-4.1.124.Final.jar (shaded: org.jctools:jctools-core:4.0.5)pkg:maven/org.jctools/jctools-core@4.0.5 09
netty-transport-4.1.124.Final.jarcpe:2.3:a:netty:netty:4.1.124:*:*:*:*:*:*:*pkg:maven/io.netty/netty-transport@4.1.124.Final 0Highest34
slf4j-api-2.1.0-alpha1.jarpkg:maven/org.slf4j/slf4j-api@2.1.0-alpha1 027
snakeyaml-2.4.jarcpe:2.3:a:snakeyaml_project:snakeyaml:2.4:*:*:*:*:*:*:*pkg:maven/org.yaml/snakeyaml@2.4 0Highest42
vertx-codegen-4.5.20.jarpkg:maven/io.vertx/vertx-codegen@4.5.20 022
vertx-core-4.5.20.jarcpe:2.3:a:eclipse:vert.x:4.5.20:*:*:*:*:*:*:*pkg:maven/io.vertx/vertx-core@4.5.20 0High34
vertx-web-4.5.20.jarcpe:2.3:a:web_project:web:4.5.20:*:*:*:*:*:*:*pkg:maven/io.vertx/vertx-web@4.5.20 0Highest31

Dependencies (vulnerable)

error_prone_annotations-2.36.0.jar

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/errorprone/error_prone_annotations/2.36.0/error_prone_annotations-2.36.0.jar
MD5: 0e48e5ba2cd0a8d8d09bad849b99f6a6
SHA1: 227d4d4957ccc3dc5761bd897e3a0ee587e750a7
SHA256:77440e270b0bc9a249903c5a076c36a722c4886ca4f42675f2903a1c53ed61a5
Referenced In Project/Scope: JWT Validator - Vertx:compile
error_prone_annotations-2.36.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.google.guava/guava@33.4.8-jre

Identifiers

failureaccess-1.0.3.jar

Description:

    Contains
    com.google.common.util.concurrent.internal.InternalFutureFailureAccess and
    InternalFutures. Most users will never need to use this artifact. Its
    classes are conceptually a part of Guava, but they're in this separate
    artifact so that Android libraries can use them without pulling in all of
    Guava (just as they can use ListenableFuture by depending on the
    listenablefuture artifact).

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/guava/failureaccess/1.0.3/failureaccess-1.0.3.jar
MD5: 29a782e90f6b37218b18bb880d2a8f4a
SHA1: aeaffd00d57023a2c947393ed251f0354f0985fc
SHA256:cbfc3906b19b8f55dd7cfd6dfe0aa4532e834250d7f080bd8d211a3e246b59cb
Referenced In Project/Scope: JWT Validator - Vertx:compile
failureaccess-1.0.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.google.guava/guava@33.4.8-jre

Identifiers

guava-33.4.8-jre.jar

Description:

    Guava is a suite of core and expanded libraries that include
    utility classes, Google's collections, I/O classes, and
    much more.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/guava/guava/33.4.8-jre/guava-33.4.8-jre.jar
MD5: 72920caab34426c5815e3b00f80e3b01
SHA1: e70a3268e6cd3e7d458aa15787ce6811c34e96ae
SHA256:f3d7f57f67fd622f4d468dfdd692b3a5e3909246c28017ac3263405f0fe617ed
Referenced In Project/Scope: JWT Validator - Vertx:compile
guava-33.4.8-jre.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.46

Identifiers

j2objc-annotations-3.0.0.jar

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/j2objc/j2objc-annotations/3.0.0/j2objc-annotations-3.0.0.jar
MD5: f59529b29202a5baf37f491ea5ec8627
SHA1: 7399e65dd7e9ff3404f4535b2f017093bdb134c7
SHA256:88241573467ddca44ffd4d74aa04c2bbfd11bf7c17e0c342c94c9de7a70a7c64
Referenced In Project/Scope: JWT Validator - Vertx:compile
j2objc-annotations-3.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.google.guava/guava@33.4.8-jre

Identifiers

jackson-annotations-2.20.jar

Description:

Core annotations used for value types, used by Jackson data binding package.

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.20/jackson-annotations-2.20.jar
MD5: b901def3c20752817f27130e4b8d6640
SHA1: 6a5e7291ea3f2b590a7ce400adb7b3aea4d7e12c
SHA256:959a2ffb2d591436f51f183c6a521fc89347912f711bf0cae008cdf045d95319
Referenced In Project/Scope: JWT Validator - Vertx:compile
jackson-annotations-2.20.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.0

Identifiers

jackson-core-2.20.0.jar

Description:

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.20.0/jackson-core-2.20.0.jar
MD5: 3536b524a7106dae1b4feb71e6f5ff74
SHA1: 3c97f7fad069f7cfae639d790bd93d6a0b2dff31
SHA256:bc0cf46075877201f8406ee7de2741ae7df6c066f5f0457bd80632a718c06e72
Referenced In Project/Scope: JWT Validator - Vertx:compile
jackson-core-2.20.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.0

Identifiers

jackson-databind-2.20.0.jar

Description:

General data-binding functionality for Jackson: works on core streaming API

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.20.0/jackson-databind-2.20.0.jar
MD5: 7e33b9e657f74f0f95fe2c881e2f8f76
SHA1: f0a5e62fbd21285e9a5498a60dccb097e1ef793b
SHA256:a70e146a6bf2cba4f9cd367169787f50adcfbb57122bc2e9c8390cd0b397ac30
Referenced In Project/Scope: JWT Validator - Vertx:compile
jackson-databind-2.20.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.46

Identifiers

jackson-dataformat-yaml-2.20.0.jar

Description:

Support for reading and writing YAML-encoded data via Jackson abstractions.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.20.0/jackson-dataformat-yaml-2.20.0.jar
MD5: 652025f2a21ade51cc34e75a75e1468b
SHA1: 58502643d75dede7fbcfc6e60b58397045da976e
SHA256:cc3dec9fb8b56574797bfef62641325508f0e5bc968bd268568402818d55baae
Referenced In Project/Scope: JWT Validator - Vertx:compile
jackson-dataformat-yaml-2.20.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.46

Identifiers

jspecify-1.0.0.jar

Description:

An artifact of well-named and well-specified annotations to power static analysis checks

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar
MD5: 9133aba420d0ca3b001dbb6ae9992cf6
SHA1: 7425a601c1c7ec76645a78d22b8c6a627edee507
SHA256:1fad6e6be7557781e4d33729d49ae1cdc8fdda6fe477bb0cc68ce351eafdfbab
Referenced In Project/Scope: JWT Validator - Vertx:compile
jspecify-1.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.google.guava/guava@33.4.8-jre

Identifiers

listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar

Description:

    An empty artifact that Guava depends on to signal that it is providing
    ListenableFuture -- but is also available in a second "version" that
    contains com.google.common.util.concurrent.ListenableFuture class, without
    any other Guava classes. The idea is:

    - If users want only ListenableFuture, they depend on listenablefuture-1.0.

    - If users want all of Guava, they depend on guava, which, as of Guava
    27.0, depends on
    listenablefuture-9999.0-empty-to-avoid-conflict-with-guava. The 9999.0-...
    version number is enough for some build systems (notably, Gradle) to select
    that empty artifact over the "real" listenablefuture-1.0 -- avoiding a
    conflict with the copy of ListenableFuture in guava itself. If users are
    using an older version of Guava or a build system other than Gradle, they
    may see class conflicts. If so, they can solve them by manually excluding
    the listenablefuture artifact or manually forcing their build systems to
    use 9999.0-....

File Path: /home/runner/.m2/repository/com/google/guava/listenablefuture/9999.0-empty-to-avoid-conflict-with-guava/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
MD5: d094c22570d65e132c19cea5d352e381
SHA1: b421526c5f297295adef1c886e5246c39d4ac629
SHA256:b372a037d4230aa57fbeffdef30fd6123f9c0c2db85d0aced00c91b974f33f99
Referenced In Project/Scope: JWT Validator - Vertx:compile
listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.google.guava/guava@33.4.8-jre

Identifiers

netty-common-4.1.124.Final.jar (shaded: org.jctools:jctools-core:4.0.5)

Description:

Java Concurrency Tools Core Library

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/io/netty/netty-common/4.1.124.Final/netty-common-4.1.124.Final.jar/META-INF/maven/org.jctools/jctools-core/pom.xml
MD5: 5d5135397b920a7dcbca5c1fb0576cf2
SHA1: eaa05d6ad937464312a2681a3236c0e06602bbb7
SHA256:a69897b8ff0c2198b4b8cd7d4f93fde6d42b8e9dbfc95553585e27587b24e211
Referenced In Project/Scope: JWT Validator - Vertx:compile

Identifiers

netty-transport-4.1.124.Final.jar

Description:

Netty is an asynchronous event-driven network application framework for    rapid development of maintainable high performance protocol servers and    clients.

License:

https://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/io/netty/netty-transport/4.1.124.Final/netty-transport-4.1.124.Final.jar
MD5: 85037b7fa9e307315c68eaac0fe4940c
SHA1: ce4f80c96f32d51659e142237c3ffbc678765e4e
SHA256:065c5aa6de5e8305dc1a25fb079b5dd041057ee19bd027ba24420316bf2e71b2
Referenced In Project/Scope: JWT Validator - Vertx:compile
netty-transport-4.1.124.Final.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/io.vertx/vertx-web@4.5.20

Identifiers

slf4j-api-2.1.0-alpha1.jar

Description:

The slf4j API

License:

http://www.opensource.org/licenses/mit-license.php
File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/2.1.0-alpha1/slf4j-api-2.1.0-alpha1.jar
MD5: 22d0512f94f321721b28b3365b2d7ea1
SHA1: 4e2525fc4327cc553c52e3937427c7cf2114735f
SHA256:9ab7ffa646202b499d05995a3ec82f31bccb7a50345c1514d8cb42ec8ccea353
Referenced In Project/Scope: JWT Validator - Vertx:compile
slf4j-api-2.1.0-alpha1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.46

Identifiers

snakeyaml-2.4.jar

Description:

YAML 1.1 parser and emitter for Java

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/yaml/snakeyaml/2.4/snakeyaml-2.4.jar
MD5: 29410ee3a987e3bff7b847933c591972
SHA1: e0666b825b796f85521f02360e77f4c92c5a7a07
SHA256:ef779af5d29a9dde8cc70ce0341f5c6f7735e23edff9685ceaa9d35359b7bb7f
Referenced In Project/Scope: JWT Validator - Vertx:compile
snakeyaml-2.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml@2.20.0

Identifiers

vertx-codegen-4.5.20.jar

File Path: /home/runner/.m2/repository/io/vertx/vertx-codegen/4.5.20/vertx-codegen-4.5.20.jar
MD5: ee5e2de9d6daa9bf4d3ef8be5bbb8262
SHA1: a743aa05f19d47a2f861747723cd71cebdc3ed87
SHA256:330c97d1eb67e9786b3dacc99f3faf30fb36d50f399c0b1a2df6365e219f4ced
Referenced In Project/Scope: JWT Validator - Vertx:compile
vertx-codegen-4.5.20.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.46

Identifiers

vertx-core-4.5.20.jar

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
Eclipse Public License - v 2.0: http://www.eclipse.org/legal/epl-v20.html
File Path: /home/runner/.m2/repository/io/vertx/vertx-core/4.5.20/vertx-core-4.5.20.jar
MD5: f86fe6dcda9d8f56d2c4120a5ca92655
SHA1: 2408678d449c3da7ba5dd891960f51eac2556396
SHA256:37d76ae4533a40565ef3a73787d99a2fb82e20d2644ee3bd7043b8355d7f2ae7
Referenced In Project/Scope: JWT Validator - Vertx:compile
vertx-core-4.5.20.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/io.vertx/vertx-web@4.5.20

Identifiers

vertx-web-4.5.20.jar

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
Eclipse Public License - v 2.0: http://www.eclipse.org/legal/epl-v20.html
File Path: /home/runner/.m2/repository/io/vertx/vertx-web/4.5.20/vertx-web-4.5.20.jar
MD5: b234398e6b941dcd73d95258897ddc40
SHA1: 6d983b4593f8baf8309f23008446cfc59b4d3631
SHA256:acc6835feea1bb954012709841346a7162cddd3b8dc93288b157fa0065a7eccb
Referenced In Project/Scope: JWT Validator - Vertx:compile
vertx-web-4.5.20.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/uk.co.spudsoft/jwt-validator-vertx@0.0.46

Identifiers



This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.