Code injection

In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these artifacts could have been MITM to maliciously compromise them and infect the build artifacts that were produced. Additionally, if any of thes...

CVE-2019-11770

The CVE-2019-11770 entry concerns Eclipse Buildship versions prior to 3.1.1, where build files resolve dependencies over HTTP instead of HTTPS. This creates a MITM risk: artifacts could be compromised in transit, potentially infecting build artifacts and, if dependencies were tainted, affecting d...

Legion - An Easy-To-Use, Super-Extensible And Semi-Automated Network Penetration Testing Tool That Aids In Discovery, Reconnaissance And Exploitation Of Information Systems

Legion, a fork of SECFORCE's Sparta, is an open source, easy-to-use, super-extensible and semi-automated network penetration testing framework that aids in discovery, reconnaissance and exploitation of information systems. Legion is developed and maintained by GoVanguard. More information about...

Unsafe Dependency Resolution

Overview io.dropwizard:dropwizard-example is a simple library for building production-ready RESTful web services. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure...

Unsafe Dependency Resolution

Overview com.paypal.digraph:digraph-parser is a Java parser for digraph DSL Graphviz DOT language. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a...

Unsafe Dependency Resolution

Overview com.paypal.selion:SeLion-Parent is a builds on top of TestNG and Selenium to provide a set of capabilities that get you up and running with WebDriver in a short time. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an...

Unsafe Dependency Resolution

Amendment This was deemed not a vulnerability. Overview com.github.ben-manes.caffeine:caffeine is a caching library for Java 8. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over ...

Unsafe Dependency Resolution

Overview com.paypal.tools:Gibberish-Detector is a small program to detect gibberish using a Markov Chain. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection...

Unsafe Dependency Resolution

Overview org.controlsfx:controlsfx is a high quality UI controls and other tools to complement the core JavaFX distribution. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an...

Unsafe Dependency Resolution

Overview com.uber:UberScriptQuery is a SQL-like DSL to make writing Spark jobs super easy. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicious...

Unsafe Dependency Resolution

Overview com.fasterxml.jackson.module:jackson-module-scala is an Add-on module for Jackson http://wiki.fasterxml.com/JacksonHome to support Scala-specific datatypes. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure...

Unsafe Dependency Resolution

Overview org.eclipse.xtext:org.eclipse.xtext.maven.parent is a framework for development of programming languages and domain-specific languages. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the bui...

Unsafe Dependency Resolution

Overview org.testng:testng is a testing framework for the JVM. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicious user could have perform a...

Unsafe Dependency Resolution

Overview com.diffplug.gradle.spotless:spotless-eclipse-cdt is a code formatting library. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicious use...

Unsafe Dependency Resolution

Overview com.diffplug.gradle.spotless:spotless-eclipse-groovy is a code formatting library. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicious...

Unsafe Dependency Resolution

Overview org.eclipse.hawkbit:hawkbit-parent is a domain independent back end solution for rolling out software updates to constrained edge devices as well as more powerful controllers and gateways connected to IP based networking infrastructure. Affected versions of this package are vulnerable to...

Unsafe Dependency Resolution

Overview org.immutables:value-fixture is a processor to create immutable objects and builders. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicio...

Unsafe Dependency Resolution

Overview com.beust:jcommander is a Command line parsing framework for Java. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicious user could have...

CVE-2015-9268

Nullsoft Scriptable Install System NSIS before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime...

GHSA-9WRQ-XVMP-XJC8 Rails Denial of Service vulnerability

Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service application hang or "data loss," a differen...