MinimalReproducer

After significant efforts, stripped it down to a minimal replicator. This is just an empty project to demonstrate the issue with dependency-check-maven usage I am forced on doing by my company rules. Do check the pom.xml and do verify: mvn org.owasp:dependency-check-maven:RELEASE:aggregate Or if...

org.apache.maven:maven-archiver (2.0-alpha-1), org.apache.maven:maven-plugin-tools-api (2.0-alpha-1) +3 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0-alpha-1)

org.apache.maven:maven-core MAVEN version 2.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - org.apache.maven:maven-archiver 2.0-alpha-1 - org.apache.maven:maven-plugin-tools-api 2.0-alpha-1 -...

org.codehaus.modello:modello-test (1.0-alpha-2), plexus:plexus-cdc (1.0-alpha-1) potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0-alpha-2)

org.apache.maven:maven-core MAVEN version 2.0-alpha-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - org.codehaus.modello:modello-test 1.0-alpha-2 - plexus:plexus-cdc 1.0-alpha-1 Source cves:...

org.apache.maven.continuum:continuum-cc (>=1.0-alpha-4, <=1.0-beta-1), org.apache.maven.continuum:continuum-core (>=1.0-alpha-4, <=1.0-beta-1) +5 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0-beta-1)

org.apache.maven:maven-core MAVEN version 2.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - org.apache.maven.continuum:continuum-cc =1.0-alpha-4, =1.0-alpha-4, =1.0-alpha-4, =1.0-alpha-4,...

org.apache.maven.plugins:maven-release-plugin (2.0-beta-2) potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0-beta-2)

org.apache.maven:maven-core MAVEN version 2.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - org.apache.maven.plugins:maven-release-plugin 2.0-beta-2 Source cves: CVE-2021-26291 Source advisory...

com.cloudbees:maven-license-plugin (>=1.2, <=1.12), com.custardsource.dybdob:dybdob-sonar-plugin (>=1.0.0, <=1.0.5) +216 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0)

org.apache.maven:maven-core MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.cloudbees:maven-license-plugin =1.2, =1.0.0, =0.2.0, =1.2.0, =1.0.0, =1.1.2, =2.5, =1.0, =1.0-alpha-1,...

com.day.jcr.vault:content-package-maven-plugin (0.0.19), org.apache.maven:maven-embedder (2.0.1) +9 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.1)

org.apache.maven:maven-core MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.day.jcr.vault:content-package-maven-plugin 0.0.19 - org.apache.maven:maven-embedder 2.0.1 -...

com.sshtools:codeswitcher-maven-plugin (2.1.1), org.codehaus.mojo:build-helper-maven-plugin (>=1.3, <=1.5) potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.2)

org.apache.maven:maven-core MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.sshtools:codeswitcher-maven-plugin 2.1.1 - org.codehaus.mojo:build-helper-maven-plugin =1.3, =1.5...

org.apache.maven:maven-embedder (2.0.3) potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.3)

org.apache.maven:maven-core MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - org.apache.maven:maven-embedder 2.0.3 Source cves: CVE-2021-26291 Source advisory: OSV:GHSA-2F88-5HG8-9X2...

ch.hortis.sonar:sonar-maven-plugin (>=0.2, <=1.0.2), com.exadel.flamingo.maven.plugin:flamingoapp (>=1.0.0, <=1.5.0) +82 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.4)

org.apache.maven:maven-core MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - ch.hortis.sonar:sonar-maven-plugin =0.2, =1.0.0, =1.1-beta, =3.2, =3.2, =2.2.4, =2.4.1, =2.1, =3.1.2,...

org.apache.maven.continuum:continuum-core (>=1.1-beta-1, <=1.1-beta-2), org.apache.maven.continuum:continuum-notifier-wagon (>=1.1-beta-1, <=1.1-beta-2) +12 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.5)

org.apache.maven:maven-core MAVEN version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - org.apache.maven.continuum:continuum-core =1.1-beta-1, =1.1-beta-1, =1.1-beta-1, =1.0-alpha-1,...

br.com.ingenieux.launchify:launchify-hashdot (0.0.1), br.com.ingenieux.launchify:launchify-launch4j (0.0.1) +159 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.6)

org.apache.maven:maven-core MAVEN version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - br.com.ingenieux.launchify:launchify-hashdot 0.0.1 - br.com.ingenieux.launchify:launchify-launch4j 0.0.1 ...

com.zaxxer:nuprocess (>=0.9.0, <=0.9.4), com.zaxxer:sansorm (1.0) +47 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.7)

org.apache.maven:maven-core MAVEN version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.zaxxer:nuprocess =0.9.0, =2.0, =1.1.0.beta5, =2.3.5, =2.2.5, =2.2.5, =1.0-beta-1, =2.1m1, =2.1m1,...

com.alibaba.citrus.tool:maven-util (1.2), com.github.mkolisnyk:muto (0.0.2) +35 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.8)

org.apache.maven:maven-core MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.alibaba.citrus.tool:maven-util 1.2 - com.github.mkolisnyk:muto 0.0.2 -...

at.craftworks.tools.maven:jooq-codegen-postgres-maven-plugin (0.0.3), biz.paluch.maven.configurator:configurator-maven-plugin (>=1.0, <=1.0.1) +328 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.9)

org.apache.maven:maven-core MAVEN version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - at.craftworks.tools.maven:jooq-codegen-postgres-maven-plugin 0.0.3 -...

com.googlecode.mavennatives:maven-nativedependencies-plugin (>=0.0.4, <=0.0.7), com.scireum:github-tag-plugin (>=0.5, <=1.2) +9 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.10)

org.apache.maven:maven-core MAVEN version 2.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.googlecode.mavennatives:maven-nativedependencies-plugin =0.0.4, =0.5, =4.0-beta1, =1.2, =1.2, =2.1,...

com.develeap:mvn.enforce.concrete-version (1.2), com.github.odavid.maven.plugins:antrun-maven-plugin (>=0.1-alpha-4, <=0.1-alpha-40) +8 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.11)

org.apache.maven:maven-core MAVEN version 2.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.develeap:mvn.enforce.concrete-version 1.2 - com.github.odavid.maven.plugins:antrun-maven-plugin...

org.apache.maven:apache-maven (2.1.0-m1), org.apache.maven:maven-toolchain (2.1.0-m1) potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.1.0-m1)

org.apache.maven:maven-core MAVEN version 2.1.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - org.apache.maven:apache-maven 2.1.0-m1 - org.apache.maven:maven-toolchain 2.1.0-m1 Source cves:...

com.evolvedbinary.thirdparty.org.codehaus.mojo:keytool-maven-plugin (1.6.0), io.github.rockfireredmoon:getdown-maven-plugin (0.9.0) +23 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.1.0)

org.apache.maven:maven-core MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.evolvedbinary.thirdparty.org.codehaus.mojo:keytool-maven-plugin 1.6.0 -...

ca.uhn.hapi:hapi-sourcegen (>=1.1-beta2, <=2.3), ca.uhn.hapi:hapi-test (>=1.1-beta2, <=1.2) +14 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.2.0)

org.apache.maven:maven-core MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - ca.uhn.hapi:hapi-sourcegen =1.1-beta2, =1.1-beta2, =1.0, =2.6, =3.0.0-m1, =3.0.0, =3.11-beta-1, =3.8,...