<?xml version="1.0" encoding="ISO-8859-1"?>

<detailedreport xmlns:xsi="http&#x3a;&#x2f;&#x2f;www.w3.org&#x2f;2001&#x2f;XMLSchema-instance" xmlns="https&#x3a;&#x2f;&#x2f;www.veracode.com&#x2f;schema&#x2f;reports&#x2f;export&#x2f;1.0" xsi:schemaLocation="https&#x3a;&#x2f;&#x2f;www.veracode.com&#x2f;schema&#x2f;reports&#x2f;export&#x2f;1.0 https&#x3a;&#x2f;&#x2f;analysiscenter.veracode.com&#x2f;resource&#x2f;detailedreport.xsd" report_format_version="1.5" account_id="17742" app_name="jenkinspipe" app_id="1283917" analysis_id="15929175" static_analysis_unit_id="15944831" sandbox_id="4045062" first_build_submitted_date="2021-12-29 22&#x3a;16&#x3a;36 UTC" version="verademoscan" build_id="15956303" submitter="Jordon Burton" platform="Not Specified" assurance_level="3" business_criticality="3" generation_date="2022-01-11 19&#x3a;30&#x3a;26 UTC" veracode_level="VL1" total_flaws="194" flaws_not_mitigated="194" teams="SwAP Development" life_cycle_stage="Not Specified" planned_deployment_date="" last_update_time="2021-12-29 22&#x3a;20&#x3a;32 UTC" is_latest_build="true" policy_name="Veracode Recommended Medium" policy_version="1" policy_compliance_status="Did Not Pass" policy_rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false" business_owner="" business_unit="Not Specified" tags="" legacy_scan_engine="false"><static-analysis rating="B" score="63" submitted_date="2021-12-29 22&#x3a;16&#x3a;26 UTC" published_date="2021-12-29 22&#x3a;20&#x3a;22 UTC" version="verademoscan" next_scan_due="2022-03-29 21&#x3a;20&#x3a;22 UTC" analysis_size_bytes="83996" engine_version="20211221160743">
      <modules>
         <module name="verademo.war" compiler="JAVAC_8" os="Java J2SE 8" architecture="JVM" loc="4068" score="63" numflawssev0="20" numflawssev1="0" numflawssev2="62" numflawssev3="96" numflawssev4="14" numflawssev5="2"/>
      </modules>
   </static-analysis>
   <severity level="5">
      <category categoryid="18" categoryname="Command or Argument Injection" pcirelated="true">
         <desc>
            <para text="Command or argument injection vulnerabilities occur when data enters an application from an untrusted source and is used to dynamically construct and execute a command.  In the case of OS command injection, an attacker may be able to either alter the command executed by the application or append additional commands.  In the case of argument injection, the attacker may influence the behavior of the program in other ways, for example, changing the destination of an outbound network request or injecting additional commands into an argument or parameter. The command is typically executed with the privileges of the executing process and gives an attacker a privilege or capability that he would not otherwise have."/>
         </desc>
         <recommendations>
            <para text="Careful handling of all untrusted data is critical in preventing injection attacks.   Using one or more of the following techniques provides defense-in-depth and minimizes the likelihood of an vulnerability.">
               <bulletitem text="If possible, use library calls rather than external processes to recreate the desired functionality."/>
               <bulletitem text="Validate user-supplied input using positive filters &#x28;white lists&#x29; to ensure that it conforms to the expected format, using centralized data validation routines when possible. "/>
               <bulletitem text="Select safe API routines.  Some APIs that execute system commands take an array of strings as input rather than a single string, which protects against some forms of command injection by ensuring that a user-supplied argument cannot be interpreted as part of the command."/>
            </para>
         </recommendations>
         <cwe cweid="78" cwename="Improper Neutralization of Special Elements used in an OS Command &#x28;&#x27;OS Command Injection&#x27;&#x29;" pcirelated="true" owasp="1347" sans="864" certc="1165" certcpp="875" certjava="1134">
            <description>
               <text text="This call contains a command injection flaw.  The argument to the function is constructed using untrusted input.  If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process.  The level of exposure depends on the effectiveness of input validation routines, if any."/>
            </description>
            <staticflaws>
               <flaw severity="5" categoryname="Improper Neutralization of Special Elements used in an OS Command &#x28;&#x27;OS Command Injection&#x27;&#x29;" count="1" issueid="16" module="verademo.war" type="java.lang.Runtime.exec" description="This call to java.lang.Runtime.exec&#x28;&#x29; contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec&#x28;&#x29; contains tainted data from the variables &#x28;new String&#x5c;&#x5b;...&#x5c;&#x5d;&#x29;. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a &#x22;safe&#x22; version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;78.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;Command_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;OS-Commanding&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="78" remediationeffort="3" exploitLevel="0" categoryid="18" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ccp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ToolsController.java" line="53" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ToolsController" functionprototype="java.lang.String ping&#x28;java.lang.String&#x29;" functionrelativelocation="37">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="5" categoryname="Improper Neutralization of Special Elements used in an OS Command &#x28;&#x27;OS Command Injection&#x27;&#x29;" count="1" issueid="171" module="verademo.war" type="java.lang.Runtime.exec" description="This call to java.lang.Runtime.exec&#x28;&#x29; contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec&#x28;&#x29; contains tainted data from the variables &#x28;new String&#x5c;&#x5b;...&#x5c;&#x5d;&#x29;. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a &#x22;safe&#x22; version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;78.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;Command_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;OS-Commanding&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="78" remediationeffort="3" exploitLevel="0" categoryid="18" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ccp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ToolsController.java" line="83" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ToolsController" functionprototype="java.lang.String fortune&#x28;java.lang.String&#x29;" functionrelativelocation="30">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
            </staticflaws>
         </cwe>
      </category>
   </severity>
   <severity level="4">
      <category categoryid="19" categoryname="SQL Injection" pcirelated="true">
         <desc>
            <para text="SQL injection vulnerabilities occur when data enters an application from an untrusted source and is used to dynamically construct a SQL query.  This allows an attacker to manipulate database queries in order to access, modify, or delete arbitrary data.  Depending on the platform, database type, and configuration, it may also be possible to execute administrative operations on the database, access the filesystem, or execute arbitrary system commands.  SQL injection attacks can also be used to subvert authentication and authorization schemes, which would enable an attacker to gain privileged access to restricted portions of the application."/>
         </desc>
         <recommendations>
            <para text="Several techniques can be used to prevent SQL injection attacks. These techniques complement each other and address security at different points in the application. Using multiple techniques provides defense-in-depth and minimizes the likelihood of a SQL injection vulnerability.">
               <bulletitem text="Use parameterized prepared statements rather than dynamically constructing SQL queries.  This will prevent the database from interpreting the contents of bind variables as part of the query and is the most effective defense against SQL injection."/>
               <bulletitem text="Validate user-supplied input using positive filters &#x28;white lists&#x29; to ensure that it conforms to the expected format, using centralized data validation routines when possible. "/>
               <bulletitem text="Normalize all user-supplied data before applying filters or regular expressions, or submitting the data to a database. This means that all URL-encoded &#x28;&#x25;xx&#x29;, HTML-encoded &#x28;&#x26;&#x23;xx&#x3b;&#x29;, or other encoding schemes should be reduced to the internal character representation expected by the application. This prevents attackers from using alternate encoding schemes to bypass filters."/>
               <bulletitem text="When using database abstraction libraries such as Hibernate, do not assume that all methods exposed by the API will automatically prevent SQL injection attacks.  Most libraries contain methods that pass arbitrary queries to the database in an unsafe manner."/>
            </para>
         </recommendations>
         <cwe cweid="89" cwename="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" pcirelated="true" owasp="1347" sans="864">
            <description>
               <text text="This database query contains a SQL injection flaw.  The function call constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database."/>
            </description>
            <staticflaws>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="31" module="verademo.war" type="java.sql.PreparedStatement.executeQuery" description="This database query contains a SQL injection flaw. The call to java.sql.PreparedStatement.executeQuery&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. executeQuery&#x28;&#x29; was called on the blabberQuery object, which contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="467" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlabbers&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="41">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="169" module="verademo.war" type="java.sql.Statement.executeQuery" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="IgnoreCommand.java" line="40" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.IgnoreCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="44">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="29" module="verademo.war" type="java.sql.Statement.execute" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.execute&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="IgnoreCommand.java" line="47" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.IgnoreCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="92">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="192" module="verademo.war" type="java.sql.Statement.executeQuery" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ListenCommand.java" line="40" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.ListenCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="44">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="71" module="verademo.war" type="java.sql.Statement.execute" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.execute&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ListenCommand.java" line="47" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.ListenCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="92">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="60" module="verademo.war" type="java.sql.Statement.executeQuery" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="RemoveAccountCommand.java" line="42" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.RemoveAccountCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="40">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="140" module="verademo.war" type="java.sql.Statement.execute" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.execute&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="RemoveAccountCommand.java" line="49" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.RemoveAccountCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="75">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="187" module="verademo.war" type="java.sql.Statement.execute" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.execute&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="RemoveAccountCommand.java" line="53" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.RemoveAccountCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="92">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="178" module="verademo.war" type="java.sql.Statement.executeQuery" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="165" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processLogin&#x28;java.lang.String, java.lang.String, java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="17">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="54" module="verademo.war" type="java.sql.Statement.executeQuery" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery&#x28;&#x29; contains tainted data from the variable sql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="249" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showPasswordHint&#x28;java.lang.String&#x29;" functionrelativelocation="38">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="21" module="verademo.war" type="java.sql.Statement.executeQuery" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery&#x28;&#x29; contains tainted data from the variable sql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="310" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processRegister&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.ui.Model&#x29;" functionrelativelocation="56">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="168" module="verademo.war" type="java.sql.Statement.execute" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.execute&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute&#x28;&#x29; contains tainted data from the variable query. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="374" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processRegisterFinish&#x28;java.lang.String, java.lang.String, java.lang.String, java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.ui.Model&#x29;" functionrelativelocation="58">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="82" module="verademo.war" type="java.sql.Statement.executeQuery" description="This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery&#x28;&#x29; contains tainted data from the variable sqlMyEvents. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="479" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showProfile&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="41">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="4" categoryname="Improper Neutralization of Special Elements used in an SQL Command &#x28;&#x27;SQL Injection&#x27;&#x29;" count="1" issueid="96" module="verademo.war" type="java.sql.PreparedStatement.executeQuery" description="This database query contains a SQL injection flaw. The call to java.sql.PreparedStatement.executeQuery&#x28;&#x29; constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. executeQuery&#x28;&#x29; was called on the myInfo object, which contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;89.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;SQL_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;SQL-Injection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="89" remediationeffort="3" exploitLevel="0" categoryid="19" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppp" grace_period_expires="2021-12-29 22&#x3a;20&#x3a;22 UTC" affects_policy_compliance="true" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="490" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showProfile&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="55">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
            </staticflaws>
         </cwe>
      </category>
   </severity>
   <severity level="3">
      <category categoryid="21" categoryname="CRLF Injection" pcirelated="true">
         <desc>
            <para text="The acronym CRLF stands for &#x22;Carriage Return, Line Feed&#x22; and refers to the sequence of characters used to denote the end of a line of text.  CRLF injection vulnerabilities occur when data enters an application from an untrusted source and is not properly validated before being used.  For example, if an attacker is able to inject a CRLF into a log file, he could append falsified log entries, thereby misleading administrators or cover traces of the attack.  If an attacker is able to inject CRLFs into an HTTP response header, he can use this ability to carry out other attacks such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.  "/>
         </desc>
         <recommendations>
            <para text="Apply robust input filtering for all user-supplied data, using centralized data validation routines when possible.  Use output filters to sanitize all output derived from user-supplied input, replacing non-alphanumeric characters with their HTML entity equivalents."/>
         </recommendations>
         <cwe cweid="93" cwename="Improper Neutralization of CRLF Sequences &#x28;&#x27;CRLF Injection&#x27;&#x29;" pcirelated="true" owasp="1347">
            <description>
               <text text="A function call contains a CRLF Injection flaw.  Writing untrusted input to an interface or external application that treats the CRLF &#x28;carriage return line feed&#x29; sequence as a delimiter to separate lines or records can result in that data being misinterpreted.  FTP and SMTP are examples of protocols that treat CRLF as a delimiter when parsing commands."/>
            </description>
            <staticflaws>
               <flaw severity="3" categoryname="Improper Neutralization of CRLF Sequences &#x28;&#x27;CRLF Injection&#x27;&#x29;" count="1" issueid="86" module="verademo.war" type="javax.mail.Message.setSubject" description="This call to javax.mail.Message.setSubject&#x28;&#x29; contains a CRLF injection flaw. Writing untrusted input to an interface or external application that treats the CRLF &#x28;carriage return line feed&#x29; sequence as a delimiter to separate lines or records can result in that data being misinterpreted. The first argument to setSubject&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Sanitize CRLF sequences from untrusted input.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;93.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;CRLF_Injection&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="93" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="419" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="void emailUser&#x28;java.lang.String&#x29;" functionrelativelocation="75"/>
            </staticflaws>
         </cwe>
         <cwe cweid="113" cwename="Improper Neutralization of CRLF Sequences in HTTP Headers &#x28;&#x27;HTTP Response Splitting&#x27;&#x29;" pcirelated="true" owasp="1347">
            <description>
               <text text="A function call contains an HTTP response splitting flaw.  Writing untrusted input into an HTTP header allows an attacker to manipulate the HTTP response rendered by the browser, leading to cache poisoning and cross-site scripting attacks."/>
            </description>
            <staticflaws>
               <flaw severity="3" categoryname="Improper Neutralization of CRLF Sequences in HTTP Headers &#x28;&#x27;HTTP Response Splitting&#x27;&#x29;" count="1" issueid="87" module="verademo.war" type="javax.servlet.ServletResponse.setContentType" description="This call to javax.servlet.ServletResponse.setContentType&#x28;&#x29; contains an HTTP response splitting flaw. Writing untrusted input into an HTTP header allows an attacker to manipulate the HTTP response rendered by the browser, to inject additional headers or an entire response body into the response stream. Injecting headers can be used to trick various security mechanisms in browsers into allowing XSS style attacks. Injecting entire response bodies can not only cause XSS attacks to succeed but may even poison the cache of any intermediary proxies between the clients and the application server.&#xd;&#xa;&#xd;&#xa;Escape, encode, or remove carriage return and line feed characters from untrusted data before inclusion in HTTP response headers. Whenever possible, use a security library such as ESAPI that provides safe versions of addHeader&#x28;&#x29;, etc. that will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;113.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;HTTP_Response_Splitting&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;HTTP-Response-Splitting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="113" remediationeffort="2" exploitLevel="0" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="678" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String downloadImage&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="48">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of CRLF Sequences in HTTP Headers &#x28;&#x27;HTTP Response Splitting&#x27;&#x29;" count="1" issueid="138" module="verademo.war" type="javax.servlet.http.HttpServletResponse.setHeader" description="This call to javax.servlet.http.HttpServletResponse.setHeader&#x28;&#x29; contains an HTTP response splitting flaw. Writing untrusted input into an HTTP header allows an attacker to manipulate the HTTP response rendered by the browser, to inject additional headers or an entire response body into the response stream. Injecting headers can be used to trick various security mechanisms in browsers into allowing XSS style attacks. Injecting entire response bodies can not only cause XSS attacks to succeed but may even poison the cache of any intermediary proxies between the clients and the application server.&#xd;&#xa;&#xd;&#xa;Escape, encode, or remove carriage return and line feed characters from untrusted data before inclusion in HTTP response headers. Whenever possible, use a security library such as ESAPI that provides safe versions of addHeader&#x28;&#x29;, etc. that will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;113.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;HTTP_Response_Splitting&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;HTTP-Response-Splitting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="113" remediationeffort="2" exploitLevel="0" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="680" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String downloadImage&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="55">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of CRLF Sequences in HTTP Headers &#x28;&#x27;HTTP Response Splitting&#x27;&#x29;" count="1" issueid="91" module="verademo.war" type="javax.servlet.http.HttpServletResponse.addCookie" description="This call to javax.servlet.http.HttpServletResponse.addCookie&#x28;&#x29; contains an HTTP response splitting flaw. Writing untrusted input into an HTTP header allows an attacker to manipulate the HTTP response rendered by the browser, to inject additional headers or an entire response body into the response stream. Injecting headers can be used to trick various security mechanisms in browsers into allowing XSS style attacks. Injecting entire response bodies can not only cause XSS attacks to succeed but may even poison the cache of any intermediary proxies between the clients and the application server. The first argument to addCookie&#x28;&#x29; contains tainted data from the variables &#x28;new Cookie&#x28;...&#x29;&#x29;. The tainted data originated from earlier calls to java.util.Base64&#x24;Encoder.encode, AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Escape, encode, or remove carriage return and line feed characters from untrusted data before inclusion in HTTP response headers. Whenever possible, use a security library such as ESAPI that provides safe versions of addHeader&#x28;&#x29;, etc. that will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;113.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;HTTP_Response_Splitting&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;HTTP-Response-Splitting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="113" remediationeffort="2" exploitLevel="0" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="Utils.java" line="55" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;utils&#x2f;" scope="com.veracode.verademo.utils.Utils" functionprototype="void setCookie&#x28;javax.servlet.http.HttpServletResponse, java.lang.String, java.lang.String&#x29;" functionrelativelocation="50">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
            </staticflaws>
         </cwe>
         <cwe cweid="117" cwename="Improper Output Neutralization for Logs" pcirelated="true" owasp="1355" certjava="1134">
            <description>
               <text text="A function call could result in a log forging attack.  Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files.  Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility.  For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible."/>
            </description>
            <staticflaws>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="118" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.sql.Statement.executeQuery, and javax.servlet.http.HttpServletRequest.getHeader.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="60" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showFeed&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="11"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="69" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.sql.Statement.executeQuery, and javax.servlet.http.HttpServletRequest.getHeader.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="213" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processFeed&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="22"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="8" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.sql.Statement.executeQuery, and javax.servlet.http.HttpServletRequest.getHeader.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="278" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlab&#x28;java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="15"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="66" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.sql.Statement.executeQuery, and javax.servlet.http.HttpServletRequest.getHeader.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="373" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlab&#x28;java.lang.String, java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="21"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="116" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.sql.Statement.executeQuery, and javax.servlet.http.HttpServletRequest.getHeader.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="444" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlabbers&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="20"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="105" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable blabbersSql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="463" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlabbers&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="33"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="167" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.sql.Statement.executeQuery, and javax.servlet.http.HttpServletRequest.getHeader.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="523" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlabbers&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="19"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="89" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="530" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlabbers&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="31"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="9" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="531" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlabbers&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="36"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="158" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="IgnoreCommand.java" line="39" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.IgnoreCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="39"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="120" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="IgnoreCommand.java" line="46" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.IgnoreCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="89"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="101" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ListenCommand.java" line="39" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.ListenCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="39"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="48" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ListenCommand.java" line="46" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.ListenCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="89"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="74" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="RemoveAccountCommand.java" line="41" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.RemoveAccountCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="35"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="173" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="RemoveAccountCommand.java" line="48" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.RemoveAccountCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="72"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="127" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="RemoveAccountCommand.java" line="52" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.RemoveAccountCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="90"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="142" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to java.sql.Statement.executeQuery, and AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="108" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="11"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="97" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to java.sql.Statement.executeQuery, and AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="131" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="31"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="108" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to java.sql.Statement.executeQuery, and AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="158" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="44"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="184" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to java.sql.Statement.executeQuery, and AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="192" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="62"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="128" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ToolsController.java" line="49" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ToolsController" functionprototype="java.lang.String ping&#x28;java.lang.String&#x29;" functionrelativelocation="13"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="175" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="115" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showLogin&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="88"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="51" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="228" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processLogin&#x28;java.lang.String, java.lang.String, java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="99"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="95" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="235" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showPasswordHint&#x28;java.lang.String&#x29;" functionrelativelocation="8"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="107" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable sql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="247" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showPasswordHint&#x28;java.lang.String&#x29;" functionrelativelocation="31"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="64" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable formatString. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="253" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showPasswordHint&#x28;java.lang.String&#x29;" functionrelativelocation="59"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="47" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable query. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="375" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processRegisterFinish&#x28;java.lang.String, java.lang.String, java.lang.String, java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.ui.Model&#x29;" functionrelativelocation="61"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="99" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable sqlMyEvents. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="477" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showProfile&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="38"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="10" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data from the variable sql. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="488" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showProfile&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="51"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="122" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.sql.Statement.executeQuery, and javax.servlet.http.HttpServletRequest.getHeader.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="541" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processProfile&#x28;java.lang.String, java.lang.String, java.lang.String, org.springframework.web.multipart.MultipartFile, org.springframework.web.multipart.MultipartHttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="11"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="55" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="627" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processProfile&#x28;java.lang.String, java.lang.String, java.lang.String, org.springframework.web.multipart.MultipartFile, org.springframework.web.multipart.MultipartHttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="87"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="104" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.sql.Statement.executeQuery, and javax.servlet.http.HttpServletRequest.getHeader.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="657" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String downloadImage&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="18"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="44" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="661" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String downloadImage&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="31"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="125" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="675" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String downloadImage&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="46"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="113" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="760" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="boolean usernameExists&#x28;java.lang.String&#x29;" functionrelativelocation="98"/>
               <flaw severity="3" categoryname="Improper Output Neutralization for Logs" count="1" issueid="92" module="verademo.war" type="org.apache.log4j.Category.info" description="This call to org.apache.log4j.Category.info&#x28;&#x29; could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker&#x27;s tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;117.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;owasp.org&#x2f;www-community&#x2f;attacks&#x2f;Log_Injection&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Improper-Output-Handling&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="117" remediationeffort="2" exploitLevel="1" categoryid="21" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="npp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="814" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="boolean updateUsername&#x28;java.lang.String, java.lang.String&#x29;" functionrelativelocation="41"/>
            </staticflaws>
         </cwe>
      </category>
      <category categoryid="10" categoryname="Credentials Management" pcirelated="true">
         <desc>
            <para text="Improper management of credentials, such as usernames and passwords, may compromise system security.  In particular, storing passwords in plaintext or hard-coding passwords directly into application code are design issues that cannot be easily remedied.  Not only does embedding a password allow all of the project&#x27;s developers to view the password, it also makes fixing the problem extremely difficult.  Once the code is in production, the password cannot be changed without patching the software.  If a hard-coded password is compromised in a commercial product, all deployed instances may be vulnerable to attack, putting customers at risk."/>
            <para text="One variation on hard-coding plaintext passwords is to hard-code a constant string which is the result of a cryptographic one-way hash.  For example, instead of storing the word &#x22;secret,&#x22; the application stores an MD5 hash of the word.  This is a common mechanism for obscuring hard-coded passwords from casual viewing but does not significantly reduce risk.  However, using cryptographic hashes for data stored outside the application code can be an effective practice."/>
         </desc>
         <recommendations>
            <para text="Avoid storing passwords in easily accessible locations, and never store any type of sensitive data in plaintext.  Avoid using hard-coded usernames, passwords, or hash constants whenever possible, particularly in relation to security-critical components.   Store passwords out-of-band from the application code.  Follow best practices for protecting credentials stored in alternate locations such as configuration or properties files."/>
         </recommendations>
         <cwe cweid="259" cwename="Use of Hard-coded Password" pcirelated="true" owasp="1353" sans="798" certjava="1152">
            <description>
               <text text="A method uses a hard-coded password that may compromise system security in a way that cannot be easily remedied.  The use of a hard-coded password significantly increases the possibility that the account being protected will be compromised.  Moreover, the password cannot be changed without patching the software.  If a hard-coded password is compromised in a commercial product, all deployed instances may be vulnerable to attack."/>
            </description>
            <staticflaws>
               <flaw severity="3" categoryname="Use of Hard-coded Password" count="1" issueid="41" module="verademo.war" type="JDBC_PASSWORD initializer" description="This variable assignment uses a hard-coded password that may compromise system security in a way that cannot be easily remedied. The use of a hard-coded password significantly increases the possibility that the account being protected will be compromised. Moreover, the password cannot be changed without patching the software. If a hard-coded password is compromised in a commercial product, all deployed instances may be vulnerable to attack. In some cases, this finding may indicate a reference to a password &#x28;e.g. the name of a key in a properties file&#x29; rather than an actual password. JDBC_PASSWORD initializer&#xd;&#xa;&#xd;&#xa;Store passwords out-of-band from the application code. Follow best practices for protecting credentials stored in locations such as configuration or properties files. An HSM may be appropriate for particularly sensitive credentials.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;259.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="259" remediationeffort="4" exploitLevel="1" categoryid="10" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="Constants.java" line="1" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;utils&#x2f;" scope="UNKNOWN" functionprototype="UNKNOWN" functionrelativelocation="-1"/>
               <flaw severity="3" categoryname="Use of Hard-coded Password" count="1" issueid="15" module="verademo.war" type="hardcodepasswdset" description="This variable assignment uses a hard-coded password that may compromise system security in a way that cannot be easily remedied. The use of a hard-coded password significantly increases the possibility that the account being protected will be compromised. Moreover, the password cannot be changed without patching the software. If a hard-coded password is compromised in a commercial product, all deployed instances may be vulnerable to attack. In some cases, this finding may indicate a reference to a password &#x28;e.g. the name of a key in a properties file&#x29; rather than an actual password. hardcodepasswdset&#xd;&#xa;&#xd;&#xa;Store passwords out-of-band from the application code. Follow best practices for protecting credentials stored in locations such as configuration or properties files. An HSM may be appropriate for particularly sensitive credentials.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;259.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="259" remediationeffort="4" exploitLevel="1" categoryid="10" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="Constants.java" line="13" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;utils&#x2f;" scope="com.veracode.verademo.utils.Constants" functionprototype="void &#x21;ctor&#x28;&#x29;" functionrelativelocation="25"/>
            </staticflaws>
         </cwe>
      </category>
      <category categoryid="20" categoryname="Cross-Site Scripting &#x28;XSS&#x29;" pcirelated="true">
         <desc>
            <para text="Cross-site scripting &#x28;XSS&#x29; attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed occur whenever a web application uses untrusted data in the output it generates without validating or encoding it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise sensitive information, with new attack vectors being discovered on a regular basis.  XSS is also commonly referred to as HTML injection."/>
            <para text="XSS vulnerabilities can be either persistent or transient &#x28;often referred to as stored and reflected, respectively&#x29;.  In a persistent XSS vulnerability, the injected code is stored by the application, for example within a blog comment or message board.  The attack occurs whenever a victim views the page containing the malicious script.  In a transient XSS vulnerability, the injected code is included directly in the HTTP request.  These attacks are often carried out via malicious URLs sent via email or another website and requires the victim to browse to that link.  The consequence of an XSS attack to a victim is the same regardless of whether it is persistent or transient&#x3b; however, persistent XSS vulnerabilities are likely to affect a greater number of victims due to its delivery mechanism."/>
         </desc>
         <recommendations>
            <para text="Several techniques can be used to prevent XSS attacks. These techniques complement each other and address security at different points in the application. Using multiple techniques provides defense-in-depth and minimizes the likelihood of a XSS vulnerability.">
               <bulletitem text="Use output filtering to sanitize all output generated from user-supplied input, selecting the appropriate method of encoding based on the use case of the untrusted data.  For example, if the data is being written to the body of an HTML page, use HTML entity encoding.  However, if the data is being used to construct generated Javascript or if it is consumed by client-side methods that may interpret it as code &#x28;a common technique in Web 2.0 applications&#x29;, additional restrictions may be necessary beyond simple HTML encoding."/>
               <bulletitem text="Validate user-supplied input using positive filters &#x28;white lists&#x29; to ensure that it conforms to the expected format, using centralized data validation routines when possible. "/>
               <bulletitem text="Do not permit users to include HTML content in posts, notes, or other data that will be displayed by the application.  If users are permitted to include HTML tags, then carefully limit access to specific elements or attributes, and use strict validation filters to prevent abuse."/>
            </para>
         </recommendations>
         <cwe cweid="80" cwename="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" pcirelated="true" owasp="1347" sans="79">
            <description>
               <text text="This call contains a cross-site scripting &#x28;XSS&#x29; flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis."/>
            </description>
            <staticflaws>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="112" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable blab_name. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="blab.jsp" line="56" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.blab_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="20"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="145" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable content. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="blab.jsp" line="60" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.blab_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="25"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="90" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable error. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="blab.jsp" line="68" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.blab_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="35"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="34" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable comment.getAuthor&#x28;&#x29;.getUsername&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="blab.jsp" line="104" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.blab_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="57">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="1" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable comment.getContent&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="blab.jsp" line="108" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.blab_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="61">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="115" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable comment.getAuthor&#x28;&#x29;.getBlabName&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="blab.jsp" line="110" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.blab_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="67">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="114" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable error. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="blabbers.jsp" line="65" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.blabbers_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="24"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="126" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable blabber.getUsername&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="blabbers.jsp" line="100" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.blabbers_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="39">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="67" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable blabber.getBlabName&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="blabbers.jsp" line="103" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.blabbers_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="44">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="119" module="verademo.war" type="getMoreFeed" description="This call to getMoreFeed&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="196" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String getMoreFeed&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="99">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="182" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable currentUser. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="feed.jsp" line="58" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.feed_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="15"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="38" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable error. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="feed.jsp" line="69" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.feed_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="22"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="25" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable post.getAuthor&#x28;&#x29;.getUsername&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="feed.jsp" line="93" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.feed_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="34">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="75" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable post.getContent&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="feed.jsp" line="96" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.feed_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="38">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="42" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable post.getAuthor&#x28;&#x29;.getBlabName&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="feed.jsp" line="98" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.feed_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="42">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="73" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable post.getContent&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="feed.jsp" line="141" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.feed_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="67">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="58" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable error. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="login.jsp" line="59" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.login_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="35"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="185" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable target. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="login.jsp" line="78" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.login_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="53"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="88" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable username. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="login.jsp" line="85" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.login_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="62"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="61" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable error. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="profile.jsp" line="62" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.profile_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="17"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="63" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable username. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="profile.jsp" line="90" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.profile_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="25"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="177" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable realName. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="profile.jsp" line="101" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.profile_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="29"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="134" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable blabName. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="profile.jsp" line="110" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.profile_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="33"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="102" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable username. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="profile.jsp" line="119" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.profile_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="36"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="46" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable heckler.getUsername&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="profile.jsp" line="160" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.profile_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="55">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="49" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable heckler.getBlabName&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.PreparedStatement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="profile.jsp" line="163" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.profile_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="58">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="181" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable events.get&#x28;&#x29;. The tainted data originated from an earlier call to java.sql.Statement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="profile.jsp" line="200" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.profile_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="76">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="62" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable error. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="register-finish.jsp" line="59" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.register_002dfinish_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="41"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="188" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable username. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="register-finish.jsp" line="82" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.register_002dfinish_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="55"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="85" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable error. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="register.jsp" line="59" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.register_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="39"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="139" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable username. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="register.jsp" line="86" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.register_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="60"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="77" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="This call to javax.servlet.jsp.JspWriter.print&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to print&#x28;&#x29; contains tainted data from the variable request.getParameter&#x28;&#x29;. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameter. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="2" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="tools.jsp" line="64" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.tools_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="37">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="1">
                        <note>This source of the tainted data is an external web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="160" module="verademo.war" type="java.io.Writer.write" description="This call to java.io.Writer.write&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to write&#x28;&#x29; contains tainted data from the variable ping. The tainted data originated from an earlier call to java.lang.Process.getInputStream. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="tools.jsp" line="67" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.tools_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="52"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="93" module="verademo.war" type="java.io.Writer.write" description="This call to java.io.Writer.write&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to write&#x28;&#x29; contains tainted data from the variable fortunes. The tainted data originated from an earlier call to java.lang.Process.getInputStream. The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="1" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="tools.jsp" line="77" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.tools_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="61"/>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="100" module="verademo.war" type="showPasswordHint" description="This call to showPasswordHint&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="254" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showPasswordHint&#x28;java.lang.String&#x29;" functionrelativelocation="86">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="Improper Neutralization of Script-Related HTML Tags in a Web Page &#x28;Basic XSS&#x29;" count="1" issueid="56" module="verademo.war" type="showPasswordHint" description="This call to showPasswordHint&#x28;&#x29; contains a cross-site scripting &#x28;XSS&#x29; flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim&#x27;s browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping&#x3b; if the data is being written to an attribute, use attribute escaping&#x3b; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;79.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;XSS&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Cross-Site-Scripting&#x29; &#xd;&#xa;Supported Cleansers &#x28;https&#x3a;&#x2f;&#x2f;help.veracode.com&#x2f;reader&#x2f;4EKhlLSMHm5jC8P8j3XccQ&#x2f;IiF_rOE79ANbwnZwreSPGA&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="80" remediationeffort="3" exploitLevel="0" categoryid="20" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="259" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showPasswordHint&#x28;java.lang.String&#x29;" functionrelativelocation="93">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
            </staticflaws>
         </cwe>
      </category>
      <category categoryid="12" categoryname="Cryptographic Issues" pcirelated="true">
         <desc>
            <para text="Applications commonly use cryptography to implement authentication mechanisms and to ensure the confidentiality and integrity of sensitive data, both in transit and at rest.  The proper and accurate implementation of cryptography is extremely critical to its efficacy.  Configuration or coding mistakes as well as incorrect assumptions may negate a large degree of the protection it affords, leaving the crypto implementation vulnerable to attack."/>
            <para text="Common cryptographic mistakes include, but are not limited to, selecting weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic data, using predictable entropy sources, and mismanaging or hard-coding keys.  "/>
            <para text="Developers often make the dangerous assumption that they can improve security by designing their own cryptographic algorithm&#x3b; however, one of the basic tenets of cryptography is that any cipher whose effectiveness is reliant on the secrecy of the algorithm is fundamentally flawed.  "/>
         </desc>
         <recommendations>
            <para text="Select the appropriate type of cryptography for the intended purpose.  Avoid proprietary encryption algorithms as they typically rely on &#x22;security through obscurity&#x22; rather than sound mathematics.  Select key sizes appropriate for the data being protected&#x3b; for high assurance applications, 256-bit symmetric keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for key storage, and ensure that plaintext data and key material are not inadvertently exposed."/>
         </recommendations>
         <cwe cweid="331" cwename="Insufficient Entropy" pcirelated="true" owasp="1346" sans="327" certc="1170">
            <description>
               <text text="Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand&#x28;&#x29;."/>
            </description>
            <staticflaws>
               <flaw severity="3" categoryname="Insufficient Entropy" count="1" issueid="124" module="verademo.war" type="java.util.Random.nextBoolean" description="Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;331.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="331" remediationeffort="2" exploitLevel="-1" categoryid="12" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="127" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="26"/>
               <flaw severity="3" categoryname="Insufficient Entropy" count="1" issueid="174" module="verademo.war" type="java.util.Random.nextInt" description="Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;331.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="331" remediationeffort="2" exploitLevel="-1" categoryid="12" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="152" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="41"/>
               <flaw severity="3" categoryname="Insufficient Entropy" count="1" issueid="123" module="verademo.war" type="java.util.Random.nextInt" description="Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;331.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="331" remediationeffort="2" exploitLevel="-1" categoryid="12" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="155" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="41"/>
               <flaw severity="3" categoryname="Insufficient Entropy" count="1" issueid="176" module="verademo.war" type="java.util.Random.nextInt" description="Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;331.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="331" remediationeffort="2" exploitLevel="-1" categoryid="12" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="178" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="54"/>
               <flaw severity="3" categoryname="Insufficient Entropy" count="1" issueid="33" module="verademo.war" type="java.util.Random.nextInt" description="Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;331.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="331" remediationeffort="2" exploitLevel="-1" categoryid="12" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="182" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="56"/>
               <flaw severity="3" categoryname="Insufficient Entropy" count="1" issueid="98" module="verademo.war" type="java.util.Random.nextInt" description="Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;331.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="331" remediationeffort="2" exploitLevel="-1" categoryid="12" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="186" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="57"/>
               <flaw severity="3" categoryname="Insufficient Entropy" count="1" issueid="37" module="verademo.war" type="java.util.Random.nextInt" description="Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;331.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="331" remediationeffort="2" exploitLevel="-1" categoryid="12" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="190" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="59"/>
            </staticflaws>
         </cwe>
         <cwe cweid="327" cwename="Use of a Broken or Risky Cryptographic Algorithm" pcirelated="true" owasp="1346" sans="866" certc="1170" certcpp="883" certjava="1152">
            <description>
               <text text="The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the disclosure of sensitive information."/>
            </description>
            <staticflaws>
               <flaw severity="3" categoryname="Use of a Broken or Risky Cryptographic Algorithm" count="1" issueid="117" module="verademo.war" type="java.security.MessageDigest.getInstance" description="This function uses the MD5&#x28;&#x29; function, which uses a hash algorithm that is considered weak. In recent years, researchers have demonstrated ways to breach many uses of previously-thought-safe hash functions such as MD5.&#xd;&#xa;&#xd;&#xa;Consider using a stronger algorithm in order to prevent attackers from being able to manipulate hash results. If this algorithm is being used to hash passwords, then consider using a strong computationally-hard algorithm such as PBKDF2 or bcrypt instead of a plain hashing algorithm.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;327.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="327" remediationeffort="1" exploitLevel="1" categoryid="12" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="User.java" line="103" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;utils&#x2f;" scope="com.veracode.verademo.utils.User" functionprototype="java.lang.String md5&#x28;java.lang.String&#x29;" functionrelativelocation="19"/>
               <flaw severity="3" categoryname="Use of a Broken or Risky Cryptographic Algorithm" count="1" issueid="4" module="verademo.war" type="java.security.MessageDigest.getInstance" description="This function uses the MD5&#x28;&#x29; function, which uses a hash algorithm that is considered weak. In recent years, researchers have demonstrated ways to breach many uses of previously-thought-safe hash functions such as MD5.&#xd;&#xa;&#xd;&#xa;Consider using a stronger algorithm in order to prevent attackers from being able to manipulate hash results. If this algorithm is being used to hash passwords, then consider using a strong computationally-hard algorithm such as PBKDF2 or bcrypt instead of a plain hashing algorithm.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;327.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="327" remediationeffort="1" exploitLevel="1" categoryid="12" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="908" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String md5&#x28;java.lang.String&#x29;" functionrelativelocation="21"/>
            </staticflaws>
         </cwe>
      </category>
      <category categoryid="1" categoryname="Directory Traversal" pcirelated="true">
         <desc>
            <para text="Allowing user input to control paths used in filesystem operations may enable an attacker to access or modify otherwise protected system resources that would normally be inaccessible to end users.  In some cases, the user-provided input may be passed directly to the filesystem operation, or it may be concatenated to one or more fixed strings to construct a fully-qualified path."/>
            <para text="When an application improperly cleanses special character sequences in user-supplied filenames, a path traversal &#x28;or directory traversal&#x29; vulnerability may occur.  For example, an attacker could specify a filename such as &#x22;..&#x2f;..&#x2f;etc&#x2f;passwd&#x22;, which resolves to a file outside of the intended directory that the attacker would not normally be authorized to view."/>
         </desc>
         <recommendations>
            <para text="Assume all user-supplied input is malicious.  Validate all user-supplied input to ensure that it conforms to the expected format, using centralized data validation routines when possible.  When using black lists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters and ensure that the end result is not dangerous."/>
         </recommendations>
         <cwe cweid="73" cwename="External Control of File Name or Path" pcirelated="true" owasp="1348" sans="22" certcpp="877">
            <description>
               <text text="This call contains a path manipulation flaw.  The argument to the function is a filename constructed using untrusted input.  If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users.  The level of exposure depends on the effectiveness of input validation routines, if any."/>
            </description>
            <staticflaws>
               <flaw severity="3" categoryname="External Control of File Name or Path" count="1" issueid="133" module="verademo.war" type="processLogin" description="This call to processLogin&#x28;&#x29; contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;73.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Path-Traversal&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="73" remediationeffort="2" exploitLevel="0" categoryid="1" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="229" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processLogin&#x28;java.lang.String, java.lang.String, java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="99">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="External Control of File Name or Path" count="1" issueid="39" module="verademo.war" type="processRegisterFinish" description="This call to processRegisterFinish&#x28;&#x29; contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.sql.Statement.executeQuery, and java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;73.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Path-Traversal&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="73" remediationeffort="2" exploitLevel="0" categoryid="1" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="398" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processRegisterFinish&#x28;java.lang.String, java.lang.String, java.lang.String, java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.ui.Model&#x29;" functionrelativelocation="99">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="External Control of File Name or Path" count="1" issueid="183" module="verademo.war" type="java.io.File.&#x21;operator_javanewinit" description="This call to java.io.File.&#x21;operator_javanewinit&#x28;&#x29; contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to &#x21;operator_javanewinit&#x28;&#x29; contains tainted data from the variable path. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;73.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Path-Traversal&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="73" remediationeffort="2" exploitLevel="0" categoryid="1" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="629" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processProfile&#x28;java.lang.String, java.lang.String, java.lang.String, org.springframework.web.multipart.MultipartFile, org.springframework.web.multipart.MultipartHttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="89">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="External Control of File Name or Path" count="1" issueid="170" module="verademo.war" type="java.io.File.&#x21;operator_javanewinit" description="This call to java.io.File.&#x21;operator_javanewinit&#x28;&#x29; contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to &#x21;operator_javanewinit&#x28;&#x29; contains tainted data from the variable path. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;73.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Path-Traversal&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="73" remediationeffort="2" exploitLevel="0" categoryid="1" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="666" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String downloadImage&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="35">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
               <flaw severity="3" categoryname="External Control of File Name or Path" count="1" issueid="150" module="verademo.war" type="java.io.File.&#x21;operator_javanewinit" description="This call to java.io.File.&#x21;operator_javanewinit&#x28;&#x29; contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to &#x21;operator_javanewinit&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;73.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Path-Traversal&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="73" remediationeffort="2" exploitLevel="0" categoryid="1" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="818" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="boolean updateUsername&#x28;java.lang.String, java.lang.String&#x29;" functionrelativelocation="54">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="-1">
                        <note>The source of the tainted data in this web application flaw is not a web request.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
            </staticflaws>
         </cwe>
      </category>
      <category categoryid="22" categoryname="Encapsulation" pcirelated="true">
         <desc>
            <para text="Encapsulation is about defining strong security boundaries governing data and processes. Within an application, it might mean differentiation between validated and unvalidated data, between public and private members, or between one user&#x27;s data and another&#x27;s.  "/>
            <para text="In object-oriented programming, the term encapsulation is used to describe the grouping together of data and functionality within an object and the ability to provide users with a well-defined interface in a way which hides their internal workings.  Though there is some overlap with the above definition, the two definitions should not be confused as being interchangeable."/>
         </desc>
         <recommendations>
            <para text="The wide variance of encapsulation issues makes it impractical to generalize how these issues should be addressed, beyond stating that encapsulation boundaries should be well-defined and adhered to.  Refer to individual categories for specific recommendations. "/>
         </recommendations>
         <cwe cweid="502" cwename="Deserialization of Untrusted Data" pcirelated="true" owasp="1354" certjava="1148">
            <description>
               <text text="The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid."/>
            </description>
            <staticflaws>
               <flaw severity="3" categoryname="Deserialization of Untrusted Data" count="1" issueid="35" module="verademo.war" type="java.io.ObjectInput.readObject" description="The serialized-object data stream used in the call to java.io.ObjectInput.readObject&#x28;&#x29; appears to have been constructed with untrusted data. Attacker manipulation of this stream has the ability to cause the creation of objects of arbitrary Serializable types. Paired with a weakness in another class&#x27;s constructor, this could result in a denial of service, code execution, or data corruption vulnerability. readObject&#x28;&#x29; was called on the in object, which contains tainted data. The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.&#xd;&#xa;&#xd;&#xa;Avoid passing untrusted data&#x3b; if the data is untrusted, consider switching to a safer serialization scheme such as JSON.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;502.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="502" remediationeffort="2" exploitLevel="0" categoryid="22" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserFactory.java" line="43" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;utils&#x2f;" scope="com.veracode.verademo.utils.UserFactory" functionprototype="User createFromRequest&#x28;javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="74"/>
            </staticflaws>
         </cwe>
      </category>
      <category categoryid="25" categoryname="Insufficient Input Validation" pcirelated="true">
         <desc>
            <para text="Weaknesses in this category are related to an absent or incorrect protection mechanism that fails to properly validate input that can affect the control flow or data flow of a program."/>
         </desc>
         <recommendations>
            <para text="Validate input from untrusted sources before it is used. The untrusted data sources may include HTTP requests, file systems, databases, and any external systems that provide data to the application. In the case of HTTP requests, validate all parts of the request, including headers, form fields, cookies, and URL components that are used to transfer information from the browser to the server side application."/>
            <para text="Duplicate any client-side checks on the server side. This should be simple to implement in terms of time and difficulty, and will greatly reduce the likelihood of insecure parameter values being used in the application."/>
         </recommendations>
         <cwe cweid="601" cwename="URL Redirection to Untrusted Site &#x28;&#x27;Open Redirect&#x27;&#x29;" pcirelated="true" owasp="1345" sans="864">
            <description>
               <text text="A web application accepts a untrusted input that specifies a link to an external site, and uses that link to generate a redirect.  This enables phishing attacks."/>
            </description>
            <staticflaws>
               <flaw severity="3" categoryname="URL Redirection to Untrusted Site &#x28;&#x27;Open Redirect&#x27;&#x29;" count="1" issueid="111" module="verademo.war" type="showLogin" description="This call to showLogin&#x28;&#x29; contains a URL redirection to untrusted site flaw. Writing untrusted input into a URL value could cause the web application to redirect the request to the specified URL, leading to phishing attempts to steal user credentials.&#xd;&#xa;&#xd;&#xa;Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;601.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Unvalidated_Redirects_and_Forwards_Cheat_Sheet.md&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;URL-Redirector-Abuse&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="601" remediationeffort="2" exploitLevel="1" categoryid="25" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="86" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showLogin&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="28"/>
               <flaw severity="3" categoryname="URL Redirection to Untrusted Site &#x28;&#x27;Open Redirect&#x27;&#x29;" count="1" issueid="23" module="verademo.war" type="showLogin" description="This call to showLogin&#x28;&#x29; contains a URL redirection to untrusted site flaw. Writing untrusted input into a URL value could cause the web application to redirect the request to the specified URL, leading to phishing attempts to steal user credentials.&#xd;&#xa;&#xd;&#xa;Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;601.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;github.com&#x2f;OWASP&#x2f;CheatSheetSeries&#x2f;blob&#x2f;master&#x2f;cheatsheets&#x2f;Unvalidated_Redirects_and_Forwards_Cheat_Sheet.md&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;URL-Redirector-Abuse&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="601" remediationeffort="2" exploitLevel="1" categoryid="25" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="98" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showLogin&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="62"/>
            </staticflaws>
         </cwe>
         <cwe cweid="470" cwename="Use of Externally-Controlled Input to Select Classes or Code &#x28;&#x27;Unsafe Reflection&#x27;&#x29;" pcirelated="true" owasp="1347">
            <description>
               <text text="A call uses reflection in an unsafe manner.  An attacker can specify the class name to be instantiated, which may create unexpected control flow paths through the application.  Depending on how reflection is being used, the attack vector may allow the attacker to bypass security checks or otherwise cause the application to behave in an unexpected manner.  Even if the object does not implement the specified interface and a ClassCastException is thrown, the constructor of the untrusted class name will have already executed."/>
            </description>
            <staticflaws>
               <flaw severity="3" categoryname="Use of Externally-Controlled Input to Select Classes or Code &#x28;&#x27;Unsafe Reflection&#x27;&#x29;" count="1" issueid="193" module="verademo.war" type="java.lang.Class.forName" description="This call to java.lang.Class.forName&#x28;&#x29; uses reflection in an unsafe manner. An attacker can specify the class name to be instantiated, which may create unexpected control flow paths through the application. Depending on how reflection is being used, the attack vector may allow the attacker to bypass security checks or otherwise cause the application to behave in an unexpected manner. Even if the object does not implement the specified interface and a ClassCastException is thrown, the constructor of the untrusted class name will have already executed. The first argument to forName&#x28;&#x29; contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.&#xd;&#xa;&#xd;&#xa;Validate the class name against a combination of white and blocklists to ensure that only expected behavior is produced.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;470.html&#x29; &#xd;&#xa;OWASP &#x28;https&#x3a;&#x2f;&#x2f;www.owasp.org&#x2f;index.php&#x2f;Unsafe_Reflection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="470" remediationeffort="2" exploitLevel="1" categoryid="25" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="ppn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="543" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlabbers&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="50">
                  <exploitability_adjustments>
                     <exploitability_adjustment score_adjustment="1">
                        <note>The class name being passed to the reflection operation is tainted.</note>
                     </exploitability_adjustment>
                  </exploitability_adjustments>
               </flaw>
            </staticflaws>
         </cwe>
      </category>
   </severity>
   <severity level="2">
      <category categoryid="7" categoryname="API Abuse" pcirelated="false">
         <desc>
            <para text="An API is a contract between a caller and a callee. Incorrect usage of certain API functions can result in exploitable security vulnerabilities."/>
            <para text="The most common forms of API abuse are caused by the caller failing to honor its end of this contract.  For example, if a program fails to call chdir&#x28;&#x29; after calling chroot&#x28;&#x29;, it violates the contract that specifies how to change the active root directory in a secure fashion.  Providing too few arguments to a varargs function such as printf&#x28;&#x29; also violates the API contract and will cause the missing parameters to be populated with unexpected data from the stack."/>
            <para text="Another common mishap is when the caller makes false assumptions about the callee&#x27;s behavior.  One example of this is when a caller expects a DNS-related function to return trustworthy information that can be used for authentication purposes.  This is a bad assumption because DNS responses can be easily spoofed."/>
         </desc>
         <recommendations>
            <para text="When calling API functions, be sure to fully understand and adhere to the specifications to avoid introducing security vulnerabilities.  Do not make assumptions about trustworthiness of the data returned from API calls or use the data in a context that was unintended by that API."/>
         </recommendations>
         <cwe cweid="245" cwename="J2EE Bad Practices&#x3a; Direct Management of Connections" pcirelated="false">
            <description>
               <text text="The J2EE application directly manages connections rather than using the container&#x27;s resource management facilities to obtain connections as specified in the J2EE standard.  Every major web application container provides pooled database connection management as part of its resource management framework. Duplicating this functionality in an application is difficult and error prone, which is part of the reason it is forbidden under the J2EE standard."/>
            </description>
            <staticflaws>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="106" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="69" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showFeed&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="15"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="155" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="175" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String getMoreFeed&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="25"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="27" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="223" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processFeed&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="30"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="164" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="293" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlab&#x28;java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="22"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="2" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="382" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlab&#x28;java.lang.String, java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="29"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="13" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="460" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlabbers&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="32"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="70" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="540" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlabbers&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="43"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="166" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="99" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="5"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="129" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="259" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="void recreateDatabaseSchema&#x28;&#x29;" functionrelativelocation="17"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="52" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="156" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processLogin&#x28;java.lang.String, java.lang.String, java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="9"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="189" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="244" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showPasswordHint&#x28;java.lang.String&#x29;" functionrelativelocation="20"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="161" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="306" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processRegister&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.ui.Model&#x29;" functionrelativelocation="25"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="68" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="358" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processRegisterFinish&#x28;java.lang.String, java.lang.String, java.lang.String, java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.ui.Model&#x29;" functionrelativelocation="16"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="11" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="454" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showProfile&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="12"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="83" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="552" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processProfile&#x28;java.lang.String, java.lang.String, java.lang.String, org.springframework.web.multipart.MultipartFile, org.springframework.web.multipart.MultipartHttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="16"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="45" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="730" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="boolean usernameExists&#x28;java.lang.String&#x29;" functionrelativelocation="10"/>
               <flaw severity="2" categoryname="J2EE Bad Practices&#x3a; Direct Management of Connections" count="1" issueid="80" module="verademo.war" type="java.sql.DriverManager.getConnection" description="This call to getConnection&#x28;&#x29; fails to use the J2EE container&#x27;s resource management facilities as required by the J2EE standard.&#xd;&#xa;&#xd;&#xa;Request the connection from the container rather than attempting to access it directly.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;245.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="245" remediationeffort="2" exploitLevel="0" categoryid="7" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="nnp" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="784" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="boolean updateUsername&#x28;java.lang.String, java.lang.String&#x29;" functionrelativelocation="6"/>
            </staticflaws>
         </cwe>
      </category>
      <category categoryid="12" categoryname="Cryptographic Issues" pcirelated="true">
         <desc>
            <para text="Applications commonly use cryptography to implement authentication mechanisms and to ensure the confidentiality and integrity of sensitive data, both in transit and at rest.  The proper and accurate implementation of cryptography is extremely critical to its efficacy.  Configuration or coding mistakes as well as incorrect assumptions may negate a large degree of the protection it affords, leaving the crypto implementation vulnerable to attack."/>
            <para text="Common cryptographic mistakes include, but are not limited to, selecting weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic data, using predictable entropy sources, and mismanaging or hard-coding keys.  "/>
            <para text="Developers often make the dangerous assumption that they can improve security by designing their own cryptographic algorithm&#x3b; however, one of the basic tenets of cryptography is that any cipher whose effectiveness is reliant on the secrecy of the algorithm is fundamentally flawed.  "/>
         </desc>
         <recommendations>
            <para text="Select the appropriate type of cryptography for the intended purpose.  Avoid proprietary encryption algorithms as they typically rely on &#x22;security through obscurity&#x22; rather than sound mathematics.  Select key sizes appropriate for the data being protected&#x3b; for high assurance applications, 256-bit symmetric keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for key storage, and ensure that plaintext data and key material are not inadvertently exposed."/>
         </recommendations>
         <cwe cweid="614" cwename="Sensitive Cookie in HTTPS Session Without &#x27;Secure&#x27; Attribute" pcirelated="true" owasp="1349" sans="311">
            <description>
               <text text="Setting the Secure attribute on an HTTP cookie instructs the web browser to send it only over a secure channel, such as a TLS connection.  Issuing a cookie without the Secure attribute allows the browser to transmit it over unencrypted connections, which are susceptible to eavesdropping.  It is particularly important to set the Secure attribute on any cookies containing sensitive data, such as authentication information &#x28;e.g. &#x22;remember me&#x22; style functionality&#x29;."/>
            </description>
            <staticflaws>
               <flaw severity="2" categoryname="Sensitive Cookie in HTTPS Session Without &#x27;Secure&#x27; Attribute" count="1" issueid="147" module="verademo.war" type="javax.servlet.http.HttpServletResponse.addCookie" description="This call to javax.servlet.http.HttpServletResponse.addCookie&#x28;&#x29; adds a cookie to the HTTP response that does not have the Secure attribute set. Failing to set this attribute allows the browser to send the cookie unencrypted over an HTTP session.&#xd;&#xa;&#xd;&#xa;Set the Secure attribute for all cookies used by HTTPS sessions.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;614.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Insufficient-Transport-Layer-Protection&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="614" remediationeffort="1" exploitLevel="0" categoryid="12" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="Utils.java" line="55" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;utils&#x2f;" scope="com.veracode.verademo.utils.Utils" functionprototype="void setCookie&#x28;javax.servlet.http.HttpServletResponse, java.lang.String, java.lang.String&#x29;" functionrelativelocation="50"/>
            </staticflaws>
         </cwe>
      </category>
      <category categoryid="8" categoryname="Information Leakage" pcirelated="true">
         <desc>
            <para text="An information leak is the intentional or unintentional disclosure of information that is either regarded as sensitive within the product&#x27;s own functionality or provides information about the product or its environment that could be useful in an attack.  Information leakage issues are commonly overlooked because they cannot be used to directly exploit the application.  However, information leaks should be viewed as building blocks that an attacker uses to carry out other, more complicated attacks."/>
            <para text="There are many different types of problems that involve information leaks, with severities that can range widely depending on the type of information leaked and the context of the information with respect to the application.  Common sources of information leakage include, but are not limited to&#x3a;">
               <bulletitem text="Source code disclosure"/>
               <bulletitem text="Browsable directories"/>
               <bulletitem text="Log files or backup files in web-accessible directories"/>
               <bulletitem text="Unfiltered backend error messages"/>
               <bulletitem text="Exception stack traces"/>
               <bulletitem text="Server version information"/>
               <bulletitem text="Transmission of uninitialized memory containing sensitive data"/>
            </para>
         </desc>
         <recommendations>
            <para text="Configure applications and servers to return generic error messages and to suppress stack traces from being displayed to end users.  Ensure that errors generated by the application do not provide insight into specific backend issues.  "/>
            <para text="Remove all backup files, binary archives, alternate versions of files, and test files from web-accessible directories of production servers.  The only files that should be present in the application&#x27;s web document root are files required by the application.  Ensure that deployment procedures include the removal of these file types by an administrator.  Keep web and application servers fully patched to minimize exposure to publicly-disclosed information leakage vulnerabilities."/>
         </recommendations>
         <cwe cweid="209" cwename="Generation of Error Message Containing Sensitive Information" pcirelated="true" owasp="1348" certcpp="880">
            <description>
               <text text="The software generates an error message that includes sensitive information about its environment, users, or associated data.  The sensitive information may be valuable information on its own &#x28;such as a password&#x29;, or it may be useful for launching other, more deadly attacks. If an attack fails, an attacker may use error information provided by the server to launch another more focused attack.  For example, file locations disclosed by an exception stack trace may be leveraged by an attacker to exploit a path traversal issue elsewhere in the application."/>
            </description>
            <staticflaws>
               <flaw severity="2" categoryname="Generation of Error Message Containing Sensitive Information" count="1" issueid="132" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="The application calls the javax.servlet.jsp.JspWriter.print&#x28;&#x29; function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. The first argument to print&#x28;&#x29; contains data from an error message &#x28;possibly containing untrusted data&#x29; from the variable error. The data from an error message &#x28;possibly containing untrusted data&#x29; originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The data from an error message &#x28;possibly containing untrusted data&#x29; is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;209.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="209" remediationeffort="1" exploitLevel="0" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="blab.jsp" line="68" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.blab_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="35"/>
               <flaw severity="2" categoryname="Generation of Error Message Containing Sensitive Information" count="1" issueid="78" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="The application calls the javax.servlet.jsp.JspWriter.print&#x28;&#x29; function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. The first argument to print&#x28;&#x29; contains data from an error message &#x28;possibly containing untrusted data&#x29; from the variable error. The data from an error message &#x28;possibly containing untrusted data&#x29; originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The data from an error message &#x28;possibly containing untrusted data&#x29; is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;209.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="209" remediationeffort="1" exploitLevel="0" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="blabbers.jsp" line="65" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.blabbers_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="24"/>
               <flaw severity="2" categoryname="Generation of Error Message Containing Sensitive Information" count="1" issueid="59" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="The application calls the javax.servlet.jsp.JspWriter.print&#x28;&#x29; function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. The first argument to print&#x28;&#x29; contains data from an error message &#x28;possibly containing untrusted data&#x29; from the variable error. The data from an error message &#x28;possibly containing untrusted data&#x29; originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The data from an error message &#x28;possibly containing untrusted data&#x29; is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;209.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="209" remediationeffort="1" exploitLevel="0" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="feed.jsp" line="69" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.feed_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="22"/>
               <flaw severity="2" categoryname="Generation of Error Message Containing Sensitive Information" count="1" issueid="50" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="The application calls the javax.servlet.jsp.JspWriter.print&#x28;&#x29; function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. The first argument to print&#x28;&#x29; contains data from an error message &#x28;possibly containing untrusted data&#x29; from the variable error. The data from an error message &#x28;possibly containing untrusted data&#x29; originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The data from an error message &#x28;possibly containing untrusted data&#x29; is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;209.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="209" remediationeffort="1" exploitLevel="0" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="login.jsp" line="59" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.login_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="35"/>
               <flaw severity="2" categoryname="Generation of Error Message Containing Sensitive Information" count="1" issueid="151" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="The application calls the javax.servlet.jsp.JspWriter.print&#x28;&#x29; function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. The first argument to print&#x28;&#x29; contains data from an error message &#x28;possibly containing untrusted data&#x29; from the variable error. The data from an error message &#x28;possibly containing untrusted data&#x29; originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The data from an error message &#x28;possibly containing untrusted data&#x29; is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;209.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="209" remediationeffort="1" exploitLevel="0" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="profile.jsp" line="62" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.profile_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="17"/>
               <flaw severity="2" categoryname="Generation of Error Message Containing Sensitive Information" count="1" issueid="141" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="The application calls the javax.servlet.jsp.JspWriter.print&#x28;&#x29; function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. The first argument to print&#x28;&#x29; contains data from an error message &#x28;possibly containing untrusted data&#x29; from the variable error. The data from an error message &#x28;possibly containing untrusted data&#x29; originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The data from an error message &#x28;possibly containing untrusted data&#x29; is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;209.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="209" remediationeffort="1" exploitLevel="0" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="register-finish.jsp" line="59" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.register_002dfinish_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="41"/>
               <flaw severity="2" categoryname="Generation of Error Message Containing Sensitive Information" count="1" issueid="53" module="verademo.war" type="javax.servlet.jsp.JspWriter.print" description="The application calls the javax.servlet.jsp.JspWriter.print&#x28;&#x29; function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. The first argument to print&#x28;&#x29; contains data from an error message &#x28;possibly containing untrusted data&#x29; from the variable error. The data from an error message &#x28;possibly containing untrusted data&#x29; originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. The data from an error message &#x28;possibly containing untrusted data&#x29; is directed into an output stream returned by javax.servlet.jsp.JspWriter.&#xd;&#xa;&#xd;&#xa;Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;209.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="209" remediationeffort="1" exploitLevel="0" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="register.jsp" line="59" sourcefilepath="&#x2f;WEB-INF&#x2f;views&#x2f;" scope="com.veracode.compiledjsp.xverademowar.WEB_002dINF.views.register_jsp" functionprototype="void _jspService&#x28;javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="39"/>
               <flaw severity="2" categoryname="Generation of Error Message Containing Sensitive Information" count="1" issueid="157" module="verademo.war" type="javax.mail.Transport.send" description="The application calls the javax.mail.Transport.send&#x28;&#x29; function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. The first argument to send&#x28;&#x29; contains data from an error message &#x28;possibly containing untrusted data&#x29; from the variable message. The data from an error message &#x28;possibly containing untrusted data&#x29; originated from earlier calls to java.lang.NullPointerException.getMessage, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace.&#xd;&#xa;&#xd;&#xa;Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;209.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="209" remediationeffort="1" exploitLevel="0" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="898" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="void emailExceptionsToAdmin&#x28;java.lang.Throwable&#x29;" functionrelativelocation="92"/>
            </staticflaws>
         </cwe>
         <cwe cweid="201" cwename="Insertion of Sensitive Information Into Sent Data" pcirelated="true" owasp="1345">
            <description>
               <text text="Sensitive information may be exposed as a result of outbound network connections made by the application."/>
            </description>
            <staticflaws>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="57" module="verademo.war" type="showFeed" description="The application calls the showFeed&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="57" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showFeed&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="5"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="32" module="verademo.war" type="processFeed" description="The application calls the processFeed&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="211" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processFeed&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="12"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="81" module="verademo.war" type="processFeed" description="The application calls the processFeed&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="257" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processFeed&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="66"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="136" module="verademo.war" type="processFeed" description="The application calls the processFeed&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="257" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processFeed&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="81"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="165" module="verademo.war" type="processFeed" description="The application calls the processFeed&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="258" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processFeed&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="85"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="179" module="verademo.war" type="processFeed" description="The application calls the processFeed&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="258" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processFeed&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="69"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="194" module="verademo.war" type="showBlab" description="The application calls the showBlab&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="275" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlab&#x28;java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="8"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="14" module="verademo.war" type="showBlab" description="The application calls the showBlab&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="351" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlab&#x28;java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="87"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="18" module="verademo.war" type="showBlab" description="The application calls the showBlab&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="351" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlab&#x28;java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="76"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="143" module="verademo.war" type="showBlab" description="The application calls the showBlab&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="352" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlab&#x28;java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="78"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="20" module="verademo.war" type="showBlab" description="The application calls the showBlab&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="352" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlab&#x28;java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="89"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="146" module="verademo.war" type="processBlab" description="The application calls the processBlab&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="370" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlab&#x28;java.lang.String, java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="11"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="5" module="verademo.war" type="processBlab" description="The application calls the processBlab&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="419" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlab&#x28;java.lang.String, java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="68"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="149" module="verademo.war" type="processBlab" description="The application calls the processBlab&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="419" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlab&#x28;java.lang.String, java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="83"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="72" module="verademo.war" type="processBlab" description="The application calls the processBlab&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="420" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlab&#x28;java.lang.String, java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="86"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="121" module="verademo.war" type="processBlab" description="The application calls the processBlab&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="420" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlab&#x28;java.lang.String, java.lang.Integer, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="71"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="191" module="verademo.war" type="showBlabbers" description="The application calls the showBlabbers&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="441" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlabbers&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="12"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="22" module="verademo.war" type="showBlabbers" description="The application calls the showBlabbers&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="501" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlabbers&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="85"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="30" module="verademo.war" type="showBlabbers" description="The application calls the showBlabbers&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="502" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String showBlabbers&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="87"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="180" module="verademo.war" type="processBlabbers" description="The application calls the processBlabbers&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="520" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlabbers&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="11"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="162" module="verademo.war" type="processBlabbers" description="The application calls the processBlabbers&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="527" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlabbers&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="26"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="172" module="verademo.war" type="processBlabbers" description="The application calls the processBlabbers&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="568" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlabbers&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="84"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="79" module="verademo.war" type="processBlabbers" description="The application calls the processBlabbers&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="568" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlabbers&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="70"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="144" module="verademo.war" type="processBlabbers" description="The application calls the processBlabbers&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="569" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlabbers&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="86"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="154" module="verademo.war" type="processBlabbers" description="The application calls the processBlabbers&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="569" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String processBlabbers&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="73"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="7" module="verademo.war" type="renderGet" description="The application calls the renderGet&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="HomeController.java" line="20" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.HomeController" functionprototype="java.lang.String renderGet&#x28;org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="33"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="43" module="verademo.war" type="processReset" description="The application calls the processReset&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ResetController.java" line="242" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ResetController" functionprototype="java.lang.String processReset&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model&#x29;" functionrelativelocation="99"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="163" module="verademo.war" type="showLogin" description="The application calls the showLogin&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="89" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showLogin&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="30"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="152" module="verademo.war" type="showLogin" description="The application calls the showLogin&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="101" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showLogin&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="64"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="19" module="verademo.war" type="processLogin" description="The application calls the processLogin&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="229" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processLogin&#x28;java.lang.String, java.lang.String, java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="99"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="135" module="verademo.war" type="processLogout" description="The application calls the processLogout&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="283" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processLogout&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="97"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="109" module="verademo.war" type="processRegisterFinish" description="The application calls the processRegisterFinish&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, java.sql.Statement.executeQuery, and java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="398" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processRegisterFinish&#x28;java.lang.String, java.lang.String, java.lang.String, java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.ui.Model&#x29;" functionrelativelocation="99"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="65" module="verademo.war" type="showProfile" description="The application calls the showProfile&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="442" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showProfile&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="7"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="26" module="verademo.war" type="downloadImage" description="The application calls the downloadImage&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The potentially sensitive data originated from an earlier call to java.lang.System.getenv.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="654" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String downloadImage&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="10"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="110" module="verademo.war" type="javax.servlet.ServletResponse.setContentType" description="The application calls the javax.servlet.ServletResponse.setContentType&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="678" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String downloadImage&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="48"/>
               <flaw severity="2" categoryname="Insertion of Sensitive Information Into Sent Data" count="1" issueid="40" module="verademo.war" type="javax.mail.Transport.send" description="The application calls the javax.mail.Transport.send&#x28;&#x29; function, which will result in data being transferred out of the application &#x28;via the network or another medium&#x29;. This data contains sensitive information. The first argument to send&#x28;&#x29; contains potentially sensitive data from the variable message. The potentially sensitive data originated from an earlier call to java.lang.System.getProperties.&#xd;&#xa;&#xd;&#xa;Ensure that the transfer of the sensitive data is intended and that it does not violate application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability. However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;201.html&#x29; &#xd;&#xa;WASC &#x28;https&#x3a;&#x2f;&#x2f;webappsec.pbworks.com&#x2f;Information-Leakage&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="201" remediationeffort="2" exploitLevel="-1" categoryid="8" pcirelated="true" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="pnn" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="898" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="void emailExceptionsToAdmin&#x28;java.lang.Throwable&#x29;" functionrelativelocation="92"/>
            </staticflaws>
         </cwe>
      </category>
   </severity>
   <severity level="1"/>
   <severity level="0">
      <category categoryid="17" categoryname="Code Quality" pcirelated="false">
         <desc>
            <para text="Code quality issues stem from failure to follow good coding practices and can lead to unpredictable behavior. These may include but are not limited to&#x3a;">
               <bulletitem text="Neglecting to remove debug code or dead code"/>
               <bulletitem text="Improper resource management, such as using a pointer after it has been freed"/>
               <bulletitem text="Using the incorrect operator to compare objects"/>
               <bulletitem text="Failing to follow an API or framework specification"/>
               <bulletitem text="Using a language feature or API in an unintended manner"/>
            </para>
            <para text="While code quality flaws are generally less severe than other categories and usually are not directly exploitable, they may serve as indicators that developers are not following practices that increase the reliability and security of an application.  For an attacker, code quality issues may provide an opportunity to stress the application in unexpected ways."/>
         </desc>
         <recommendations>
            <para text="The wide variance of code quality issues makes it impractical to generalize how these issues should be addressed.  Refer to individual categories for specific recommendations. "/>
         </recommendations>
         <cwe cweid="404" cwename="Improper Resource Shutdown or Release" pcirelated="false" certc="1162" certcpp="876" certjava="1147">
            <description>
               <text text="The application fails to release &#x28;or incorrectly releases&#x29; a system resource before it is made available for re-use.  This condition often occurs with resources such as database connections or file handles.  Most unreleased resource issues result in general software reliability problems, but if an attacker can intentionally trigger a resource leak, it may be possible to launch a denial of service attack by depleting the resource pool."/>
            </description>
            <staticflaws>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="186" module="verademo.war" type="java.sql.DriverManager.getConnection" description="The program fails to release or incorrectly releases the variable connect, which was previously allocated by a call to java.sql.DriverManager.getConnection&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="BlabController.java" line="175" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.BlabController" functionprototype="java.lang.String getMoreFeed&#x28;java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="25"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="130" module="verademo.war" type="java.sql.Connection.createStatement" description="The program fails to release or incorrectly releases the variable sqlStatement, which was previously allocated by a call to java.sql.Connection.createStatement&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="IgnoreCommand.java" line="38" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.IgnoreCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="36"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="131" module="verademo.war" type="java.sql.Statement.executeQuery" description="The program fails to release or incorrectly releases the variable result, which was previously allocated by a call to java.sql.Statement.executeQuery&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="IgnoreCommand.java" line="40" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.IgnoreCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="44"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="153" module="verademo.war" type="java.sql.Connection.createStatement" description="The program fails to release or incorrectly releases the variable sqlStatement, which was previously allocated by a call to java.sql.Connection.createStatement&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ListenCommand.java" line="38" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.ListenCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="36"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="76" module="verademo.war" type="java.sql.Statement.executeQuery" description="The program fails to release or incorrectly releases the variable result, which was previously allocated by a call to java.sql.Statement.executeQuery&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ListenCommand.java" line="40" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.ListenCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="44"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="36" module="verademo.war" type="java.sql.Connection.createStatement" description="The program fails to release or incorrectly releases the variable sqlStatement, which was previously allocated by a call to java.sql.Connection.createStatement&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="RemoveAccountCommand.java" line="40" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.RemoveAccountCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="33"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="17" module="verademo.war" type="java.sql.Statement.executeQuery" description="The program fails to release or incorrectly releases the variable result, which was previously allocated by a call to java.sql.Statement.executeQuery&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="RemoveAccountCommand.java" line="42" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;commands&#x2f;" scope="com.veracode.verademo.commands.RemoveAccountCommand" functionprototype="void execute&#x28;java.lang.String&#x29;" functionrelativelocation="40"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="148" module="verademo.war" type="java.io.BufferedReader.&#x21;operator_javanewinit" description="The program fails to release or incorrectly releases the variable br, which was previously allocated by a call to java.io.BufferedReader.&#x21;operator_javanewinit&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ToolsController.java" line="58" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ToolsController" functionprototype="java.lang.String ping&#x28;java.lang.String&#x29;" functionrelativelocation="55"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="12" module="verademo.war" type="java.io.BufferedReader.&#x21;operator_javanewinit" description="The program fails to release or incorrectly releases the variable br, which was previously allocated by a call to java.io.BufferedReader.&#x21;operator_javanewinit&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ToolsController.java" line="88" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ToolsController" functionprototype="java.lang.String fortune&#x28;java.lang.String&#x29;" functionrelativelocation="54"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="3" module="verademo.war" type="java.sql.Statement.executeQuery" description="The program fails to release or incorrectly releases the variable result, which was previously allocated by a call to java.sql.Statement.executeQuery&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="165" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processLogin&#x28;java.lang.String, java.lang.String, java.lang.String, java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse&#x29;" functionrelativelocation="17"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="84" module="verademo.war" type="java.sql.DriverManager.getConnection" description="The program fails to release or incorrectly releases the variable connect, which was previously allocated by a call to java.sql.DriverManager.getConnection&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="244" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showPasswordHint&#x28;java.lang.String&#x29;" functionrelativelocation="20"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="28" module="verademo.war" type="java.sql.Connection.createStatement" description="The program fails to release or incorrectly releases the variable statement, which was previously allocated by a call to java.sql.Connection.createStatement&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="248" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showPasswordHint&#x28;java.lang.String&#x29;" functionrelativelocation="35"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="24" module="verademo.war" type="java.sql.Statement.executeQuery" description="The program fails to release or incorrectly releases the variable result, which was previously allocated by a call to java.sql.Statement.executeQuery&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="249" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showPasswordHint&#x28;java.lang.String&#x29;" functionrelativelocation="38"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="190" module="verademo.war" type="java.sql.DriverManager.getConnection" description="The program fails to release or incorrectly releases the variable connect, which was previously allocated by a call to java.sql.DriverManager.getConnection&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="306" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processRegister&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.ui.Model&#x29;" functionrelativelocation="25"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="159" module="verademo.war" type="java.sql.Connection.createStatement" description="The program fails to release or incorrectly releases the variable statement, which was previously allocated by a call to java.sql.Connection.createStatement&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="309" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processRegister&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.ui.Model&#x29;" functionrelativelocation="48"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="137" module="verademo.war" type="java.sql.Statement.executeQuery" description="The program fails to release or incorrectly releases the variable result, which was previously allocated by a call to java.sql.Statement.executeQuery&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="310" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String processRegister&#x28;java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, org.springframework.ui.Model&#x29;" functionrelativelocation="56"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="6" module="verademo.war" type="java.sql.Connection.createStatement" description="The program fails to release or incorrectly releases the variable sqlStatement, which was previously allocated by a call to java.sql.Connection.createStatement&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="478" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showProfile&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="40"/>
               <flaw severity="0" categoryname="Improper Resource Shutdown or Release" count="1" issueid="103" module="verademo.war" type="java.sql.Statement.executeQuery" description="The program fails to release or incorrectly releases the variable userHistoryResult, which was previously allocated by a call to java.sql.Statement.executeQuery&#x28;&#x29;.&#xd;&#xa;&#xd;&#xa;Ensure that all code paths properly release this resource.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;404.html&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="404" remediationeffort="2" exploitLevel="0" categoryid="17" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="UserController.java" line="479" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.UserController" functionprototype="java.lang.String showProfile&#x28;java.lang.String, org.springframework.ui.Model, javax.servlet.http.HttpServletRequest&#x29;" functionrelativelocation="41"/>
            </staticflaws>
         </cwe>
      </category>
      <category categoryid="24" categoryname="Untrusted Initialization" pcirelated="false">
         <desc>
            <para text="Applications should be reluctant to trust variables that have been initialized outside of its trust boundary. Untrusted initialization refers to instances in which an application allows external control of system settings or variables, which can disrupt service or cause an application to behave in unexpected ways.  For example, if an application uses values from the environment, assuming the data cannot be tampered with, it may use that data in a dangerous way."/>
         </desc>
         <recommendations>
            <para text="Compartmentalize the application and determine where the trust boundaries exist, then treat any input or control outside the trust boundary as potentially hostile.  In general, do not allow user-provided or otherwise untrusted data to control sensitive values."/>
         </recommendations>
         <cwe cweid="454" cwename="External Initialization of Trusted Variables or Data Stores" pcirelated="false">
            <description>
               <text text="A function is used to process options passed into a command line application.  The optarg variable is used to store any additional arguments that an option requires.  If optarg is used in an unbounded string copy, an attacker can specify overly long command line arguments and overflow the destination buffer, potentially resulting in execution of arbitrary code."/>
            </description>
            <staticflaws>
               <flaw severity="0" categoryname="External Initialization of Trusted Variables or Data Stores" count="1" issueid="156" module="verademo.war" type="java.lang.Runtime.exec" description="This call to java.lang.Runtime.exec&#x28;&#x29; invokes an external shell. Environment variables inherited from the calling program as well as those modified by the application itself will be passed to the shell. In light of the vulnerability in the shell bash described in CVE-2014-6271, the runtime environment should be reviewed to ensure that this is not an exploitable call.&#xd;&#xa;&#xd;&#xa;If this application is being run in an environment in which bash is present, ensure that the version of bash used always includes the most recent security updates. Also, in the application itself, consider creating an allowlist of environment variables to protect against external contamination.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;454.html&#x29; &#xd;&#xa;CVE-2014-6271 &#x28;https&#x3a;&#x2f;&#x2f;cve.mitre.org&#x2f;cgi-bin&#x2f;cvename.cgi&#x3f;name&#x3d;CVE-2014-6271&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="454" remediationeffort="4" exploitLevel="0" categoryid="24" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ToolsController.java" line="53" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ToolsController" functionprototype="java.lang.String ping&#x28;java.lang.String&#x29;" functionrelativelocation="37"/>
               <flaw severity="0" categoryname="External Initialization of Trusted Variables or Data Stores" count="1" issueid="94" module="verademo.war" type="java.lang.Runtime.exec" description="This call to java.lang.Runtime.exec&#x28;&#x29; invokes an external shell. Environment variables inherited from the calling program as well as those modified by the application itself will be passed to the shell. In light of the vulnerability in the shell bash described in CVE-2014-6271, the runtime environment should be reviewed to ensure that this is not an exploitable call.&#xd;&#xa;&#xd;&#xa;If this application is being run in an environment in which bash is present, ensure that the version of bash used always includes the most recent security updates. Also, in the application itself, consider creating an allowlist of environment variables to protect against external contamination.&#xd;&#xa;&#xd;&#xa;References&#x3a; &#xd;&#xa;CWE &#x28;https&#x3a;&#x2f;&#x2f;cwe.mitre.org&#x2f;data&#x2f;definitions&#x2f;454.html&#x29; &#xd;&#xa;CVE-2014-6271 &#x28;https&#x3a;&#x2f;&#x2f;cve.mitre.org&#x2f;cgi-bin&#x2f;cvename.cgi&#x3f;name&#x3d;CVE-2014-6271&#x29;&#xd;&#xa;&#xd;&#xa;" note="" cweid="454" remediationeffort="4" exploitLevel="0" categoryid="24" pcirelated="false" date_first_occurrence="2021-12-29 22&#x3a;11&#x3a;27 UTC" remediation_status="New" cia_impact="zzz" grace_period_expires="" affects_policy_compliance="false" mitigation_status="none" mitigation_status_desc="Not Mitigated" sourcefile="ToolsController.java" line="83" sourcefilepath="com&#x2f;veracode&#x2f;verademo&#x2f;controller&#x2f;" scope="com.veracode.verademo.controller.ToolsController" functionprototype="java.lang.String fortune&#x28;java.lang.String&#x29;" functionrelativelocation="30"/>
            </staticflaws>
         </cwe>
      </category>
   </severity>
   <flaw-status new="194" reopen="0" open="0" cannot-reproduce="0" fixed="0" total="194" not_mitigated="194" sev-1-change="0" sev-2-change="62" sev-3-change="96" sev-4-change="14" sev-5-change="2"/>
   <customfields>
      <customfield name="Custom 1" value=""/>
      <customfield name="Custom 2" value=""/>
      <customfield name="Custom 3" value=""/>
      <customfield name="Custom 4" value=""/>
      <customfield name="Custom 5" value=""/>
      <customfield name="Custom 6" value=""/>
      <customfield name="Custom 7" value=""/>
      <customfield name="Custom 8" value=""/>
      <customfield name="Custom 9" value=""/>
      <customfield name="Custom 10" value=""/>
   </customfields>
   <software_composition_analysis third_party_components="95" violate_policy="false" components_violated_policy="0">
      <vulnerable_components>
         <component component_id="057e93d5-c7c8-4b3a-bf16-d7450929ced2" file_name="tomcat-jni-9.0.36.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="9.0.36" library="tomcat-jni" library_id="maven&#x3a;org.apache.tomcat&#x3a;tomcat-jni&#x3a;9.0.36&#x3a;" vendor="org.apache.tomcat" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-core-9.0.36.jar&#x3a;tomcat-jni-9.0.36.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="0a7e5504-34d8-49a9-9910-10fc8e8ff384" file_name="jakarta.el-api-3.0.3.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="3.0.3" library="Jakarta Expression Language API" library_id="maven&#x3a;jakarta.el&#x3a;jakarta.el-api&#x3a;3.0.3&#x3a;" vendor="jakarta.el" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;jakarta.el-3.0.3.jar&#x3a;jakarta.el-api-3.0.3.jar"/>
            </file_paths>
            <licenses>
               <license name="Eclipse Public License 2.0" spdx_id="EPL-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;EPL-2.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU General Public License with Classpath Exceptions version 2.0" spdx_id="GPL-2.0-with-classpath-exception" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0-with-classpath-exception.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="0d64a1dd-b9ae-4b6e-9b41-f811c7885b91" file_name="spring-boot-starter-json-2.3.1.RELEASE.jar" sha1="8342003919c7e5a2470072595ea190cb8a9552c0" vulnerabilities="0" max_cvss_score="" version="2.3.1.RELEASE" library="spring-boot-starter-json" library_id="maven&#x3a;org.springframework.boot&#x3a;spring-boot-starter-json&#x3a;2.3.1.RELEASE&#x3a;" vendor="org.springframework.boot" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-boot-starter-json-2.3.1.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="10838146-6cb6-421a-9cad-8c6a1643157e" file_name="slf4j-log4j12-1.7.7.jar" sha1="58f588119ffd1702c77ccab6acb54bfb41bed8bd" vulnerabilities="0" max_cvss_score="" version="1.7.7" library="SLF4J LOG4J-12 Binding" library_id="maven&#x3a;org.slf4j&#x3a;slf4j-log4j12&#x3a;1.7.7&#x3a;" vendor="org.slf4j" description="SLF4J LOG4J-12 Binding" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;slf4j-log4j12-1.7.7.jar"/>
            </file_paths>
            <licenses>
               <license name="MIT License" spdx_id="MIT" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;MIT.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="11a5a4d1-f78b-4e66-8a3c-24177ee8c7a4" file_name="org.apache.servicemix.bundles.javax-el-impl-3.0.3_1.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="3.0.3_1" library="org.apache.servicemix.bundles.javax-el-impl" library_id="maven&#x3a;org.apache.servicemix.bundles&#x3a;org.apache.servicemix.bundles.javax-el-impl&#x3a;3.0.3_1&#x3a;" vendor="org.apache.servicemix.bundles" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;jakarta.el-3.0.3.jar&#x3a;org.apache.servicemix.bundles.javax-el-impl-3.0.3_1.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="16f00554-a92c-4a63-b8a2-e71b572a529e" file_name="maven-repository-metadata-2.0.jar" sha1="3f162989e8077f37911ec7d025f3480e65c2c5be" vulnerabilities="0" max_cvss_score="" version="2.0" library="Maven Repository Metadata Model" library_id="maven&#x3a;org.apache.maven&#x3a;maven-repository-metadata&#x3a;2.0&#x3a;" vendor="org.apache.maven" description="Maven Plugin Mapping" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;maven-repository-metadata-2.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="1793362a-098a-47f2-95e8-0565117aa7fd" file_name="commons-httpclient-3.1.jar" sha1="964cd74171f427720480efdec40a7c7f6e58426a" vulnerabilities="4" max_cvss_score="5.8" version="3.1" library="HttpClient" library_id="maven&#x3a;commons-httpclient&#x3a;commons-httpclient&#x3a;3.1&#x3a;" vendor="commons-httpclient" description="The HttpClient  component supports the client-side of RFC 1945 &#x28;HTTP&#x2f;1.0&#x29;  and RFC 2616 &#x28;HTTP&#x2f;1.1&#x29; , several related specifications &#x28;RFC 2109 &#x28;Cookies&#x29; , RFC 2617 &#x28;HTTP Authentication&#x29; , etc.&#x29;, and provides a framework by which new request types &#x28;methods&#x29; or HTTP extensions can be created easily." added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;commons-httpclient-3.1.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2012-5783" cvss_score="5.8" severity="3" cwe_id="CWE-20" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service &#x28;FPS&#x29; merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject&#x27;s Common Name &#x28;CN&#x29; or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2012-6153" cvss_score="4.3" severity="3" cwe_id="CWE-20" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="http&#x2f;conn&#x2f;ssl&#x2f;AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject&#x27;s Common Name &#x28;CN&#x29; or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE&#x3a; this issue exists because of an incomplete fix for CVE-2012-5783." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2014-3577" cvss_score="5.8" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject&#x27;s Common Name &#x28;CN&#x29; or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a &#x22;CN&#x3d;&#x22; string in a field in the distinguished name &#x28;DN&#x29; of a certificate, as demonstrated by the &#x22;foo,CN&#x3d;www.apache.org&#x22; string in the O field." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2015-5262" cvss_score="4.3" severity="3" cwe_id="CWE-399" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="http&#x2f;conn&#x2f;ssl&#x2f;SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service &#x28;HTTPS call hang&#x29; via unspecified vectors." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="28614053-0ad6-4c0f-817e-6b4c89777501" file_name="mysql-connector-java-5.1.48.jar" sha1="9140be77aafa5050bf4bb936d560cbacb5a6b5c1" vulnerabilities="2" max_cvss_score="3.5" version="5.1.48" library="MySQL Connector&#x2f;J" library_id="maven&#x3a;mysql&#x3a;mysql-connector-java&#x3a;5.1.48&#x3a;" vendor="mysql" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;mysql-connector-java-5.1.48.jar"/>
            </file_paths>
            <licenses>
               <license name="GNU General Public License v2.0 only" spdx_id="GPL-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2019-2692" cvss_score="3.5" severity="2" cwe_id="CWE-20" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="Vulnerability in the MySQL Connectors component of Oracle MySQL &#x28;subcomponent&#x3a; Connector&#x2f;J&#x29;. Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 6.3 &#x28;Confidentiality, Integrity and Availability impacts&#x29;. CVSS Vector&#x3a; &#x28;CVSS&#x3a;3.0&#x2f;AV&#x3a;L&#x2f;AC&#x3a;H&#x2f;PR&#x3a;H&#x2f;UI&#x3a;R&#x2f;S&#x3a;U&#x2f;C&#x3a;H&#x2f;I&#x3a;H&#x2f;A&#x3a;H&#x29;." severity_desc="Low" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2020-2933" cvss_score="3.5" severity="2" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="mysql-connector-java is vulnerable to denial of service. When working with a load balancing setup, if the connection property &#x60;loadBalanceStrategy&#x60; was set to &#x60;bestResponseTime&#x60; and connections to all the hosts in the original setup failed, a denial of service condition will occur in Connector&#x2f;J, even if newly-added hosts are available." severity_desc="Low" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="2d1e78d8-89d7-46bb-9633-2fbea4d0e2c7" file_name="tomcat-jasper-el-9.0.36.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="9.0.36" library="tomcat-jasper-el" library_id="maven&#x3a;org.apache.tomcat&#x3a;tomcat-jasper-el&#x3a;9.0.36&#x3a;" vendor="org.apache.tomcat" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-el-9.0.36.jar&#x3a;tomcat-jasper-el-9.0.36.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="2dddf946-16e7-406d-9b77-ce36e04cf1f2" file_name="spring-boot-2.3.1.RELEASE.jar" sha1="ce8d8b6838ecceb68962b975b18682f4237ccf71" vulnerabilities="0" max_cvss_score="" version="2.3.1.RELEASE" library="spring-boot" library_id="maven&#x3a;org.springframework.boot&#x3a;spring-boot&#x3a;2.3.1.RELEASE&#x3a;" vendor="org.springframework.boot" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-boot-2.3.1.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="31117674-2020-41e0-be67-1385f0a4257d" file_name="tomcat-embed-websocket-9.0.36.jar" sha1="33fa5038aa66be6e9cc188000c2188aa4dd33c85" vulnerabilities="1" max_cvss_score="5.0" version="9.0.36" library="tomcat-embed-websocket" library_id="maven&#x3a;org.apache.tomcat.embed&#x3a;tomcat-embed-websocket&#x3a;9.0.36&#x3a;" vendor="org.apache.tomcat.embed" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-websocket-9.0.36.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2020-13935" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="apache tomcat is vulnerable to denial of service. An infinite loop to occurs when invalid payload lengths are parsed. An attacker is able to cause a denial of service condition in the application via malicious WebSocket frames with invalid payload lengths." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="36fa0a91-39cf-4663-96e1-a413324a37df" file_name="xmlsec-1.5.1.jar" sha1="bbf5d96a49a2b58b8988202a3c8728461639090e" vulnerabilities="3" max_cvss_score="5.0" version="1.5.1" library="Apache XML Security for Java" library_id="maven&#x3a;org.apache.santuario&#x3a;xmlsec&#x3a;1.5.1&#x3a;" vendor="org.apache.santuario" description="Apache XML Security for Java supports XML-Signature Syntax and Processing,&#xa;        W3C Recommendation 12 February 2002, and XML Encryption Syntax and&#xa;        Processing, W3C Recommendation 10 December 2002. As of version 1.4,&#xa;        the library supports the standard Java API JSR-105&#x3a; XML Digital Signature APIs." added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;xmlsec-1.5.1.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2013-2172" cvss_score="4.3" severity="3" cwe_id="CWE-310" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="jcp&#x2f;xml&#x2f;dsig&#x2f;internal&#x2f;dom&#x2f;DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak &#x22;canonicalization algorithm to apply to the SignedInfo part of the Signature.&#x22;" severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2013-4517" cvss_score="4.3" severity="3" cwe_id="CWE-399" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service &#x28;memory consumption&#x29; via crafted Document Type Definitions &#x28;DTDs&#x29;, related to signatures." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2021-40690" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="Apache Santuario is vulnerable to bypass of secure validation. Lack of secure handling of &#x60;secureValidation&#x60; property allows an attacker to abuse an XPath Transform and to extract any local .xml files in a RetrievalMethod element during the creation of a KeyInfo from a KeyInfoReference element.&#xa;" severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="372535e6-627f-4e28-8779-8737df8c8e4a" file_name="maven-artifact-manager-2.0.jar" sha1="8672c4278c184dbd4b18fed7e72688fd6018e112" vulnerabilities="0" max_cvss_score="" version="2.0" library="Maven Artifact Manager" library_id="maven&#x3a;org.apache.maven&#x3a;maven-artifact-manager&#x3a;2.0&#x3a;" vendor="org.apache.maven" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;maven-artifact-manager-2.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="38678b7f-6718-4b4f-adb6-390ca146c1dc" file_name="spring-core-5.2.7.RELEASE.jar" sha1="56e14a3a5e2813534b5db2da1502cd58ab5bc61d" vulnerabilities="1" max_cvss_score="4.0" version="5.2.7.RELEASE" library="Spring Core" library_id="maven&#x3a;org.springframework&#x3a;spring-core&#x3a;5.2.7.RELEASE&#x3a;" vendor="org.springframework" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-core-5.2.7.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2021-22096" cvss_score="4.0" severity="2" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="Spring Framework is vulnerable to privilege escalation. The vulnerability exists due to lack of secure validations of user input which allows a malicious user to inject additional log files. " severity_desc="Low" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="3c4a1c6a-aa0d-4a98-9125-a2ec75b88f58" file_name="tomcat-jaspic-api-9.0.2.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="9.0.2" library="tomcat-jaspic-api" library_id="maven&#x3a;org.apache.tomcat&#x3a;tomcat-jaspic-api&#x3a;9.0.2&#x3a;" vendor="org.apache.tomcat" description="javax.security.auth.message package" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-core-9.0.36.jar&#x3a;tomcat-jaspic-api-9.0.2.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="3e54457b-9cff-40ca-a06b-0ffcd76136b3" file_name="hamcrest-core-2.2.jar" sha1="3f2bd07716a31c395e2837254f37f21f0f0ab24b" vulnerabilities="0" max_cvss_score="" version="2.2" library="Hamcrest Core" library_id="maven&#x3a;org.hamcrest&#x3a;hamcrest-core&#x3a;2.2&#x3a;" vendor="org.hamcrest" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;hamcrest-core-2.2.jar"/>
            </file_paths>
            <licenses>
               <license name="BSD 3-Clause &#x22;New&#x22; or &#x22;Revised&#x22; License" spdx_id="BSD-3-Clause" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;BSD-3-Clause.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="47004b3b-df69-4a60-a235-ac4a0e62d206" file_name="logback-classic-1.2.3.jar" sha1="7c4f3c474fb2c041d8028740440937705ebb473a" vulnerabilities="1" max_cvss_score="8.5" version="1.2.3" library="Logback Classic Module" library_id="maven&#x3a;ch.qos.logback&#x3a;logback-classic&#x3a;1.2.3&#x3a;" vendor="ch.qos.logback" description="logback-classic module" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;logback-classic-1.2.3.jar"/>
            </file_paths>
            <licenses>
               <license name="Eclipse Public License 1.0" spdx_id="EPL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;EPL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU Lesser General Public License v2.1 only" spdx_id="LGPL-2.1" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;LGPL-2.1.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU Lesser General Public License v2.1 only" spdx_id="LGPL-2.1-only" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;LGPL-2.1-only.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU Lesser General Public License v3.0 only" spdx_id="LGPL-3.0-only" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;LGPL-3.0-only.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2021-42550" cvss_score="8.5" severity="5" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="logback is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of write access allowing an attacker to craft a malicious configuration.&#xa;" severity_desc="Very High" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="4bc7d82b-07f5-4b02-bd8c-4a2d278645d4" file_name="spring-beans-5.2.7.RELEASE.jar" sha1="05465ab17688ed62254fdef411cf883fd5c3b77a" vulnerabilities="0" max_cvss_score="" version="5.2.7.RELEASE" library="Spring Beans" library_id="maven&#x3a;org.springframework&#x3a;spring-beans&#x3a;5.2.7.RELEASE&#x3a;" vendor="org.springframework" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-beans-5.2.7.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="4ebeadf3-e305-4520-8e20-f7b2b15141c4" file_name="junit-4.13.jar" sha1="e49ccba652b735c93bd6e6f59760d8254cf597dd" vulnerabilities="1" max_cvss_score="1.9" version="4.13" library="JUnit" library_id="maven&#x3a;junit&#x3a;junit&#x3a;4.13&#x3a;" vendor="junit" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;junit-4.13.jar"/>
            </file_paths>
            <licenses>
               <license name="Eclipse Public License 1.0" spdx_id="EPL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;EPL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2020-15250" cvss_score="1.9" severity="1" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="junit is vulnerable to information disclosure. The vulnerability exists through the behaviour of &#x60;TemporaryFolder&#x60; on UNIX-like systems, where the system&#x27;s temporary directory is shared between all users on that system by default." severity_desc="Very Low" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="50739ae5-8acf-4331-afac-66410b4a688b" file_name="tomcat-servlet-api-9.0.35.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="9.0.35" library="tomcat-servlet-api" library_id="maven&#x3a;org.apache.tomcat&#x3a;tomcat-servlet-api&#x3a;9.0.35&#x3a;" vendor="org.apache.tomcat" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-core-9.0.36.jar&#x3a;tomcat-servlet-api-9.0.35.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="Common Development and Distribution License 1.0" spdx_id="CDDL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CDDL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="522b27c1-fea7-4b03-bf79-25354ebe0270" file_name="encoder-jsp-1.2.2.jar" sha1="3f124a0eb702c11389aa79018781cb43c8041f32" vulnerabilities="0" max_cvss_score="" version="1.2.2" library="JSP Encoder" library_id="maven&#x3a;org.owasp.encoder&#x3a;encoder-jsp&#x3a;1.2.2&#x3a;" vendor="org.owasp.encoder" description="The OWASP Encoder JSP package contains JSP tag definitions and TLDs to allow&#xa;        easy use of the OWASP Encoder Project&#x27;s core API. The TLDs contain both tag&#xa;        definitions and JSP EL functions." added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;encoder-jsp-1.2.2.jar"/>
            </file_paths>
            <licenses>
               <license name="BSD 3-Clause &#x22;New&#x22; or &#x22;Revised&#x22; License" spdx_id="BSD-3-Clause" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;BSD-3-Clause.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="556904e5-40b0-49b9-be83-3822f3c1a11c" file_name="tomcat-websocket-api-9.0.16.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="9.0.16" library="tomcat-websocket-api" library_id="maven&#x3a;org.apache.tomcat&#x3a;tomcat-websocket-api&#x3a;9.0.16&#x3a;" vendor="org.apache.tomcat" description="WebSocket &#x28;JSR356&#x29; API" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-websocket-9.0.36.jar&#x3a;tomcat-websocket-api-9.0.16.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="58dab3c5-b691-4006-9be3-91edbf87d27f" file_name="logback-core-1.2.3.jar" sha1="864344400c3d4d92dfeb0a305dc87d953677c03c" vulnerabilities="1" max_cvss_score="8.5" version="1.2.3" library="Logback Core Module" library_id="maven&#x3a;ch.qos.logback&#x3a;logback-core&#x3a;1.2.3&#x3a;" vendor="ch.qos.logback" description="logback-core module" added_date="2021-12-29 22&#x3a;18&#x3a;21 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;logback-core-1.2.3.jar"/>
            </file_paths>
            <licenses>
               <license name="Eclipse Public License 1.0" spdx_id="EPL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;EPL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU Lesser General Public License v2.1 only" spdx_id="LGPL-2.1" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;LGPL-2.1.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU Lesser General Public License v2.1 only" spdx_id="LGPL-2.1-only" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;LGPL-2.1-only.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU Lesser General Public License v3.0 only" spdx_id="LGPL-3.0-only" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;LGPL-3.0-only.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2021-42550" cvss_score="8.5" severity="5" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;21 UTC" cve_summary="logback is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of write access allowing an attacker to craft a malicious configuration.&#xa;" severity_desc="Very High" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="592cbbec-e7d4-4881-bc8b-3fa364cb1dce" file_name="org.apache.sling.commons.osgi-2.0.2-incubator.jar" sha1="7b13d706ac8019b269408831210707df64f93798" vulnerabilities="0" max_cvss_score="" version="2.0.2-incubator" library="Apache Sling Commons OSGi support" library_id="maven&#x3a;org.apache.sling&#x3a;org.apache.sling.commons.osgi&#x3a;2.0.2-incubator&#x3a;" vendor="org.apache.sling" description="Commons OSGi" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;org.apache.sling.commons.osgi-2.0.2-incubator.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="5bc897b9-5207-4702-a9b6-82f43266bcdd" file_name="jackson-datatype-jsr310-2.11.0.jar" sha1="168b2d0e11478b9f0a1bfccd62d6b5e8547b1e6f" vulnerabilities="0" max_cvss_score="" version="2.11.0" library="Jackson datatype&#x3a; JSR310" library_id="maven&#x3a;com.fasterxml.jackson.datatype&#x3a;jackson-datatype-jsr310&#x3a;2.11.0&#x3a;" vendor="com.fasterxml.jackson.datatype" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;jackson-datatype-jsr310-2.11.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="5d9e6e34-bc64-4f09-ba83-dd176dec6157" file_name="maven-sling-plugin-2.0.4-incubator.jar" sha1="d8b247e9c2e9b5b6e8d16142af9a5c66cd913430" vulnerabilities="0" max_cvss_score="" version="2.0.4-incubator" library="Apache Sling Maven Plugin Relocation" library_id="maven&#x3a;org.apache.sling&#x3a;maven-sling-plugin&#x3a;2.0.4-incubator&#x3a;" vendor="org.apache.sling" description="Maven Plugin supporting various Sling Development Tasks" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;maven-sling-plugin-2.0.4-incubator.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="5e780142-ba84-431f-b2f7-72cdf66861a0" file_name="tomcat-jasper-9.0.35.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="9.0.35" library="tomcat-jasper" library_id="maven&#x3a;org.apache.tomcat&#x3a;tomcat-jasper&#x3a;9.0.35&#x3a;" vendor="org.apache.tomcat" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-jasper-9.0.36.jar&#x3a;tomcat-jasper-9.0.35.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="5f415b4a-faa3-4ce8-97c7-78df73712658" file_name="jakarta.el-3.0.3.jar" sha1="dab46ee1ee23f7197c13d7c40fce14817c9017df" vulnerabilities="0" max_cvss_score="" version="3.0.3" library="Jakarta Expression Language 3.0" library_id="maven&#x3a;org.glassfish&#x3a;jakarta.el&#x3a;3.0.3&#x3a;" vendor="org.glassfish" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;jakarta.el-3.0.3.jar"/>
            </file_paths>
            <licenses>
               <license name="Eclipse Public License 2.0" spdx_id="EPL-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;EPL-2.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU General Public License with Classpath Exceptions version 2.0" spdx_id="GPL-2.0-with-classpath-exception" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0-with-classpath-exception.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="6599f523-eda1-4491-8724-418b20fe6380" file_name="javax.mail-api-1.4.7.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="1.4.7" library="JavaMail API jar" library_id="maven&#x3a;javax.mail&#x3a;javax.mail-api&#x3a;1.4.7&#x3a;" vendor="javax.mail" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;mail-1.4.7.jar&#x3a;javax.mail-api-1.4.7.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="Common Development and Distribution License 1.0" spdx_id="CDDL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CDDL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="CeCILL Free Software License Agreement v1.0" spdx_id="CECILL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CECILL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="Eclipse Distribution License &#x28;EDL&#x29;" spdx_id="EDL" license_url="https&#x3a;&#x2f;&#x2f;www.eclipse.org&#x2f;org&#x2f;documents&#x2f;edl-v10.php" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="Eclipse Public License 2.0" spdx_id="EPL-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;EPL-2.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU General Public License with Classpath Exceptions version 2.0" spdx_id="GPL-2.0-with-classpath-exception" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0-with-classpath-exception.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="696ebdd0-a72f-4254-8433-ad57b7f8ff8b" file_name="tomcat-annotations-api-9.0.36.jar" sha1="accb87a9bffc36d717a8dc6bd6ae05982a172f8a" vulnerabilities="0" max_cvss_score="" version="9.0.36" library="tomcat-annotations-api" library_id="maven&#x3a;org.apache.tomcat&#x3a;tomcat-annotations-api&#x3a;9.0.36&#x3a;" vendor="org.apache.tomcat" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-annotations-api-9.0.36.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="6d58721f-b672-4d42-b8b8-cdaf0c8a3e01" file_name="tomcat-embed-el-9.0.36.jar" sha1="0df7c99202598126a5897b37bbf7993ce321efdd" vulnerabilities="0" max_cvss_score="" version="9.0.36" library="tomcat-embed-el" library_id="maven&#x3a;org.apache.tomcat.embed&#x3a;tomcat-embed-el&#x3a;9.0.36&#x3a;" vendor="org.apache.tomcat.embed" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-el-9.0.36.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="6d7c9b3e-39cd-4843-a0b3-4945a701ae8f" file_name="tomcat-jsp-api-9.0.36.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="9.0.36" library="tomcat-jsp-api" library_id="maven&#x3a;org.apache.tomcat&#x3a;tomcat-jsp-api&#x3a;9.0.36&#x3a;" vendor="org.apache.tomcat" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-jasper-9.0.36.jar&#x3a;tomcat-jsp-api-9.0.36.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="6e6add0e-02ba-4bd9-9445-a3fb27e96b95" file_name="spring-boot-starter-web-2.3.1.RELEASE.jar" sha1="555c4f90141cdbc7637145e413bca0d622ba6796" vulnerabilities="0" max_cvss_score="" version="2.3.1.RELEASE" library="spring-boot-starter-web" library_id="maven&#x3a;org.springframework.boot&#x3a;spring-boot-starter-web&#x3a;2.3.1.RELEASE&#x3a;" vendor="org.springframework.boot" description="" added_date="2021-12-29 22&#x3a;18&#x3a;21 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-boot-starter-web-2.3.1.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="6f481977-a06c-45ff-a1ff-42a0079dcbcb" file_name="org.osgi.core-1.2.0.jar" sha1="3006beb1ca6a83449def6127dad3c060148a0209" vulnerabilities="0" max_cvss_score="" version="1.2.0" library="OSGi R4 Core Bundle" library_id="maven&#x3a;org.apache.felix&#x3a;org.osgi.core&#x3a;1.2.0&#x3a;" vendor="org.apache.felix" description="OSGi Service Platform Release 4 Core Interfaces and Classes." added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;org.osgi.core-1.2.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="707fd737-73ed-4161-9863-b7b82cd59d72" file_name="jaxb-api-2.3.1.jar" sha1="8531ad5ac454cc2deb9d4d32c40c4d7451939b5d" vulnerabilities="0" max_cvss_score="" version="2.3.1" library="jaxb-api" library_id="maven&#x3a;javax.xml.bind&#x3a;jaxb-api&#x3a;2.3.1&#x3a;" vendor="javax.xml.bind" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;jaxb-api-2.3.1.jar"/>
            </file_paths>
            <licenses>
               <license name="Common Development and Distribution License 1.1&#x28;CDDL-1.1&#x29;" spdx_id="CDDL-1.1" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CDDL-1.1.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU General Public License with Classpath Exceptions version 2.0" spdx_id="GPL-2.0-with-classpath-exception" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0-with-classpath-exception.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="723432a9-fca7-4cd1-a32c-0625a828c664" file_name="VeracodeAnnotations-1.2.1.jar" sha1="c7b6bcfca2967d20caa5fd1f03fd0ce7aa42b809" vulnerabilities="0" max_cvss_score="" version="1.2.1" library="VeracodeAnnotations" library_id="maven&#x3a;com.veracode.annotation&#x3a;VeracodeAnnotations&#x3a;1.2.1&#x3a;" vendor="com.veracode.annotation" description="Annotations used by Veracode&#x27;s software analysis framework" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;VeracodeAnnotations-1.2.1.jar"/>
            </file_paths>
            <licenses>
               <license name="MIT License" spdx_id="MIT" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;MIT.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="72fb5479-fe7a-47f7-b7d2-85777227293d" file_name="jul-to-slf4j-1.7.30.jar" sha1="d58bebff8cbf70ff52b59208586095f467656c30" vulnerabilities="0" max_cvss_score="" version="1.7.30" library="JUL to SLF4J bridge" library_id="maven&#x3a;org.slf4j&#x3a;jul-to-slf4j&#x3a;1.7.30&#x3a;" vendor="org.slf4j" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;jul-to-slf4j-1.7.30.jar"/>
            </file_paths>
            <licenses>
               <license name="MIT License" spdx_id="MIT" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;MIT.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="7339ff8f-298c-4821-98a9-7fd2c7a74fee" file_name="pop3-1.4.6.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="1.4.6" library="Jakarta Mail API pop3 provider" library_id="maven&#x3a;com.sun.mail&#x3a;pop3&#x3a;1.4.6&#x3a;" vendor="com.sun.mail" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;mail-1.4.7.jar&#x3a;pop3-1.4.6.jar"/>
            </file_paths>
            <licenses>
               <license name="Common Development and Distribution License 1.0" spdx_id="CDDL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CDDL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="CeCILL Free Software License Agreement v1.0" spdx_id="CECILL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CECILL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="Eclipse Distribution License &#x28;EDL&#x29;" spdx_id="EDL" license_url="https&#x3a;&#x2f;&#x2f;www.eclipse.org&#x2f;org&#x2f;documents&#x2f;edl-v10.php" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="Eclipse Public License 2.0" spdx_id="EPL-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;EPL-2.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU General Public License v2.0 only" spdx_id="GPL-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU General Public License with Classpath Exceptions version 2.0" spdx_id="GPL-2.0-with-classpath-exception" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0-with-classpath-exception.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="7af6c9ab-b28e-4870-8553-6fec23094864" file_name="tomcat-embed-jasper-9.0.36.jar" sha1="a2dbada2312d6fa749ca2d6266466f0a3cb279f2" vulnerabilities="0" max_cvss_score="" version="9.0.36" library="tomcat-embed-jasper" library_id="maven&#x3a;org.apache.tomcat.embed&#x3a;tomcat-embed-jasper&#x3a;9.0.36&#x3a;" vendor="org.apache.tomcat.embed" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-jasper-9.0.36.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="7b97d2dc-f55b-488d-a19b-f28a2c52a6e1" file_name="maven-profile-2.0.jar" sha1="442e147cd361128f56ce8003019421f0d90b388a" vulnerabilities="0" max_cvss_score="" version="2.0" library="Maven Profile Model" library_id="maven&#x3a;org.apache.maven&#x3a;maven-profile&#x3a;2.0&#x3a;" vendor="org.apache.maven" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;maven-profile-2.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="80921602-84bd-4397-ae9a-ef836cb936f9" file_name="spring-boot-starter-tomcat-2.3.1.RELEASE.jar" sha1="5b599d0da04e724479c22daa47f9bfd62533a2e9" vulnerabilities="0" max_cvss_score="" version="2.3.1.RELEASE" library="spring-boot-starter-tomcat" library_id="maven&#x3a;org.springframework.boot&#x3a;spring-boot-starter-tomcat&#x3a;2.3.1.RELEASE&#x3a;" vendor="org.springframework.boot" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;spring-boot-starter-tomcat-2.3.1.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="811aa8f7-da6c-4269-b1f8-5bbd19ce1a61" file_name="hamcrest-2.2.jar" sha1="1820c0968dba3a11a1b30669bb1f01978a91dedc" vulnerabilities="0" max_cvss_score="" version="2.2" library="Hamcrest" library_id="maven&#x3a;org.hamcrest&#x3a;hamcrest&#x3a;2.2&#x3a;" vendor="org.hamcrest" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;hamcrest-2.2.jar"/>
            </file_paths>
            <licenses>
               <license name="BSD 3-Clause &#x22;New&#x22; or &#x22;Revised&#x22; License" spdx_id="BSD-3-Clause" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;BSD-3-Clause.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="818e21c0-1a85-4a0e-acf9-77d264d85da4" file_name="jackson-annotations-2.11.0.jar" sha1="c626020ae55d19c690d25cb51c1532ba76e5890f" vulnerabilities="0" max_cvss_score="" version="2.11.0" library="Jackson-annotations" library_id="maven&#x3a;com.fasterxml.jackson.core&#x3a;jackson-annotations&#x3a;2.11.0&#x3a;" vendor="com.fasterxml.jackson.core" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;jackson-annotations-2.11.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="83fe7fdd-3039-409a-8fab-555d5b823ed0" file_name="log4j-to-slf4j-2.13.3.jar" sha1="966f6fd1af4959d6b12bfa880121d4a2b164f857" vulnerabilities="0" max_cvss_score="" version="2.13.3" library="Apache Log4j to SLF4J Adapter" library_id="maven&#x3a;org.apache.logging.log4j&#x3a;log4j-to-slf4j&#x3a;2.13.3&#x3a;" vendor="org.apache.logging.log4j" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;log4j-to-slf4j-2.13.3.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="843d5a03-d3ab-42df-a149-3d89967d1f1c" file_name="jackson-module-parameter-names-2.11.0.jar" sha1="950a1e9a7c1093e7ffd92b216d5a0667f1e39058" vulnerabilities="0" max_cvss_score="" version="2.11.0" library="Jackson-module-parameter-names" library_id="maven&#x3a;com.fasterxml.jackson.module&#x3a;jackson-module-parameter-names&#x3a;2.11.0&#x3a;" vendor="com.fasterxml.jackson.module" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;jackson-module-parameter-names-2.11.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="8b4f55d4-ea0b-4115-a79f-41e564717d1e" file_name="jstl-1.2.jar" sha1="74aca283cd4f4b4f3e425f5820cda58f44409547" vulnerabilities="1" max_cvss_score="7.5" version="1.2" library="jstl" library_id="maven&#x3a;javax.servlet&#x3a;jstl&#x3a;1.2&#x3a;" vendor="javax.servlet" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;jstl-1.2.jar"/>
            </file_paths>
            <licenses>
               <license name="Common Development and Distribution License 1.0" spdx_id="CDDL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CDDL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU General Public License v2.0 only" spdx_id="GPL-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2015-0254" cvss_score="7.5" severity="4" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity &#x28;XXE&#x29; attacks via a crafted XSLT extension in a &#x28;1&#x29; &#x3c;x&#x3a;parse&#x3e; or &#x28;2&#x29; &#x3c;x&#x3a;transform&#x3e; JSTL XML tag." severity_desc="High" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="8d83649b-8fe3-40fa-b124-9f9d43bb30b1" file_name="org.ops4j.pax.tipi.tomcat-embed-core-9.0.36.1.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="9.0.36.1" library="org.ops4j.pax.tipi.tomcat-embed-core" library_id="maven&#x3a;org.ops4j.pax.tipi&#x3a;org.ops4j.pax.tipi.tomcat-embed-core&#x3a;9.0.36.1&#x3a;" vendor="org.ops4j.pax.tipi" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-core-9.0.36.jar&#x3a;org.ops4j.pax.tipi.tomcat-embed-core-9.0.36.1.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="8d9a63d8-808b-4233-9e54-279d0f51826f" file_name="log4j-1.2.17.jar" sha1="5af35056b4d257e4b64b9e8069c0746e8b08629f" vulnerabilities="2" max_cvss_score="7.5" version="1.2.17" library="Apache Log4j" library_id="maven&#x3a;log4j&#x3a;log4j&#x3a;1.2.17&#x3a;" vendor="log4j" description="Apache Log4j 1.2" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;log4j-1.2.17.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2019-17571" cvss_score="7.5" severity="4" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="log4j-core is vulnerable to arbitrary code execution. Deserialization of untrusted data in &#x60;TcpSocketServer&#x60; and &#x60;UdpSocketServer&#x60; when listening for log data allows an attacker to execute arbitrary code via a malicious deserialization gadget." severity_desc="High" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2021-4104" cvss_score="6.0" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="JMSAppender in log4j is vulnerable to deserialization of untrusted object. When an application is configured to use JMSAppender with the setting TopicBindingName or TopicConnectionFactoryBindingName to something that JNDI can handle - for example &#x22;ldap&#x3a;&#x2f;&#x2f;host&#x3a;port&#x2f;a&#x22;, an attacker is able to execute code on the server as in Log4j 2.x CVE-2021-44228. However, this vulnerability is only depending on configuration. Note&#x3a; This CVE is for Log4j 1.x and its corresponding flaw information for Log4j 2.x is in CVE-2021-44228." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="8e65d6c5-1044-42a1-9842-107728590261" file_name="org.apache.sling.commons.json-2.0.4-incubator.jar" sha1="19ce406cfe62be665037f5d397b62b4920a41e20" vulnerabilities="0" max_cvss_score="" version="2.0.4-incubator" library="Apache Sling JSON Library" library_id="maven&#x3a;org.apache.sling&#x3a;org.apache.sling.commons.json&#x3a;2.0.4-incubator&#x3a;" vendor="org.apache.sling" description="Apache Sling JSON Library" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;org.apache.sling.commons.json-2.0.4-incubator.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="8fadadf2-48d9-405b-a095-c526be235da2" file_name="spring-boot-starter-2.3.1.RELEASE.jar" sha1="e0d28696fea064578cb01da346232284f922eba4" vulnerabilities="0" max_cvss_score="" version="2.3.1.RELEASE" library="spring-boot-starter" library_id="maven&#x3a;org.springframework.boot&#x3a;spring-boot-starter&#x3a;2.3.1.RELEASE&#x3a;" vendor="org.springframework.boot" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-boot-starter-2.3.1.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="909191b8-ab7f-4944-84bc-39f12b809732" file_name="encoder-1.2.2.jar" sha1="664346e62c3a95e1de5153db231bd283392a9532" vulnerabilities="0" max_cvss_score="" version="1.2.2" library="Java Encoder" library_id="maven&#x3a;org.owasp.encoder&#x3a;encoder&#x3a;1.2.2&#x3a;" vendor="org.owasp.encoder" description="The OWASP Encoders package is a collection of high-performance low-overhead&#xa;        contextual encoders, that when utilized correctly, is an effective tool in&#xa;        preventing Web Application security vulnerabilities such as Cross-Site&#xa;        Scripting." added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;encoder-1.2.2.jar"/>
            </file_paths>
            <licenses>
               <license name="BSD 3-Clause &#x22;New&#x22; or &#x22;Revised&#x22; License" spdx_id="BSD-3-Clause" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;BSD-3-Clause.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="91873e93-df8f-432b-b4eb-69c5ad96b775" file_name="plexus-container-default-1.0-alpha-8.jar" sha1="26fca33e988fb2c4a6688e65a1cd5bab3bb93a64" vulnerabilities="0" max_cvss_score="" version="1.0-alpha-8" library="Plexus &#x3a;&#x3a; Default Container" library_id="maven&#x3a;org.codehaus.plexus&#x3a;plexus-container-default&#x3a;1.0-alpha-8&#x3a;" vendor="org.codehaus.plexus" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;plexus-container-default-1.0-alpha-8.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="92d18e2a-1b13-46df-b9be-de51d4bc6c9e" file_name="commons-logging-1.0.4.jar" sha1="f029a2aefe2b3e1517573c580f948caac31b1056" vulnerabilities="0" max_cvss_score="" version="1.0.4" library="Apache Commons Logging" library_id="maven&#x3a;commons-logging&#x3a;commons-logging&#x3a;1.0.4&#x3a;" vendor="commons-logging" description="Commons Logging is a thin adapter allowing configurable bridging to other,&#xa;    well known logging systems." added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;commons-logging-1.0.4.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="948a145e-813d-4d08-98d3-7795976aec7d" file_name="jackson-datatype-jdk8-2.11.0.jar" sha1="cca91d6375258fd7ff2a6abb7bf91eef492bd606" vulnerabilities="0" max_cvss_score="" version="2.11.0" library="Jackson datatype&#x3a; jdk8" library_id="maven&#x3a;com.fasterxml.jackson.datatype&#x3a;jackson-datatype-jdk8&#x3a;2.11.0&#x3a;" vendor="com.fasterxml.jackson.datatype" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;jackson-datatype-jdk8-2.11.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="97f0fb05-af1a-4a15-bb80-89dc2ac6f707" file_name="org.apache.sling.api-2.0.2-incubator.jar" sha1="b984f6288bb695b49d5eed9e3fcc3d75d5fe5e9f" vulnerabilities="1" max_cvss_score="4.3" version="2.0.2-incubator" library="Apache Sling API" library_id="maven&#x3a;org.apache.sling&#x3a;org.apache.sling.api&#x3a;2.0.2-incubator&#x3a;" vendor="org.apache.sling" description="The Sling API defines an extension to the Servlet API 2.4 to&#xa;        provide access to content and unified access to request&#xa;        parameters hiding the differences between the different methods&#xa;        of transferring parameters from client to server. Note that the&#xa;        Sling API bundle does not include the Servlet API but instead&#xa;        requires the API to be provided by the Servlet container in&#xa;        which the Sling framework is running or by another bundle." added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;org.apache.sling.api-2.0.2-incubator.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2015-2944" cvss_score="4.3" severity="3" cwe_id="CWE-79" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="Multiple cross-site scripting &#x28;XSS&#x29; vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to &#x28;1&#x29; org&#x2f;apache&#x2f;sling&#x2f;api&#x2f;servlets&#x2f;HtmlResponse and &#x28;2&#x29; org&#x2f;apache&#x2f;sling&#x2f;servlets&#x2f;post&#x2f;HtmlResponse." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="994959a9-c6e3-49f0-82c6-c283583e23ba" file_name="tomcat-juli-9.0.37.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="9.0.37" library="tomcat-juli" library_id="maven&#x3a;org.apache.tomcat&#x3a;tomcat-juli&#x3a;9.0.37&#x3a;" vendor="org.apache.tomcat" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-core-9.0.36.jar&#x3a;tomcat-juli-9.0.37.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="9fdb0cb9-3f05-4fb3-b221-cd97bdacc307" file_name="commons-collections4-4.0.jar" sha1="da217367fd25e88df52ba79e47658d4cf928b0d1" vulnerabilities="2" max_cvss_score="7.5" version="4.0" library="Apache Commons Collections" library_id="maven&#x3a;org.apache.commons&#x3a;commons-collections4&#x3a;4.0&#x3a;" vendor="org.apache.commons" description="The Apache Commons Collections package contains types that extend and augment the Java Collections Framework." added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;commons-collections4-4.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2015-4852" cvss_score="7.5" severity="4" cwe_id="CWE-77" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="Apache Commons includes a class called InvokerTransformer. An application is vulnerable to a deserialization attack if this class is available on the classpath and the application deserializes untrusted or user-supplied data. It&#x27;s not necessary to actually use InvokerTransfomer to be vulnerable. With these two criteria satisfied, an attacker may construct a gadget chain using classes in the component to execute arbitrary code. The chain relies on the class InvokerTransformer in the org.apache.commons.collections.functors package to invoke methods during the deserialization process.&#xa;&#xa;The fix prevents deserialization of InvokerTransformer by default unless it&#x27;s specifically enabled.&#xa;&#xa;CVE-2015-4852, CVE-2015-6420, CVE-2015-7501, and CVE-2015-7450 are all related to this artifact." severity_desc="High" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2015-6420" cvss_score="7.5" severity="4" cwe_id="CWE-502" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="Apache Commons Collections &#x28;ACC&#x29; library is vulnerable to arbitrary code execution. The vulnerability is possible because it directly uses ACC, or contains ACC, in the classpath, allowing a malicious user to inject and execute arbitrary code upon deserialization." severity_desc="High" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="a05bbd80-250f-4a54-b4fe-cc8d11957d25" file_name="jbcrypt-0.3m.jar" sha1="fe2d9c5f23767d681a7e38fc8986b812400ec583" vulnerabilities="1" max_cvss_score="5.0" version="0.3m" library="jBCrypt" library_id="maven&#x3a;org.mindrot&#x3a;jbcrypt&#x3a;0.3m&#x3a;" vendor="org.mindrot" description="jBCrypt is a Java implementation of OpenBSD&#x27;s Blowfish password hashing code, as described in A Future-Adaptable Password Scheme by Niels Provos and David Mazi&#xe8;res, by Damien Miller." added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;jbcrypt-0.3m.jar"/>
            </file_paths>
            <licenses>
               <license name="BSD 3-Clause &#x22;New&#x22; or &#x22;Revised&#x22; License" spdx_id="BSD-3-Clause" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;BSD-3-Clause.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="ISC License" spdx_id="ISC" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;ISC.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2015-0886" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="a71a1300-9a17-45dd-81a6-bd4ec5dd18d9" file_name="keycloak-saml-core-1.8.1.Final.jar" sha1="73cebee358d4738326d4540ea496eefa1e5ad05f" vulnerabilities="3" max_cvss_score="6.4" version="1.8.1.Final" library="Keycloak SAML Core" library_id="maven&#x3a;org.keycloak&#x3a;keycloak-saml-core&#x3a;1.8.1.Final&#x3a;" vendor="org.keycloak" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;keycloak-saml-core-1.8.1.Final.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2017-2582" cvss_score="4.0" severity="2" cwe_id="CWE-200" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="keycloak-saml-core is vulnerable to sensitive information disclosure. The attack exists because SAML messages are being parsed by replacing the string to obtain the attribute values with the system property in &#x60;StaxParserUtil&#x60; class. Therefore, attacker can just parse the chosen system property name through the SAML request ID field and can get the response with system property value in &#x60;InResponseTo&#x60; filed ." severity_desc="Low" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2017-2646" cvss_score="5.0" severity="3" cwe_id="CWE-400" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="keycloak-saml-core is vulnerable to denial of service &#x28;DoS&#x29; attacks. The vulnerability exists due to the mishandling of a &#x60;Logout&#x60; request with an &#x60;Extensions&#x60; in the middle of the request." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="SRCCLR-SID-2367" cvss_score="6.4" severity="4" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="Keycloak saml-core is vulnerable to malicious SAML assertion insertion. This vulnerability is due to the fact that the assertions are not verified as signed before being accepted." severity_desc="High" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="af04dc46-3a04-4c38-a0b0-dc438f6d3e53" file_name="org.apache.servicemix.bundles.spring-aop-5.2.7.RELEASE_1.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="5.2.7.RELEASE_1" library="org.apache.servicemix.bundles.spring-aop" library_id="maven&#x3a;org.apache.servicemix.bundles&#x3a;org.apache.servicemix.bundles.spring-aop&#x3a;5.2.7.RELEASE_1&#x3a;" vendor="org.apache.servicemix.bundles" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-aop-5.2.7.RELEASE.jar&#x3a;org.apache.servicemix.bundles.spring-aop-5.2.7.RELEASE_1.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="b2fe525b-676f-4cfb-a9e5-898a840923f3" file_name="spring-webmvc-5.2.7.RELEASE.jar" sha1="dcd97bcb0a2aa33f272b0031e4771134e327d942" vulnerabilities="0" max_cvss_score="" version="5.2.7.RELEASE" library="Spring Web MVC" library_id="maven&#x3a;org.springframework&#x3a;spring-webmvc&#x3a;5.2.7.RELEASE&#x3a;" vendor="org.springframework" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-webmvc-5.2.7.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="b710849d-bda8-4518-a5fb-d73c8554bc7e" file_name="activation-1.1.jar" sha1="e6cb541461c2834bdea3eb920f1884d1eb508b50" vulnerabilities="0" max_cvss_score="" version="1.1" library="JavaBeans&#x28;TM&#x29; Activation Framework" library_id="maven&#x3a;javax.activation&#x3a;activation&#x3a;1.1&#x3a;" vendor="javax.activation" description="JavaBeans Activation Framework &#x28;JAF&#x29; is a standard extension to the Java platform that lets you take advantage of standard services to&#x3a; determine the type of an arbitrary piece of data&#x3b; encapsulate access to it&#x3b; discover the operations available on it&#x3b; and instantiate the appropriate bean to perform the operation&#x28;s&#x29;." added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;activation-1.1.jar"/>
            </file_paths>
            <licenses>
               <license name="Common Development and Distribution License 1.0" spdx_id="CDDL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CDDL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="CeCILL Free Software License Agreement v1.0" spdx_id="CECILL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CECILL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="b9352d09-4d50-4f03-9e6d-3a0209047cc3" file_name="spring-boot-autoconfigure-2.3.1.RELEASE.jar" sha1="6d679d6ba26235a0e81ca1d58f9c1024d9427411" vulnerabilities="0" max_cvss_score="" version="2.3.1.RELEASE" library="spring-boot-autoconfigure" library_id="maven&#x3a;org.springframework.boot&#x3a;spring-boot-autoconfigure&#x3a;2.3.1.RELEASE&#x3a;" vendor="org.springframework.boot" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-boot-autoconfigure-2.3.1.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="b9545edb-70de-4de0-ac0a-022f90ddd1d5" file_name="maven-model-2.0.jar" sha1="fa69aef20d04737d916ea79957ccacc4ff41aa55" vulnerabilities="0" max_cvss_score="" version="2.0" library="Maven Model" library_id="maven&#x3a;org.apache.maven&#x3a;maven-model&#x3a;2.0&#x3a;" vendor="org.apache.maven" description="Maven Model" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;maven-model-2.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="bb0ca070-f19a-40ce-a058-c7f855b56643" file_name="classworlds-1.1-alpha-2.jar" sha1="05adf2e681c57d7f48038b602f3ca2254ee82d47" vulnerabilities="0" max_cvss_score="" version="1.1-alpha-2" library="classworlds" library_id="maven&#x3a;classworlds&#x3a;classworlds&#x3a;1.1-alpha-2&#x3a;" vendor="classworlds" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;classworlds-1.1-alpha-2.jar"/>
            </file_paths>
            <licenses>
               <license name="BSD 4-Clause &#x22;Original&#x22; or &#x22;Old&#x22; License &#x28;BSD-4-Clause&#x29;" spdx_id="BSD-4-Clause" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;BSD-4-Clause.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="MIT License" spdx_id="MIT" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;MIT.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="bf9c6956-425a-45b1-8c48-c6cddbc41cec" file_name="maven-plugin-api-2.0.jar" sha1="163ff2bc46c56d26e37e82a2cd79408c394a01e2" vulnerabilities="0" max_cvss_score="" version="2.0" library="Maven Plugin API" library_id="maven&#x3a;org.apache.maven&#x3a;maven-plugin-api&#x3a;2.0&#x3a;" vendor="org.apache.maven" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;maven-plugin-api-2.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="c08a27c6-e9a8-4a4d-8696-221ff9d1c6be" file_name="tomcat-embed-core-9.0.36.jar" sha1="cf6574dd9c4764e60c548b69da52fc07a5a0a9bd" vulnerabilities="8" max_cvss_score="5.8" version="9.0.36" library="tomcat-embed-core" library_id="maven&#x3a;org.apache.tomcat.embed&#x3a;tomcat-embed-core&#x3a;9.0.36&#x3a;" vendor="org.apache.tomcat.embed" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-core-9.0.36.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2020-13934" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="apache tomcat is vulnerable to denial of service. The HTTP&#x2f;1.1 processor is not released after an upgrade to HTTP&#x2f;2, allowing an attacker to cause a denial of service condition due to an &#x60;OutOfMemoryException&#x60; by sending a large number of upgrade requests." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2020-13943" cvss_score="4.0" severity="2" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="tomcat-coyote is vulnerable to authorization bypass. The vulnerability exists as requests could contain HTTP headers of a previous request rather than the intended headers, if a HTTP&#x2f;2 client has exceeded the agreed maximum number of concurrent streams for a connection." severity_desc="Low" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2020-17527" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="tomcat is vulnerable to denial of service. Re-use of an HTTP request header value from the previous stream received on an HTTP&#x2f;2 connection for the request associated with the subsequent stream would most likely lead to an error and the closure of the HTTP&#x2f;2 connection. It is also possible that information could leak between requests." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2021-24122" cvss_score="4.3" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="apache tomcat is vulnerable to information disclosure. Security constraints can be bypassed to obtain and view JSP source code in certain configurations, when serving resources from a network location using the NTFS file system. The vulnerability is caused by the insufficient validation for the &#x60;&#x3a;&#x60; character in the file path." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2021-25122" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary=" tomcat-coyote is vulnerable to information leakage. When responding to new h2c connection requests, a request mix-up occurs with h2c as the request headers and a limited amount of request body is duplicated from one request to another, resulting in the request being seen by another user." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2021-25329" cvss_score="4.4" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="tomcat9 is vulnerable to remote code execution &#x28;RCE&#x29;. The vulnerability exists through the incomplete fix for CVE-2020-9484, with a configuration edge case that was highly unlikely to be used." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2021-30640" cvss_score="5.8" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="tomcat-catalina is vulnerable to access restriction bypass. Lack of proper sanitization of user provided parameter or configuration data provided by an administrator accept authentication using variations of their user name and&#x2f;or to bypass some of the protection provided by the LockOut Realm.&#xa;&#xa;" severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2021-33037" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="tomcat-coyote is vulnerable request smuggling.  Incorrect way of parsing of the HTTP transfer-encoding request header causes request smuggling when it is used with a reverse proxy and if the client declared it would only accept an HTTP&#x2f;1.0 response." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="c4aa313a-7457-4444-9df3-1bd931ed88d6" file_name="log4j-api-2.13.3.jar" sha1="ec1508160b93d274b1add34419b897bae84c6ca9" vulnerabilities="0" max_cvss_score="" version="2.13.3" library="Apache Log4j API" library_id="maven&#x3a;org.apache.logging.log4j&#x3a;log4j-api&#x3a;2.13.3&#x3a;" vendor="org.apache.logging.log4j" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;log4j-api-2.13.3.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="c7ce22bf-c9d5-4465-9fb7-5aedd8261079" file_name="commons-io-2.4.jar" sha1="b1b6ea3b7e4aa4f492509a4952029cd8e48019ad" vulnerabilities="2" max_cvss_score="5.8" version="2.4" library="Apache Commons IO" library_id="maven&#x3a;commons-io&#x3a;commons-io&#x3a;2.4&#x3a;" vendor="commons-io" description="The Commons IO library contains utility classes, stream implementations, file filters, &#xa;file comparators, endian transformation classes, and much more." added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;commons-io-2.4.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2021-29425" cvss_score="5.8" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="commons-io is vulnerable to directory traversal. Invoking the method &#x60;FileNameUtils.normalize&#x60; with a malicious input string would potentially allow access to files within the parent directory." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="SRCCLR-SID-5295" cvss_score="5.1" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="commons-io is vulnerable to remote code execution &#x28;RCE&#x29; attacks. These attacks are possible because the library doesn&#x27;t restrict the classes which can be accepted when deserializing a binary." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="c8eddd7c-a541-4367-82a3-1ce00d4526b1" file_name="ecj-3.18.0.jar" sha1="4d5d0911b30db24c8eb844702c8adf8e434314ff" vulnerabilities="0" max_cvss_score="" version="3.18.0" library="Eclipse Compiler for Java&#x28;TM&#x29;" library_id="maven&#x3a;org.eclipse.jdt&#x3a;ecj&#x3a;3.18.0&#x3a;" vendor="org.eclipse.jdt" description="Eclipse Compiler for Java&#x28;TM&#x29;" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;ecj-3.18.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Eclipse Public License 2.0" spdx_id="EPL-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;EPL-2.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="c8f4b14a-fd9f-485f-b06b-95ce0e42b6a2" file_name="slf4j-api-1.7.30.jar" sha1="b5a4b6d16ab13e34a88fae84c35cd5d68cac922c" vulnerabilities="0" max_cvss_score="" version="1.7.30" library="SLF4J API Module" library_id="maven&#x3a;org.slf4j&#x3a;slf4j-api&#x3a;1.7.30&#x3a;" vendor="org.slf4j" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;slf4j-api-1.7.30.jar"/>
            </file_paths>
            <licenses>
               <license name="MIT License" spdx_id="MIT" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;MIT.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="c9daab8d-4347-44b0-ae8f-3d9a6060193f" file_name="commons-fileupload-1.3.2.jar" sha1="5d7491ed6ebd02b6a8d2305f8e6b7fe5dbd95f72" vulnerabilities="1" max_cvss_score="7.5" version="1.3.2" library="Apache Commons FileUpload" library_id="maven&#x3a;commons-fileupload&#x3a;commons-fileupload&#x3a;1.3.2&#x3a;" vendor="commons-fileupload" description="The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart&#xa;    file upload functionality to servlets and web applications." added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;commons-fileupload-1.3.2.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2016-1000031" cvss_score="7.5" severity="4" cwe_id="CWE-284" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution" severity_desc="High" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="ca8c30b8-db2a-4378-8700-5c971d4a3257" file_name="jakarta.annotation-api-1.3.5.jar" sha1="59eb84ee0d616332ff44aba065f3888cf002cd2d" vulnerabilities="0" max_cvss_score="" version="1.3.5" library="Jakarta Annotations API" library_id="maven&#x3a;jakarta.annotation&#x3a;jakarta.annotation-api&#x3a;1.3.5&#x3a;" vendor="jakarta.annotation" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;jakarta.annotation-api-1.3.5.jar"/>
            </file_paths>
            <licenses>
               <license name="Eclipse Public License 2.0" spdx_id="EPL-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;EPL-2.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU General Public License with Classpath Exceptions version 2.0" spdx_id="GPL-2.0-with-classpath-exception" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0-with-classpath-exception.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="cf0f4e71-354e-4d78-adb6-4d6155418e16" file_name="commons-codec-1.14.jar" sha1="3cb1181b2141a7e752f5bdc998b7ef1849f726cf" vulnerabilities="0" max_cvss_score="" version="1.14" library="Apache Commons Codec" library_id="maven&#x3a;commons-codec&#x3a;commons-codec&#x3a;1.14&#x3a;" vendor="commons-codec" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;commons-codec-1.14.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="d3d7a9ab-12fd-41a3-a344-7e30c4d07dbd" file_name="maven-archiver-2.0.jar" sha1="e68a6b39a72aa99bab1e28083e400bb72e9a2da3" vulnerabilities="0" max_cvss_score="" version="2.0" library="Apache Maven Archiver" library_id="maven&#x3a;org.apache.maven&#x3a;maven-archiver&#x3a;2.0&#x3a;" vendor="org.apache.maven" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;maven-archiver-2.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="d3ff7550-8371-4531-97c7-c20d70b6e537" file_name="plexus-archiver-1.0-alpha-3.jar" sha1="0f9ac8399aae46521a8d50703e68e1849722580e" vulnerabilities="1" max_cvss_score="4.3" version="1.0-alpha-3" library="Plexus Archiver Component" library_id="maven&#x3a;org.codehaus.plexus&#x3a;plexus-archiver&#x3a;1.0-alpha-3&#x3a;" vendor="org.codehaus.plexus" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;plexus-archiver-1.0-alpha-3.jar"/>
            </file_paths>
            <licenses/>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2018-1002200" cvss_score="4.3" severity="3" cwe_id="CWE-22" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ..&#x2f; &#x28;dot dot slash&#x29; in an archive entry that is mishandled during extraction. This vulnerability is also known as &#x27;Zip-Slip&#x27;." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="d59b6b9c-0c8a-49b4-b4fb-460bde0608e9" file_name="maven-artifact-2.0.jar" sha1="7a8be3d404ff84f3fc329204a5ff42e321e1b1ca" vulnerabilities="0" max_cvss_score="" version="2.0" library="Maven Artifact" library_id="maven&#x3a;org.apache.maven&#x3a;maven-artifact&#x3a;2.0&#x3a;" vendor="org.apache.maven" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;maven-artifact-2.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="d6ad47d1-6990-4a6d-b248-aa8cb1a968c1" file_name="tomcat-websocket-9.0.36.jar" sha1="" vulnerabilities="2" max_cvss_score="5.0" version="9.0.36" library="tomcat-websocket" library_id="maven&#x3a;org.apache.tomcat&#x3a;tomcat-websocket&#x3a;9.0.36&#x3a;" vendor="org.apache.tomcat" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-websocket-9.0.36.jar&#x3a;tomcat-websocket-9.0.36.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2020-13935" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="apache tomcat is vulnerable to denial of service. An infinite loop to occurs when invalid payload lengths are parsed. An attacker is able to cause a denial of service condition in the application via malicious WebSocket frames with invalid payload lengths." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2021-42340" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" cve_summary="tomcat-websocket is vulnerable to denial of service &#x28;DoS&#x29; attacks. An out of memory &#x28;OOM&#x29; occurs as the internal upgrade handler doesn&#x27;t close the associated web connection on destroy causing an application crash. " severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="d7da02ab-ef18-4e19-a9d3-cebc46975778" file_name="jackson-core-2.11.0.jar" sha1="f84302e14648f9f63c0c73951054aeb2ff0b810a" vulnerabilities="0" max_cvss_score="" version="2.11.0" library="Jackson-core" library_id="maven&#x3a;com.fasterxml.jackson.core&#x3a;jackson-core&#x3a;2.11.0&#x3a;" vendor="com.fasterxml.jackson.core" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;jackson-core-2.11.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="da356a8c-2a4f-4ae6-8e3b-6e343832bd2a" file_name="spring-jcl-5.2.7.RELEASE.jar" sha1="72282e1f89c58284632220437b5a1e8066c53d7d" vulnerabilities="0" max_cvss_score="" version="5.2.7.RELEASE" library="Spring Commons Logging Bridge" library_id="maven&#x3a;org.springframework&#x3a;spring-jcl&#x3a;5.2.7.RELEASE&#x3a;" vendor="org.springframework" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-jcl-5.2.7.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="da8ad165-d5a1-4651-9897-d074b84ae47f" file_name="mail-1.4.7.jar" sha1="9add058589d5d85adeb625859bf2c5eeaaedf12d" vulnerabilities="0" max_cvss_score="" version="1.4.7" library="JavaMail API &#x28;compat&#x29;" library_id="maven&#x3a;javax.mail&#x3a;mail&#x3a;1.4.7&#x3a;" vendor="javax.mail" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;mail-1.4.7.jar"/>
            </file_paths>
            <licenses>
               <license name="BSD 3-Clause &#x22;New&#x22; or &#x22;Revised&#x22; License" spdx_id="BSD-3-Clause" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;BSD-3-Clause.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="Common Development and Distribution License 1.0" spdx_id="CDDL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CDDL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="CeCILL Free Software License Agreement v1.0" spdx_id="CECILL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CECILL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="Eclipse Distribution License &#x28;EDL&#x29;" spdx_id="EDL" license_url="https&#x3a;&#x2f;&#x2f;www.eclipse.org&#x2f;org&#x2f;documents&#x2f;edl-v10.php" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="Eclipse Public License 2.0" spdx_id="EPL-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;EPL-2.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU General Public License with Classpath Exceptions version 2.0" spdx_id="GPL-2.0-with-classpath-exception" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0-with-classpath-exception.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="e3dcb8c9-9d7d-4f2c-832c-fb638c4b5761" file_name="spring-boot-starter-logging-2.3.1.RELEASE.jar" sha1="03f242a91ffddf7485fde1367e1354c7e13024c8" vulnerabilities="0" max_cvss_score="" version="2.3.1.RELEASE" library="spring-boot-starter-logging" library_id="maven&#x3a;org.springframework.boot&#x3a;spring-boot-starter-logging&#x3a;2.3.1.RELEASE&#x3a;" vendor="org.springframework.boot" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-boot-starter-logging-2.3.1.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="e4889cf9-7ffc-4de7-b65f-e9a3568b304e" file_name="snakeyaml-1.26.jar" sha1="a78a8747147d2c5807683e76ec2b633e95c14fe9" vulnerabilities="0" max_cvss_score="" version="1.26" library="SnakeYAML" library_id="maven&#x3a;org.yaml&#x3a;snakeyaml&#x3a;1.26&#x3a;" vendor="org.yaml" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;snakeyaml-1.26.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="e5ecc7cd-f1f1-469d-92d5-4a081b2bd69d" file_name="smtp-1.4.7.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="1.4.7" library="Jakarta Mail API smtp provider" library_id="maven&#x3a;com.sun.mail&#x3a;smtp&#x3a;1.4.7&#x3a;" vendor="com.sun.mail" description="" added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;mail-1.4.7.jar&#x3a;smtp-1.4.7.jar"/>
            </file_paths>
            <licenses>
               <license name="Common Development and Distribution License 1.0" spdx_id="CDDL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CDDL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="CeCILL Free Software License Agreement v1.0" spdx_id="CECILL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CECILL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU General Public License v2.0 only" spdx_id="GPL-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="GNU General Public License with Classpath Exceptions version 2.0" spdx_id="GPL-2.0-with-classpath-exception" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;GPL-2.0-with-classpath-exception.html" risk_rating="4" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="e8e5529c-07b3-46e9-a6b3-59a8152b8265" file_name="maven-project-2.0.jar" sha1="ab4f37a40999caefc6cd65863dcacc591572171a" vulnerabilities="0" max_cvss_score="" version="2.0" library="Maven Project Builder" library_id="maven&#x3a;org.apache.maven&#x3a;maven-project&#x3a;2.0&#x3a;" vendor="org.apache.maven" description="This library is used to not only read Maven project object model files, but to assemble inheritence&#xa;    and to retrieve remote models as required." added_date="2021-12-29 22&#x3a;18&#x3a;19 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;maven-project-2.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="ec7cced4-487b-4c4c-b2c0-f6d1fc9a935f" file_name="tomcat-el-api-9.0.36.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="9.0.36" library="tomcat-el-api" library_id="maven&#x3a;org.apache.tomcat&#x3a;tomcat-el-api&#x3a;9.0.36&#x3a;" vendor="org.apache.tomcat" description="" added_date="2021-12-29 22&#x3a;18&#x3a;21 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib-provided&#x2f;tomcat-embed-el-9.0.36.jar&#x3a;tomcat-el-api-9.0.36.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="edd26e9d-0c8f-4e6e-96c3-67603d61499c" file_name="jackson-databind-2.11.0.jar" sha1="8f5aaf3878b0647ff3a16610af53b1a5c05d9f15" vulnerabilities="0" max_cvss_score="" version="2.11.0" library="jackson-databind" library_id="maven&#x3a;com.fasterxml.jackson.core&#x3a;jackson-databind&#x3a;2.11.0&#x3a;" vendor="com.fasterxml.jackson.core" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;jackson-databind-2.11.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="ee9b8868-dd77-47d1-8019-7b21861a87f4" file_name="spring-web-5.2.7.RELEASE.jar" sha1="050a27c77e1731f3b7af5c2ae7caf6fe59bcc309" vulnerabilities="2" max_cvss_score="4.6" version="5.2.7.RELEASE" library="Spring Web" library_id="maven&#x3a;org.springframework&#x3a;spring-web&#x3a;5.2.7.RELEASE&#x3a;" vendor="org.springframework" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-web-5.2.7.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2020-5421" cvss_score="3.6" severity="2" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="spring-web is vulnerable to Reflected File Download &#x28;RFD&#x29; attack. An incomplete fix of CVE-2015-5211 allows an attacker to bypass the protection against RFD attack via the &#x60;jsessionid&#x60; path parameter.&#xa;&#xa;" severity_desc="Low" mitigation="false" vulnerability_affects_policy_compliance="false"/>
               <vulnerability cve_id="CVE-2021-22118" cvss_score="4.6" severity="3" cwe_id="" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="spring-web is vulnerable to privilege escalation. Creating or recreating the temporary storage directory creates multiple instances collision which allows a locally authenticated malicious user to read or modify files being uploaded or overwrite arbitrary files with multipart request data." severity_desc="Medium" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="eebcd29b-5d6b-4c58-b15b-897448f67f4f" file_name="plexus-utils-1.0.4.jar" sha1="60783e4623f2e44063cf2d43d9fbacb2816855c2" vulnerabilities="1" max_cvss_score="7.5" version="1.0.4" library="Plexus Common Utilities" library_id="maven&#x3a;org.codehaus.plexus&#x3a;plexus-utils&#x3a;1.0.4&#x3a;" vendor="org.codehaus.plexus" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;plexus-utils-1.0.4.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 1.1" spdx_id="Apache-1.1" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-1.1.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities>
               <vulnerability cve_id="CVE-2017-1000487" cvss_score="7.5" severity="4" cwe_id="CWE-77" first_found_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" cve_summary="Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings." severity_desc="High" mitigation="false" vulnerability_affects_policy_compliance="false"/>
            </vulnerabilities>
            <violated_policy_rules/>
         </component>
         <component component_id="f4bb26b8-67cb-4128-86a9-cadd07bf9ef6" file_name="javax.activation-api-1.2.0.jar" sha1="85262acf3ca9816f9537ca47d5adeabaead7cb16" vulnerabilities="0" max_cvss_score="" version="1.2.0" library="JavaBeans Activation Framework API jar" library_id="maven&#x3a;javax.activation&#x3a;javax.activation-api&#x3a;1.2.0&#x3a;" vendor="javax.activation" description="" added_date="2021-12-29 22&#x3a;18&#x3a;21 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;javax.activation-api-1.2.0.jar"/>
            </file_paths>
            <licenses>
               <license name="Common Development and Distribution License 1.0" spdx_id="CDDL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CDDL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
               <license name="CeCILL Free Software License Agreement v1.0" spdx_id="CECILL-1.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;CECILL-1.0.html" risk_rating="3" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="f5eb3ae0-bbc8-422a-a186-1f6575c4af6a" file_name="wagon-provider-api-1.0-alpha-5.jar" sha1="30d03be3128389dae0419701b1cb4b3034e1cabc" vulnerabilities="0" max_cvss_score="" version="1.0-alpha-5" library="Apache Maven Wagon &#x3a;&#x3a; API" library_id="maven&#x3a;org.apache.maven.wagon&#x3a;wagon-provider-api&#x3a;1.0-alpha-5&#x3a;" vendor="org.apache.maven.wagon" description="Tools to manage artifacts and deployment" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;wagon-provider-api-1.0-alpha-5.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="f617d7be-e92d-42f9-8cfd-2ce03ad8a7e2" file_name="spring-expression-5.2.7.RELEASE.jar" sha1="c98d7b10f959f9bedfbbbd4d723cf7a1f17a1f71" vulnerabilities="0" max_cvss_score="" version="5.2.7.RELEASE" library="Spring Expression Language &#x28;SpEL&#x29;" library_id="maven&#x3a;org.springframework&#x3a;spring-expression&#x3a;5.2.7.RELEASE&#x3a;" vendor="org.springframework" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-expression-5.2.7.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="fb8e54c1-dd82-4897-87dc-2c4ac4f4830f" file_name="spring-aop-5.2.7.RELEASE.jar" sha1="9cf69f8e888091684c05f0a287bb638502e90725" vulnerabilities="0" max_cvss_score="" version="5.2.7.RELEASE" library="Spring AOP" library_id="maven&#x3a;org.springframework&#x3a;spring-aop&#x3a;5.2.7.RELEASE&#x3a;" vendor="org.springframework" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-aop-5.2.7.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="fcd10677-f7e1-4a35-874b-e2b5c1475400" file_name="spring-boot-loader-2.3.1.RELEASE.jar" sha1="" vulnerabilities="0" max_cvss_score="" version="2.3.1.RELEASE" library="spring-boot-loader" library_id="maven&#x3a;org.springframework.boot&#x3a;spring-boot-loader&#x3a;2.3.1.RELEASE&#x3a;" vendor="org.springframework.boot" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x3a;spring-boot-loader-2.3.1.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
         <component component_id="fe7a7b24-afac-44ca-b650-54ef440328d7" file_name="spring-context-5.2.7.RELEASE.jar" sha1="7fd9c4ea311a5d9ab92770be7fc93cc53db334f9" vulnerabilities="0" max_cvss_score="" version="5.2.7.RELEASE" library="Spring Context" library_id="maven&#x3a;org.springframework&#x3a;spring-context&#x3a;5.2.7.RELEASE&#x3a;" vendor="org.springframework" description="" added_date="2021-12-29 22&#x3a;18&#x3a;20 UTC" component_affects_policy_compliance="false">
            <file_paths>
               <file_path value="verademo.war&#x23;zip&#x3a;WEB-INF&#x2f;lib&#x2f;spring-context-5.2.7.RELEASE.jar"/>
            </file_paths>
            <licenses>
               <license name="Apache License 2.0" spdx_id="Apache-2.0" license_url="https&#x3a;&#x2f;&#x2f;spdx.org&#x2f;licenses&#x2f;Apache-2.0.html" risk_rating="2" mitigation="false" license_affects_policy_compliance="false"/>
            </licenses>
            <vulnerabilities/>
            <violated_policy_rules/>
         </component>
      </vulnerable_components>
   </software_composition_analysis>
</detailedreport>
