Bump commons-io:commons-io from 2.6 to 2.14.0

[dependabot]

Bumps commons-io:commons-io from 2.6 to 2.14.0.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[nirw]

Checkmarx One – Scan Summary & Details – c73199c1-e5f8-44d9-8c46-0f105cf93259

New Issues (75)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2022-42920	Maven-org.apache.bcel:bcel-6.3	details Recommended version: 6.6.0 Description: Apache Commons BCEL versions prior to 6.6.0-RC1 has a number of APIs that would normally only allow changing specific class characteristics. Howeve... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
	Expression_Language_Injection_SPEL	/findsecbugs-samples-jsp/src/test/webapp/spring/spring_eval_2.jsp: 17	details The user input provided in ""lang"" at line 17 is inserted into a string, which is evaluated as an expression language statement by eval in /findse... Attack Vector
	Expression_Language_Injection_SPEL	/findsecbugs-samples-jsp/src/test/webapp/spring/spring_eval_4_safe.jsp: 17	details The user input provided in value at line 17 is inserted into a string, which is evaluated as an expression language statement by eval in /findsecbu... Attack Vector
	CVE-2023-6378	Maven-ch.qos.logback:logback-core-1.2.3	details Recommended version: 1.3.15 Description: A serialization vulnerability in logback receiver component part of logback versions prior to 1.2.13, 1.3.x prior to 1.3.12, and 1.4.x prior to 1.4... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
	CVE-2023-6378	Maven-ch.qos.logback:logback-classic-1.2.3	details Recommended version: 1.3.15 Description: A serialization vulnerability in logback receiver component part of logback versions prior to 1.2.13, 1.3.x prior to 1.3.12, and 1.4.x prior to 1.4... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
	CVE-2023-6481	Maven-ch.qos.logback:logback-core-1.2.3	details Recommended version: 1.3.15 Description: A serialization vulnerability in logback receiver component part of logback versions through 1.2.12, 1.3.x through 1.3.13, and 1.4.x through 1.4.13... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
	Deserialization_of_Untrusted_Data	/findsecbugs-samples-java/src/test/java/testcode/xmldecoder/XmlDecodeUtil.java: 21	details The serialized object getResourceAsStream processed in main in the file /findsecbugs-samples-java/src/test/java/testcode/xmldecoder/XmlDecodeUtil.j... Attack Vector
	Reflected_XSS	/findsecbugs-samples-jsp/src/test/webapp/jstl/jstl_expression_secure.jsp: 5	details The method jstl_expression_secure embeds untrusted data in generated output with forHtmlContent, at line 5 of /findsecbugs-samples-jsp/src/test/web... Attack Vector
	Reflected_XSS	/findsecbugs-samples-jsp/src/test/webapp/jstl/jstl_escape_3.jsp: 3	details The method jstl_escape_3 embeds untrusted data in generated output with _ViewOutput, at line 3 of /findsecbugs-samples-jsp/src/test/webapp/jstl/jst... Attack Vector
	Reflected_XSS	/findsecbugs-samples-jsp/src/test/webapp/jstl/jstl_expression_secure.jsp: 11	details The method jstl_expression_secure embeds untrusted data in generated output with getContextPath, at line 11 of /findsecbugs-samples-jsp/src/test/we... Attack Vector
	Reflected_XSS	/findsecbugs-samples-jsp/src/test/webapp/includes/jsp_include_1.jsp: 4	details The method jsp_include_1 embeds untrusted data in generated output with getParameter, at line 4 of /findsecbugs-samples-jsp/src/test/webapp/include... Attack Vector
	Reflected_XSS	/findsecbugs-samples-java/src/test/java/testcode/spring/SpringUnvalidatedRedirectController.java: 37	details The method redirect5 embeds untrusted data in generated output with view, at line 39 of /findsecbugs-samples-java/src/test/java/testcode/spring/Spr... Attack Vector
	CVE-2022-24329	Maven-org.jetbrains.kotlin:kotlin-stdlib-1.2.51	details Recommended version: 1.6.0 Description: In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
	CVE-2024-12798	Maven-ch.qos.logback:logback-core-1.2.3	details Recommended version: 1.3.15 Description: Arbitrary Code Execution vulnerability in "JaninoEventEvaluator" by QOS.CH logback in Java applications, allows attackers to execute arbitrary code... Attack Vector: LOCAL Attack Complexity: LOW Vulnerable Package
	CVE-2024-12798	Maven-ch.qos.logback:logback-classic-1.2.3	details Recommended version: 1.3.15 Description: Arbitrary Code Execution vulnerability in "JaninoEventEvaluator" by QOS.CH logback in Java applications, allows attackers to execute arbitrary code... Attack Vector: LOCAL Attack Complexity: LOW Vulnerable Package
	Hardcoded_AWS_Credentials	/findsecbugs-samples-java/src/test/java/testcode/AwsQueryInjection.java: 18	details AWS credentials are hardcoded in ""test"", in the file /findsecbugs-samples-java/src/test/java/testcode/AwsQueryInjection.java at line 18. Attack Vector
	Hardcoded_AWS_Credentials	/findsecbugs-samples-java/src/test/java/testcode/AwsQueryInjection.java: 18	details AWS credentials are hardcoded in ""test"", in the file /findsecbugs-samples-java/src/test/java/testcode/AwsQueryInjection.java at line 18. Attack Vector
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/transformerfactory/TransformerFactoryVulnerable.java: 23	details The parseXMLdefaultValue loads and parses XML using transform, at line 53 of /findsecbugs-samples-java/src/test/java/testcode/xxe/transformerfactor... Attack Vector
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xsl/StdXmlTransform.java: 33	details The xslt2UnsafeResource loads and parses XML using transform, at line 37 of /findsecbugs-samples-java/src/test/java/testcode/xsl/StdXmlTransform.ja... Attack Vector
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/saml/XmlIgnoreCommentsSaxParser.java: 28	details The receiveXMLStream loads and parses XML using parse, at line 22 of /findsecbugs-samples-java/src/test/java/testcode/saml/XmlIgnoreCommentsSaxPars... Attack Vector
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/xmlinputfactory/XMLStreamReaderVulnerable.java: 16	details The parseXMLwithWrongFlag loads and parses XML using createXMLStreamReader, at line 40 of /findsecbugs-samples-java/src/test/java/testcode/xxe/xmli... Attack Vector
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/xmlinputfactory/XMLEventReaderVulnerable.java: 17	details The parseFile loads and parses XML using createXMLEventReader, at line 22 of /findsecbugs-samples-java/src/test/java/testcode/xxe/xmlinputfactory/X... Attack Vector
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xpath/XmlUtils.java: 21	details The loadDoc loads and parses XML using parse, at line 22 of /findsecbugs-samples-java/src/test/java/testcode/xpath/XmlUtils.java. This XML was rec... Attack Vector
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/xpathexpression/XPathExpressionVulnerable.java: 68	details The unsafe1 loads and parses XML using parse, at line 38 of /findsecbugs-samples-java/src/test/java/testcode/xxe/xpathexpression/XPathExpressionVul... Attack Vector
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/xpathexpression/XPathExpressionSafe.java: 49	details The main2 loads and parses XML using parse, at line 45 of /findsecbugs-samples-java/src/test/java/testcode/xxe/xpathexpression/XPathExpressionSafe.... Attack Vector
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-plugin/src/test/java/com/h3xstream/findsecbugs/MetadataFilesValidationTest.java: 129	details The iterateDocNode loads and parses XML using parse, at line 129 of /findsecbugs-plugin/src/test/java/com/h3xstream/findsecbugs/MetadataFilesValida... Attack Vector
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/saml/XmlIgnoreCommentsDocumentParser.java: 25	details The main loads and parses XML using parse, at line 25 of /findsecbugs-samples-java/src/test/java/testcode/saml/XmlIgnoreCommentsDocumentParser.java... Attack Vector
	Open_Redirect	/findsecbugs-samples-java/src/test/java/testcode/spring/SpringUnvalidatedRedirectController.java: 12	details The potentially tainted value provided by url in /findsecbugs-samples-java/src/test/java/testcode/spring/SpringUnvalidatedRedirectController.java a... Attack Vector
	Open_Redirect	/findsecbugs-samples-java/src/test/java/testcode/spring/SpringUnvalidatedRedirectController.java: 23	details The potentially tainted value provided by url in /findsecbugs-samples-java/src/test/java/testcode/spring/SpringUnvalidatedRedirectController.java a... Attack Vector
	Relative_Path_Traversal	/findsecbugs-samples-java/src/test/java/testcode/file/FileDisclosure.java: 54	details Method doGet2 at line 54 of /findsecbugs-samples-java/src/test/java/testcode/file/FileDisclosure.java gets dynamic data from the ""jspFile"" elemen... Attack Vector
	Relative_Path_Traversal	/findsecbugs-samples-java/src/test/java/testcode/file/FileDisclosure.java: 54	details Method doGet2 at line 54 of /findsecbugs-samples-java/src/test/java/testcode/file/FileDisclosure.java gets dynamic data from the ""jspFile"" elemen... Attack Vector
	Relative_Path_Traversal	/findsecbugs-plugin/src/test/java/com/h3xstream/findsecbugs/injection/SinkFilesValidationTest.java: 44	details Method validateSinks at line 44 of /findsecbugs-plugin/src/test/java/com/h3xstream/findsecbugs/injection/SinkFilesValidationTest.java gets dynamic ... Attack Vector
	SSL_Verification_Bypass	/findsecbugs-samples-java/src/test/java/testcode/crypto/ssldisabler/AllHosts.java: 8	details /findsecbugs-samples-java/src/test/java/testcode/crypto/ssldisabler/AllHosts.java relies HTTPS requests, in verify. The true parameter, at line 8, ... Attack Vector
	SSL_Verification_Bypass	/findsecbugs-samples-java/src/test/java/testcode/trustmanager/WeakTrustManager.java: 46	details /findsecbugs-samples-java/src/test/java/testcode/trustmanager/WeakTrustManager.java relies HTTPS requests, in getAcceptedIssuers. The null paramete... Attack Vector
	SSL_Verification_Bypass	/findsecbugs-samples-java/src/test/java/testcode/crypto/ssldisabler/TrustAllManager.java: 18	details /findsecbugs-samples-java/src/test/java/testcode/crypto/ssldisabler/TrustAllManager.java relies HTTPS requests, in getAcceptedIssuers. The null par... Attack Vector

More results are available on the CxOne platform

Fixed Issues (77)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	Command_Injection	/findsecbugs-samples-java/src/test/java/testcode/command/CommandInjection.java: 16
	Command_Injection	/findsecbugs-samples-java/src/test/java/testcode/command/CommandInjection.java: 16
	Command_Injection	/findsecbugs-samples-java/src/test/java/testcode/command/CommandInjection.java: 16
	Command_Injection	/findsecbugs-samples-java/src/test/java/testcode/command/CommandInjection.java: 16
	Command_Injection	/findsecbugs-samples-java/src/test/java/testcode/command/CommandInjection.java: 16
	Command_Injection	/findsecbugs-samples-java/src/test/java/testcode/command/CommandInjection.java: 16
	LDAP_Injection	/findsecbugs-samples-java/src/test/java/testcode/ldap/JndiLdapSpecial.java: 8
	Reflected_XSS_All_Clients	/findsecbugs-samples-java/src/test/java/testcode/xss/servlets/XssServlet3.java: 18
	Reflected_XSS_All_Clients	/findsecbugs-samples-java/src/test/java/testcode/xss/portlets/XssIbmPortlet.java: 24
	Reflected_XSS_All_Clients	/findsecbugs-samples-java/src/test/java/testcode/xss/portlets/XssPortlet.java: 23
	Reflected_XSS_All_Clients	/findsecbugs-samples-java/src/test/java/testcode/cookie/UrlRewriting.java: 13
	Reflected_XSS_All_Clients	/findsecbugs-samples-jsp/src/test/webapp/jstl/jstl_escape_3.jsp: 3
	SQL_Injection	/findsecbugs-samples-java/src/test/java/testcode/taint/JaxRsAnnotatedController.java: 23
	XPath_Injection	/findsecbugs-samples-java/src/test/java/testcode/xpath/XPathJavax.java: 10
	XPath_Injection	/findsecbugs-samples-java/src/test/java/testcode/xpath/XPathJavax.java: 10
	Absolute_Path_Traversal	/findsecbugs-samples-java/src/test/java/testcode/pathtraversal/PathTraversal.java: 15
	Absolute_Path_Traversal	/findsecbugs-samples-java/src/test/java/testcode/pathtraversal/PathTraversal.java: 15
	Absolute_Path_Traversal	/findsecbugs-samples-java/src/test/java/testcode/pathtraversal/PathTraversal.java: 15
	Absolute_Path_Traversal	/findsecbugs-samples-java/src/test/java/testcode/pathtraversal/PathTraversal.java: 15
	Absolute_Path_Traversal	/findsecbugs-samples-java/src/test/java/testcode/pathtraversal/PathTraversal.java: 15
	Absolute_Path_Traversal	/findsecbugs-samples-java/src/test/java/testcode/pathtraversal/PathTraversal.java: 15
	Absolute_Path_Traversal	/findsecbugs-samples-java/src/test/java/testcode/pathtraversal/PathTraversal.java: 15
	Absolute_Path_Traversal	/findsecbugs-samples-java/src/test/java/testcode/pathtraversal/PathTraversal.java: 15
	Absolute_Path_Traversal	/findsecbugs-samples-java/src/test/java/testcode/pathtraversal/PathTraversal.java: 15
	CVE-2007-2379	Npm-jquery-3.5.1
	CVE-2014-6071	Npm-jquery-3.5.1
	CVE-2018-14040	Npm-bootstrap-4.1.1
	CVE-2018-14041	Npm-bootstrap-4.1.1
	CVE-2018-14042	Npm-bootstrap-4.1.1
	CVE-2019-8331	Npm-bootstrap-4.1.1
	CVE-2021-29425	Maven-commons-io:commons-io-2.6
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xsl/StdXmlTransform.java: 71
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xsl/StdXmlTransform.java: 53
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/DocumentBuilderSafeProperty.java: 18
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/DocumentBuilderSafeProperty.java: 18
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/DocumentBuilderSafeProperty.java: 18
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/DocumentBuilderSafeProperty.java: 18
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/DocumentBuilderSafeProperty.java: 18
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/DocumentBuilderSafeProperty.java: 18
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/DocumentBuilderSafeProperty.java: 18
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/SaxParserSafeProperty.java: 15
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/SaxParserSafeProperty.java: 15
	Improper_Restriction_of_Stored_XXE_Ref	/findsecbugs-samples-java/src/test/java/testcode/xxe/SaxParserSafeProperty.java: 15
	Unchecked_Input_for_Loop_Condition	/findsecbugs-samples-java/src/test/java/testcode/xpath/XPathApacheXPathApi.java: 12
	Unchecked_Input_for_Loop_Condition	/findsecbugs-test-util/src/test/java/com/h3xstream/findbugs/test/jsp/SmapParser.java: 84
	Unchecked_Input_for_Loop_Condition	/findsecbugs-test-util/src/test/java/com/h3xstream/findbugs/test/jsp/SmapParser.java: 84
	Client_Hardcoded_Domain	/website/templates/social.htm: 2
	Client_Hardcoded_Domain	/website/templates/common_footer.htm: 35
	Client_Hardcoded_Domain	/website/templates/common_footer.htm: 35
	Client_Hardcoded_Domain	/website/templates/social.htm: 21
	Heap_Inspection	/findsecbugs-samples-java/src/test/java/testcode/crypto/iv/SafeApacheCamelCipherPair.java: 26
	Heap_Inspection	/findsecbugs-plugin/src/main/java/com/h3xstream/findsecbugs/crypto/CipherWithNoIntegrityDetector.java: 82
	Heap_Inspection	/findsecbugs-samples-java/src/test/java/testcode/crypto/NullCipherUse.java: 33
	Log_Forging	/findsecbugs-samples-java/src/test/java/testcode/Logging.java: 12
	Log_Forging	/findsecbugs-samples-java/src/test/java/testcode/struts1/StrutsV1Action.java: 17
	Log_Forging	/findsecbugs-samples-java/src/test/java/testcode/struts1/StrutsV1Action.java: 22
	Trust_Boundary_Violation_in_Session_Variables	/findsecbugs-samples-jsp/src/test/webapp/spring/spring_eval_1.jsp: 10
	Unsafe_Use_Of_Target_blank	/website/templates/tutorials.htm: 39
	Unsafe_Use_Of_Target_blank	/website/templates/tutorials.htm: 36
	Unsafe_Use_Of_Target_blank	/website/templates/tutorials.htm: 35
	Unsafe_Use_Of_Target_blank	/website/templates/tutorials.htm: 34
	Unsafe_Use_Of_Target_blank	/website/templates/tutorials.htm: 33
	Unsafe_Use_Of_Target_blank	/website/templates/tutorials.htm: 32
	Unsafe_Use_Of_Target_blank	/website/templates/tutorials.htm: 31
	Unsafe_Use_Of_Target_blank	/website/templates/tutorials.htm: 23
	Unsafe_Use_Of_Target_blank	/website/templates/tutorials.htm: 21
	Unsafe_Use_Of_Target_blank	/website/templates/tutorials.htm: 17
	Unsafe_Use_Of_Target_blank	/website/templates/tutorials.htm: 16

More results are available on the CxOne platform