Checking analysis of application shiftleft-java-demo against 3 build rules.

Using sl version 0.9.2671 (6bd25dd47adfc0fc138e9001a8e33a395eb0c135).

Checking findings on scan 2.

Results per rule:

• Allow no critical findings: FAIL
  (52 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	CVE	Title
  198	10.0	critical	CVE-2018-14721	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to b…
  477	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  483	10.0	critical	GMS-2022-558	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-beans.
  492	10.0	critical	GMS-2022-560	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework.boot:spring-boot-starter-web.
  144	9.8	critical	CVE-2017-5929	QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderCli…

  Severity rating	Count
  Critical	52
  High	0
  Medium	0
  Low	0

  Finding Type	Count
  Oss_vuln	43
  Container	7
  Vuln	2

• Allow one OSS or container finding: FAIL
  (255 matched vulnerabilities; configured threshold is 1).

  First 5 findings:

  ID	CVSS	Rating	CVE	Title
  198	10.0	critical	CVE-2018-14721	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to b…
  477	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  483	10.0	critical	GMS-2022-558	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-beans.
  492	10.0	critical	GMS-2022-560	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework.boot:spring-boot-starter-web.
  144	9.8	critical	CVE-2017-5929	QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderCli…

  Severity rating	Count
  Critical	50
  High	130
  Medium	71
  Low	4

  Finding Type	Count
  Oss_vuln	188
  Container	67

• Allow no reachable OSS vulnerability: FAIL
  (74 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	CVE	Title
  477	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  395	9.8	critical	CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insec…
  404	9.8	critical	CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as ha…
  407	9.8	critical	CVE-2017-5651	In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing.…
  448	9.8	critical	CVE-2016-1000027	Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. De…

  Severity rating	Count
  Critical	8
  High	34
  Medium	31
  Low	1

3 rules failed.