Checking analysis of application shiftleft-java-demo against 3 build rules.

Using sl version 0.9.1621 (46e03afbe21c55bff9cfdc23f2c84040ef42dab6).

Checking findings on scan 1.

Results per rule:

• Allow no critical findings: FAIL
  (44 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	CVE	Title
  15	10.0	critical	GMS-2022-560	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework.boot:spring-boot-starter-web.
  149	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  154	10.0	critical	GMS-2022-558	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-beans.
  164	10.0	critical	CVE-2018-14721	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to b…
  13	9.8	critical	CVE-2022-22965	Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as Spring4Shell.

  Severity rating	Count
  Critical	44
  High	0
  Medium	0
  Low	0

  Finding Type	Count
  Oss_vuln	41
  Vuln	3

  Category	Count
  Directory Traversal	2
  Remote Code Execution	1

  OWASP 2021 Category	Count
  A01-Broken-Access-Control	2
  A03-Injection	1

• Allow one OSS or container finding: FAIL
  (143 matched vulnerabilities; configured threshold is 1).

  First 5 findings:

  ID	CVSS	Rating	CVE	Title
  15	10.0	critical	GMS-2022-560	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework.boot:spring-boot-starter-web.
  149	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  154	10.0	critical	GMS-2022-558	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-beans.
  164	10.0	critical	CVE-2018-14721	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to b…
  13	9.8	critical	CVE-2022-22965	Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as Spring4Shell.

  Severity rating	Count
  Critical	41
  High	61
  Medium	39
  Low	2

• Allow no reachable OSS vulnerability: FAIL
  (50 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	CVE	Title
  149	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  61	9.8	critical	CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as havin…
  73	9.8	critical	CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure…
  95	9.8	critical	CVE-2017-5651	The refactoring of the HTTP connectors introduced a regression in the send file processing. If the file processing completed quickly, it is possible for t…
  138	9.8	critical	CVE-2018-1270	Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over Web…

  Severity rating	Count
  Critical	7
  High	22
  Medium	20
  Low	1

3 rules failed.