...
Overall Information on Components
- Number of components by language
- Number of components by Security Risk level (High, Medium, Low and None)
- Alerts :
- Components with High Security Risk
- Components being used with different versions that might be cause conflicts
- Etc.
...
- Component name and description
- Used version(s)
- Its filename (i.e. physical container) (.jar, .dll, .js, etc)
- Programming language
- Obsolescence risk (see XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
- License risk (see XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
- Security risk (see XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
Security risk
Info | ||
---|---|---|
| ||
A component’s Security Risk is based on CVSS v2 Base Scores (Severities) of its vulnerabilities:
|
...
- Description of the component
- License of the component
- Found vulnerabilities of the selected component:
- CVE identifier, and link to NIST National Vulnerability Database desc page
- CWE type, and link to MITRE Common Weakness Enumeration desc page
- Vulnerability description
- Severity (more on this at XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
Duplicated components
...
Below example shows that the analyzed application is incorporating two different version of ZKoss common library: 8.0.1 and 6.0.0
Most probably, this component duplication is not intended, and it’s something that would produce maintainability headaches when upgrading to a newer version of the library.
...