29 questions
0
votes
0
answers
54
views
Generate OWASP Dependency Report as HTML and JSON inside Jenkins pipeline using Kotlin pom.xml profile
I want to generate artifacts of type HTML and JSON for Jenkins.
I now only generate HTML reports.
My end goal is to check the JSON report for any issues and make the build UNSTABLE if there are any ...
- 1,422
0
votes
1
answer
58
views
I’m not sure how to configure the OWASP plugin in Jenkins
In Jenkins, I'm using the OWASP plugin, but I keep getting the error: ERROR: Couldn’t find any executable in 'null'.
stage('Dependency-Check') {
steps {
dir("${...
- 1
0
votes
1
answer
200
views
dependency check or CycloneDX with dependency tracker
We are setting up our CI/CD pipelines, and thinking about what we can do for the dependencies we use.
I haven't used any of the software mentioned so I am a bit lost and would appreciate some help.
...
- 1,082
2
votes
2
answers
4k
views
OWASP Dependency Check Maven Plugin
I'm trying to use the dependency-check-maven plugin, but I always get stuck in the updateof the NVD database. This is my easy set up:
<plugin>
<groupId>org.owasp</groupId>
<...
- 41
0
votes
1
answer
289
views
settings.xml when running owasp dependency check from CLI
If I run the tool from CLI to check a pom.xml file, how can I specify the location of settings.xml file (~/.m2/settings.xml)? I have two different private maven repositories specified in there to get ...
- 21.5k
1
vote
1
answer
625
views
Jenkins OWASP dependency-check-plugin unsupported xml
After the CVSS v4.0 is added to NVD Jenkins dependency-check-plugin cannot parse xml output of OWASP dependency-check in version 10.0.1.
Error:
[Pipeline] dependencyCheckPublisher
[DependencyCheck] ...
- 38
0
votes
0
answers
156
views
Why am I getting a build failure for this Maven build?
I keep getting this message while trying to run a maven dependency check in the Eclipse IDE.BUILD FAILURE "ERROR The goal you specified requires a project to execute but there is no POM in this ...
1
vote
1
answer
142
views
Writing exclude configs for dependancy check
I am using https://github.com/dependency-check/dependency-check-gradle in my Android project.
Where I want to exclude these dependencies
ant-1.10.9.jar (pkg:maven/org.apache.ant/[email protected], cpe:2.3:a:...
0
votes
1
answer
756
views
Problem with JSON-Report-Mapping with OWASP dependency-check-gradle plugin and Sonarqube
I am using OWASP dependency-check-gradle plugin version 8.4.0 https://plugins.gradle.org/plugin/org.owasp.dependencycheck
sonar-scanner-gradle version 4.3.1.3277
sonar-scanner-gradle version = ?
https:...
- 979
1
vote
1
answer
1k
views
How to manage vulnerabilities in a maven project?
I created a Jenkins pipeline that performs a daily vulnerability check (I'm using OWASP Dependency-Check) of my Java projects (Maven and Spring Boot).
It often happens that vulnerabilities are ...
- 376
1
vote
1
answer
1k
views
disable org.owasp dependency-check-maven upon mvn clean install but enable during mvn clean site
I want to avoid running org.owasp dependency-check-maven when I run mvn clean install. On the other hand, I would like it to run on mvn clean site.
In my pom file, I have this code:
<plugin>
...
- 5,418
2
votes
0
answers
355
views
Should I ignore node_modules when using OWASP dependency-check?
I'm currently using the OWASP dependency check tools in order to find vulnerabilities in my Angular application.
When reading blog posts about this, I noticed that people usually exclude the ...
- 5,986
3
votes
0
answers
632
views
OWASP Dependency check suppress doesn't work
I am trying to use owasp dependency check in gitlab-ci job using latest owasp docker image.
Dependency check works well, but when I tried to add suppress xml file, it doesn't work - it doesn't ...
- 31
0
votes
1
answer
403
views
Dependency-Check Offline Issue (mvn -o)
I am currently facing a challenge with running the Dependency-Check plugin in offline mode using "mvn -o."
Although I have mirrored all external resources locally, I encounter an issue that ...
0
votes
1
answer
833
views
Can't see CVEs (vulnerabilities) on Sonar UI under Project>Issues. Used to see them in the past. Has anything changed?
We're using a combination of Jenkins and Sonar Plugin of OWASP DependencyCheck https://owasp.org/www-project-dependency-check/. The reports in HTML and JSON getting generated during pipeline build in ...
- 465