| 3 | | I was looking at downloading non-svn jar files and processing them to find any vulnerabilities. Some tools use the pom.xml files to parse dependencies quickly. I can use the [https://owasp.org/www-project-dependency-check/ OWASP dependency checker], which seems to check the actual file content. |
| | 3 | I was looking at downloading non-svn jar files and processing them to find any vulnerabilities. Some tools use the pom.xml files to parse dependencies quickly. ~~I can use the [https://owasp.org/www-project-dependency-check/ OWASP dependency checker], which seems to check the actual file content.~~ |
| | 4 | |
| | 5 | EDIT: It looks like the OWASP dependency checkers detects the usage of packages, but does not know the version. So it isn't very helpful without the pom files. |
