Base
Hardened build
minimal ports, security patches applied at build time
OWASP Dependency-Check on Ubuntu 24.04 LTS
Azure
Security
OWASP Dependency-Check, the open source software composition analysis scanner that finds publicly disclosed vulnerabilities in the third party dependencies your projects rely on.
Overview
OWASP Dependency-Check is the OWASP Foundation's software composition analysis (SCA) tool. It scans an application's third party dependencies, identifies the libraries actually in use, and reports the publicly disclosed vulnerabilities (CVEs) associated with them by matching against the National Vulnerability Database. It understands Java, .NET, JavaScript and Node, Python, Ruby, PHP, Go and more, and produces HTML, JSON, XML, CSV, SARIF and JUnit reports for developers and CI pipelines.
It suits development, security and platform teams who need to know which of the open source components in their software carry known vulnerabilities, whether as an ad hoc audit or as an automated gate in a build pipeline. Dependency-Check builds a local copy of the vulnerability database, which the NVD now serves behind a free API key, so the scanner runs entirely on infrastructure you control.
Why the cloudimg image
cloudimg delivers Dependency-Check fully installed on a hardened, fully patched Ubuntu base with a bundled Java runtime, verified against the project's official published checksum before install. Because the initial vulnerability database download is heavily rate limited and would make an image stale on day one, the image deliberately ships without a populated database: you add your own free NVD API key once, and a bundled updater plus a daily timer keep the database current, with your key never leaving the instance. It ships a shared system database directory, an HTML and JSON scan wrapper for CI, and a built in self test so you can prove the scanner works before pointing it at your own code. There is no listening service and no baked credential to manage. The base keeps receiving unattended security updates, and every deployment is paired with a step by step deploy guide and backed by 24/7 cloudimg support.
Common uses
- Software composition analysis of application dependencies
- Detecting known vulnerable open source libraries
- Automated dependency scanning in CI pipelines
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.