{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4abd54eb-a776-57b7-a8b8-1e303f8c67fa", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "name": "spring-orm", "version": "4.1.7.RELEASE-tuxcare.4", "purl": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7bd81f4a-0059-5804-8f39-f521b76a74aa", "id": "CVE-2015-5211", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-5211 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b85d8bce-7b3a-5aca-9cc8-a4528b24c9f2", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0b4d1536-c46f-53a6-b251-9766bd4df28a", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0c10d694-275d-5164-9951-410ec58f112f", "id": "CVE-2018-11039", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11039 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d01c75fe-f12f-5fcb-81c8-f506970ed252", "id": "CVE-2018-11040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:907302f2-4967-5e50-9180-d22cbd8ce5e1", "id": "CVE-2018-1257", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a8ae7f90-95ee-5370-b849-9a4146a1c253", "id": "CVE-2018-1270", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:47e88ea5-554b-574b-9e10-8f00c319efa9", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6941c3a6-45cb-5ce7-a15d-925cc4c2be6d", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c6137208-391d-5f07-92b9-2108cdb6bd5c", "id": "CVE-2018-1275", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0b71d000-dcd6-5440-b247-7c4a71d2d39c", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3a5abb86-8704-5cf3-a61c-f64f2d8c0631", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:55e3878e-dc8f-503e-9a60-a3ee0a614a00", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d0dd2845-a3bb-5b31-a55c-65627d9d2a1b", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c656a44d-ecbd-59b0-8f9b-50aa728ed42b", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fc273ecf-d41d-59dc-b3d9-684cdc24072b", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5d4f63a8-3678-5f4a-ab4d-c7390e1fb510", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ebe5a5f4-f185-5c97-b6d5-29493256652b", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4e84a0a2-aad5-55a8-acfa-25ea6e7affcd", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b750e637-a949-5e13-86d7-4c045f5bce9d", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a2e9bb50-dc50-5f8b-b723-910afde2be88", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f8985e59-18c0-5aa8-889e-d112076e50be", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:974b315c-e64a-57de-af52-33ba0e24e894", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1db81e6b-17aa-5133-9a03-536eff5eac4d", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:58049820-2889-5577-96b3-39df5f28fb1a", "id": "CVE-2024-38809", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ce19bc88-6a89-55c2-a093-2711e477e417", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bcab31a6-ad49-5121-a94a-bfcc90efc779", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c134144d-1a3d-51f6-a381-4a6941007b25", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:14992299-239a-5dc4-a88c-1a021bd6437f", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:896b960d-2398-5d12-a1bd-1e445df9202d", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cbcf9dbd-98d8-5efb-9f98-67324277d300", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:571da6b2-9845-5683-989c-7b30a09c8a6b", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bd439020-769f-5549-8dd5-112c48aa691b", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d8de1aeb-0e85-5378-ad48-694690642a8c", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3142f2ed-a1ac-5fad-b6cc-72ec7f31e032", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:313bec20-61f3-5a89-9b98-b73a327e7975", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1e96915a-2b37-5edf-9c36-a92f46f85592", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:58df3102-c225-5ffc-83a6-1f521eca507d", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a5aeb541-29e0-59eb-9a6c-1ddb3cd684ad", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8962eb99-c4a3-5593-9faa-9c4346f87e75", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ff6cf67d-ba49-5029-b1f2-718341d80986", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f0294abe-73a8-5306-bd75-a8e998366e15", "id": "CVE-2026-41852", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41852 does not affect version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2026-41852. The vulnerability requires record-style property accessor support (empty-prefix method lookup), which was introduced in Spring 5.2+ and does not exist in version 4.1.7. While this version lacks void return type validation for getter methods, it cannot invoke arbitrary zero-argument methods as described in the CVE." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0c8dbc7d-96f2-512b-9115-2dc6df7e52c6", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:965a8fa7-fa4b-547b-ab98-58c3aaadc20e", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.1.7.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.1.7.RELEASE-tuxcare.4" } ] }