{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a46e96d8-6442-57a4-a9a7-1e22672b15eb", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-oxm", "version": "5.0.13.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:eeb365ea-33c6-5ef5-8b4d-a35c7e79d23f", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:37f5cf50-7ebe-566b-b0bf-cd5f98786d12", "id": "CVE-2020-5398", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5398 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5afd70b5-6e82-5ff1-8d2f-001048df6eef", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:68e0b83c-f498-5fbb-9d6e-b805cea92d24", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ef9d6ee4-b848-5759-98fb-e9f0b23d0d3f", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3898d0a4-3675-530b-9193-0e4b8dd8bb8f", "id": "CVE-2022-22950", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:902aa4de-eb50-56ac-ba2d-d4bae2ea1236", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b93c9609-e638-5471-99a7-77106378624b", "id": "CVE-2022-22968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5ca29886-39a4-5172-b95c-0901486034f1", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8434858b-f024-5860-996b-dc6304d29faf", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5fda8454-d2a3-53c7-8095-eb41af512174", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d5327fca-e333-5dd9-8308-288847c83507", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cebfb60e-1612-5a67-baba-d9008c5d58bb", "id": "CVE-2024-22243", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:121a932d-bf41-5284-b7c2-08d56e453c4a", "id": "CVE-2024-22259", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8162988e-9e58-59e4-ac9a-6b408a0fd58b", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d6e4dbf2-9d16-5ccd-96c4-6dc517d8f4bf", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2c281358-3bc0-5fb5-a17e-9f8a0499c5b7", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1cdc5515-4b82-5d3a-b7e7-db93c77797b7", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0dc5d838-7a34-5836-b1a4-59b43de093e6", "id": "CVE-2024-38820", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 Target version 5.0.13.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() calls that were introduced by the CVE-2022-22968 fix. Version 5.0.13 predates CVE-2022-22968 and uses case-sensitive field matching without any case transformation, therefore the locale-dependent bypass mechanism described in CVE-2024-38820 cannot occur." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1dbf22c7-5cc3-5509-aa5d-998737500eff", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7b8944aa-5f54-5770-8db9-b6f93233a7c8", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9a88ebf0-7b70-57d3-8ec6-891eb65c928d", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cba824aa-74dd-54e9-9756-ffb6f14797f0", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dd5f9371-324b-5b41-b801-c20b81fc9de7", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b2809eb8-cff7-5f04-9571-ed6491c58331", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:456c6818-f2f7-5825-8567-a2baed8aa6a3", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1c32757e-f535-509c-94aa-cec334c62fbb", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:17159442-8d9b-524a-a890-bcdb2ba6a874", "id": "CVE-2026-41840", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:700656a2-03ac-5f69-b770-de4c7f948f8c", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2f992127-6735-50ac-a86f-ee7e674d91f7", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cd98a515-cc98-5bd8-805b-5992a5f75ac4", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5afddae9-ed65-5ee8-86e3-a6b39b326f83", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d6bfd0d3-7f60-513a-a40f-02284c5380bd", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2423989a-27bc-549e-aa03-4a9c99fe949d", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d55589a8-45e8-5836-a635-10567c452715", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:980c6c44-f54c-51c2-8a2f-551f52b5ccd7", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.0.13.RELEASE-tuxcare.1" } ] }