{
  "@id": "urn:uuid:f6940875-606a-4455-baed-ef72561827b1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 30,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T07:52:00.042759+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2005-4838 does not affect version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2. Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2005-4838"
      },
      "impact_statement": "Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1358 does not affect version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2. All 1 patch commits already exist in target branch",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1358"
      },
      "impact_statement": "All 1 patch commits already exist in target branch"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2008-0128 is a false positive for org.apache.cxf:cxf-rt-rs-security-oauth2 3.5.9-tuxcare.7. false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing....",
      "vulnerability": {
        "name": "CVE-2008-0128"
      },
      "impact_statement": "false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2009-2696 does not affect version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2. Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2009-2696"
      },
      "impact_statement": "Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2010-1151 is a false positive for org.apache.cxf:cxf-rt-rs-security-oauth2 3.5.9-tuxcare.7. false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository.",
      "vulnerability": {
        "name": "CVE-2010-1151"
      },
      "impact_statement": "false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2013-4444 is a false positive for org.apache.cxf:cxf-rt-rs-security-oauth2 3.5.9-tuxcare.7. direct vulnerability is in Apache Tomcat project",
      "vulnerability": {
        "name": "CVE-2013-4444"
      },
      "impact_statement": "direct vulnerability is in Apache Tomcat project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2013-6357 is a false positive for org.apache.cxf:cxf-rt-rs-security-oauth2 3.5.9-tuxcare.7. false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository.",
      "vulnerability": {
        "name": "CVE-2013-6357"
      },
      "impact_statement": "false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2014-0119 is a false positive for org.apache.cxf:cxf-rt-rs-security-oauth2 3.5.9-tuxcare.7. direct vulnerability is in Apache Tomcat project",
      "vulnerability": {
        "name": "CVE-2014-0119"
      },
      "impact_statement": "direct vulnerability is in Apache Tomcat project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2025-15104 is a false positive for org.apache.cxf:cxf-rt-rs-security-oauth2 3.5.9-tuxcare.7. direct vulnerability is in Nu Html Checker (validator.nu) project",
      "vulnerability": {
        "name": "CVE-2025-15104"
      },
      "impact_statement": "direct vulnerability is in Nu Html Checker (validator.nu) project"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50623 is fixed in version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-50623"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50627 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-50627"
      },
      "action_statement": "Vulnerability CVE-2026-50627 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-14T07:52:00.042759+00:00",
      "status_notes": "Vulnerability CVE-2026-50628 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2, and is fixed in 3.5.9-tuxcare.17.",
      "vulnerability": {
        "name": "CVE-2026-50628"
      },
      "action_statement": "Vulnerability CVE-2026-50628 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2, and is fixed in 3.5.9-tuxcare.17."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50629 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-50629"
      },
      "action_statement": "Vulnerability CVE-2026-50629 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50630 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-50630"
      },
      "action_statement": "Vulnerability CVE-2026-50630 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50631 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-50631"
      },
      "action_statement": "Vulnerability CVE-2026-50631 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-57818 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-57818"
      },
      "action_statement": "Vulnerability CVE-2026-57818 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-61466 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-61466"
      },
      "action_statement": "Vulnerability CVE-2026-61466 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-12T18:56:11.819524+00:00",
      "status_notes": "Vulnerability CVE-2026-63687 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2, and is fixed in 3.5.9-tuxcare.16.",
      "vulnerability": {
        "name": "CVE-2026-63687"
      },
      "action_statement": "Vulnerability CVE-2026-63687 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2, and is fixed in 3.5.9-tuxcare.16."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-10T18:46:12.481725+00:00",
      "status_notes": "Vulnerability CVE-2026-68079 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2, and is fixed in 3.5.9-tuxcare.15.",
      "vulnerability": {
        "name": "CVE-2026-68079"
      },
      "action_statement": "Vulnerability CVE-2026-68079 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2, and is fixed in 3.5.9-tuxcare.15."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68481 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-68481"
      },
      "action_statement": "Vulnerability CVE-2026-68481 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs-security-oauth2@3.5.9-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-09T10:36:00.171692+00:00",
      "status_notes": "Vulnerability CVE-2026-73179 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2.",
      "vulnerability": {
        "name": "CVE-2026-73179"
      },
      "action_statement": "Vulnerability CVE-2026-73179 affects version 3.5.9-tuxcare.7 of org.apache.cxf:cxf-rt-rs-security-oauth2."
    }
  ]
}