{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f41079ba-a4a5-5926-afa3-87eb638a1966",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-orm",
      "purl": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4",
      "version": "4.0.0.RELEASE-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-orm",
            "purl": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.0.0.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d20b11db-9ff1-52a1-9ffb-e719bcb7198d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:45c0a0bf-4384-5256-810a-9c324fbcfdf7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:35f4df10-5c2f-5133-acf8-b915c2f9afe7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:16256af5-745d-5724-afc1-329f21727ea8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2014-3578 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6d0f95a3-9021-5cdb-8ee8-ad881f5f5afd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d06db025-ef0f-53ff-9914-b578ca609785",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2015-5211 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a8cbed0b-6dd9-53ef-a6d1-55f88cb7f74c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:49c4bea8-a663-5bc5-88e3-b1630cfaa037",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-11040 does not affect version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm. The vulnerable automatic JSONP handling in MappingJackson2JsonView was introduced in Spring Framework 4.1 and is not present in Spring Framework 4.0.0.RELEASE.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:12e4333e-6e45-5ea2-9602-1d85c6cd8184",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:07638b02-81ee-5149-9393-eabca46a219f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1257 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4f5a8113-cd82-5d21-8999-7a39a4cd8249",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:52bd4c7a-3696-5afb-9bed-dcca27c68e42",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:98c23cde-fa08-5938-a403-b464bb68d75c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:57e2059b-3dfd-5094-b7b6-dec0201b0317",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f92117ef-2332-5301-899e-26ca542d5a4e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ea008391-2a49-574f-801a-c355daef1939",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:86f923d7-2b0b-5a4b-97cf-4eef463556c7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e71c3701-4e51-5cb5-8e47-c7b7ad76b6a6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ba96a138-d29d-5b4f-9202-d8021a4fafa1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b76dfa47-17c1-5dcd-bb5b-a672d482eb54",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41249 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:43e2e729-4c13-5dbd-a1c9-19a13a8b7e15",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22740 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:5e90204b-4bfe-50e5-9439-43f95f676467",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:df75efbb-cde6-5790-953c-1f6e179e06f2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-orm."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.4"
    }
  ]
}