{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5f101563-33a0-54aa-88ec-7e7267eaf8af",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-orm",
      "purl": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5",
      "version": "4.0.0.RELEASE-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-orm",
            "purl": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.0.0.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:1e45d4c5-28b8-5510-9abc-ebe4936d6464",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:d6ea9db1-706d-5595-a352-3dce27efc923",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:156b6896-55e1-5b3b-9612-0ea9205ead73",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:0bfb0f9d-c0a8-5ba7-8375-b1f105545dc6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2014-3578 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:e0d484d7-dbf2-5931-a875-aba7d5b9a13e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:9154651d-7048-56d8-8fb4-20056486c0f6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2015-5211 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:0df4b564-2772-527c-987c-78e85a90e595",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:995fae09-8bf5-5fe9-a687-e2dbebfc6f90",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-11040 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm. The vulnerable automatic JSONP handling in MappingJackson2JsonView was introduced in Spring Framework 4.1 and is not present in Spring Framework 4.0.0.RELEASE.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:47329ebc-1cc1-5787-87d0-299bc54ba32d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:36aef514-dae0-5fda-b04a-58c72cf76f63",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1257 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:80604bc8-2b29-5015-b754-6cc9b9fd3a0c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:71637e0e-81ab-5de1-ab3f-93c5ea68a0e9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:1fcf4ecb-149c-5042-a24e-8090917b488e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:c0939596-cb77-5a88-90fa-3a2f72919dbd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:f62a1541-f192-5245-857c-f0968ce6a5b6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:0346b1a0-1da0-517e-b3d0-a1214cc4a267",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:1bb56f81-4925-53fc-9ae6-63072261a16a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:0bf128fe-4aa5-5044-91a8-532338da72ee",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:10716a23-eb91-5da9-a5ed-5f034b81abbf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:e125b8bd-62de-5877-a8f2-7069d52e988e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41249 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:a11fa9e5-e15e-5f4b-9126-6bd6f148d859",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22740 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:c202947f-2f6b-5df1-bd9c-3e457e31e7d0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:d6cad371-62ea-5c60-b447-efe44a0b6ebe",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-orm."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-orm@4.0.0.RELEASE-tuxcare.5"
    }
  ]
}