{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:67e1e9c8-6186-5705-8b9a-da44b50422f5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12", "version": "4.2.9.RELEASE-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.2.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:a9a7d31b-218a-53cb-b7ec-0a6561e0249e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.2.9.RELEASE is not affected by CVE-2009-1190. While the framework still contains deserialization code (HttpInvokerServiceExporter) with no Spring-level filtering for Pattern objects, the vulnerability requires JDK < 1.6 to exploit. Spring 4.2.9 is compiled with Java 6 bytecode compatibility (sourceCompatibility = 1.6) and cannot run on Java 5 or earlier. The JDK 6+ runtime in...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:dafc3615-9d81-50d0-91da-5775ca4407fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:1107e3b8-9828-5745-a220-93b150932015", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:44a69b54-4096-5803-85b2-c3501f510324", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:d164ebcf-6fd2-50be-9609-f5105b016144", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:980c83c1-beb4-5a21-8389-0b0636998947", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:b0dcd2cd-e0f1-5e6e-a8f3-7250bc3f1dca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:f4698603-9d84-5388-8022-18216fc98024", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:e99641d1-5ad1-5a3d-ad92-0e1e5eb9a3b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:d549f5d9-8ce6-53e4-aaa2-04fdf68f8936", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:6bfc85a1-4d44-56f4-a7e0-6aab3a616ec2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:a1536d92-c003-516a-89c0-1e7af0711cfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:3db40141-de90-55c2-9de6-b1b30bd0a970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:861a0418-bdcd-5f16-8e12-639ebff97a4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:7538b160-ac10-5acd-bd95-bd20dd00d957", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:f3e125d5-8273-559c-bb86-7e02b65bc139", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:206c3983-7143-5830-83b9-06eb9f091f68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:23143b2b-5597-5fae-8fe1-25bc66ec6166", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm, and is fixed in 4.2.9.RELEASE-tuxcare.13." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:40a03059-e933-583b-beae-e6484c26deaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:c000ef04-92c5-508d-bce2-e695c2f45876", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:b3f9f3d4-2620-5be8-9e48-26c54eda5852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:6e65a7a8-76f0-55fe-8507-6c1c3c4112a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:2a4e789e-97a6-596f-8123-1b3f677516cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:cce190b4-1dbb-5f92-8aad-637cbdb658ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:8f421dd2-3c79-536a-b425-890556091d33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.12" } ] }