{ "bomFormat": "CycloneDX", "specVersion": "1.5", "serialNumber": "urn:uuid:a1b2c3d4-e5f6-7890-abcd-ef1234567890", "version": 1, "metadata": { "timestamp": "2026-04-07T14:30:00Z", "tools": [ { "vendor": "anchore", "name": "syft", "version": "1.4.1" } ], "component": { "type": "application", "name": "acme-webapp", "version": "2.8.1", "description": "ACME Corporation internal web application", "purl": "pkg:docker/acme-webapp@2.8.1" } }, "components": [ { "type": "library", "name": "express", "version": "4.18.2", "purl": "pkg:npm/express@4.18.2", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2" }], "externalReferences": [{ "type": "website", "url": "https://expressjs.com" }] }, { "type": "library", "name": "lodash", "version": "4.17.20", "purl": "pkg:npm/lodash@4.17.20", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3" }], "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2021-23337 — command injection via template(). Fix: upgrade to 4.17.21" }] }, { "type": "library", "name": "jsonwebtoken", "version": "8.5.1", "purl": "pkg:npm/jsonwebtoken@8.5.1", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4" }], "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2022-23529 — JWT forgery via prototype pollution. Fix: upgrade to 9.0.0 (BREAKING)" }] }, { "type": "library", "name": "axios", "version": "1.6.0", "purl": "pkg:npm/axios@1.6.0", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5" }], "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2023-45857 — XSRF-TOKEN cookie leak. Fix: upgrade to 1.6.2" }] }, { "type": "library", "name": "follow-redirects", "version": "1.15.4", "purl": "pkg:npm/follow-redirects@1.15.4", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6" }], "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2024-28849 — Authorization header leak on cross-origin redirect. Fix: 1.15.6" }] }, { "type": "library", "name": "xml2js", "version": "0.4.23", "purl": "pkg:npm/xml2js@0.4.23", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1" }], "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2023-0842 — prototype pollution via __proto__ in parsed XML. Fix: 0.5.0 (BREAKING)" }] }, { "type": "library", "name": "helmet", "version": "7.1.0", "purl": "pkg:npm/helmet@7.1.0", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "a1a2b3c4d5e6f7a1a2b3c4d5e6f7a1a2b3c4d5e6f7a1a2b3c4d5e6f7a1a2b3c4" }] }, { "type": "library", "name": "cors", "version": "2.8.5", "purl": "pkg:npm/cors@2.8.5", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "b2b3c4d5e6f7a1b2b3c4d5e6f7a1b2b3c4d5e6f7a1b2b3c4d5e6f7a1b2b3c4d5" }] }, { "type": "library", "name": "winston", "version": "3.11.0", "purl": "pkg:npm/winston@3.11.0", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "c3c4d5e6f7a1b2c3c4d5e6f7a1b2c3c4d5e6f7a1b2c3c4d5e6f7a1b2c3c4d5e6" }] }, { "type": "library", "name": "mongoose", "version": "7.6.3", "purl": "pkg:npm/mongoose@7.6.3", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "d4d5e6f7a1b2c3d4d5e6f7a1b2c3d4d5e6f7a1b2c3d4d5e6f7a1b2c3d4d5e6f7" }] }, { "type": "library", "name": "flask", "version": "3.0.0", "purl": "pkg:pypi/flask@3.0.0", "licenses": [{ "license": { "id": "BSD-3-Clause" } }], "hashes": [{ "alg": "SHA-256", "content": "e5e6f7a1b2c3d4e5e6f7a1b2c3d4e5e6f7a1b2c3d4e5e6f7a1b2c3d4e5e6f7a1" }] }, { "type": "library", "name": "werkzeug", "version": "3.0.1", "purl": "pkg:pypi/werkzeug@3.0.1", "licenses": [{ "license": { "id": "BSD-3-Clause" } }], "hashes": [{ "alg": "SHA-256", "content": "f6f7a1b2c3d4e5f6f7a1b2c3d4e5f6f7a1b2c3d4e5f6f7a1b2c3d4e5f6f7a1b2" }], "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2024-34069 — debugger RCE if enabled in production. Fix: 3.0.3" }] }, { "type": "library", "name": "jinja2", "version": "3.1.2", "purl": "pkg:pypi/jinja2@3.1.2", "licenses": [{ "license": { "id": "BSD-3-Clause" } }], "hashes": [{ "alg": "SHA-256", "content": "a7a8b9c0d1e2f3a7a8b9c0d1e2f3a7a8b9c0d1e2f3a7a8b9c0d1e2f3a7a8b9c0" }], "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2024-34064 — XSS via xmlattr filter. Fix: 3.1.4" }] }, { "type": "library", "name": "pillow", "version": "9.5.0", "purl": "pkg:pypi/pillow@9.5.0", "licenses": [{ "license": { "id": "HPND" } }], "hashes": [{ "alg": "SHA-256", "content": "b8b9c0d1e2f3a4b8b9c0d1e2f3a4b8b9c0d1e2f3a4b8b9c0d1e2f3a4b8b9c0d1" }], "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2023-44271 — DoS via crafted image. Fix: 10.0.1 (BREAKING)" }] }, { "type": "library", "name": "cryptography", "version": "41.0.4", "purl": "pkg:pypi/cryptography@41.0.4", "licenses": [{ "license": { "id": "Apache-2.0" } }], "hashes": [{ "alg": "SHA-256", "content": "c9c0d1e2f3a4b5c9c0d1e2f3a4b5c9c0d1e2f3a4b5c9c0d1e2f3a4b5c9c0d1e2" }], "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2024-26130 — NULL dereference on PKCS#7 load. Fix: 42.0.0 (BREAKING — requires OpenSSL 3.0+)" }] }, { "type": "library", "name": "requests", "version": "2.31.0", "purl": "pkg:pypi/requests@2.31.0", "licenses": [{ "license": { "id": "Apache-2.0" } }], "hashes": [{ "alg": "SHA-256", "content": "d0d1e2f3a4b5c6d0d1e2f3a4b5c6d0d1e2f3a4b5c6d0d1e2f3a4b5c6d0d1e2f3" }], "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2024-35195 — certificate verification bypass after verify=False. Fix: 2.32.0" }] }, { "type": "library", "name": "gunicorn", "version": "21.2.0", "purl": "pkg:pypi/gunicorn@21.2.0", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "e1e2f3a4b5c6d7e1e2f3a4b5c6d7e1e2f3a4b5c6d7e1e2f3a4b5c6d7e1e2f3a4" }] }, { "type": "library", "name": "celery", "version": "5.3.6", "purl": "pkg:pypi/celery@5.3.6", "licenses": [{ "license": { "id": "BSD-3-Clause" } }], "hashes": [{ "alg": "SHA-256", "content": "f2f3a4b5c6d7e8f2f3a4b5c6d7e8f2f3a4b5c6d7e8f2f3a4b5c6d7e8f2f3a4b5" }] }, { "type": "library", "name": "redis", "version": "5.0.1", "purl": "pkg:pypi/redis@5.0.1", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "a3a4b5c6d7e8f9a3a4b5c6d7e8f9a3a4b5c6d7e8f9a3a4b5c6d7e8f9a3a4b5c6" }] }, { "type": "library", "name": "sqlalchemy", "version": "2.0.23", "purl": "pkg:pypi/sqlalchemy@2.0.23", "licenses": [{ "license": { "id": "MIT" } }], "hashes": [{ "alg": "SHA-256", "content": "b4b5c6d7e8f9a0b4b5c6d7e8f9a0b4b5c6d7e8f9a0b4b5c6d7e8f9a0b4b5c6d7" }] } ], "vulnerabilities": [ { "id": "CVE-2021-23337", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337" }, "ratings": [{ "score": 7.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }], "description": "Lodash template command injection", "recommendation": "Upgrade lodash to 4.17.21", "affects": [{ "ref": "pkg:npm/lodash@4.17.20" }] }, { "id": "CVE-2022-23529", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23529" }, "ratings": [{ "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }], "description": "jsonwebtoken insecure key retrieval allows JWT forgery", "recommendation": "Upgrade jsonwebtoken to 9.0.0", "affects": [{ "ref": "pkg:npm/jsonwebtoken@8.5.1" }] }, { "id": "CVE-2023-45857", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45857" }, "ratings": [{ "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }], "description": "Axios XSRF-TOKEN cookie leaked to arbitrary hosts", "recommendation": "Upgrade axios to 1.6.2", "affects": [{ "ref": "pkg:npm/axios@1.6.0" }] }, { "id": "CVE-2024-28849", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28849" }, "ratings": [{ "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }], "description": "follow-redirects authorization header leak on cross-origin redirect", "recommendation": "Upgrade follow-redirects to 1.15.6", "affects": [{ "ref": "pkg:npm/follow-redirects@1.15.4" }] }, { "id": "CVE-2023-0842", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0842" }, "ratings": [{ "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }], "description": "xml2js prototype pollution via __proto__ key in parsed XML", "recommendation": "Upgrade xml2js to 0.5.0", "affects": [{ "ref": "pkg:npm/xml2js@0.4.23" }] }, { "id": "CVE-2024-34069", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34069" }, "ratings": [{ "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }], "description": "Werkzeug debugger remote code execution when enabled in production", "recommendation": "Upgrade werkzeug to 3.0.3 and ensure debugger is disabled in production", "affects": [{ "ref": "pkg:pypi/werkzeug@3.0.1" }] }, { "id": "CVE-2024-34064", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34064" }, "ratings": [{ "score": 5.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }], "description": "Jinja2 XSS via xmlattr filter", "recommendation": "Upgrade jinja2 to 3.1.4", "affects": [{ "ref": "pkg:pypi/jinja2@3.1.2" }] }, { "id": "CVE-2023-44271", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44271" }, "ratings": [{ "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }], "description": "Pillow denial of service via uncontrolled resource consumption", "recommendation": "Upgrade pillow to 10.0.1", "affects": [{ "ref": "pkg:pypi/pillow@9.5.0" }] }, { "id": "CVE-2024-26130", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26130" }, "ratings": [{ "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }], "description": "cryptography NULL dereference on PKCS#7 certificate load", "recommendation": "Upgrade cryptography to 42.0.0", "affects": [{ "ref": "pkg:pypi/cryptography@41.0.4" }] }, { "id": "CVE-2024-35195", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35195" }, "ratings": [{ "score": 5.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N" }], "description": "requests session certificate verification bypass after verify=False", "recommendation": "Upgrade requests to 2.32.0", "affects": [{ "ref": "pkg:pypi/requests@2.31.0" }] } ] }