{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2d31d50c-2716-5ed3-89b9-b6cde0757869", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/semver@5.1.0-tuxcare.1", "type": "library", "name": "semver", "version": "5.1.0-tuxcare.1", "purl": "pkg:npm/semver@5.1.0-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e34de5f0-e61e-56fa-9d02-f2587dc4cb94", "id": "CVE-2017-1000048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-1000048 is fixed in version 5.1.0-tuxcare.1 of semver." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f79f67a6-042f-5a26-b3f3-d682b1116804", "id": "CVE-2020-5284", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-5284 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2020-5284 is a false positive for this repository. The CVE concerns Next.js (a React framework), but this repository is semver v5.1.0 (a semantic versioning parser library for npm). These are completely different projects with no dependency or code relationship." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e2002704-8cff-5059-9ee6-c0c0e2b03fef", "id": "CVE-2021-27290", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-27290 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2021-27290 concerns the npm 'ssri' package (Subresource Integrity library), but this repository is the 'semver' package (semantic version parser). This is a wrong-project match with no relationship between the two packages." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3580c37c-4914-5285-af83-cda0e57f5411", "id": "CVE-2021-37699", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-37699 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2021-37699 is a Next.js open redirect vulnerability, but the target repository is the semver npm package (a semantic version parser). This is a wrong-project match - the affected product and its code are completely absent from this repository." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:687ca798-2ba9-565a-9343-3bde968a783d", "id": "CVE-2021-43803", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43803 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2021-43803 is a false positive for this repository. The CVE concerns Next.js (a React framework with HTTP server capabilities), but the target repository is semver (a semantic version parser library). These are completely different products with no containment relationship." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9986b66d-0aa5-5104-86d1-46f8c8a53954", "id": "CVE-2022-24999", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-24999 is fixed in version 5.1.0-tuxcare.1 of semver." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3b4d3291-0291-5123-b277-7c61b42d6269", "id": "CVE-2022-25883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-25883 is fixed in version 5.1.0-tuxcare.1 of semver." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b0c43247-d89c-539a-99ce-6bcfe7f1aba1", "id": "CVE-2023-45133", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-45133 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2023-45133 concerns @babel/traverse, a component of the Babel JavaScript compiler. The target repository is 'semver' v5.1.0, a semantic version parser for npm. These are completely different projects with no relationship. The target contains no Babel code, no @babel/traverse dependency, and no vendored copies. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8cc072b4-14c8-5470-adb4-fcce58e54541", "id": "CVE-2023-46298", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-46298 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2023-46298 concerns Next.js (a React web framework), but the target repository is semver (a semantic version parsing library for npm). This is a wrong-project match with no code overlap." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b0cf52a1-d394-5d42-8b83-75d14a7214ed", "id": "CVE-2024-21534", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-21534 is fixed in version 5.1.0-tuxcare.1 of semver." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:779e714e-631f-59ac-80fb-71dc220d296d", "id": "CVE-2024-21538", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-21538 is fixed in version 5.1.0-tuxcare.1 of semver." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3b59f7c5-b090-532d-b461-ae2fed0418a8", "id": "CVE-2024-43799", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-43799 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2024-43799 concerns the 'Send' library (file streaming), but this repository is 'semver' (semantic version parser). Wrong-project match confirmed via Product-Identity Check." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ddca1dab-bd21-5dd6-ab54-3ab8cb3ddf96", "id": "CVE-2024-45296", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-45296 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2024-45296 concerns the path-to-regexp library, but the target repository is semver (semantic version parser). These are completely different npm packages. The CVE was incorrectly matched to the wrong project." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c58918aa-66d8-5dc7-b9ba-8fb23aeb60fc", "id": "CVE-2025-1302", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-1302 is fixed in version 5.1.0-tuxcare.1 of semver." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f845a69c-f578-5e0c-84ee-5512ad9ff073", "id": "CVE-2025-14505", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-14505 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2025-14505 concerns the Elliptic cryptographic library, but the target repository is the semver package (semantic version parser for npm). These are completely different projects with no relationship. The affected component is entirely absent from this repository." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b2ee998a-9707-516d-9c20-65303fbcc62f", "id": "CVE-2025-15284", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15284 is fixed in version 5.1.0-tuxcare.1 of semver." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c20457da-8356-5bcb-80e3-733520b5cd07", "id": "CVE-2025-32421", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-32421 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2025-32421 affects Next.js Pages Router, not the semver library. This is a wrong-project match - the target repository is the 'semver' package (semantic versioning parser for npm), while the CVE concerns the 'next' package (React web framework). No code relationship exists between these projects." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4b0bf145-6fd7-5eff-b19c-6710e47ea69b", "id": "CVE-2025-55173", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-55173 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2025-55173 concerns Next.js Image Optimization, but the target repository is the 'semver' package (semantic version parser for npm) - a completely different npm package. The Product-Identity Check confirms this is a wrong-project match: the target has no Next.js code, no vendored Next.js components, and no Next.js dependencies." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:26533a38-1ee5-5699-bbbc-2a610913b10b", "id": "CVE-2025-57752", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-57752 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2025-57752 is a wrong-project match. The advisory concerns Next.js Image Optimization, but the target repository is 'semver' (a semantic version parser for npm). The affected component does not exist in this repository." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4986fb13-1758-5efd-a267-dd42fbc55276", "id": "CVE-2025-57822", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-57822 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2025-57822 is a wrong-project match. The advisory concerns Next.js Middleware (NextResponse.next() SSRF vulnerability in Next.js v14.2.32/v15.4.7), but the target repository is 'semver' v5.1.0 - a semantic version parser library for npm. These are completely different products with no code relationship." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e79f6e1e-3c92-54fe-b55c-50ba52b2ab15", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.1.0-tuxcare.1 of semver." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:848b8aee-5a72-5588-a5b0-bdc194e93033", "id": "CVE-2026-2739", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-2739 is a false positive for semver 5.1.0-tuxcare.1. false_positive \u2014 CVE-2026-2739 concerns bn.js (big number library), but the target repository is semver (semantic version parser). These are completely different projects with no relationship. The affected component (bn.js) is absent from the entire repository." }, "affects": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/semver@5.1.0-tuxcare.1" } ] }