{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bcb02663-466e-546e-8d20-39a208dfd26b",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/moment@2.0.0",
      "type": "library",
      "name": "moment",
      "version": "2.0.0",
      "purl": "pkg:npm/moment@2.0.0"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:185d6fd2-625c-5347-8bbe-66083b0073b5",
      "id": "CVE-2016-4055",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-4055 does not affect version 2.0.0 of moment. not_affected \u2014 Version 2.0.0 of moment.js is not affected by CVE-2016-4055. The vulnerable aspNetRegex for duration parsing that causes ReDoS was introduced in version 2.11.0 (November 2015) and fixed in version 2.11.2 (February 2016). Version 2.0.0 predates the introduction of this feature entirely - it does not parse duration strings with regex and simply returns a zero duration when given arbitrary string ..."
      },
      "affects": [
        {
          "ref": "pkg:npm/moment@2.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:85693612-4b1d-5102-b84c-2ae969cb1c40",
      "id": "GHSA-hxf5-mg84-pj4m",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-hxf5-mg84-pj4m is a false positive for moment 2.0.0."
      },
      "affects": [
        {
          "ref": "pkg:npm/moment@2.0.0"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/moment@2.0.0"
    }
  ]
}