{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a59fe513-49b4-4296-9c82-6b8a7f6b77ae",
  "version": 1,
  "metadata": {
    "timestamp": "2026-09-27T06:09:46.547087+00:00",
    "component": {
      "type": "application",
      "name": "StexNet SN App 1.1.0",
      "bom-ref": "release-zmjUeXtwiLvl"
    }
  },
  "components": [],
  "vulnerabilities": [
    {
      "bom-ref": "4a70a7b7-ad20-416d-a431-353996b3f71e",
      "id": "CVE-2025-24813",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/"
      },
      "ratings": [
        {
          "source": {
            "name": "NVD",
            "url": "https://nvd.nist.gov/"
          },
          "score": 9.8,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "cwes": [
        44,
        502,
        706
      ],
      "description": "Path Equivalence: 'file.Name' (Internal Dot) leading to\u00a0Remote Code Execution and/or Information disclosure\u00a0and/or malicious content added to uploaded files via write enabled\u00a0Default Servlet\u00a0in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n-\u00a0writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of\u00a0a target URL for public uploads\n-\u00a0attacker knowledge of the names of security sensitive files being\u00a0uploaded\n-\u00a0the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n-\u00a0support for partial PUT (enabled by default)\n-\u00a0application was using Tomcat's file based session persistence with the\u00a0default storage location\n-\u00a0application included a library that may be leveraged in a\u00a0deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.",
      "published": "2025-03-10T17:15:35Z",
      "updated": "2026-06-17T08:59:39Z",
      "analysis": {
        "state": "not_affected",
        "justification": "requires_configuration",
        "response": [
          "will_not_fix"
        ],
        "detail": "The conditions required to exploit the vulnerability are not (all) present."
      },
      "affects": [
        {
          "ref": "abcdefab-aaaa-bbbb-cccc-0123456789ab"
        }
      ]
    },
    {
      "bom-ref": "99acfd01-8fbe-4409-ae82-681e366d2090",
      "id": "CVE-2025-31650",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/"
      },
      "ratings": [
        {
          "source": {
            "name": "NVD",
            "url": "https://nvd.nist.gov/"
          },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "cwes": [
        459
      ],
      "description": "Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.",
      "published": "2025-04-28T20:15:20Z",
      "updated": "2026-06-17T09:10:43Z",
      "analysis": {
        "state": "not_affected",
        "justification": "requires_configuration",
        "detail": "The vulnerability is only affects h2/h2c. This is not enabled."
      },
      "affects": [
        {
          "ref": "abcdefab-aaaa-bbbb-cccc-0123456789ab"
        }
      ]
    },
    {
      "bom-ref": "8799b1c6-1fc8-41d2-9fa4-44b5f977fe61",
      "id": "CVE-2025-31651",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/"
      },
      "ratings": [
        {
          "source": {
            "name": "NVD",
            "url": "https://nvd.nist.gov/"
          },
          "score": 9.8,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "cwes": [
        116
      ],
      "description": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.\u00a0For a subset of unlikely rewrite rule configurations, it was possible \nfor a specially crafted request to bypass some rewrite rules. If those \nrewrite rules effectively enforced security constraints, those \nconstraints could be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.",
      "published": "2025-04-28T20:15:20Z",
      "updated": "2026-06-17T09:10:44Z",
      "analysis": {
        "state": "not_affected",
        "justification": "requires_configuration",
        "detail": "Rewrite rules are not used"
      },
      "affects": [
        {
          "ref": "abcdefab-aaaa-bbbb-cccc-0123456789ab"
        }
      ]
    }
  ]
}