{
  "@id": "urn:uuid:97b80889-8b6d-4d2a-9d61-a5855d1b6933",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T02:46:00.035379+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-09T19:30:37.797521+00:00",
      "status_notes": "Vulnerability CVE-2005-4838 is a false positive for org.apache.cxf:cxf-java2ws-plugin 3.5.11-tuxcare.12. false_positive \u2014 CVE-2005-4838 concerns XSS vulnerabilities in Jakarta Tomcat's example web applications (examples/jsp2/ directory). This repository is Apache CXF, a completely different Apache project. The affected Tomcat example applications are not present in this repository.",
      "vulnerability": {
        "name": "CVE-2005-4838"
      },
      "impact_statement": "false_positive \u2014 CVE-2005-4838 concerns XSS vulnerabilities in Jakarta Tomcat's example web applications (examples/jsp2/ directory). This repository is Apache CXF, a completely different Apache project. The affected Tomcat example applications are not present in this repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-09T19:30:37.797521+00:00",
      "status_notes": "Vulnerability CVE-2006-7196 is a false positive for org.apache.cxf:cxf-java2ws-plugin 3.5.11-tuxcare.12. false_positive \u2014 CVE-2006-7196 concerns Apache Tomcat's calendar example application (cal2.jsp), but this repository is Apache CXF, a completely different Apache project. This is a wrong-project match - the affected component is not present in this repository.",
      "vulnerability": {
        "name": "CVE-2006-7196"
      },
      "impact_statement": "false_positive \u2014 CVE-2006-7196 concerns Apache Tomcat's calendar example application (cal2.jsp), but this repository is Apache CXF, a completely different Apache project. This is a wrong-project match - the affected component is not present in this repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-09T19:30:37.797521+00:00",
      "status_notes": "Vulnerability CVE-2007-1358 is a false positive for org.apache.cxf:cxf-java2ws-plugin 3.5.11-tuxcare.12. false_positive \u2014 CVE-2007-1358 concerns Apache Tomcat 4.x, but this repository is Apache CXF (a web services framework). The CVE's affected product code is not present in this repository - Tomcat appears only as a test-scoped dependency. This is a wrong-project match.",
      "vulnerability": {
        "name": "CVE-2007-1358"
      },
      "impact_statement": "false_positive \u2014 CVE-2007-1358 concerns Apache Tomcat 4.x, but this repository is Apache CXF (a web services framework). The CVE's affected product code is not present in this repository - Tomcat appears only as a test-scoped dependency. This is a wrong-project match."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-09T19:30:37.797521+00:00",
      "status_notes": "Vulnerability CVE-2007-2449 is a false positive for org.apache.cxf:cxf-java2ws-plugin 3.5.11-tuxcare.12. false_positive \u2014 CVE-2007-2449 concerns Apache Tomcat's examples web application (specifically JSP files like snoop.jsp). The target repository is Apache CXF (org.apache.cxf), a different Apache project. Exhaustive containment search found no Tomcat examples web application - neither as the project itself, nor vendored/bundled, nor as a runtime dependency. Tomcat appears only as a test dependency. This is a wrong-project match.",
      "vulnerability": {
        "name": "CVE-2007-2449"
      },
      "impact_statement": "false_positive \u2014 CVE-2007-2449 concerns Apache Tomcat's examples web application (specifically JSP files like snoop.jsp). The target repository is Apache CXF (org.apache.cxf), a different Apache project. Exhaustive containment search found no Tomcat examples web application - neither as the project itself, nor vendored/bundled, nor as a runtime dependency. Tomcat appears only as a test dependency. This is a wrong-project match."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-09T19:30:37.797521+00:00",
      "status_notes": "Vulnerability CVE-2008-0128 does not affect version 3.5.11-tuxcare.12 of org.apache.cxf:cxf-java2ws-plugin. not_affected \u2014 CVE-2008-0128 targets Apache Tomcat's SingleSignOn Valve and JSESSIONIDSSO cookie. The target repository is Apache CXF (web services framework), which does not contain Tomcat's authentication infrastructure or SSO functionality.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-0128"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-0128 targets Apache Tomcat's SingleSignOn Valve and JSESSIONIDSSO cookie. The target repository is Apache CXF (web services framework), which does not contain Tomcat's authentication infrastructure or SSO functionality."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-09T19:30:37.797521+00:00",
      "status_notes": "Vulnerability CVE-2009-2696 does not affect version 3.5.11-tuxcare.12 of org.apache.cxf:cxf-java2ws-plugin. Version 3.5.11 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2009-2696"
      },
      "impact_statement": "Version 3.5.11 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-09T19:30:37.797521+00:00",
      "status_notes": "Vulnerability CVE-2010-1151 is a false positive for org.apache.cxf:cxf-java2ws-plugin 3.5.11-tuxcare.12. false_positive \u2014 CVE-2010-1151 is a wrong-project match. The CVE concerns mod_auth_shadow for Apache HTTP Server (a C-based authentication module), not Apache CXF (a Java web services framework). No mod_auth_shadow code, dependencies, or related authentication patterns exist in this repository.",
      "vulnerability": {
        "name": "CVE-2010-1151"
      },
      "impact_statement": "false_positive \u2014 CVE-2010-1151 is a wrong-project match. The CVE concerns mod_auth_shadow for Apache HTTP Server (a C-based authentication module), not Apache CXF (a Java web services framework). No mod_auth_shadow code, dependencies, or related authentication patterns exist in this repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-09T19:30:37.797521+00:00",
      "status_notes": "Vulnerability CVE-2013-4286 is a false positive for org.apache.cxf:cxf-java2ws-plugin 3.5.11-tuxcare.12. false_positive \u2014 CVE-2013-4286 is a false positive for Apache CXF 3.5.11. The CVE concerns Apache Tomcat's servlet container (versions before 6.0.39, 7.x before 7.0.47, 8.x before 8.0.0-RC3) and its handling of inconsistent HTTP request headers leading to request smuggling. The target repository is Apache CXF, a web services framework that is a completely different project from Tomcat. CXF does not vendor or bu...",
      "vulnerability": {
        "name": "CVE-2013-4286"
      },
      "impact_statement": "false_positive \u2014 CVE-2013-4286 is a false positive for Apache CXF 3.5.11. The CVE concerns Apache Tomcat's servlet container (versions before 6.0.39, 7.x before 7.0.47, 8.x before 8.0.0-RC3) and its handling of inconsistent HTTP request headers leading to request smuggling. The target repository is Apache CXF, a web services framework that is a completely different project from Tomcat. CXF does not vendor or bu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-09T19:30:37.797521+00:00",
      "status_notes": "Vulnerability CVE-2013-6357 is a false positive for org.apache.cxf:cxf-java2ws-plugin 3.5.11-tuxcare.12. false_positive \u2014 CVE-2013-6357 is a false positive match for this repository. The CVE concerns a CSRF vulnerability in Apache Tomcat's Manager web application (versions 5.5.25 and earlier), but this repository is Apache CXF version 3.5.11, a completely different Apache project. Apache CXF is a web services framework for building SOAP/REST services, not a servlet container or application server. The affected com...",
      "vulnerability": {
        "name": "CVE-2013-6357"
      },
      "impact_statement": "false_positive \u2014 CVE-2013-6357 is a false positive match for this repository. The CVE concerns a CSRF vulnerability in Apache Tomcat's Manager web application (versions 5.5.25 and earlier), but this repository is Apache CXF version 3.5.11, a completely different Apache project. Apache CXF is a web services framework for building SOAP/REST services, not a servlet container or application server. The affected com..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-09T19:30:37.797521+00:00",
      "status_notes": "Vulnerability CVE-2014-0096 affects version 3.5.11-tuxcare.12 of org.apache.cxf:cxf-java2ws-plugin.",
      "vulnerability": {
        "name": "CVE-2014-0096"
      },
      "action_statement": "Vulnerability CVE-2014-0096 affects version 3.5.11-tuxcare.12 of org.apache.cxf:cxf-java2ws-plugin."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-java2ws-plugin@3.5.11-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-09T19:30:37.797521+00:00",
      "status_notes": "Vulnerability CVE-2025-15104 is a false positive for org.apache.cxf:cxf-java2ws-plugin 3.5.11-tuxcare.12. direct vulnerability is in Nu Html Checker (validator.nu) project",
      "vulnerability": {
        "name": "CVE-2025-15104"
      },
      "impact_statement": "direct vulnerability is in Nu Html Checker (validator.nu) project"
    }
  ]
}