raw.json

{
  "components": [
    {
      "packageUrl": "pkg:a-name/%40tuia/wysihtml5@0.3.0",
      "hash": "0018df393cd34e8e5463",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "@tuia/wysihtml5",
          "qualifier": "",
          "version": "0.3.0"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "ISC",
            "licenseName": "ISC"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.3?type=jar",
      "hash": "0142ce64dcd709a4b5f6",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "jackson-core",
          "classifier": "",
          "extension": "jar",
          "groupId": "com.fasterxml.jackson.core",
          "version": "2.6.3"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/jackson-core-2.6.3.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Source-License",
            "licenseName": "No Source License"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "sonatype",
            "reference": "sonatype-2016-0397",
            "severity": 7.5,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0355",
            "severity": 7.5,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/aopalliance/aopalliance@1.0?type=jar",
      "hash": "0235ba8b489512805ac1",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "aopalliance",
          "classifier": "",
          "extension": "jar",
          "groupId": "aopalliance",
          "version": "1.0"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/aopalliance-1.0.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "PUBLIC-DOMAIN",
            "licenseName": "Public Domain"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Source-License",
            "licenseName": "No Source License"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:a-name/berserker@0.2.1",
      "hash": "03deb26bd71f770e7df1",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "berserker",
          "qualifier": "",
          "version": "0.2.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugins/bootstrap-slider/js/bootstrap-slider.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.slf4j/slf4j-log4j12@1.7.12?type=jar",
      "hash": "0485f77901840cf4e8bf",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "slf4j-log4j12",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.slf4j",
          "version": "1.7.12"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/slf4j-log4j12-1.7.12.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.seleniumhq.selenium/selenium-safari-driver@2.48.2?type=jar",
      "hash": "06a6340819a62ba1e0ba",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "selenium-safari-driver",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.seleniumhq.selenium",
          "version": "2.48.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-safari-driver-2.48.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.springframework/spring-aop@3.2.4.RELEASE?type=jar",
      "hash": "0773389e56c871ab558b",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "spring-aop",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.springframework",
          "version": "3.2.4.RELEASE"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/spring-aop-3.2.4.RELEASE.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/net.sourceforge.jtds/jtds@1.3.1?type=jar",
      "hash": "1527f2fc2f0408986253",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "jtds",
          "classifier": "",
          "extension": "jar",
          "groupId": "net.sourceforge.jtds",
          "version": "1.3.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/jtds-1.3.1.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "LGPL-UNSPECIFIED",
            "licenseName": "LGPL"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "LGPL-2.1",
            "licenseName": "LGPL-2.1"
          },
          {
            "licenseId": "LGPL-3.0",
            "licenseName": "LGPL-3.0"
          },
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          },
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.apache.tiles/tiles-request-api@1.0.6?type=jar",
      "hash": "159cd498ce20e904516e",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "tiles-request-api",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.apache.tiles",
          "version": "1.0.6"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/tiles-request-api-1.0.6.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/java2html/j2h@1.3.1?type=jar",
      "hash": "18d393ad345b03b49c62",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "j2h",
          "classifier": "",
          "extension": "jar",
          "groupId": "java2html",
          "version": "1.3.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/j2h-1.3.1.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Not-Declared",
            "licenseName": "Not Declared"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Sources",
            "licenseName": "No Sources"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.springframework.security/spring-security-web@3.2.4.RELEASE?type=jar",
      "hash": "197d803ab63dd3523d9d",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "spring-security-web",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.springframework.security",
          "version": "3.2.4.RELEASE"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/spring-security-web-3.2.4.RELEASE.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2016-9879",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9879",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-1199",
            "severity": 5.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1199",
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0507",
            "severity": 5.0,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0641",
            "severity": 7.1,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2019-0341",
            "severity": 3.7,
            "status": "Open",
            "url": null,
            "threatCategory": "moderate"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/net.java.dev.jna/jna@4.1.0?type=jar",
      "hash": "1c12d070e602efd80218",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "jna",
          "classifier": "",
          "extension": "jar",
          "groupId": "net.java.dev.jna",
          "version": "4.1.0"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/jna-4.1.0.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "LGPL-2.1",
            "licenseName": "LGPL-2.1"
          },
          {
            "licenseId": "UNKNOWN",
            "licenseName": "Non-Standard"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "LGPL-2.1",
            "licenseName": "LGPL-2.1"
          },
          {
            "licenseId": "LGPL-3.0",
            "licenseName": "LGPL-3.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          },
          {
            "licenseThreatGroupName": "Non Standard",
            "licenseThreatGroupLevel": 6,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.seleniumhq.selenium/selenium-chrome-driver@2.48.2?type=jar",
      "hash": "1c22091849c3f4ee5b74",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "selenium-chrome-driver",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.seleniumhq.selenium",
          "version": "2.48.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-chrome-driver-2.48.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/net.java.dev.jna/jna-platform@4.1.0?type=jar",
      "hash": "23457ad1cf75c2c16763",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "jna-platform",
          "classifier": "",
          "extension": "jar",
          "groupId": "net.java.dev.jna",
          "version": "4.1.0"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/jna-platform-4.1.0.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "LGPL-2.1",
            "licenseName": "LGPL-2.1"
          },
          {
            "licenseId": "UNKNOWN",
            "licenseName": "Non-Standard"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "LGPL-2.1",
            "licenseName": "LGPL-2.1"
          },
          {
            "licenseId": "LGPL-3.0",
            "licenseName": "LGPL-3.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          },
          {
            "licenseThreatGroupName": "Non Standard",
            "licenseThreatGroupLevel": 6,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/xalan/serializer@2.7.2?type=jar",
      "hash": "24247f3bb052ee068971",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "serializer",
          "classifier": "",
          "extension": "jar",
          "groupId": "xalan",
          "version": "2.7.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/serializer-2.7.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "W3C",
            "licenseName": "W3C"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/Junit/junit@4.12?type=jar",
      "hash": "2973d150c0dc1fefe998",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "junit",
          "classifier": "",
          "extension": "jar",
          "groupId": "Junit",
          "version": "4.12"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/junit-4.12.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "UNSPECIFIED",
            "licenseName": "Not Provided"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.seleniumhq.selenium/selenium-htmlunit-driver@2.48.2?type=jar",
      "hash": "2d75ff755ae721373cd9",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "selenium-htmlunit-driver",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.seleniumhq.selenium",
          "version": "2.48.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-htmlunit-driver-2.48.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:a-name/org.webjars%20jquery@1.10.2",
      "hash": "37081687a930b9a4a29c",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "org.webjars jquery",
          "qualifier": "",
          "version": "1.10.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/js/jquery/jquery-1.10.2.min.js",
        "webgoat.jar/WebGoat.war/js/libs/jquery-1.10.2.min.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "sonatype",
            "reference": "sonatype-2014-0026",
            "severity": 6.5,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2019-0115",
            "severity": 6.1,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/xml-apis/xml-apis@1.4.01?type=jar",
      "hash": "3789d9fada2d3d458c4b",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "xml-apis",
          "classifier": "",
          "extension": "jar",
          "groupId": "xml-apis",
          "version": "1.4.01"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/xml-apis-1.4.01.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "PUBLIC-DOMAIN",
            "licenseName": "Public Domain"
          },
          {
            "licenseId": "SAX-PD",
            "licenseName": "SAX-PD"
          },
          {
            "licenseId": "W3C",
            "licenseName": "W3C"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "PUBLIC-DOMAIN",
            "licenseName": "Public Domain"
          },
          {
            "licenseId": "W3C",
            "licenseName": "W3C"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:a-name/org.webjars%20modernizr@2.6.2",
      "hash": "3a02cbccb0e1bac1729e",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "org.webjars modernizr",
          "qualifier": "",
          "version": "2.6.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/js/modernizr-2.6.2.min.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/commons-discovery/commons-discovery@0.5?type=jar",
      "hash": "3a8ac816bbe02d2f8852",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "commons-discovery",
          "classifier": "",
          "extension": "jar",
          "groupId": "commons-discovery",
          "version": "0.5"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/commons-discovery-0.5.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.webbitserver/webbit@0.4.14?type=jar",
      "hash": "3bf3f17fe41fb34c4d98",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "webbit",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.webbitserver",
          "version": "0.4.14"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/webbit-0.4.14.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "BSD-UNSPECIFIED",
            "licenseName": "BSD"
          },
          {
            "licenseId": "BSD-2-Clause",
            "licenseName": "BSD-2-Clause"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "sonatype",
            "reference": "sonatype-2014-0177",
            "severity": 5.9,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/net.sourceforge.cssparser/cssparser@0.9.16?type=jar",
      "hash": "3f751904d467537b8ee9",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "cssparser",
          "classifier": "",
          "extension": "jar",
          "groupId": "net.sourceforge.cssparser",
          "version": "0.9.16"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/cssparser-0.9.16.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "LGPL-3.0",
            "licenseName": "LGPL-3.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "LGPL-2.0",
            "licenseName": "LGPL-2.0"
          },
          {
            "licenseId": "LGPL-2.1",
            "licenseName": "LGPL-2.1"
          },
          {
            "licenseId": "LGPL-3.0",
            "licenseName": "LGPL-3.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/axis/axis-ant@1.4?type=jar",
      "hash": "4200087029ba7bc85351",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "axis-ant",
          "classifier": "",
          "extension": "jar",
          "groupId": "axis",
          "version": "1.4"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/axis-ant-1.4.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Not-Declared",
            "licenseName": "Not Declared"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          },
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.hamcrest/hamcrest-core@1.3?type=jar",
      "hash": "42a25dc3219429f0e5d0",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "hamcrest-core",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.hamcrest",
          "version": "1.3"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/hamcrest-core-1.3.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "BSD-2-Clause",
            "licenseName": "BSD-2-Clause"
          },
          {
            "licenseId": "BSD-3-Clause",
            "licenseName": "BSD-3-Clause"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Source-License",
            "licenseName": "No Source License"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/net.sourceforge.htmlunit/htmlunit-core-js@2.17?type=jar",
      "hash": "4316d68f449d42f69faf",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "htmlunit-core-js",
          "classifier": "",
          "extension": "jar",
          "groupId": "net.sourceforge.htmlunit",
          "version": "2.17"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/htmlunit-core-js-2.17.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "MPL-2.0",
            "licenseName": "MPL-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "BSD-3-Clause",
            "licenseName": "BSD-3-Clause"
          },
          {
            "licenseId": "MPL-2.0",
            "licenseName": "MPL-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          },
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.springframework/spring-beans@3.2.4.RELEASE?type=jar",
      "hash": "47b156296a5e9875faa7",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "spring-beans",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.springframework",
          "version": "3.2.4.RELEASE"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/spring-beans-3.2.4.RELEASE.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/javax.activation/activation@1.1.1?type=jar",
      "hash": "485de3a253e23f645037",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "activation",
          "classifier": "",
          "extension": "jar",
          "groupId": "javax.activation",
          "version": "1.1.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/activation-1.1.1.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "CDDL-1.0",
            "licenseName": "CDDL-1.0"
          },
          {
            "licenseId": "CDDL-1.1",
            "licenseName": "CDDL-1.1"
          },
          {
            "licenseId": "GPL-2.0-with-classpath-exception",
            "licenseName": "GPL-2.0-with-classpath-exception"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "CDDL-1.1",
            "licenseName": "CDDL-1.1"
          },
          {
            "licenseId": "GPL-2.0-with-classpath-exception",
            "licenseName": "GPL-2.0-with-classpath-exception"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          },
          {
            "licenseThreatGroupName": "Copyleft",
            "licenseThreatGroupLevel": 9,
            "licenseThreatGroupCategory": "critical"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.springframework.security/spring-security-core@3.2.4.RELEASE?type=jar",
      "hash": "493bc57396a821e8ffa7",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "spring-security-core",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.springframework.security",
          "version": "3.2.4.RELEASE"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/spring-security-core-3.2.4.RELEASE.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "ISC",
            "licenseName": "ISC"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2019-11272",
            "severity": 7.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11272",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2019-3795",
            "severity": 5.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3795",
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/commons-codec/commons-codec@1.10?type=jar",
      "hash": "4b95f4897fa13f2cd904",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "commons-codec",
          "classifier": "",
          "extension": "jar",
          "groupId": "commons-codec",
          "version": "1.10"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/commons-codec-1.10.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "sonatype",
            "reference": "sonatype-2012-0050",
            "severity": 5.3,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/commons-logging/commons-logging@1.2?type=jar",
      "hash": "4bfc12adfe4842bf07b6",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "commons-logging",
          "classifier": "",
          "extension": "jar",
          "groupId": "commons-logging",
          "version": "1.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/commons-logging-1.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.springframework/spring-context@3.2.4.RELEASE?type=jar",
      "hash": "4e6d5edcaeeed6cb332b",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "spring-context",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.springframework",
          "version": "3.2.4.RELEASE"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/spring-context-3.2.4.RELEASE.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/net.sourceforge.nekohtml/nekohtml@1.9.22?type=jar",
      "hash": "4f54af68ecb345f2453f",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "nekohtml",
          "classifier": "",
          "extension": "jar",
          "groupId": "net.sourceforge.nekohtml",
          "version": "1.9.22"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/nekohtml-1.9.22.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/axis/axis-saaj@1.4?type=jar",
      "hash": "581149d1f39125875435",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "axis-saaj",
          "classifier": "",
          "extension": "jar",
          "groupId": "axis",
          "version": "1.4"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/axis-saaj-1.4.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Not-Declared",
            "licenseName": "Not Declared"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Sources",
            "licenseName": "No Sources"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.seleniumhq.selenium/selenium-edge-driver@2.48.2?type=jar",
      "hash": "58ce29b698328f076bb5",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "selenium-edge-driver",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.seleniumhq.selenium",
          "version": "2.48.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-edge-driver-2.48.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/cglib/cglib-nodep@2.1_3?type=jar",
      "hash": "58d3be5953547c0019e5",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "cglib-nodep",
          "classifier": "",
          "extension": "jar",
          "groupId": "cglib",
          "version": "2.1_3"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/cglib-nodep-2.1_3.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Not-Declared",
            "licenseName": "Not Declared"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          },
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.seleniumhq.selenium/selenium-leg-rc@2.48.2?type=jar",
      "hash": "5a8fc124ecfcc2f99ff4",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "selenium-leg-rc",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.seleniumhq.selenium",
          "version": "2.48.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-leg-rc-2.48.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/Log4j/log4j@1.2.17?type=jar",
      "hash": "5af35056b4d257e4b64b",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "log4j",
          "classifier": "",
          "extension": "jar",
          "groupId": "Log4j",
          "version": "1.2.17"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/log4j-1.2.17.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "UNSPECIFIED",
            "licenseName": "Not Provided"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.3?type=jar",
      "hash": "5c4fcae53dd82e2c549b",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "jackson-databind",
          "classifier": "",
          "extension": "jar",
          "groupId": "com.fasterxml.jackson.core",
          "version": "2.6.3"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/jackson-databind-2.6.3.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Source-License",
            "licenseName": "No Source License"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2017-7525",
            "severity": 9.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7525",
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2016-0593",
            "severity": 6.3,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/org.apache.commons/commons-lang3@3.4?type=jar",
      "hash": "5fe28b9518e58819180a",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "commons-lang3",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.apache.commons",
          "version": "3.4"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/commons-lang3-3.4.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:a-name/requirejs@2.1.17",
      "hash": "676c720ba67a2c690d36",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "requirejs",
          "qualifier": "",
          "version": "2.1.17"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/js/libs/require.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "BSD-UNSPECIFIED",
            "licenseName": "BSD"
          },
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/commons-beanutils/commons-beanutils@1.8.3?type=jar",
      "hash": "686ef3410bcf4ab8ce7f",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "commons-beanutils",
          "classifier": "",
          "extension": "jar",
          "groupId": "commons-beanutils",
          "version": "1.8.3"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/commons-beanutils-1.8.3.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2014-0114",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114",
            "threatCategory": "critical"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/org.eclipse.jetty.websocket/websocket-api@9.2.12.v20150709?type=jar",
      "hash": "6bb55e8ef1a385e40f14",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "websocket-api",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.eclipse.jetty.websocket",
          "version": "9.2.12.v20150709"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/websocket-api-9.2.12.v20150709.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/wsdl4j/wsdl4j@1.6.3?type=jar",
      "hash": "6d106a6845a3d3477a15",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "wsdl4j",
          "classifier": "",
          "extension": "jar",
          "groupId": "wsdl4j",
          "version": "1.6.3"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/wsdl4j-1.6.3.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "CPL-1.0",
            "licenseName": "CPL-1.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Source-License",
            "licenseName": "No Source License"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:a-name/org.seleniumhq.selenium.server%20selenium-server@1.0.2",
      "hash": "732c443bf5eeaea8160a",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "org.seleniumhq.selenium.server selenium-server",
          "qualifier": "",
          "version": "1.0.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-leg-rc-2.48.2.jar/com/thoughtworks/selenium/webdriven/htmlutils.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Not-Declared",
            "licenseName": "Not Declared"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/commons-digester/commons-digester@2.1?type=jar",
      "hash": "73a8001e7a54a255eef0",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "commons-digester",
          "classifier": "",
          "extension": "jar",
          "groupId": "commons-digester",
          "version": "2.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/commons-digester-2.1.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/javax.servlet/jstl@1.2?type=jar",
      "hash": "74aca283cd4f4b4f3e42",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "jstl",
          "classifier": "",
          "extension": "jar",
          "groupId": "javax.servlet",
          "version": "1.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/jstl-1.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Not-Declared",
            "licenseName": "Not Declared"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "CDDL-1.0",
            "licenseName": "CDDL-1.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          },
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2015-0254",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0254",
            "threatCategory": "critical"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/commons-collections/commons-collections@3.2.1?type=jar",
      "hash": "761ea405b9b37ced573d",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "commons-collections",
          "classifier": "",
          "extension": "jar",
          "groupId": "commons-collections",
          "version": "3.2.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/commons-collections-3.2.1.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "sonatype",
            "reference": "sonatype-2015-0002",
            "severity": 9.0,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/org.eclipse.jetty.websocket/websocket-client@9.2.12.v20150709?type=jar",
      "hash": "79e439a426514af24e69",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "websocket-client",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.eclipse.jetty.websocket",
          "version": "9.2.12.v20150709"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/websocket-client-9.2.12.v20150709.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.apache.httpcomponents/httpmime@4.5?type=jar",
      "hash": "7bdb321e86724b16af61",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "httpmime",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.apache.httpcomponents",
          "version": "4.5"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/httpmime-4.5.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.1?type=jar",
      "hash": "7e3cecc566df91338c6c",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "httpclient",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.apache.httpcomponents",
          "version": "4.5.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/httpclient-4.5.1.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0359",
            "severity": 7.5,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/hsqldb/hsqldb@1.8.0.10?type=jar",
      "hash": "7e9978fdb754bce5fcd5",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "hsqldb",
          "classifier": "",
          "extension": "jar",
          "groupId": "hsqldb",
          "version": "1.8.0.10"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/hsqldb-1.8.0.10.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "BSD-3-Clause",
            "licenseName": "BSD-3-Clause"
          },
          {
            "licenseId": "UNKNOWN",
            "licenseName": "Non-Standard"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "BSD-UNSPECIFIED",
            "licenseName": "BSD"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Non Standard",
            "licenseThreatGroupLevel": 6,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.apache.tiles/tiles-api@3.0.5?type=jar",
      "hash": "7f0d9bdb153119b45a0f",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "tiles-api",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.apache.tiles",
          "version": "3.0.5"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/tiles-api-3.0.5.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:a-name/hubba@0.0.1-19",
      "hash": "81d1be23b8fc6a5bdae6",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "hubba",
          "qualifier": "",
          "version": "0.0.1-19"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/js/html5shiv.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Not-Declared",
            "licenseName": "Not Declared"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.seleniumhq.selenium/selenium-ie-driver@2.48.2?type=jar",
      "hash": "8278d774a0945374e1a2",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "selenium-ie-driver",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.seleniumhq.selenium",
          "version": "2.48.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-ie-driver-2.48.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:a-name/selenium-webdriver@2.53.1",
      "hash": "83085d0cce6167806ec1",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "selenium-webdriver",
          "qualifier": "",
          "version": "2.53.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-safari-driver-2.48.2.jar/org/openqa/selenium/safari/client.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.springframework/spring-web@3.2.4.RELEASE?type=jar",
      "hash": "8daf0bd1172cb253d936",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "spring-web",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.springframework",
          "version": "3.2.4.RELEASE"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/spring-web-3.2.4.RELEASE.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2013-6429",
            "severity": 6.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6429",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-0054",
            "severity": 6.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0054",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-0225",
            "severity": 8.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0225",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2015-3192",
            "severity": 5.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3192",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-11039",
            "severity": 5.9,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11039",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-1272",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1272",
            "threatCategory": "critical"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/org.apache.commons/commons-exec@1.3?type=jar",
      "hash": "8dfb9facd0830a27b1b5",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "commons-exec",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.apache.commons",
          "version": "1.3"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/commons-exec-1.3.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.slf4j/slf4j-api@1.7.12?type=jar",
      "hash": "8e20852d05222dc286bf",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "slf4j-api",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.slf4j",
          "version": "1.7.12"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/slf4j-api-1.7.12.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.apache.tiles/tiles-core@3.0.5?type=jar",
      "hash": "8f38e1390dac6bd01dc6",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "tiles-core",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.apache.tiles",
          "version": "3.0.5"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/tiles-core-3.0.5.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.seleniumhq.selenium/selenium-firefox-driver@2.48.2?type=jar",
      "hash": "947d3e890dac4ee569af",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "selenium-firefox-driver",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.seleniumhq.selenium",
          "version": "2.48.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-firefox-driver-2.48.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "sonatype",
            "reference": "sonatype-2018-0334",
            "severity": 7.6,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/axis/axis@1.4?type=jar",
      "hash": "94a9ce681a42d0352b3a",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "axis",
          "classifier": "",
          "extension": "jar",
          "groupId": "axis",
          "version": "1.4"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/axis-1.4.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-1.1",
            "licenseName": "Apache-1.1"
          },
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2007-2353",
            "severity": 5.0,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2353",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2012-5784",
            "severity": 5.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5784",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-3596",
            "severity": 5.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3596",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2019-0227",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0227",
            "threatCategory": "critical"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/org.springframework.security/spring-security-config@3.2.4.RELEASE?type=jar",
      "hash": "952da051fc959b215c8e",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "spring-security-config",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.springframework.security",
          "version": "3.2.4.RELEASE"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/spring-security-config-3.2.4.RELEASE.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2016-5007",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5007",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-1199",
            "severity": 5.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1199",
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:a-name/com.eventsourcing%20h2@1.4.192",
      "hash": "95b0c6866f97346938b1",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "com.eventsourcing h2",
          "qualifier": "",
          "version": "1.4.192"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/h2-1.4.190.jar/org/h2/util/data.zip/org/h2/server/web/res/table.js",
        "webgoat.jar/WebGoat.war/WEB-INF/lib/h2-1.4.190.jar/org/h2/util/data.zip/org/h2/server/web/res/tree.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "UNSPECIFIED",
            "licenseName": "Not Provided"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.eclipse.jetty.websocket/websocket-common@9.2.12.v20150709?type=jar",
      "hash": "97219331c7ec90b2964b",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "websocket-common",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.eclipse.jetty.websocket",
          "version": "9.2.12.v20150709"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/websocket-common-9.2.12.v20150709.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.seleniumhq.selenium/selenium-java@2.48.2?type=jar",
      "hash": "97e2c7b45cfe3e11a33d",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "selenium-java",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.seleniumhq.selenium",
          "version": "2.48.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-java-2.48.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Sources",
            "licenseName": "No Sources"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.springframework/spring-webmvc@3.2.4.RELEASE?type=jar",
      "hash": "99c0303b36c421b3c43d",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "spring-webmvc",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.springframework",
          "version": "3.2.4.RELEASE"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/spring-webmvc-3.2.4.RELEASE.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2014-1904",
            "severity": 4.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1904",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-3625",
            "severity": 5.0,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3625",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2015-5211",
            "severity": 8.6,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5211",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2016-9878",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9878",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-1271",
            "severity": 5.9,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1271",
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0651",
            "severity": 5.0,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/xerces/xercesImpl@2.11.0?type=jar",
      "hash": "9bb329db1cfc4e22462c",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "xercesImpl",
          "classifier": "",
          "extension": "jar",
          "groupId": "xerces",
          "version": "2.11.0"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/xercesImpl-2.11.0.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "W3C",
            "licenseName": "W3C"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2012-0881",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0881",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2013-4002",
            "severity": 7.1,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4002",
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0348",
            "severity": 5.9,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:a-name/jquery-form@3.50.0",
      "hash": "9c06887e03feb6c996ab",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "jquery-form",
          "qualifier": "",
          "version": "3.50.0"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/js/jquery_form/jquery.form.js",
        "webgoat.jar/WebGoat.war/js/libs/jquery.form.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "GPL-2.0",
            "licenseName": "GPL-2.0"
          },
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Copyleft",
            "licenseThreatGroupLevel": 9,
            "licenseThreatGroupCategory": "critical"
          },
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:a-name/underscore@1.7.0",
      "hash": "9ed04c851383b355a7db",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "underscore",
          "qualifier": "",
          "version": "1.7.0"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/js/backbone/underscore-min.js",
        "webgoat.jar/WebGoat.war/js/backbone/underscore.js",
        "webgoat.jar/WebGoat.war/js/libs/underscore-min.js",
        "webgoat.jar/WebGoat.war/js/libs/underscore.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.6.0?type=jar",
      "hash": "a0990e2e812ac6639b6c",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "jackson-annotations",
          "classifier": "",
          "extension": "jar",
          "groupId": "com.fasterxml.jackson.core",
          "version": "2.6.0"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/jackson-annotations-2.6.0.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Source-License",
            "licenseName": "No Source License"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.seleniumhq.selenium/selenium-api@2.48.2?type=jar",
      "hash": "a0ae87eb600f042cf678",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "selenium-api",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.seleniumhq.selenium",
          "version": "2.48.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-api-2.48.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "BSD-UNSPECIFIED",
            "licenseName": "BSD"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/apache-taglibs/standard@1.1.2?type=jar",
      "hash": "a17e8a4d9a1f7fcc5eed",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "standard",
          "classifier": "",
          "extension": "jar",
          "groupId": "apache-taglibs",
          "version": "1.1.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/standard-1.1.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Sources",
            "licenseName": "No Sources"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2015-0254",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0254",
            "threatCategory": "critical"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:a-name/backbone@1.1.2",
      "hash": "a85f630ad8ac27df06e3",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "backbone",
          "qualifier": "",
          "version": "1.1.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/js/backbone/backbone-min.js",
        "webgoat.jar/WebGoat.war/js/backbone/backbone.js",
        "webgoat.jar/WebGoat.war/js/libs/backbone-min.js",
        "webgoat.jar/WebGoat.war/js/libs/backbone.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.slf4j/jcl-over-slf4j@1.7.12?type=jar",
      "hash": "adef7a9e1263298255fd",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "jcl-over-slf4j",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.slf4j",
          "version": "1.7.12"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/jcl-over-slf4j-1.7.12.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/commons-io/commons-io@2.4?type=jar",
      "hash": "b1b6ea3b7e4aa4f49250",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "commons-io",
          "classifier": "",
          "extension": "jar",
          "groupId": "commons-io",
          "version": "2.4"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/commons-io-2.4.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/axis/axis-jaxrpc@1.4?type=jar",
      "hash": "b393f1f0c0d95b68c86d",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "axis-jaxrpc",
          "classifier": "",
          "extension": "jar",
          "groupId": "axis",
          "version": "1.4"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/axis-jaxrpc-1.4.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Sources",
            "licenseName": "No Sources"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:a-name/org.webjars%20bootstrap@3.1.1",
      "hash": "b72e6b076e32fb3a87f6",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "org.webjars bootstrap",
          "qualifier": "",
          "version": "3.1.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugins/bootstrap/js/bootstrap.min.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2018-14042",
            "severity": 6.1,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14042",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2019-8331",
            "severity": 6.1,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8331",
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2016-0129",
            "severity": 5.4,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/org.seleniumhq.selenium/selenium-support@2.48.2?type=jar",
      "hash": "bc39b5db73598c65ebae",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "selenium-support",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.seleniumhq.selenium",
          "version": "2.48.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-support-2.48.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/axis/axis-wsdl4j@1.5.1?type=jar",
      "hash": "bd804633b9c2cf062586",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "axis-wsdl4j",
          "classifier": "",
          "extension": "jar",
          "groupId": "axis",
          "version": "1.5.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/axis-wsdl4j-1.5.1.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Not-Declared",
            "licenseName": "Not Declared"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Sources",
            "licenseName": "No Sources"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.eclipse.jetty/jetty-io@9.2.12.v20150709?type=jar",
      "hash": "c02e9e303d231a589e0c",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "jetty-io",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.eclipse.jetty",
          "version": "9.2.12.v20150709"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/jetty-io-9.2.12.v20150709.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.seleniumhq.selenium/selenium-remote-driver@2.48.2?type=jar",
      "hash": "c35f3cbc64b254ae931c",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "selenium-remote-driver",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.seleniumhq.selenium",
          "version": "2.48.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/selenium-remote-driver-2.48.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/commons-fileupload/commons-fileupload@1.3.1?type=jar",
      "hash": "c621b54583719ac03104",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "commons-fileupload",
          "classifier": "",
          "extension": "jar",
          "groupId": "commons-fileupload",
          "version": "1.3.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/commons-fileupload-1.3.1.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2016-1000031",
            "severity": 9.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2016-3092",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092",
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2014-0173",
            "severity": 5.3,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/com.google.guava/guava@18.0?type=jar",
      "hash": "cce0823396aa693798f8",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "guava",
          "classifier": "",
          "extension": "jar",
          "groupId": "com.google.guava",
          "version": "18.0"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/guava-18.0.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "PUBLIC-DOMAIN",
            "licenseName": "Public Domain"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2018-10237",
            "severity": 5.9,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10237",
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/org.w3c.css/sac@1.3?type=jar",
      "hash": "cdb2dcb4e22b83d6b32b",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "sac",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.w3c.css",
          "version": "1.3"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/sac-1.3.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "W3C",
            "licenseName": "W3C"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "W3C",
            "licenseName": "W3C"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:a-name/org.owasp.webgoat%20webgoat-container@7.0",
      "hash": "cf589d4746179e58dc8e",
      "componentIdentifier": {
        "format": "a-name",
        "coordinates": {
          "name": "org.owasp.webgoat webgoat-container",
          "qualifier": "",
          "version": "7.0"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/js/DOMXSS_backup.js",
        "webgoat.jar/WebGoat.war/js/application.js",
        "webgoat.jar/WebGoat.war/js/goatApp/controller/LessonController.js",
        "webgoat.jar/WebGoat.war/js/goatApp/controller/MenuController.js",
        "webgoat.jar/WebGoat.war/js/goatApp/goatApp.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/CookieCollection.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/CookieModel.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/HTMLContentModel.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/HintCollection.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/HintModel.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/LessonContentModel.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/LessonInfoModel.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/LessonPlanModel.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/MenuCollection.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/MenuData.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/MenuModel.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/ParamModel.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/SolutionModel.js",
        "webgoat.jar/WebGoat.war/js/goatApp/model/SourceModel.js",
        "webgoat.jar/WebGoat.war/js/goatApp/support/GoatUtils.js",
        "webgoat.jar/WebGoat.war/js/goatApp/support/goatConstants.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/CookieView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/GoatRouter.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/HelpControlsView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/HelpView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/HintView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/LessonContentView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/MenuButtonView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/MenuItemView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/MenuStageView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/MenuView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/ParamView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/PlanView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/SolutionView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/SourceView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/TitleView.js",
        "webgoat.jar/WebGoat.war/js/goatApp/view/UserAndInfoView.js",
        "webgoat.jar/WebGoat.war/js/instructor/DOMXSS_i.js",
        "webgoat.jar/WebGoat.war/js/main.js",
        "webgoat.jar/WebGoat.war/js/makeWindow.js",
        "webgoat.jar/WebGoat.war/js/toggle.js",
        "webgoat.jar/WebGoat.war/plugins/nanoScroller/jquery.nanoscroller.min.js"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "GPL-2.0",
            "licenseName": "GPL-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Not-Supported",
            "licenseName": "Not Supported"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Copyleft",
            "licenseThreatGroupLevel": 9,
            "licenseThreatGroupCategory": "critical"
          },
          {
            "licenseThreatGroupName": "Sonatype Informational",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.springframework/spring-core@3.2.4.RELEASE?type=jar",
      "hash": "d36bed1dbca3f725bb5a",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "spring-core",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.springframework",
          "version": "3.2.4.RELEASE"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/spring-core-3.2.4.RELEASE.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2014-3578",
            "severity": 5.0,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3578",
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/xalan/xalan@2.7.2?type=jar",
      "hash": "d55d3f02a56ec4c25695",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "xalan",
          "classifier": "",
          "extension": "jar",
          "groupId": "xalan",
          "version": "2.7.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/xalan-2.7.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "W3C",
            "licenseName": "W3C"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/javax.transaction/javax.transaction-api@1.2?type=jar",
      "hash": "d81aff979d603edd90dc",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "javax.transaction-api",
          "classifier": "",
          "extension": "jar",
          "groupId": "javax.transaction",
          "version": "1.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/javax.transaction-api-1.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "CDDL-1.1",
            "licenseName": "CDDL-1.1"
          },
          {
            "licenseId": "Generic-Open-Source-Clause",
            "licenseName": "Generic-Open-Source-Clause"
          },
          {
            "licenseId": "GPL-2.0-with-classpath-exception",
            "licenseName": "GPL-2.0-with-classpath-exception"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "CDDL-1.1",
            "licenseName": "CDDL-1.1"
          },
          {
            "licenseId": "GPL-2.0-with-classpath-exception",
            "licenseName": "GPL-2.0-with-classpath-exception"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          },
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Copyleft",
            "licenseThreatGroupLevel": 9,
            "licenseThreatGroupCategory": "critical"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.eclipse.jetty/jetty-util@9.2.12.v20150709?type=jar",
      "hash": "d99d38adfdb5ec677643",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "jetty-util",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.eclipse.jetty",
          "version": "9.2.12.v20150709"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/jetty-util-9.2.12.v20150709.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          },
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2017-9735",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9735",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-12536",
            "severity": 5.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12536",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2019-10241",
            "severity": 6.1,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10241",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2019-10246",
            "severity": 5.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10246",
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/com.h2database/h2@1.4.190?type=jar",
      "hash": "df71536d44e3b07f0c15",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "h2",
          "classifier": "",
          "extension": "jar",
          "groupId": "com.h2database",
          "version": "1.4.190"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/h2-1.4.190.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          },
          {
            "licenseId": "MPL-2.0",
            "licenseName": "MPL-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "BSD-3-Clause",
            "licenseName": "BSD-3-Clause"
          },
          {
            "licenseId": "EPL-1.0",
            "licenseName": "EPL-1.0"
          },
          {
            "licenseId": "LGPL-3.0",
            "licenseName": "LGPL-3.0"
          },
          {
            "licenseId": "MPL-1.1",
            "licenseName": "MPL-1.1"
          }
        ],
        "overriddenLicenses": [
          {
            "licenseId": "ZPL-2.1",
            "licenseName": "ZPL-2.1"
          }
        ],
        "status": "Overridden",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2018-14335",
            "severity": 6.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14335",
            "threatCategory": "severe"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/io.netty/netty@3.5.2.Final?type=jar",
      "hash": "e6fb74a0699abe108969",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "netty",
          "classifier": "",
          "extension": "jar",
          "groupId": "io.netty",
          "version": "3.5.2.Final"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/netty-3.5.2.Final.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          },
          {
            "licenseId": "BSD-3-Clause",
            "licenseName": "BSD-3-Clause"
          },
          {
            "licenseId": "MIT",
            "licenseName": "MIT"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2014-0193",
            "severity": 5.0,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0193",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2015-2156",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2156",
            "threatCategory": "critical"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/org.apache.httpcomponents/httpcore@4.4.3?type=jar",
      "hash": "e876a79d561e5c6207b7",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "httpcore",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.apache.httpcomponents",
          "version": "4.4.3"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/httpcore-4.4.3.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/javax.mail/javax.mail-api@1.5.4?type=jar",
      "hash": "e8f442af51a2cc8aea57",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "javax.mail-api",
          "classifier": "",
          "extension": "jar",
          "groupId": "javax.mail",
          "version": "1.5.4"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/javax.mail-api-1.5.4.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "CDDL-1.1",
            "licenseName": "CDDL-1.1"
          },
          {
            "licenseId": "GPL-2.0-with-classpath-exception",
            "licenseName": "GPL-2.0-with-classpath-exception"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "CDDL-1.1",
            "licenseName": "CDDL-1.1"
          },
          {
            "licenseId": "GPL-2.0-with-classpath-exception",
            "licenseName": "GPL-2.0-with-classpath-exception"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Weak Copyleft",
            "licenseThreatGroupLevel": 2,
            "licenseThreatGroupCategory": "moderate"
          },
          {
            "licenseThreatGroupName": "Copyleft",
            "licenseThreatGroupLevel": 9,
            "licenseThreatGroupCategory": "critical"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.18?type=jar",
      "hash": "ec30f76601f7010abbc0",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "htmlunit",
          "classifier": "",
          "extension": "jar",
          "groupId": "net.sourceforge.htmlunit",
          "version": "2.18"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/htmlunit-2.18.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/com.google.code.gson/gson@2.3.1?type=jar",
      "hash": "ecb6e1f8e4b0e84c4b88",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "gson",
          "classifier": "",
          "extension": "jar",
          "groupId": "com.google.code.gson",
          "version": "2.3.1"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/gson-2.3.1.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.springframework/spring-expression@3.2.4.RELEASE?type=jar",
      "hash": "edde2efe828f5890f57a",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "spring-expression",
          "classifier": "",
          "extension": "jar",
          "groupId": "org.springframework",
          "version": "3.2.4.RELEASE"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/spring-expression-3.2.4.RELEASE.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "Apache-2.0",
            "licenseName": "Apache-2.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2018-1257",
            "severity": 6.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1257",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-1270",
            "severity": 9.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1270",
            "threatCategory": "critical"
          }
        ]
      }
    },
    {
      "packageUrl": "pkg:maven/ecs/ecs@1.4.2?type=jar",
      "hash": "f9bc5fdde56d60876c17",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "ecs",
          "classifier": "",
          "extension": "jar",
          "groupId": "ecs",
          "version": "1.4.2"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/WEB-INF/lib/ecs-1.4.2.jar"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "Apache-1.1",
            "licenseName": "Apache-1.1"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "No-Sources",
            "licenseName": "No Sources"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Liberal",
            "licenseThreatGroupLevel": 0,
            "licenseThreatGroupCategory": "no-threat"
          },
          {
            "licenseThreatGroupName": "Sonatype Special Licenses",
            "licenseThreatGroupLevel": 5,
            "licenseThreatGroupCategory": "severe"
          }
        ]
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": "pkg:maven/org.owasp.webgoat/webgoat-container@7.0?type=war",
      "hash": "0153d2c62dca2886d06f",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "webgoat-container",
          "classifier": "",
          "extension": "war",
          "groupId": "org.owasp.webgoat",
          "version": "7.0"
        }
      },
      "proprietary": true,
      "matchState": "similar",
      "pathnames": [
        "webgoat.jar/WebGoat.war"
      ],
      "licenseData": {
        "declaredLicenses": [
          {
            "licenseId": "GPL-2.0",
            "licenseName": "GPL-2.0"
          }
        ],
        "observedLicenses": [
          {
            "licenseId": "GPL-1.0",
            "licenseName": "GPL-1.0"
          },
          {
            "licenseId": "GPL-2.0",
            "licenseName": "GPL-2.0"
          },
          {
            "licenseId": "GPL-3.0",
            "licenseName": "GPL-3.0"
          }
        ],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": [
          {
            "licenseThreatGroupName": "Copyleft",
            "licenseThreatGroupLevel": 9,
            "licenseThreatGroupCategory": "critical"
          }
        ]
      },
      "securityData": {
        "securityIssues": [
          {
            "source": "cve",
            "reference": "CVE-2007-2353",
            "severity": 5.0,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2353",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2012-0881",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0881",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2012-5784",
            "severity": 5.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5784",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2013-4002",
            "severity": 7.1,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4002",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2013-6429",
            "severity": 6.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6429",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-0054",
            "severity": 6.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0054",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-0114",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-0193",
            "severity": 5.0,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0193",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-0225",
            "severity": 8.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0225",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-1904",
            "severity": 4.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1904",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-3578",
            "severity": 5.0,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3578",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-3596",
            "severity": 5.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3596",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2014-3625",
            "severity": 5.0,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3625",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2015-0254",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0254",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2015-2156",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2156",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2015-3192",
            "severity": 5.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3192",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2015-5211",
            "severity": 8.6,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5211",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2016-1000031",
            "severity": 9.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2016-3092",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2016-5007",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5007",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2016-9878",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9878",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2016-9879",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9879",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2017-7525",
            "severity": 9.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7525",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2017-9735",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9735",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-10237",
            "severity": 5.9,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10237",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-11039",
            "severity": 5.9,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11039",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-1199",
            "severity": 5.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1199",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-12536",
            "severity": 5.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12536",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-1257",
            "severity": 6.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1257",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-1270",
            "severity": 9.8,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1270",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-1271",
            "severity": 5.9,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1271",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-1272",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1272",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-14042",
            "severity": 6.1,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14042",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2018-14335",
            "severity": 6.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14335",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2019-0227",
            "severity": 7.5,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0227",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2019-10241",
            "severity": 6.1,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10241",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2019-10246",
            "severity": 5.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10246",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2019-11272",
            "severity": 7.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11272",
            "threatCategory": "critical"
          },
          {
            "source": "cve",
            "reference": "CVE-2019-3795",
            "severity": 5.3,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3795",
            "threatCategory": "severe"
          },
          {
            "source": "cve",
            "reference": "CVE-2019-8331",
            "severity": 6.1,
            "status": "Open",
            "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8331",
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2012-0050",
            "severity": 5.3,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2014-0026",
            "severity": 6.5,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2014-0173",
            "severity": 5.3,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2014-0177",
            "severity": 5.9,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2015-0002",
            "severity": 9.0,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2016-0129",
            "severity": 5.4,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2016-0397",
            "severity": 7.5,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2016-0593",
            "severity": 6.3,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0348",
            "severity": 5.9,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0355",
            "severity": 7.5,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0359",
            "severity": 7.5,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0507",
            "severity": 5.0,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0641",
            "severity": 7.1,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2017-0651",
            "severity": 5.0,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2018-0334",
            "severity": 7.6,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2019-0115",
            "severity": 6.1,
            "status": "Open",
            "url": null,
            "threatCategory": "severe"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2019-0190",
            "severity": 9.8,
            "status": "Open",
            "url": null,
            "threatCategory": "critical"
          },
          {
            "source": "sonatype",
            "reference": "sonatype-2019-0341",
            "severity": 3.7,
            "status": "Open",
            "url": null,
            "threatCategory": "moderate"
          }
        ]
      }
    },
    {
      "packageUrl": null,
      "hash": "a3edc41966777c6d3823",
      "componentIdentifier": null,
      "proprietary": true,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "9543482c494e7afcec63",
      "componentIdentifier": null,
      "proprietary": true,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/access-control-matrix-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": "pkg:maven/11/22@33?classifier=44&type=55",
      "hash": "b8eaebc9686e016687bd",
      "componentIdentifier": {
        "format": "maven",
        "coordinates": {
          "artifactId": "22",
          "classifier": "44",
          "extension": "55",
          "groupId": "11",
          "version": "33"
        }
      },
      "proprietary": false,
      "matchState": "exact",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/back-doors-1.0.jar"
      ],
      "licenseData": {
        "declaredLicenses": [],
        "observedLicenses": [],
        "overriddenLicenses": [],
        "status": "Open",
        "effectiveLicenseThreats": []
      },
      "securityData": {
        "securityIssues": []
      }
    },
    {
      "packageUrl": null,
      "hash": "5791d9b44807aea66484",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/basic-authentication-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "5c48f1f0688a7c88b53b",
      "componentIdentifier": null,
      "proprietary": true,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/blind-numeric-sql-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "ad26e637f54503eae730",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/blind-script-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "99110762261cfed61862",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/blind-string-sql-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "708c9807a2268f38d222",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/bypass-html-field-restrictions-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "ff878363f8b7e6485716",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/challenge-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "548271900358caefa177",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/client-side-filtering-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "00b2069f22c704ee6e48",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/client-side-validation-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "169c93ca9ca7ebc8b112",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/command-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "dfc305ea015cd787af5a",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/common-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "7287b835112e093e24b8",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/concurrency-cart-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "9517d942728946e00358",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/cross-site-scripting-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "ad5e08eac229fee3705f",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/csrf-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "ed37a209f03fa76ae937",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/csrf-prompt-by-pass-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "41b3822e74da79dce1f2",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/csrf-token-by-pass-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "2e57889283f2d73c1f42",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/dangerous-eval-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "4045bc30cb4b5e90dd18",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/db-cross-site-scripting-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "0202089c07878fc200c8",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/db-sql-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "964c50721263efddd5bc",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/dom-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "10e5e4b1f582da6a7df7",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/dom-xss-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "b9e94cd33985f5f7fa90",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/dos-login-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "ea7f4601e72defd1888b",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/encoding-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "1d1b2abcaedd8463ff07",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/fail-open-authentication-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "d0b7b9bbf263a081f02a",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/forced-browsing-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "26ebad56c8db423c8cac",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/forgot-password-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "06f3d86364bc0eb70fa5",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/goat-hills-financial-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "e61dd0d482acf08e0631",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/hidden-field-tampering-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "d4687583a73c871701ae",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/how-to-work-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "02836a4644b214820159",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/html-clues-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "42f81ebc7d3f04b371f9",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/http-basics-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "0c3d52392cae6340536b",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/http-only-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "21deb6778f0e95171941",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/insecure-login-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "402a6850edab6adca50c",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/java-script-validation-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "d8564f7742faf52a2898",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/json-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "20f4133418e36eabbe85",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/lesson-template-legacy-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "3425aaea6a6b0b807904",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/log-spoofing-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "6d73a122721bc160b4a0",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/malicious-file-execution-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "544692c73c43bcc8cf34",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/multi-level-login1-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "fe082b2fff75a44c30a7",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/multi-level-login2-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "82bdc2f207ba2d216e7c",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/off-by-one-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "bc875a4d7c87ac02d563",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/password-strength-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "55f2676b804b543636b9",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/path-based-access-control-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "0bdb11b975c26ccda260",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/phishing-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "10415987f61fb140f28c",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/reflected-xss-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "b147fa9b7bef5a88c40f",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/remote-admin-flaw-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "047ba1d9f00757323ec5",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/role-based-access-control-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "836fad501cb19f7511f3",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/same-origin-policy-protection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "512e2a8d392b957e2b33",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/session-fixation-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "b8f992d8b313e7abe95e",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/silent-transactions-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "156a1f982a17973fd7e0",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/soap-request-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "3341feab8aa6f78be91c",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/sql-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "d3bc91aea72306cbf9aa",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/sql-numeric-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "4b357ef9c57eb53d128e",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/sql-string-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "253003bcdf2e7ed92c66",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/stored-xss-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "cdf974c534d4334193e7",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/thread-safety-problem-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "b82e0cc93c559997a50b",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/trace-xss-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "ed6141781e53aa91cbca",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/unchecked-email-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "e998ccedcba5751bb1c1",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/weak-authentication-cookie-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "69387d5eb21918b6903a",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/weak-session-id-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "44b839d9890597b7ccf5",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/wsdl-scanning-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "f5debec3a9187617d87a",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/ws-sax-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "a501b91e83a374385342",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/ws-sql-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "ea50653584b86768da0d",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/xml-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "e00da358b0877ca12996",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/xpath-injection-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    },
    {
      "packageUrl": null,
      "hash": "51f0789a2668e73bf789",
      "componentIdentifier": null,
      "proprietary": false,
      "matchState": "unknown",
      "pathnames": [
        "webgoat.jar/WebGoat.war/plugin_lessons/zip-bomb-1.0.jar"
      ],
      "licenseData": null,
      "securityData": null
    }
  ],
  "matchSummary": {
    "totalComponentCount": 167,
    "knownComponentCount": 100
  }
}