{"action":"created","issue":{"url":"https://api.github.com/repos/oasp/oasp4j/issues/285","labels_url":"https://api.github.com/repos/oasp/oasp4j/issues/285/labels{/name}","comments_url":"https://api.github.com/repos/oasp/oasp4j/issues/285/comments","events_url":"https://api.github.com/repos/oasp/oasp4j/issues/285/events","html_url":"https://github.com/oasp/oasp4j/issues/285","id":94741177,"number":285,"title":"Consider using victims to check for vulnerabilities","user":{"login":"hweber","id":6253895,"avatar_url":"https://avatars.githubusercontent.com/u/6253895?v=3","gravatar_id":"","url":"https://api.github.com/users/hweber","html_url":"https://github.com/hweber","followers_url":"https://api.github.com/users/hweber/followers","following_url":"https://api.github.com/users/hweber/following{/other_user}","gists_url":"https://api.github.com/users/hweber/gists{/gist_id}","starred_url":"https://api.github.com/users/hweber/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hweber/subscriptions","organizations_url":"https://api.github.com/users/hweber/orgs","repos_url":"https://api.github.com/users/hweber/repos","events_url":"https://api.github.com/users/hweber/events{/privacy}","received_events_url":"https://api.github.com/users/hweber/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-13T15:00:05Z","updated_at":"2015-09-28T13:16:29Z","closed_at":null,"body":"To enhance the security of applications built with OASP, dependencies imported through the recursive dependency resolution mechanism of maven should be checked for known security vulnerabilities.\r\n\r\nVictims is a tool that checks a maven build tree against a database of known vulnerabilities. The tool can be integrated through a maven enforcer plugin (https://github.com/victims/victims-enforcer), the database itself is available here: https://github.com/victims/victims-cve-db."},"comment":{"url":"https://api.github.com/repos/oasp/oasp4j/issues/comments/143740512","html_url":"https://github.com/oasp/oasp4j/issues/285#issuecomment-143740512","issue_url":"https://api.github.com/repos/oasp/oasp4j/issues/285","id":143740512,"user":{"login":"maihacke","id":6260677,"avatar_url":"https://avatars.githubusercontent.com/u/6260677?v=3","gravatar_id":"","url":"https://api.github.com/users/maihacke","html_url":"https://github.com/maihacke","followers_url":"https://api.github.com/users/maihacke/followers","following_url":"https://api.github.com/users/maihacke/following{/other_user}","gists_url":"https://api.github.com/users/maihacke/gists{/gist_id}","starred_url":"https://api.github.com/users/maihacke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maihacke/subscriptions","organizations_url":"https://api.github.com/users/maihacke/orgs","repos_url":"https://api.github.com/users/maihacke/repos","events_url":"https://api.github.com/users/maihacke/events{/privacy}","received_events_url":"https://api.github.com/users/maihacke/received_events","type":"User","site_admin":false},"created_at":"2015-09-28T13:16:29Z","updated_at":"2015-09-28T13:16:29Z","body":"We made a small proof of concept with victims db. We had a big a mount of false positives and at least one known security bug which was available in cve-db, but not detected by victims db. So I consider it as worthless at them moment."}}