<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:4ffe8b79-1a2d-4fb4-b47c-4be38a8a6f10" version="1">
  <metadata>
    <timestamp>2022-06-09T23:40:38Z</timestamp>
    <tools>
      <tool>
        <vendor>anchore</vendor>
        <name>grype</name>
        <version>[not provided]</version>
      </tool>
    </tools>
    <component type="container">
      <name>user-input</name>
      <version>sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368</version>
    </component>
  </metadata>
  <components>
    <component bom-ref="package-1-id" type="library">
      <name>package-1</name>
      <version>1.0.1</version>
    </component>
    <component bom-ref="package-2-id" type="library">
      <name>package-2</name>
      <version>2.0.1</version>
      <licenses>
        <license>
          <name>MIT</name>
        </license>
        <license>
          <name>Apache-v2</name>
        </license>
      </licenses>
    </component>
  </components>
  <vulnerabilities>
    <vulnerability>
      <id>CVE-1999-0001</id>
      <source>
        <name>source-1</name>
        <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0001</url>
      </source>
      <ratings>
        <rating>
          <severity>low</severity>
        </rating>
        <rating>
          <score>4</score>
          <method>CVSSv3</method>
          <vector>another vector</vector>
        </rating>
      </ratings>
      <description>1999-01 description</description>
      <advisories></advisories>
      <analysis>
        <state>in_triage</state>
      </analysis>
      <affects>
        <target>
          <ref>package-1-id</ref>
        </target>
      </affects>
      <properties></properties>
    </vulnerability>
    <vulnerability>
      <id>CVE-1999-0002</id>
      <source>
        <name>source-2</name>
        <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0002</url>
      </source>
      <ratings>
        <rating>
          <severity>critical</severity>
        </rating>
        <rating>
          <score>1</score>
          <method>CVSSv2</method>
          <vector>vector</vector>
        </rating>
      </ratings>
      <description>1999-02 description</description>
      <advisories></advisories>
      <analysis>
        <state>in_triage</state>
      </analysis>
      <affects>
        <target>
          <ref>package-2-id</ref>
        </target>
      </affects>
      <properties></properties>
    </vulnerability>
  </vulnerabilities>
</bom>