change in namespace as this is now an OWASP project

Former-commit-id: dc00f98a142bef2560d90f3b851844f352fbf262

src/main/java/org/owasp/dependencycheck/App.java

@@ -0,0 +1,150 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.LogManager;
+import java.util.logging.Logger;
+import org.apache.commons.cli.ParseException;
+import org.owasp.dependencycheck.reporting.ReportGenerator;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.utils.CliParser;
+
+/*
+ * This file is part of App.
+ *
+ * App is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later
+ * version.
+ *
+ * App is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+ * A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * App. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+/**
+ * The command line interface for the DependencyCheck application.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class App {
+
+    private static final String LOG_PROPERTIES_FILE = "configuration/log.properties";
+
+    /**
+     * @param args the command line arguments
+     */
+    public static void main(String[] args) {
+        prepareLogger();
+        App app = new App();
+        app.run(args);
+    }
+
+    private static void prepareLogger() {
+        //while java doc for JUL says to use preferences api - it throws an exception...
+        //Preferences.systemRoot().put("java.util.logging.config.file", "log.properties");
+        //System.getProperties().put("java.util.logging.config.file", "configuration/log.properties");
+
+        //removed the file handler. since this is a console app - just write to console.
+//        File dir = new File("logs");
+//        if (!dir.exists()) {
+//            dir.mkdir();
+//        }
+        try {
+            InputStream in = App.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
+            LogManager.getLogManager().reset();
+            LogManager.getLogManager().readConfiguration(in);
+        } catch (IOException ex) {
+            System.err.println(ex.toString());
+            Logger.getLogger(App.class.getName()).log(Level.SEVERE, null, ex);
+        } catch (SecurityException ex) {
+            Logger.getLogger(App.class.getName()).log(Level.SEVERE, null, ex);
+        }
+    }
+
+    /**
+     * main CLI entry-point into the application.
+     *
+     * @param args the command line arguments
+     */
+    public void run(String[] args) {
+
+        CliParser cli = new CliParser();
+        try {
+            cli.parse(args);
+        } catch (FileNotFoundException ex) {
+            System.err.println(ex.getMessage());
+            cli.printHelp();
+            Logger.getLogger(App.class.getName()).log(Level.WARNING, null, ex);
+            return;
+        } catch (ParseException ex) {
+            System.err.println(ex.getMessage());
+            cli.printHelp();
+            Logger.getLogger(App.class.getName()).log(Level.INFO, null, ex);
+            return;
+        }
+
+        if (cli.isGetVersion()) {
+            cli.printVersionInfo();
+        } else if (cli.isRunScan()) {
+            runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getApplicationName(), cli.getScanFiles(), cli.isAutoUpdate());
+        } else {
+            cli.printHelp();
+        }
+
+    }
+
+    /**
+     * Scans the specified directories and writes the dependency reports to the
+     * reportDirectory.
+     *
+     * @param reportDirectory the path to the directory where the reports will
+     * be written.
+     * @param outputFormat the output format of the report.
+     * @param applicationName the application name for the report.
+     * @param files the files/directories to scan.
+     */
+    private void runScan(String reportDirectory, String outputFormat, String applicationName, String[] files, boolean autoUpdate) {
+        Engine scanner = new Engine(autoUpdate);
+        for (String file : files) {
+            scanner.scan(file);
+        }
+        scanner.analyzeDependencies();
+        List<Dependency> dependencies = scanner.getDependencies();
+
+        ReportGenerator report = new ReportGenerator(applicationName, dependencies, scanner.getAnalyzers());
+        try {
+            report.generateReports(reportDirectory, outputFormat);
+        } catch (IOException ex) {
+            Logger.getLogger(App.class.getName()).log(Level.SEVERE, null, ex);
+        } catch (Exception ex) {
+            Logger.getLogger(App.class.getName()).log(Level.SEVERE, null, ex);
+        }
+
+    }
+}

src/main/java/org/owasp/dependencycheck/Engine.java

@@ -0,0 +1,267 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck;
+
+import java.util.EnumMap;
+import java.io.File;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Set;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.owasp.dependencycheck.analyzer.AnalysisException;
+import org.owasp.dependencycheck.analyzer.AnalysisPhase;
+import org.owasp.dependencycheck.analyzer.Analyzer;
+import org.owasp.dependencycheck.analyzer.AnalyzerService;
+import org.owasp.dependencycheck.data.CachedWebDataSource;
+import org.owasp.dependencycheck.data.UpdateException;
+import org.owasp.dependencycheck.data.UpdateService;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.utils.FileUtils;
+
+/**
+ * Scans files, directories, etc. for Dependencies. Analyzers are loaded and
+ * used to process the files found by the scan, if a file is encountered and an
+ * Analyzer is associated with the file type then the file is turned into a
+ * dependency.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class Engine {
+
+    /**
+     * The list of dependencies.
+     */
+    protected List<Dependency> dependencies = new ArrayList<Dependency>();
+    /**
+     * A Map of analyzers grouped by Analysis phase.
+     */
+    protected EnumMap<AnalysisPhase, List<Analyzer>> analyzers =
+            new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class);
+    /**
+     * A set of extensions supported by the analyzers.
+     */
+    protected Set<String> extensions = new HashSet<String>();
+
+    /**
+     * Creates a new Engine.
+     */
+    public Engine() {
+        doUpdates();
+        loadAnalyzers();
+    }
+
+    /**
+     * Creates a new Engine
+     *
+     * @param autoUpdate indicates whether or not data should be updated from
+     * the Internet.
+     */
+    public Engine(boolean autoUpdate) {
+        if (autoUpdate) {
+            doUpdates();
+        }
+        loadAnalyzers();
+    }
+
+    /**
+     * Loads the analyzers specified in the configuration file (or system
+     * properties).
+     */
+    private void loadAnalyzers() {
+
+        for (AnalysisPhase phase : AnalysisPhase.values()) {
+            analyzers.put(phase, new ArrayList<Analyzer>());
+        }
+
+        AnalyzerService service = AnalyzerService.getInstance();
+        Iterator<Analyzer> iterator = service.getAnalyzers();
+        while (iterator.hasNext()) {
+            Analyzer a = iterator.next();
+            analyzers.get(a.getAnalysisPhase()).add(a);
+            if (a.getSupportedExtensions() != null) {
+                extensions.addAll(a.getSupportedExtensions());
+            }
+        }
+    }
+
+    /**
+     * Get the List of the analyzers for a specific phase of analysis.
+     *
+     * @param phase the phase to get the configured analyzers.
+     * @return the analyzers loaded
+     */
+    public List<Analyzer> getAnalyzers(AnalysisPhase phase) {
+        return analyzers.get(phase);
+    }
+
+    /**
+     * Get the dependencies identified
+     *
+     * @return the dependencies identified
+     */
+    public List<Dependency> getDependencies() {
+        return dependencies;
+    }
+
+    /**
+     * Scans a given file or directory. If a directory is specified, it will be
+     * scanned recursively. Any dependencies identified are added to the
+     * dependency collection.
+     *
+     * @param path the path to a file or directory to be analyzed.
+     */
+    public void scan(String path) {
+        File file = new File(path);
+        if (file.exists()) {
+            if (file.isDirectory()) {
+                scanDirectory(file);
+            } else {
+                scanFile(file);
+            }
+        }
+    }
+
+    /**
+     * Recursively scans files and directories. Any dependencies identified are
+     * added to the dependency collection.
+     *
+     * @param dir the directory to scan.
+     */
+    protected void scanDirectory(File dir) {
+        File[] files = dir.listFiles();
+        for (File f : files) {
+            if (f.isDirectory()) {
+                scanDirectory(f);
+            } else {
+                scanFile(f);
+            }
+        }
+    }
+
+    /**
+     * Scans a specified file. If a dependency is identified it is added to the
+     * dependency collection.
+     *
+     * @param file The file to scan.
+     */
+    protected void scanFile(File file) {
+        if (!file.isFile()) {
+            String msg = String.format("Path passed to scanFile(File) is not a file: %s.", file.toString());
+            Logger.getLogger(Engine.class.getName()).log(Level.WARNING, msg);
+        }
+        String fileName = file.getName();
+        String extension = FileUtils.getFileExtension(fileName);
+        if (extension != null) {
+            if (extensions.contains(extension)) {
+                Dependency dependency = new Dependency(file);
+                dependencies.add(dependency);
+            }
+        } else {
+            String msg = String.format("No file extension found on file '%s'. The file was not analyzed.",
+                    file.toString());
+            Logger.getLogger(Engine.class.getName()).log(Level.FINEST, msg);
+        }
+    }
+
+    /**
+     * Runs the analyzers against all of the dependencies.
+     */
+    public void analyzeDependencies() {
+        //phase one initialize
+        for (AnalysisPhase phase : AnalysisPhase.values()) {
+            List<Analyzer> analyzerList = analyzers.get(phase);
+            for (Analyzer a : analyzerList) {
+                try {
+                    a.initialize();
+                } catch (Exception ex) {
+                    Logger.getLogger(Engine.class.getName()).log(Level.SEVERE,
+                            "Exception occurred initializing " + a.getName() + ".", ex);
+                    try {
+                        a.close();
+                    } catch (Exception ex1) {
+                        Logger.getLogger(Engine.class.getName()).log(Level.FINER, null, ex1);
+                    }
+                }
+            }
+        }
+
+        // analysis phases
+        for (AnalysisPhase phase : AnalysisPhase.values()) {
+            List<Analyzer> analyzerList = analyzers.get(phase);
+
+            for (Analyzer a : analyzerList) {
+                for (Dependency d : dependencies) {
+                    if (a.supportsExtension(d.getFileExtension())) {
+                        try {
+                            a.analyze(d, this);
+                        } catch (AnalysisException ex) {
+                            d.addAnalysisException(ex);
+                        }
+                    }
+                }
+            }
+        }
+
+        //close/cleanup
+        for (AnalysisPhase phase : AnalysisPhase.values()) {
+            List<Analyzer> analyzerList = analyzers.get(phase);
+            for (Analyzer a : analyzerList) {
+                try {
+                    a.close();
+                } catch (Exception ex) {
+                    Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, null, ex);
+                }
+            }
+        }
+    }
+
+    /**
+     *
+     */
+    private void doUpdates() {
+        UpdateService service = UpdateService.getInstance();
+        Iterator<CachedWebDataSource> iterator = service.getDataSources();
+        while (iterator.hasNext()) {
+            CachedWebDataSource source = iterator.next();
+            try {
+                source.update();
+            } catch (UpdateException ex) {
+                Logger.getLogger(Engine.class.getName()).log(Level.SEVERE,
+                        "Unable to update " + source.getClass().getName(), ex);
+            }
+        }
+    }
+
+    /**
+     * Returns a full list of all of the analyzers. This is useful
+     * for reporting which analyzers where used.
+     * @return a list of Analyzers
+     */
+    public List<Analyzer> getAnalyzers() {
+        List<Analyzer> ret = new ArrayList<Analyzer>();
+        for (AnalysisPhase phase : AnalysisPhase.values()) {
+            List<Analyzer> analyzerList = analyzers.get(phase);
+            ret.addAll(analyzerList);
+        }
+        return ret;
+    }
+}

src/main/java/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.java

@@ -0,0 +1,46 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public abstract class AbstractAnalyzer implements Analyzer {
+
+    /**
+     * Utility method to help in the creation of the extensions set. This constructs
+     * a new Set that can be used in a final static declaration.<br/><br/>
+     *
+     * This implementation was copied from http://stackoverflow.com/questions/2041778/initialize-java-hashset-values-by-construction
+     *
+     * @param strings a list of strings to add to the set.
+     * @return a Set of strings.
+     */
+    protected static Set<String> newHashSet(String... strings) {
+        Set<String> set = new HashSet<String>();
+
+        Collections.addAll(set, strings);
+        return set;
+    }
+}

src/main/java/org/owasp/dependencycheck/analyzer/AnalysisException.java

@@ -0,0 +1,64 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+/**
+ * An exception thrown when the analysis of a dependency fails.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class AnalysisException extends Exception {
+
+    private static final long serialVersionUID = 1L;
+
+    /**
+     * Creates a new AnalysisException.
+     */
+    public AnalysisException() {
+        super();
+    }
+
+    /**
+     * Creates a new AnalysisException.
+     *
+     * @param msg a message for the exception.
+     */
+    public AnalysisException(String msg) {
+        super(msg);
+    }
+
+    /**
+     * Creates a new AnalysisException.
+     *
+     * @param ex the cause of the failure.
+     */
+    public AnalysisException(Throwable ex) {
+        super(ex);
+    }
+
+    /**
+     * Creates a new DownloadFailedException.
+     *
+     * @param msg a message for the exception.
+     * @param ex the cause of the failure.
+     */
+    public AnalysisException(String msg, Throwable ex) {
+        super(msg, ex);
+    }
+}

src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java

@@ -0,0 +1,56 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+/**
+ * An enumeration defining the phases of analysis.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public enum AnalysisPhase {
+
+    /**
+     * The first phase of analysis.
+     */
+    INITIAL,
+    /**
+     * The second phase of analysis.
+     */
+    INFORMATION_COLLECTION,
+    /**
+     * The third phase of analysis.
+     */
+    PRE_IDENTIFIER_ANALYSIS,
+    /**
+     * The fourth phase of analysis.
+     */
+    IDENTIFIER_ANALYSIS,
+    /**
+     * The fifth phase of analysis.
+     */
+    POST_IDENTIFIER_ANALYSIS,
+    /**
+     * The sixth phase of analysis.
+     */
+    FINDING_ANALYSIS,
+    /**
+     * The seventh and final phase of analysis.
+     */
+    FINAL
+}

src/main/java/org/owasp/dependencycheck/analyzer/Analyzer.java

@@ -0,0 +1,102 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import java.util.Set;
+import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.dependency.Dependency;
+
+/**
+ * An interface that defines an Analyzer that is used to identify Dependencies.
+ * An analyzer will collect information about the dependency in the form of
+ * Evidence.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public interface Analyzer {
+
+    /**
+     * Analyzes the given dependency. The analysis could be anything from
+     * identifying an Identifier for the dependency, to finding vulnerabilities,
+     * etc. Additionally, if the analyzer collects enough information to add a
+     * description or license information for the dependency it should be added.
+     *
+     * @param dependency a dependency to analyze.
+     * @param engine the engine that is scanning the dependencies - this is useful
+     * if we need to check other dependencies
+     * @throws AnalysisException is thrown if there is an error analyzing the
+     * dependency file
+     */
+    void analyze(Dependency dependency, Engine engine) throws AnalysisException;
+
+    /**
+     * <p>Returns a list of supported file extensions. An example would be an
+     * analyzer that inspected java jar files. The getSupportedExtensions
+     * function would return a set with a single element "jar".</p>
+     *
+     * <p><b>Note:</b> when implementing this the extensions returned MUST be
+     * lowercase.</p>
+     *
+     * @return The file extensions supported by this analyzer.
+     *
+     * <p>If the analyzer returns null it will not cause additional files to be
+     * analyzed but will be executed against every file loaded</p>
+     */
+    Set<String> getSupportedExtensions();
+
+    /**
+     * Returns the name of the analyzer.
+     *
+     * @return the name of the analyzer.
+     */
+    String getName();
+
+    /**
+     * Returns whether or not this analyzer can process the given extension.
+     *
+     * @param extension the file extension to test for support.
+     * @return whether or not the specified file extension is supported by this
+     * analyzer.
+     */
+    boolean supportsExtension(String extension);
+
+    /**
+     * Returns the phase that the analyzer is intended to run in.
+     *
+     * @return the phase that the analyzer is intended to run in.
+     */
+    AnalysisPhase getAnalysisPhase();
+
+    /**
+     * The initialize method is called (once) prior to the analyze method being
+     * called on all of the dependencies.
+     *
+     * @throws Exception is thrown if an exception occurs initializing the
+     * analyzer.
+     */
+    void initialize() throws Exception;
+
+    /**
+     * The close method is called after all of the dependencies have been
+     * analyzed.
+     *
+     * @throws Exception is thrown if an exception occurs closing the analyzer.
+     */
+    void close() throws Exception;
+}

src/main/java/org/owasp/dependencycheck/analyzer/AnalyzerService.java

@@ -0,0 +1,60 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import java.util.Iterator;
+import java.util.ServiceLoader;
+
+/**
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class AnalyzerService {
+
+    private static AnalyzerService service;
+    private final ServiceLoader<Analyzer> loader;
+
+    /**
+     * Creates a new instance of AnalyzerService
+     */
+    private AnalyzerService() {
+        loader = ServiceLoader.load(Analyzer.class);
+    }
+
+    /**
+     * Retrieve the singleton instance of AnalyzerService.
+     *
+     * @return a singleton AnalyzerService.
+     */
+    public static synchronized AnalyzerService getInstance() {
+        if (service == null) {
+            service = new AnalyzerService();
+        }
+        return service;
+    }
+
+    /**
+     * Returns an Iterator for all instances of the Analyzer interface.
+     *
+     * @return an iterator of Analyzers.
+     */
+    public Iterator<Analyzer> getAnalyzers() {
+        return loader.iterator();
+    }
+}

src/main/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.java

@@ -0,0 +1,126 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.Evidence;
+import java.util.Set;
+import org.owasp.dependencycheck.Engine;
+
+/**
+ *
+ * Takes a dependency and analyzes the filename and determines the hashes.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class FileNameAnalyzer implements Analyzer {
+
+    /**
+     * The name of the analyzer.
+     */
+    private static final String ANALYZER_NAME = "File Name Analyzer";
+    /**
+     * The phase that this analyzer is intended to run in.
+     */
+    private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+    /**
+     * The set of file extensions supported by this analyzer.
+     */
+    private static final Set<String> EXTENSIONS = null;
+
+    /**
+     * Returns a list of file EXTENSIONS supported by this analyzer.
+     *
+     * @return a list of file EXTENSIONS supported by this analyzer.
+     */
+    public Set<String> getSupportedExtensions() {
+        return EXTENSIONS;
+    }
+
+    /**
+     * Returns the name of the analyzer.
+     *
+     * @return the name of the analyzer.
+     */
+    public String getName() {
+        return ANALYZER_NAME;
+    }
+
+    /**
+     * Returns whether or not this analyzer can process the given extension.
+     *
+     * @param extension the file extension to test for support.
+     * @return whether or not the specified file extension is supported by this
+     * analyzer.
+     */
+    public boolean supportsExtension(String extension) {
+        return true;
+    }
+
+    /**
+     * Returns the phase that the analyzer is intended to run in.
+     *
+     * @return the phase that the analyzer is intended to run in.
+     */
+    public AnalysisPhase getAnalysisPhase() {
+        return ANALYSIS_PHASE;
+    }
+
+    /**
+     * Collects information about the file name.
+     *
+     * @param dependency the dependency to analyze.
+     * @param engine the engine that is scanning the dependencies
+     * @throws AnalysisException is thrown if there is an error reading the JAR
+     * file.
+     */
+    public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+
+        String fileName = dependency.getFileName();
+        int pos = fileName.lastIndexOf(".");
+        if (pos > 0) {
+            fileName = fileName.substring(0, pos);
+        }
+
+        dependency.getProductEvidence().addEvidence("file", "name",
+                fileName, Evidence.Confidence.HIGH);
+
+        dependency.getVendorEvidence().addEvidence("file", "name",
+                fileName, Evidence.Confidence.HIGH);
+
+        if (fileName.matches(".*\\d.*")) {
+            dependency.getVersionEvidence().addEvidence("file", "name",
+                    fileName, Evidence.Confidence.HIGH);
+        }
+    }
+
+    /**
+     * The initialize method does nothing for this Analyzer
+     */
+    public void initialize() {
+        //do nothing
+    }
+
+    /**
+     * The close method does nothing for this Analyzer
+     */
+    public void close() {
+        //do nothing
+    }
+}

src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java

@@ -0,0 +1,664 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import javax.xml.bind.JAXBException;
+import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.Evidence;
+import org.owasp.dependencycheck.dependency.EvidenceCollection;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.io.Reader;
+import java.util.HashMap;
+import java.util.Map.Entry;
+import java.util.Properties;
+import java.util.Set;
+import java.util.StringTokenizer;
+import java.util.jar.Attributes;
+import java.util.jar.JarFile;
+import java.util.jar.Manifest;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.JAXBElement;
+import javax.xml.bind.Unmarshaller;
+import org.owasp.dependencycheck.analyzer.pom.generated.License;
+import org.owasp.dependencycheck.analyzer.pom.generated.Model;
+import org.owasp.dependencycheck.analyzer.pom.generated.Organization;
+import org.owasp.dependencycheck.utils.NonClosingStream;
+
+/**
+ *
+ * Used to load a JAR file and collect information that can be used to determine
+ * the associated CPE.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
+
+    /**
+     * The system independent newline character.
+     */
+    private static final String NEWLINE = System.getProperty("line.separator");
+    /**
+     * The name of the analyzer.
+     */
+    private static final String ANALYZER_NAME = "Jar Analyzer";
+    /**
+     * The phase that this analyzer is intended to run in.
+     */
+    private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+    /**
+     * A list of elements in the manifest to ignore.
+     */
+    private static final Set<String> IGNORE_LIST = newHashSet(
+            "built-by",
+            "created-by",
+            "builtby",
+            "createdby",
+            "build-jdk",
+            "buildjdk",
+            "ant-version",
+            "antversion",
+            "import-package",
+            "export-package",
+            "importpackage",
+            "exportpackage",
+            "sealed",
+            "manifest-version",
+            "archiver-version",
+            "manifestversion",
+            "archiverversion",
+            "classpath",
+            "class-path",
+            "tool",
+            "bundle-manifestversion",
+            "bundlemanifestversion");
+    /**
+     * The set of file extensions supported by this analyzer.
+     */
+    private static final Set<String> EXTENSIONS = newHashSet("jar");
+    /**
+     * item in some manifest, should be considered medium confidence.
+     */
+    private static final String BUNDLE_VERSION = "Bundle-Version"; //: 2.1.2
+    /**
+     * item in some manifest, should be considered medium confidence.
+     */
+    private static final String BUNDLE_DESCRIPTION = "Bundle-Description"; //: Apache Struts 2
+    /**
+     * item in some manifest, should be considered medium confidence.
+     */
+    private static final String BUNDLE_NAME = "Bundle-Name"; //: Struts 2 Core
+    /**
+     * item in some manifest, should be considered medium confidence.
+     */
+    private static final String BUNDLE_VENDOR = "Bundle-Vendor"; //: Apache Software Foundation
+    /**
+     * The unmarshaller used to parse the pom.xml from a JAR file.
+     */
+    private Unmarshaller pomUnmarshaller = null;
+
+    /**
+     * Constructs a new JarAnalyzer.
+     */
+    public JarAnalyzer() {
+        try {
+            JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.analyzer.pom.generated");
+            pomUnmarshaller = jaxbContext.createUnmarshaller();
+        } catch (JAXBException ex) { //guess we will just have a null pointer exception later...
+            Logger.getLogger(JarAnalyzer.class.getName()).log(Level.SEVERE, null, ex);
+        }
+    }
+
+    /**
+     * Returns a list of file EXTENSIONS supported by this analyzer.
+     *
+     * @return a list of file EXTENSIONS supported by this analyzer.
+     */
+    public Set<String> getSupportedExtensions() {
+        return EXTENSIONS;
+    }
+
+    /**
+     * Returns the name of the analyzer.
+     *
+     * @return the name of the analyzer.
+     */
+    public String getName() {
+        return ANALYZER_NAME;
+    }
+
+    /**
+     * Returns whether or not this analyzer can process the given extension.
+     *
+     * @param extension the file extension to test for support.
+     * @return whether or not the specified file extension is supported by this
+     * analyzer.
+     */
+    public boolean supportsExtension(String extension) {
+        return EXTENSIONS.contains(extension);
+    }
+
+    /**
+     * Returns the phase that the analyzer is intended to run in.
+     *
+     * @return the phase that the analyzer is intended to run in.
+     */
+    public AnalysisPhase getAnalysisPhase() {
+        return ANALYSIS_PHASE;
+    }
+
+    /**
+     * Loads a specified JAR file and collects information from the manifest and
+     * checksums to identify the correct CPE information.
+     *
+     * @param dependency the dependency to analyze.
+     * @param engine the engine that is scanning the dependencies
+     * @throws AnalysisException is thrown if there is an error reading the JAR
+     * file.
+     */
+    public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+        try {
+            parseManifest(dependency);
+            analyzePackageNames(dependency);
+            analyzePOM(dependency);
+            addPredefinedData(dependency);
+        } catch (IOException ex) {
+            throw new AnalysisException("Exception occurred reading the JAR file.", ex);
+        } catch (JAXBException ex) {
+            throw new AnalysisException("Exception occurred reading the POM within the JAR file.", ex);
+        }
+
+    }
+
+    /**
+     * Attempts to find a pom.xml within the JAR file. If found it extracts information
+     * and adds it to the evidence. This will attempt to interpolate the strings contained
+     * within the pom.properties if one exists.
+     *
+     * @param dependency the dependency being analyzed.
+     * @throws IOException is thrown if there is an error reading the zip file.
+     * @throws JAXBException is thrown if there is an error extracting the model (aka pom).
+     * @throws AnalysisException is thrown if there is an exception parsing the pom.
+     */
+    protected void analyzePOM(Dependency dependency) throws IOException, JAXBException, AnalysisException {
+
+        Properties pomProperties = null;
+        Model pom = null;
+        FileInputStream fs = null;
+        try {
+            fs = new FileInputStream(dependency.getActualFilePath());
+            ZipInputStream zin = new ZipInputStream(fs);
+            ZipEntry entry = zin.getNextEntry();
+
+            while (entry != null) {
+                String entryName = (new File(entry.getName())).getName().toLowerCase();
+
+                if (!entry.isDirectory() && "pom.xml".equals(entryName)) {
+                    if (pom == null) {
+                        NonClosingStream stream = new NonClosingStream(zin);
+                        JAXBElement obj = (JAXBElement) pomUnmarshaller.unmarshal(stream);
+                        pom = (org.owasp.dependencycheck.analyzer.pom.generated.Model) obj.getValue();
+                        zin.closeEntry();
+                    } else {
+                        throw new AnalysisException("JAR file contains multiple pom.xml files - unable to process POM");
+                    }
+                } else if (!entry.isDirectory() && "pom.properties".equals(entryName)) {
+                    if (pomProperties == null) {
+                        Reader reader = null;
+                        try {
+                            reader = new InputStreamReader(zin, "UTF-8");
+                            pomProperties = new Properties();
+                            pomProperties.load(reader);
+                        } finally {
+                            //zin.closeEntry closes the reader
+                            //reader.close();
+                            zin.closeEntry();
+                        }
+                    } else {
+                        throw new AnalysisException("JAR file contains multiple pom.properties files - unable to process POM");
+                    }
+                }
+
+                entry = zin.getNextEntry();
+            }
+        } catch (IOException ex) {
+            throw new AnalysisException("Error reading JAR file as zip.", ex);
+        } finally {
+            if (fs != null) {
+                fs.close();
+            }
+        }
+
+        if (pom != null) {
+            //group id
+            String groupid = interpolateString(pom.getGroupId(), pomProperties);
+            if (groupid != null) {
+                dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Evidence.Confidence.HIGH);
+                dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Evidence.Confidence.LOW);
+            }
+            //artifact id
+            String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
+            if (artifactid != null) {
+                dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Evidence.Confidence.HIGH);
+            }
+            //version
+            String version = interpolateString(pom.getVersion(), pomProperties);
+            if (version != null) {
+                dependency.getVersionEvidence().addEvidence("pom", "version", version, Evidence.Confidence.HIGH);
+            }
+            // org name
+            Organization org = pom.getOrganization();
+            if (org != null && org.getName() != null) {
+                String orgName = interpolateString(org.getName(), pomProperties);
+                dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Evidence.Confidence.HIGH);
+            }
+            //pom name
+            String pomName = interpolateString(pom.getName(), pomProperties);
+            if (pomName != null) {
+                dependency.getProductEvidence().addEvidence("pom", "name", pomName, Evidence.Confidence.HIGH);
+            }
+
+            //Description
+            if (pom.getDescription() != null) {
+                String description = interpolateString(pom.getDescription(), pomProperties);
+                dependency.setDescription(description);
+                dependency.getProductEvidence().addEvidence("pom", "description", description, Evidence.Confidence.MEDIUM);
+                dependency.getVendorEvidence().addEvidence("pom", "description", description, Evidence.Confidence.MEDIUM);
+            }
+
+            //license
+            if (pom.getLicenses() != null) {
+                String license = null;
+                for (License lic : pom.getLicenses().getLicense()) {
+                    String tmp = null;
+                    if (lic.getName() != null) {
+                        tmp = interpolateString(lic.getName(), pomProperties);
+                    }
+                    if (lic.getUrl() != null) {
+                        if (tmp == null) {
+                            tmp = interpolateString(lic.getUrl(), pomProperties);
+                        } else {
+                            tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
+                        }
+                    }
+                    if (tmp == null) {
+                        continue;
+                    }
+                    if (license == null) {
+                        license = tmp;
+                    } else {
+                        license += "\n" + tmp;
+                    }
+                }
+                if (license != null) {
+                    dependency.setLicense(license);
+                }
+            }
+        }
+    }
+
+    /**
+     * Analyzes the path information of the classes contained within the
+     * JarAnalyzer to try and determine possible vendor or product names. If any
+     * are found they are stored in the packageVendor and packageProduct
+     * hashSets.
+     *
+     * @param dependency A reference to the dependency.
+     * @throws IOException is thrown if there is an error reading the JAR file.
+     */
+    protected void analyzePackageNames(Dependency dependency) throws IOException {
+
+        JarFile jar = null;
+        try {
+            jar = new JarFile(dependency.getActualFilePath());
+
+            java.util.Enumeration en = jar.entries();
+
+            HashMap<String, Integer> level0 = new HashMap<String, Integer>();
+            HashMap<String, Integer> level1 = new HashMap<String, Integer>();
+            HashMap<String, Integer> level2 = new HashMap<String, Integer>();
+            HashMap<String, Integer> level3 = new HashMap<String, Integer>();
+            int count = 0;
+            while (en.hasMoreElements()) {
+                java.util.jar.JarEntry entry = (java.util.jar.JarEntry) en.nextElement();
+                if (entry.getName().endsWith(".class") && entry.getName().contains("/")) {
+                    String[] path = entry.getName().toLowerCase().split("/");
+
+                    if ("java".equals(path[0])
+                            || "javax".equals(path[0])
+                            || ("com".equals(path[0]) && "sun".equals(path[0]))) {
+                        continue;
+                    }
+
+                    count += 1;
+                    String temp = path[0];
+                    if (level0.containsKey(temp)) {
+                        level0.put(temp, level0.get(temp) + 1);
+                    } else {
+                        level0.put(temp, 1);
+                    }
+
+                    if (path.length > 2) {
+                        temp += "/" + path[1];
+                        if (level1.containsKey(temp)) {
+                            level1.put(temp, level1.get(temp) + 1);
+                        } else {
+                            level1.put(temp, 1);
+                        }
+                    }
+                    if (path.length > 3) {
+                        temp += "/" + path[2];
+                        if (level2.containsKey(temp)) {
+                            level2.put(temp, level2.get(temp) + 1);
+                        } else {
+                            level2.put(temp, 1);
+                        }
+                    }
+
+                    if (path.length > 4) {
+                        temp += "/" + path[3];
+                        if (level3.containsKey(temp)) {
+                            level3.put(temp, level3.get(temp) + 1);
+                        } else {
+                            level3.put(temp, 1);
+                        }
+                    }
+
+                }
+            }
+
+            if (count == 0) {
+                return;
+            }
+            EvidenceCollection vendor = dependency.getVendorEvidence();
+            EvidenceCollection product = dependency.getProductEvidence();
+
+            for (String s : level0.keySet()) {
+                if (!"org".equals(s) && !"com".equals(s)) {
+                    vendor.addWeighting(s);
+                    product.addWeighting(s);
+                    vendor.addEvidence("jar", "package", s, Evidence.Confidence.LOW);
+                    product.addEvidence("jar", "package", s, Evidence.Confidence.LOW);
+                }
+            }
+            for (String s : level1.keySet()) {
+                float ratio = level1.get(s);
+                ratio /= count;
+                if (ratio > 0.5) {
+                    String[] parts = s.split("/");
+                    if ("org".equals(parts[0]) || "com".equals(parts[0])) {
+                        vendor.addWeighting(parts[1]);
+                        vendor.addEvidence("jar", "package", parts[1], Evidence.Confidence.LOW);
+                    } else {
+                        vendor.addWeighting(parts[0]);
+                        product.addWeighting(parts[1]);
+                        vendor.addEvidence("jar", "package", parts[0], Evidence.Confidence.LOW);
+                        product.addEvidence("jar", "package", parts[1], Evidence.Confidence.LOW);
+                    }
+                }
+            }
+            for (String s : level2.keySet()) {
+                float ratio = level2.get(s);
+                ratio /= count;
+                if (ratio > 0.4) {
+                    String[] parts = s.split("/");
+                    if ("org".equals(parts[0]) || "com".equals(parts[0])) {
+                        vendor.addWeighting(parts[1]);
+                        product.addWeighting(parts[2]);
+                        vendor.addEvidence("jar", "package", parts[1], Evidence.Confidence.LOW);
+                        product.addEvidence("jar", "package", parts[2], Evidence.Confidence.LOW);
+                    } else {
+                        vendor.addWeighting(parts[0]);
+                        vendor.addWeighting(parts[1]);
+                        product.addWeighting(parts[1]);
+                        product.addWeighting(parts[2]);
+                        vendor.addEvidence("jar", "package", parts[0], Evidence.Confidence.LOW);
+                        vendor.addEvidence("jar", "package", parts[1], Evidence.Confidence.LOW);
+                        product.addEvidence("jar", "package", parts[1], Evidence.Confidence.LOW);
+                        product.addEvidence("jar", "package", parts[2], Evidence.Confidence.LOW);
+                    }
+                }
+            }
+            for (String s : level3.keySet()) {
+                float ratio = level3.get(s);
+                ratio /= count;
+                if (ratio > 0.3) {
+                    String[] parts = s.split("/");
+                    if ("org".equals(parts[0]) || "com".equals(parts[0])) {
+                        vendor.addWeighting(parts[1]);
+                        vendor.addWeighting(parts[2]);
+                        product.addWeighting(parts[2]);
+                        product.addWeighting(parts[3]);
+                        vendor.addEvidence("jar", "package", parts[1], Evidence.Confidence.LOW);
+                        vendor.addEvidence("jar", "package", parts[2], Evidence.Confidence.LOW);
+                        product.addEvidence("jar", "package", parts[2], Evidence.Confidence.LOW);
+                        product.addEvidence("jar", "package", parts[3], Evidence.Confidence.LOW);
+
+                    } else {
+                        vendor.addWeighting(parts[0]);
+                        vendor.addWeighting(parts[1]);
+                        vendor.addWeighting(parts[2]);
+                        product.addWeighting(parts[1]);
+                        product.addWeighting(parts[2]);
+                        product.addWeighting(parts[3]);
+                        vendor.addEvidence("jar", "package", parts[0], Evidence.Confidence.LOW);
+                        vendor.addEvidence("jar", "package", parts[1], Evidence.Confidence.LOW);
+                        vendor.addEvidence("jar", "package", parts[2], Evidence.Confidence.LOW);
+                        product.addEvidence("jar", "package", parts[1], Evidence.Confidence.LOW);
+                        product.addEvidence("jar", "package", parts[2], Evidence.Confidence.LOW);
+                        product.addEvidence("jar", "package", parts[3], Evidence.Confidence.LOW);
+                    }
+                }
+            }
+        } finally {
+            if (jar != null) {
+                jar.close();
+            }
+        }
+    }
+
+    /**
+     * <p>Reads the manifest from the JAR file and collects the entries. Some
+     * key entries are:</p> <ul><li>Implementation Title</li> <li>Implementation
+     * Version</li> <li>Implementation Vendor</li> <li>Implementation
+     * VendorId</li> <li>Bundle Name</li> <li>Bundle Version</li> <li>Bundle
+     * Vendor</li> <li>Bundle Description</li> <li>Main Class</li> </ul>
+     * However, all but a handful of specific entries are read in.
+     *
+     * @param dependency A reference to the dependency.
+     * @throws IOException if there is an issue reading the JAR file.
+     */
+    protected void parseManifest(Dependency dependency) throws IOException {
+        JarFile jar = null;
+        try {
+            jar = new JarFile(dependency.getActualFilePath());
+
+            Manifest manifest = jar.getManifest();
+            if (manifest == null) {
+                Logger.getLogger(JarAnalyzer.class.getName()).log(Level.SEVERE,
+                        "Jar file '{0}' does not contain a manifest.",
+                        dependency.getFileName());
+                return;
+            }
+            Attributes atts = manifest.getMainAttributes();
+
+            EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
+            EvidenceCollection productEvidence = dependency.getProductEvidence();
+            EvidenceCollection versionEvidence = dependency.getVersionEvidence();
+
+            String source = "Manifest";
+
+            for (Entry<Object, Object> entry : atts.entrySet()) {
+                String key = entry.getKey().toString();
+                String value = atts.getValue(key);
+                if (key.equals(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
+                    productEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
+                } else if (key.equals(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
+                    versionEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
+                } else if (key.equals(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
+                    vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
+                } else if (key.equals(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
+                    vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
+                } else if (key.equals(BUNDLE_DESCRIPTION)) {
+                    productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
+                    dependency.setDescription(value);
+                } else if (key.equals(BUNDLE_NAME)) {
+                    productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
+                } else if (key.equals(BUNDLE_VENDOR)) {
+                    vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
+                } else if (key.equals(BUNDLE_VERSION)) {
+                    versionEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
+                } else if (key.equals(Attributes.Name.MAIN_CLASS.toString())) {
+                    productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
+                    vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
+                } else {
+                    key = key.toLowerCase();
+
+                    if (!IGNORE_LIST.contains(key) && !key.endsWith("jdk")
+                            && !key.contains("lastmodified") && !key.endsWith("package")) {
+
+                        if (key.contains("version")) {
+                            versionEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
+                        } else if (key.contains("title")) {
+                            productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
+                        } else if (key.contains("vendor")) {
+                            vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
+                        } else if (key.contains("name")) {
+                            productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
+                            vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
+                        } else if (key.contains("license")) {
+                            addLicense(dependency, value);
+                        } else {
+                            if (key.contains("description")) {
+                                addDescription(dependency, value);
+                            }
+                            productEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW);
+                            vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW);
+                            if (value.matches(".*\\d.*")) {
+                                StringTokenizer tokenizer = new StringTokenizer(value, " ");
+                                while (tokenizer.hasMoreElements()) {
+                                    String s = tokenizer.nextToken();
+                                    if (s.matches("^[0-9.]+$")) {
+                                        versionEvidence.addEvidence(source, key, s, Evidence.Confidence.LOW);
+                                    }
+                                }
+                                //versionEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW);
+                            }
+                        }
+                    }
+                }
+            }
+        } finally {
+            if (jar != null) {
+                jar.close();
+            }
+        }
+    }
+
+    private void addDescription(Dependency d, String description) {
+        if (d.getDescription() == null) {
+            d.setDescription(description);
+        }
+    }
+
+    private void addLicense(Dependency d, String license) {
+        if (d.getLicense() == null) {
+            d.setLicense(license);
+        } else if (!d.getLicense().contains(license)) {
+            d.setLicense(d.getLicense() + NEWLINE + license);
+        }
+    }
+
+    /**
+     * The initialize method does nothing for this Analyzer
+     */
+    public void initialize() {
+        //do nothing
+    }
+
+    /**
+     * The close method does nothing for this Analyzer
+     */
+    public void close() {
+        //do nothing
+    }
+
+    /**
+     * A utiltiy function that will interpolate strings based on values given
+     * in the properties file. It will also interpolate the strings contained
+     * within the properties file so that properties can reference other
+     * properties.
+     *
+     * @param text the string that contains references to properties.
+     * @param properties a collection of properties that may be referenced within the text.
+     * @return the interpolated text.
+     */
+    protected String interpolateString(String text, Properties properties) {
+        //${project.build.directory}
+        if (properties == null || text == null) {
+            return text;
+        }
+
+        int pos = text.indexOf("${");
+        if (pos < 0) {
+            return text;
+        }
+        int end = text.indexOf("}");
+        if (end < pos) {
+            return text;
+        }
+
+        String propName = text.substring(pos + 2, end);
+        String propValue = interpolateString(properties.getProperty(propName), properties);
+        if (propValue == null) {
+            propValue = "";
+        }
+        StringBuilder sb = new StringBuilder(propValue.length() + text.length());
+        sb.append(text.subSequence(0, pos));
+        sb.append(propValue);
+        sb.append(text.substring(end + 1));
+        return interpolateString(sb.toString(), properties); //yes yes, this should be a loop...
+    }
+
+    private void addPredefinedData(Dependency dependency) {
+        Evidence springTest1 = new Evidence("Manifest",
+                "Implementation-Title",
+                "Spring Framework",
+                Evidence.Confidence.HIGH);
+
+        Evidence springTest2 = new Evidence("Manifest",
+                "Implementation-Title",
+                "org.springframework.core",
+                Evidence.Confidence.HIGH);
+
+        Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
+        if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
+            dependency.getProductEvidence().addEvidence("a priori", "product", "springsource_spring_framework", Evidence.Confidence.HIGH);
+            dependency.getVendorEvidence().addEvidence("a priori", "vendor", "SpringSource", Evidence.Confidence.HIGH);
+            dependency.getVendorEvidence().addEvidence("a priori", "vendor", "vmware", Evidence.Confidence.HIGH);
+        }
+    }
+}

src/main/java/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java

@@ -0,0 +1,126 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.dependency.Dependency;
+import java.util.Set;
+import java.util.regex.Pattern;
+
+/**
+ *
+ * Used to load a JAR file and collect information that can be used to determine
+ * the associated CPE.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer {
+
+    /**
+     * The system independent newline character.
+     */
+    private static final String NEWLINE = System.getProperty("line.separator");
+    /**
+     * The name of the analyzer.
+     */
+    private static final String ANALYZER_NAME = "JavaScript Analyzer";
+    /**
+     * The phase that this analyzer is intended to run in.
+     */
+    private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+    /**
+     * The set of file extensions supported by this analyzer.
+     */
+    private static final Set<String> EXTENSIONS = newHashSet("js");
+
+    /**
+     * Returns a list of file EXTENSIONS supported by this analyzer.
+     *
+     * @return a list of file EXTENSIONS supported by this analyzer.
+     */
+    public Set<String> getSupportedExtensions() {
+        return EXTENSIONS;
+    }
+
+    /**
+     * Returns the name of the analyzer.
+     *
+     * @return the name of the analyzer.
+     */
+    public String getName() {
+        return ANALYZER_NAME;
+    }
+
+    /**
+     * Returns whether or not this analyzer can process the given extension.
+     *
+     * @param extension the file extension to test for support.
+     * @return whether or not the specified file extension is supported by this
+     * analyzer.
+     */
+    public boolean supportsExtension(String extension) {
+        return EXTENSIONS.contains(extension);
+    }
+
+    /**
+     * Returns the phase that the analyzer is intended to run in.
+     *
+     * @return the phase that the analyzer is intended to run in.
+     */
+    public AnalysisPhase getAnalysisPhase() {
+        return ANALYSIS_PHASE;
+    }
+
+    /**
+     * Loads a specified JAR file and collects information from the manifest and
+     * checksums to identify the correct CPE information.
+     *
+     * @param dependency the dependency to analyze.
+     * @param engine the engine that is scanning the dependencies
+     * @throws AnalysisException is thrown if there is an error reading the JAR
+     * file.
+     */
+    public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+        Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)");
+
+    }
+
+    private void addLicense(Dependency d, String license) {
+        if (d.getLicense() == null) {
+            d.setLicense(license);
+        } else if (!d.getLicense().contains(license)) {
+            d.setLicense(d.getLicense() + NEWLINE + license);
+        }
+    }
+
+    /**
+     * The initialize method does nothing for this Analyzer
+     */
+    public void initialize() {
+        //do nothing
+    }
+
+    /**
+     * The close method does nothing for this Analyzer
+     */
+    public void close() {
+        //do nothing
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/SpringCleaningAnalyzer.java

@@ -0,0 +1,159 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.Identifier;
+
+/**
+ * This analyzer ensures that the Spring Framework Core CPE identifiers are only associated
+ * with the "core" jar files. If there are other Spring JARs, such as spring-beans, and
+ * spring-core is in the scanned dependencies then only the spring-core will have a reference
+ * to the CPE values (if there are any for the version of spring being used).
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class SpringCleaningAnalyzer extends AbstractAnalyzer {
+
+    /**
+     * The set of file extensions supported by this analyzer.
+     */
+    private static final Set<String> EXTENSIONS = newHashSet("jar");
+    /**
+     * The name of the analyzer.
+     */
+    private static final String ANALYZER_NAME = "Jar Analyzer";
+    /**
+     * The phase that this analyzer is intended to run in.
+     */
+    private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
+
+    /**
+     * Returns a list of file EXTENSIONS supported by this analyzer.
+     *
+     * @return a list of file EXTENSIONS supported by this analyzer.
+     */
+    public Set<String> getSupportedExtensions() {
+        return EXTENSIONS;
+    }
+
+    /**
+     * Returns the name of the analyzer.
+     *
+     * @return the name of the analyzer.
+     */
+    public String getName() {
+        return ANALYZER_NAME;
+    }
+
+    /**
+     * Returns whether or not this analyzer can process the given extension.
+     *
+     * @param extension the file extension to test for support
+     * @return whether or not the specified file extension is supported by this
+     * analyzer.
+     */
+    public boolean supportsExtension(String extension) {
+        return EXTENSIONS.contains(extension);
+    }
+
+    /**
+     * Returns the phase that the analyzer is intended to run in.
+     *
+     * @return the phase that the analyzer is intended to run in.
+     */
+    public AnalysisPhase getAnalysisPhase() {
+        return ANALYSIS_PHASE;
+    }
+
+    /**
+     * The initialize method does nothing for this Analyzer
+     * @throws Exception never thrown by this analyzer
+     */
+    public void initialize() throws Exception {
+        //do nothing
+    }
+
+    /**
+     * The close method does nothing for this Analyzer
+     * @throws Exception never thrown by this analyzer
+     */
+    public void close() throws Exception {
+        //do nothing
+    }
+    private List<Identifier> springVersions = null;
+
+    /**
+     * Determines if several "spring" libraries were scanned and trims the
+     * cpe:/a:springsource:spring_framework:[version] from the none "core" framework
+     * if the core framework was part of the scan.
+     *
+     * @param dependency the dependency to analyze.
+     * @param engine the engine that is scanning the dependencies
+     * @throws AnalysisException is thrown if there is an error reading the JAR
+     * file.
+     */
+    public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+
+        collectSpringFrameworkIdentifiers(engine);
+
+        List<Identifier> identifiersToRemove = new ArrayList<Identifier>();
+        for (Identifier identifier : dependency.getIdentifiers()) {
+            if (springVersions.contains(identifier) && !isCoreFramework(dependency.getFileName())) {
+                identifiersToRemove.add(identifier);
+            }
+        }
+
+        for (Identifier i : identifiersToRemove) {
+            dependency.getIdentifiers().remove(i);
+        }
+    }
+
+    private void collectSpringFrameworkIdentifiers(Engine engine) {
+        //check to see if any of the libs are the core framework
+        if (springVersions == null) {
+            springVersions = new ArrayList<Identifier>();
+            for (Dependency d : engine.getDependencies()) {
+                if (supportsExtension(d.getFileExtension())) {
+                    for (Identifier i : d.getIdentifiers()) {
+                        if (isSpringFrameworkCpe(i)) {
+                            if (isCoreFramework(d.getFileName())) {
+                                springVersions.add(i);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    private boolean isSpringFrameworkCpe(Identifier identifier) {
+        return "cpe".equals(identifier.getType())
+                && (identifier.getValue().startsWith("cpe:/a:springsource:spring_framework:")
+                || identifier.getValue().startsWith("cpe:/a:vmware:springsource_spring_framework"));
+    }
+
+    private boolean isCoreFramework(String filename) {
+        return filename.toLowerCase().matches("^spring([ _-]?core)?[ _-]?\\d.*");
+    }
+}

src/main/java/org/owasp/dependencycheck/analyzer/package-info.java

@@ -0,0 +1,15 @@
+/**
+ * <html>
+ * <head>
+ * <title>org.owasp.dependencycheck.scanner</title>
+ * </head>
+ * <body>
+ * The scanner package contains the utilities to scan files and directories for
+ * dependencies. Analyzers are used to inspect the identified dependencies and
+ * collect Evidence. This evidence is then used to determine if the dependency
+ * has a known CPE.
+ * </body>
+ * </html>
+*/
+
+package org.owasp.dependencycheck.analyzer;

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Activation.java

@@ -0,0 +1,195 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         The conditions within the build runtime environment which will trigger
+ *         the automatic inclusion of the build profile.
+ *
+ *
+ * <p>Java class for Activation complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Activation">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="activeByDefault" type="{http://www.w3.org/2001/XMLSchema}boolean" minOccurs="0"/>
+ *         &lt;element name="jdk" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="os" type="{http://maven.apache.org/POM/4.0.0}ActivationOS" minOccurs="0"/>
+ *         &lt;element name="property" type="{http://maven.apache.org/POM/4.0.0}ActivationProperty" minOccurs="0"/>
+ *         &lt;element name="file" type="{http://maven.apache.org/POM/4.0.0}ActivationFile" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Activation", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Activation {
+
+    @XmlElement(defaultValue = "false")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Boolean activeByDefault;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String jdk;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected ActivationOS os;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected ActivationProperty property;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected ActivationFile file;
+
+    /**
+     * Gets the value of the activeByDefault property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Boolean isActiveByDefault() {
+        return activeByDefault;
+    }
+
+    /**
+     * Sets the value of the activeByDefault property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setActiveByDefault(Boolean value) {
+        this.activeByDefault = value;
+    }
+
+    /**
+     * Gets the value of the jdk property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getJdk() {
+        return jdk;
+    }
+
+    /**
+     * Sets the value of the jdk property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setJdk(String value) {
+        this.jdk = value;
+    }
+
+    /**
+     * Gets the value of the os property.
+     *
+     * @return
+     *     possible object is
+     *     {@link ActivationOS }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public ActivationOS getOs() {
+        return os;
+    }
+
+    /**
+     * Sets the value of the os property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link ActivationOS }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setOs(ActivationOS value) {
+        this.os = value;
+    }
+
+    /**
+     * Gets the value of the property property.
+     *
+     * @return
+     *     possible object is
+     *     {@link ActivationProperty }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public ActivationProperty getProperty() {
+        return property;
+    }
+
+    /**
+     * Sets the value of the property property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link ActivationProperty }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setProperty(ActivationProperty value) {
+        this.property = value;
+    }
+
+    /**
+     * Gets the value of the file property.
+     *
+     * @return
+     *     possible object is
+     *     {@link ActivationFile }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public ActivationFile getFile() {
+        return file;
+    }
+
+    /**
+     * Sets the value of the file property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link ActivationFile }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setFile(ActivationFile value) {
+        this.file = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/ActivationFile.java

@@ -0,0 +1,107 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         This is the file specification used to activate the profile. The missing value will be the location
+ *         of a file that needs to exist, and if it doesn't the profile will be activated.  On the other hand exists will test
+ *         for the existence of the file and if it is there the profile will be activated.
+ *
+ *
+ * <p>Java class for ActivationFile complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="ActivationFile">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="missing" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="exists" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "ActivationFile", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class ActivationFile {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String missing;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String exists;
+
+    /**
+     * Gets the value of the missing property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getMissing() {
+        return missing;
+    }
+
+    /**
+     * Sets the value of the missing property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setMissing(String value) {
+        this.missing = value;
+    }
+
+    /**
+     * Gets the value of the exists property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getExists() {
+        return exists;
+    }
+
+    /**
+     * Sets the value of the exists property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setExists(String value) {
+        this.exists = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/ActivationOS.java

@@ -0,0 +1,164 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         This is an activator which will detect an operating system's attributes in order to activate
+ *         its profile.
+ *
+ *
+ * <p>Java class for ActivationOS complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="ActivationOS">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="name" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="family" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="arch" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="version" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "ActivationOS", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class ActivationOS {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String name;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String family;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String arch;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String version;
+
+    /**
+     * Gets the value of the name property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Sets the value of the name property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setName(String value) {
+        this.name = value;
+    }
+
+    /**
+     * Gets the value of the family property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getFamily() {
+        return family;
+    }
+
+    /**
+     * Sets the value of the family property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setFamily(String value) {
+        this.family = value;
+    }
+
+    /**
+     * Gets the value of the arch property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getArch() {
+        return arch;
+    }
+
+    /**
+     * Sets the value of the arch property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setArch(String value) {
+        this.arch = value;
+    }
+
+    /**
+     * Gets the value of the version property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getVersion() {
+        return version;
+    }
+
+    /**
+     * Sets the value of the version property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setVersion(String value) {
+        this.version = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/ActivationProperty.java

@@ -0,0 +1,107 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         This is the property specification used to activate a profile. If the value field is empty,
+ *         then the existence of the named property will activate the profile, otherwise it does a case-sensitive
+ *         match against the property value as well.
+ *
+ *
+ * <p>Java class for ActivationProperty complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="ActivationProperty">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="name" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="value" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "ActivationProperty", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class ActivationProperty {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String name;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String value;
+
+    /**
+     * Gets the value of the name property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Sets the value of the name property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setName(String value) {
+        this.name = value;
+    }
+
+    /**
+     * Gets the value of the value property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getValue() {
+        return value;
+    }
+
+    /**
+     * Sets the value of the value property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Build.java

@@ -0,0 +1,813 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *  3.0.0+
+ *
+ * <p>Java class for Build complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Build">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="sourceDirectory" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="scriptSourceDirectory" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="testSourceDirectory" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="outputDirectory" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="testOutputDirectory" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="extensions" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="extension" type="{http://maven.apache.org/POM/4.0.0}Extension" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="defaultGoal" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="resources" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="resource" type="{http://maven.apache.org/POM/4.0.0}Resource" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="testResources" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="testResource" type="{http://maven.apache.org/POM/4.0.0}Resource" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="directory" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="finalName" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="filters" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="filter" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="pluginManagement" type="{http://maven.apache.org/POM/4.0.0}PluginManagement" minOccurs="0"/>
+ *         &lt;element name="plugins" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="plugin" type="{http://maven.apache.org/POM/4.0.0}Plugin" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Build", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Build {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String sourceDirectory;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String scriptSourceDirectory;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String testSourceDirectory;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String outputDirectory;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String testOutputDirectory;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Build.Extensions extensions;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String defaultGoal;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Build.Resources resources;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Build.TestResources testResources;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String directory;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String finalName;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Build.Filters filters;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected PluginManagement pluginManagement;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Build.Plugins plugins;
+
+    /**
+     * Gets the value of the sourceDirectory property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getSourceDirectory() {
+        return sourceDirectory;
+    }
+
+    /**
+     * Sets the value of the sourceDirectory property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSourceDirectory(String value) {
+        this.sourceDirectory = value;
+    }
+
+    /**
+     * Gets the value of the scriptSourceDirectory property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getScriptSourceDirectory() {
+        return scriptSourceDirectory;
+    }
+
+    /**
+     * Sets the value of the scriptSourceDirectory property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setScriptSourceDirectory(String value) {
+        this.scriptSourceDirectory = value;
+    }
+
+    /**
+     * Gets the value of the testSourceDirectory property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getTestSourceDirectory() {
+        return testSourceDirectory;
+    }
+
+    /**
+     * Sets the value of the testSourceDirectory property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setTestSourceDirectory(String value) {
+        this.testSourceDirectory = value;
+    }
+
+    /**
+     * Gets the value of the outputDirectory property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getOutputDirectory() {
+        return outputDirectory;
+    }
+
+    /**
+     * Sets the value of the outputDirectory property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setOutputDirectory(String value) {
+        this.outputDirectory = value;
+    }
+
+    /**
+     * Gets the value of the testOutputDirectory property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getTestOutputDirectory() {
+        return testOutputDirectory;
+    }
+
+    /**
+     * Sets the value of the testOutputDirectory property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setTestOutputDirectory(String value) {
+        this.testOutputDirectory = value;
+    }
+
+    /**
+     * Gets the value of the extensions property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Build.Extensions }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Build.Extensions getExtensions() {
+        return extensions;
+    }
+
+    /**
+     * Sets the value of the extensions property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Build.Extensions }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setExtensions(Build.Extensions value) {
+        this.extensions = value;
+    }
+
+    /**
+     * Gets the value of the defaultGoal property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getDefaultGoal() {
+        return defaultGoal;
+    }
+
+    /**
+     * Sets the value of the defaultGoal property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDefaultGoal(String value) {
+        this.defaultGoal = value;
+    }
+
+    /**
+     * Gets the value of the resources property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Build.Resources }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Build.Resources getResources() {
+        return resources;
+    }
+
+    /**
+     * Sets the value of the resources property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Build.Resources }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setResources(Build.Resources value) {
+        this.resources = value;
+    }
+
+    /**
+     * Gets the value of the testResources property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Build.TestResources }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Build.TestResources getTestResources() {
+        return testResources;
+    }
+
+    /**
+     * Sets the value of the testResources property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Build.TestResources }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setTestResources(Build.TestResources value) {
+        this.testResources = value;
+    }
+
+    /**
+     * Gets the value of the directory property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getDirectory() {
+        return directory;
+    }
+
+    /**
+     * Sets the value of the directory property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDirectory(String value) {
+        this.directory = value;
+    }
+
+    /**
+     * Gets the value of the finalName property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getFinalName() {
+        return finalName;
+    }
+
+    /**
+     * Sets the value of the finalName property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setFinalName(String value) {
+        this.finalName = value;
+    }
+
+    /**
+     * Gets the value of the filters property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Build.Filters }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Build.Filters getFilters() {
+        return filters;
+    }
+
+    /**
+     * Sets the value of the filters property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Build.Filters }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setFilters(Build.Filters value) {
+        this.filters = value;
+    }
+
+    /**
+     * Gets the value of the pluginManagement property.
+     *
+     * @return
+     *     possible object is
+     *     {@link PluginManagement }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public PluginManagement getPluginManagement() {
+        return pluginManagement;
+    }
+
+    /**
+     * Sets the value of the pluginManagement property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link PluginManagement }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setPluginManagement(PluginManagement value) {
+        this.pluginManagement = value;
+    }
+
+    /**
+     * Gets the value of the plugins property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Build.Plugins }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Build.Plugins getPlugins() {
+        return plugins;
+    }
+
+    /**
+     * Sets the value of the plugins property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Build.Plugins }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setPlugins(Build.Plugins value) {
+        this.plugins = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="extension" type="{http://maven.apache.org/POM/4.0.0}Extension" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "extension"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Extensions {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Extension> extension;
+
+        /**
+         * Gets the value of the extension property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the extension property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getExtension().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Extension }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Extension> getExtension() {
+            if (extension == null) {
+                extension = new ArrayList<Extension>();
+            }
+            return this.extension;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="filter" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "filter"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Filters {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<String> filter;
+
+        /**
+         * Gets the value of the filter property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the filter property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getFilter().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link String }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<String> getFilter() {
+            if (filter == null) {
+                filter = new ArrayList<String>();
+            }
+            return this.filter;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="plugin" type="{http://maven.apache.org/POM/4.0.0}Plugin" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "plugin"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Plugins {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Plugin> plugin;
+
+        /**
+         * Gets the value of the plugin property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the plugin property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getPlugin().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Plugin }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Plugin> getPlugin() {
+            if (plugin == null) {
+                plugin = new ArrayList<Plugin>();
+            }
+            return this.plugin;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="resource" type="{http://maven.apache.org/POM/4.0.0}Resource" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "resource"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Resources {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Resource> resource;
+
+        /**
+         * Gets the value of the resource property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the resource property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getResource().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Resource }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Resource> getResource() {
+            if (resource == null) {
+                resource = new ArrayList<Resource>();
+            }
+            return this.resource;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="testResource" type="{http://maven.apache.org/POM/4.0.0}Resource" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "testResource"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class TestResources {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Resource> testResource;
+
+        /**
+         * Gets the value of the testResource property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the testResource property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getTestResource().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Resource }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Resource> getTestResource() {
+            if (testResource == null) {
+                testResource = new ArrayList<Resource>();
+            }
+            return this.testResource;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/BuildBase.java

@@ -0,0 +1,567 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *  3.0.0+
+ *
+ * <p>Java class for BuildBase complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="BuildBase">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="defaultGoal" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="resources" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="resource" type="{http://maven.apache.org/POM/4.0.0}Resource" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="testResources" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="testResource" type="{http://maven.apache.org/POM/4.0.0}Resource" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="directory" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="finalName" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="filters" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="filter" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="pluginManagement" type="{http://maven.apache.org/POM/4.0.0}PluginManagement" minOccurs="0"/>
+ *         &lt;element name="plugins" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="plugin" type="{http://maven.apache.org/POM/4.0.0}Plugin" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "BuildBase", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class BuildBase {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String defaultGoal;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected BuildBase.Resources resources;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected BuildBase.TestResources testResources;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String directory;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String finalName;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected BuildBase.Filters filters;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected PluginManagement pluginManagement;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected BuildBase.Plugins plugins;
+
+    /**
+     * Gets the value of the defaultGoal property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getDefaultGoal() {
+        return defaultGoal;
+    }
+
+    /**
+     * Sets the value of the defaultGoal property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDefaultGoal(String value) {
+        this.defaultGoal = value;
+    }
+
+    /**
+     * Gets the value of the resources property.
+     *
+     * @return
+     *     possible object is
+     *     {@link BuildBase.Resources }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public BuildBase.Resources getResources() {
+        return resources;
+    }
+
+    /**
+     * Sets the value of the resources property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link BuildBase.Resources }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setResources(BuildBase.Resources value) {
+        this.resources = value;
+    }
+
+    /**
+     * Gets the value of the testResources property.
+     *
+     * @return
+     *     possible object is
+     *     {@link BuildBase.TestResources }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public BuildBase.TestResources getTestResources() {
+        return testResources;
+    }
+
+    /**
+     * Sets the value of the testResources property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link BuildBase.TestResources }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setTestResources(BuildBase.TestResources value) {
+        this.testResources = value;
+    }
+
+    /**
+     * Gets the value of the directory property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getDirectory() {
+        return directory;
+    }
+
+    /**
+     * Sets the value of the directory property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDirectory(String value) {
+        this.directory = value;
+    }
+
+    /**
+     * Gets the value of the finalName property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getFinalName() {
+        return finalName;
+    }
+
+    /**
+     * Sets the value of the finalName property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setFinalName(String value) {
+        this.finalName = value;
+    }
+
+    /**
+     * Gets the value of the filters property.
+     *
+     * @return
+     *     possible object is
+     *     {@link BuildBase.Filters }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public BuildBase.Filters getFilters() {
+        return filters;
+    }
+
+    /**
+     * Sets the value of the filters property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link BuildBase.Filters }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setFilters(BuildBase.Filters value) {
+        this.filters = value;
+    }
+
+    /**
+     * Gets the value of the pluginManagement property.
+     *
+     * @return
+     *     possible object is
+     *     {@link PluginManagement }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public PluginManagement getPluginManagement() {
+        return pluginManagement;
+    }
+
+    /**
+     * Sets the value of the pluginManagement property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link PluginManagement }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setPluginManagement(PluginManagement value) {
+        this.pluginManagement = value;
+    }
+
+    /**
+     * Gets the value of the plugins property.
+     *
+     * @return
+     *     possible object is
+     *     {@link BuildBase.Plugins }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public BuildBase.Plugins getPlugins() {
+        return plugins;
+    }
+
+    /**
+     * Sets the value of the plugins property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link BuildBase.Plugins }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setPlugins(BuildBase.Plugins value) {
+        this.plugins = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="filter" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "filter"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Filters {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<String> filter;
+
+        /**
+         * Gets the value of the filter property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the filter property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getFilter().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link String }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<String> getFilter() {
+            if (filter == null) {
+                filter = new ArrayList<String>();
+            }
+            return this.filter;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="plugin" type="{http://maven.apache.org/POM/4.0.0}Plugin" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "plugin"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Plugins {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Plugin> plugin;
+
+        /**
+         * Gets the value of the plugin property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the plugin property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getPlugin().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Plugin }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Plugin> getPlugin() {
+            if (plugin == null) {
+                plugin = new ArrayList<Plugin>();
+            }
+            return this.plugin;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="resource" type="{http://maven.apache.org/POM/4.0.0}Resource" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "resource"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Resources {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Resource> resource;
+
+        /**
+         * Gets the value of the resource property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the resource property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getResource().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Resource }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Resource> getResource() {
+            if (resource == null) {
+                resource = new ArrayList<Resource>();
+            }
+            return this.resource;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="testResource" type="{http://maven.apache.org/POM/4.0.0}Resource" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "testResource"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class TestResources {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Resource> testResource;
+
+        /**
+         * Gets the value of the testResource property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the testResource property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getTestResource().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Resource }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Resource> getTestResource() {
+            if (testResource == null) {
+                testResource = new ArrayList<Resource>();
+            }
+            return this.testResource;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/CiManagement.java

@@ -0,0 +1,206 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *  4.0.0
+ *
+ * <p>Java class for CiManagement complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="CiManagement">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="system" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="url" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="notifiers" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="notifier" type="{http://maven.apache.org/POM/4.0.0}Notifier" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "CiManagement", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class CiManagement {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String system;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String url;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected CiManagement.Notifiers notifiers;
+
+    /**
+     * Gets the value of the system property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getSystem() {
+        return system;
+    }
+
+    /**
+     * Sets the value of the system property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSystem(String value) {
+        this.system = value;
+    }
+
+    /**
+     * Gets the value of the url property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Sets the value of the url property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUrl(String value) {
+        this.url = value;
+    }
+
+    /**
+     * Gets the value of the notifiers property.
+     *
+     * @return
+     *     possible object is
+     *     {@link CiManagement.Notifiers }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public CiManagement.Notifiers getNotifiers() {
+        return notifiers;
+    }
+
+    /**
+     * Sets the value of the notifiers property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link CiManagement.Notifiers }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setNotifiers(CiManagement.Notifiers value) {
+        this.notifiers = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="notifier" type="{http://maven.apache.org/POM/4.0.0}Notifier" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "notifier"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Notifiers {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Notifier> notifier;
+
+        /**
+         * Gets the value of the notifier property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the notifier property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getNotifier().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Notifier }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Notifier> getNotifier() {
+            if (notifier == null) {
+                notifier = new ArrayList<Notifier>();
+            }
+            return this.notifier;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Contributor.java

@@ -0,0 +1,430 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAnyElement;
+import javax.xml.bind.annotation.XmlType;
+import org.w3c.dom.Element;
+
+
+/**
+ *
+ *         Description of a person who has contributed to the project, but who does
+ *         not have commit privileges. Usually, these contributions come in the
+ *         form of patches submitted.
+ *
+ *
+ * <p>Java class for Contributor complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Contributor">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="name" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="email" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="url" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="organization" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="organizationUrl" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="roles" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="role" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="timezone" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="properties" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Contributor", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Contributor {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String name;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String email;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String url;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String organization;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String organizationUrl;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Contributor.Roles roles;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String timezone;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Contributor.Properties properties;
+
+    /**
+     * Gets the value of the name property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Sets the value of the name property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setName(String value) {
+        this.name = value;
+    }
+
+    /**
+     * Gets the value of the email property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getEmail() {
+        return email;
+    }
+
+    /**
+     * Sets the value of the email property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setEmail(String value) {
+        this.email = value;
+    }
+
+    /**
+     * Gets the value of the url property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Sets the value of the url property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUrl(String value) {
+        this.url = value;
+    }
+
+    /**
+     * Gets the value of the organization property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getOrganization() {
+        return organization;
+    }
+
+    /**
+     * Sets the value of the organization property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setOrganization(String value) {
+        this.organization = value;
+    }
+
+    /**
+     * Gets the value of the organizationUrl property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getOrganizationUrl() {
+        return organizationUrl;
+    }
+
+    /**
+     * Sets the value of the organizationUrl property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setOrganizationUrl(String value) {
+        this.organizationUrl = value;
+    }
+
+    /**
+     * Gets the value of the roles property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Contributor.Roles }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Contributor.Roles getRoles() {
+        return roles;
+    }
+
+    /**
+     * Sets the value of the roles property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Contributor.Roles }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setRoles(Contributor.Roles value) {
+        this.roles = value;
+    }
+
+    /**
+     * Gets the value of the timezone property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getTimezone() {
+        return timezone;
+    }
+
+    /**
+     * Sets the value of the timezone property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setTimezone(String value) {
+        this.timezone = value;
+    }
+
+    /**
+     * Gets the value of the properties property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Contributor.Properties }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Contributor.Properties getProperties() {
+        return properties;
+    }
+
+    /**
+     * Sets the value of the properties property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Contributor.Properties }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setProperties(Contributor.Properties value) {
+        this.properties = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "any"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Properties {
+
+        @XmlAnyElement
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Element> any;
+
+        /**
+         * Gets the value of the any property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the any property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getAny().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Element }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Element> getAny() {
+            if (any == null) {
+                any = new ArrayList<Element>();
+            }
+            return this.any;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="role" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "role"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Roles {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<String> role;
+
+        /**
+         * Gets the value of the role property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the role property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getRole().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link String }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<String> getRole() {
+            if (role == null) {
+                role = new ArrayList<String>();
+            }
+            return this.role;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Dependency.java

@@ -0,0 +1,383 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *  3.0.0+
+ *
+ * <p>Java class for Dependency complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Dependency">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="groupId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="artifactId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="version" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="type" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="classifier" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="scope" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="systemPath" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="exclusions" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="exclusion" type="{http://maven.apache.org/POM/4.0.0}Exclusion" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="optional" type="{http://www.w3.org/2001/XMLSchema}boolean" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Dependency", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Dependency {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String groupId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String artifactId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String version;
+    @XmlElement(defaultValue = "jar")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String type;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String classifier;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String scope;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String systemPath;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Dependency.Exclusions exclusions;
+    @XmlElement(defaultValue = "false")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Boolean optional;
+
+    /**
+     * Gets the value of the groupId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getGroupId() {
+        return groupId;
+    }
+
+    /**
+     * Sets the value of the groupId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setGroupId(String value) {
+        this.groupId = value;
+    }
+
+    /**
+     * Gets the value of the artifactId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getArtifactId() {
+        return artifactId;
+    }
+
+    /**
+     * Sets the value of the artifactId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setArtifactId(String value) {
+        this.artifactId = value;
+    }
+
+    /**
+     * Gets the value of the version property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getVersion() {
+        return version;
+    }
+
+    /**
+     * Sets the value of the version property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setVersion(String value) {
+        this.version = value;
+    }
+
+    /**
+     * Gets the value of the type property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getType() {
+        return type;
+    }
+
+    /**
+     * Sets the value of the type property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setType(String value) {
+        this.type = value;
+    }
+
+    /**
+     * Gets the value of the classifier property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getClassifier() {
+        return classifier;
+    }
+
+    /**
+     * Sets the value of the classifier property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setClassifier(String value) {
+        this.classifier = value;
+    }
+
+    /**
+     * Gets the value of the scope property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getScope() {
+        return scope;
+    }
+
+    /**
+     * Sets the value of the scope property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setScope(String value) {
+        this.scope = value;
+    }
+
+    /**
+     * Gets the value of the systemPath property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getSystemPath() {
+        return systemPath;
+    }
+
+    /**
+     * Sets the value of the systemPath property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSystemPath(String value) {
+        this.systemPath = value;
+    }
+
+    /**
+     * Gets the value of the exclusions property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Dependency.Exclusions }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Dependency.Exclusions getExclusions() {
+        return exclusions;
+    }
+
+    /**
+     * Sets the value of the exclusions property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Dependency.Exclusions }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setExclusions(Dependency.Exclusions value) {
+        this.exclusions = value;
+    }
+
+    /**
+     * Gets the value of the optional property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Boolean isOptional() {
+        return optional;
+    }
+
+    /**
+     * Sets the value of the optional property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setOptional(Boolean value) {
+        this.optional = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="exclusion" type="{http://maven.apache.org/POM/4.0.0}Exclusion" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "exclusion"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Exclusions {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Exclusion> exclusion;
+
+        /**
+         * Gets the value of the exclusion property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the exclusion property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getExclusion().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Exclusion }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Exclusion> getExclusion() {
+            if (exclusion == null) {
+                exclusion = new ArrayList<Exclusion>();
+            }
+            return this.exclusion;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/DependencyManagement.java

@@ -0,0 +1,150 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         Section for management of default dependency information for use in a group of POMs.
+ *
+ *
+ * <p>Java class for DependencyManagement complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="DependencyManagement">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="dependencies" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="dependency" type="{http://maven.apache.org/POM/4.0.0}Dependency" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "DependencyManagement", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class DependencyManagement {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected DependencyManagement.Dependencies dependencies;
+
+    /**
+     * Gets the value of the dependencies property.
+     *
+     * @return
+     *     possible object is
+     *     {@link DependencyManagement.Dependencies }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public DependencyManagement.Dependencies getDependencies() {
+        return dependencies;
+    }
+
+    /**
+     * Sets the value of the dependencies property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link DependencyManagement.Dependencies }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDependencies(DependencyManagement.Dependencies value) {
+        this.dependencies = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="dependency" type="{http://maven.apache.org/POM/4.0.0}Dependency" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "dependency"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Dependencies {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Dependency> dependency;
+
+        /**
+         * Gets the value of the dependency property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the dependency property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getDependency().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Dependency }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Dependency> getDependency() {
+            if (dependency == null) {
+                dependency = new ArrayList<Dependency>();
+            }
+            return this.dependency;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/DeploymentRepository.java

@@ -0,0 +1,195 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         Repository contains the information needed for deploying to the remote repository.
+ *
+ *
+ * <p>Java class for DeploymentRepository complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="DeploymentRepository">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="uniqueVersion" type="{http://www.w3.org/2001/XMLSchema}boolean" minOccurs="0"/>
+ *         &lt;element name="id" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="name" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="url" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="layout" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "DeploymentRepository", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class DeploymentRepository {
+
+    @XmlElement(defaultValue = "true")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Boolean uniqueVersion;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String id;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String name;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String url;
+    @XmlElement(defaultValue = "default")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String layout;
+
+    /**
+     * Gets the value of the uniqueVersion property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Boolean isUniqueVersion() {
+        return uniqueVersion;
+    }
+
+    /**
+     * Sets the value of the uniqueVersion property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUniqueVersion(Boolean value) {
+        this.uniqueVersion = value;
+    }
+
+    /**
+     * Gets the value of the id property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getId() {
+        return id;
+    }
+
+    /**
+     * Sets the value of the id property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setId(String value) {
+        this.id = value;
+    }
+
+    /**
+     * Gets the value of the name property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Sets the value of the name property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setName(String value) {
+        this.name = value;
+    }
+
+    /**
+     * Gets the value of the url property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Sets the value of the url property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUrl(String value) {
+        this.url = value;
+    }
+
+    /**
+     * Gets the value of the layout property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getLayout() {
+        return layout;
+    }
+
+    /**
+     * Sets the value of the layout property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setLayout(String value) {
+        this.layout = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Developer.java

@@ -0,0 +1,457 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAnyElement;
+import javax.xml.bind.annotation.XmlType;
+import org.w3c.dom.Element;
+
+
+/**
+ *
+ *         Information about one of the committers on this project.
+ *
+ *
+ * <p>Java class for Developer complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Developer">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="id" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="name" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="email" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="url" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="organization" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="organizationUrl" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="roles" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="role" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="timezone" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="properties" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Developer", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Developer {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String id;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String name;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String email;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String url;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String organization;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String organizationUrl;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Developer.Roles roles;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String timezone;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Developer.Properties properties;
+
+    /**
+     * Gets the value of the id property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getId() {
+        return id;
+    }
+
+    /**
+     * Sets the value of the id property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setId(String value) {
+        this.id = value;
+    }
+
+    /**
+     * Gets the value of the name property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Sets the value of the name property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setName(String value) {
+        this.name = value;
+    }
+
+    /**
+     * Gets the value of the email property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getEmail() {
+        return email;
+    }
+
+    /**
+     * Sets the value of the email property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setEmail(String value) {
+        this.email = value;
+    }
+
+    /**
+     * Gets the value of the url property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Sets the value of the url property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUrl(String value) {
+        this.url = value;
+    }
+
+    /**
+     * Gets the value of the organization property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getOrganization() {
+        return organization;
+    }
+
+    /**
+     * Sets the value of the organization property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setOrganization(String value) {
+        this.organization = value;
+    }
+
+    /**
+     * Gets the value of the organizationUrl property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getOrganizationUrl() {
+        return organizationUrl;
+    }
+
+    /**
+     * Sets the value of the organizationUrl property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setOrganizationUrl(String value) {
+        this.organizationUrl = value;
+    }
+
+    /**
+     * Gets the value of the roles property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Developer.Roles }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Developer.Roles getRoles() {
+        return roles;
+    }
+
+    /**
+     * Sets the value of the roles property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Developer.Roles }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setRoles(Developer.Roles value) {
+        this.roles = value;
+    }
+
+    /**
+     * Gets the value of the timezone property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getTimezone() {
+        return timezone;
+    }
+
+    /**
+     * Sets the value of the timezone property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setTimezone(String value) {
+        this.timezone = value;
+    }
+
+    /**
+     * Gets the value of the properties property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Developer.Properties }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Developer.Properties getProperties() {
+        return properties;
+    }
+
+    /**
+     * Sets the value of the properties property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Developer.Properties }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setProperties(Developer.Properties value) {
+        this.properties = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "any"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Properties {
+
+        @XmlAnyElement
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Element> any;
+
+        /**
+         * Gets the value of the any property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the any property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getAny().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Element }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Element> getAny() {
+            if (any == null) {
+                any = new ArrayList<Element>();
+            }
+            return this.any;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="role" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "role"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Roles {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<String> role;
+
+        /**
+         * Gets the value of the role property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the role property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getRole().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link String }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<String> getRole() {
+            if (role == null) {
+                role = new ArrayList<String>();
+            }
+            return this.role;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/DistributionManagement.java

@@ -0,0 +1,223 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         This elements describes all that pertains to distribution for a project.
+ *         It is primarily used for deployment of artifacts and the site
+ *         produced by the build.
+ *
+ *
+ * <p>Java class for DistributionManagement complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="DistributionManagement">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="repository" type="{http://maven.apache.org/POM/4.0.0}DeploymentRepository" minOccurs="0"/>
+ *         &lt;element name="snapshotRepository" type="{http://maven.apache.org/POM/4.0.0}DeploymentRepository" minOccurs="0"/>
+ *         &lt;element name="site" type="{http://maven.apache.org/POM/4.0.0}Site" minOccurs="0"/>
+ *         &lt;element name="downloadUrl" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="relocation" type="{http://maven.apache.org/POM/4.0.0}Relocation" minOccurs="0"/>
+ *         &lt;element name="status" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "DistributionManagement", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class DistributionManagement {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected DeploymentRepository repository;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected DeploymentRepository snapshotRepository;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Site site;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String downloadUrl;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Relocation relocation;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String status;
+
+    /**
+     * Gets the value of the repository property.
+     *
+     * @return
+     *     possible object is
+     *     {@link DeploymentRepository }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public DeploymentRepository getRepository() {
+        return repository;
+    }
+
+    /**
+     * Sets the value of the repository property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link DeploymentRepository }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setRepository(DeploymentRepository value) {
+        this.repository = value;
+    }
+
+    /**
+     * Gets the value of the snapshotRepository property.
+     *
+     * @return
+     *     possible object is
+     *     {@link DeploymentRepository }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public DeploymentRepository getSnapshotRepository() {
+        return snapshotRepository;
+    }
+
+    /**
+     * Sets the value of the snapshotRepository property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link DeploymentRepository }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSnapshotRepository(DeploymentRepository value) {
+        this.snapshotRepository = value;
+    }
+
+    /**
+     * Gets the value of the site property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Site }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Site getSite() {
+        return site;
+    }
+
+    /**
+     * Sets the value of the site property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Site }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSite(Site value) {
+        this.site = value;
+    }
+
+    /**
+     * Gets the value of the downloadUrl property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getDownloadUrl() {
+        return downloadUrl;
+    }
+
+    /**
+     * Sets the value of the downloadUrl property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDownloadUrl(String value) {
+        this.downloadUrl = value;
+    }
+
+    /**
+     * Gets the value of the relocation property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Relocation }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Relocation getRelocation() {
+        return relocation;
+    }
+
+    /**
+     * Sets the value of the relocation property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Relocation }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setRelocation(Relocation value) {
+        this.relocation = value;
+    }
+
+    /**
+     * Gets the value of the status property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getStatus() {
+        return status;
+    }
+
+    /**
+     * Sets the value of the status property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setStatus(String value) {
+        this.status = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Exclusion.java

@@ -0,0 +1,103 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *  4.0.0
+ *
+ * <p>Java class for Exclusion complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Exclusion">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="artifactId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="groupId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Exclusion", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Exclusion {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String artifactId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String groupId;
+
+    /**
+     * Gets the value of the artifactId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getArtifactId() {
+        return artifactId;
+    }
+
+    /**
+     * Sets the value of the artifactId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setArtifactId(String value) {
+        this.artifactId = value;
+    }
+
+    /**
+     * Gets the value of the groupId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getGroupId() {
+        return groupId;
+    }
+
+    /**
+     * Sets the value of the groupId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setGroupId(String value) {
+        this.groupId = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Extension.java

@@ -0,0 +1,132 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ * Describes a build extension to utilise.
+ *
+ * <p>Java class for Extension complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Extension">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="groupId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="artifactId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="version" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Extension", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Extension {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String groupId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String artifactId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String version;
+
+    /**
+     * Gets the value of the groupId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getGroupId() {
+        return groupId;
+    }
+
+    /**
+     * Sets the value of the groupId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setGroupId(String value) {
+        this.groupId = value;
+    }
+
+    /**
+     * Gets the value of the artifactId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getArtifactId() {
+        return artifactId;
+    }
+
+    /**
+     * Sets the value of the artifactId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setArtifactId(String value) {
+        this.artifactId = value;
+    }
+
+    /**
+     * Gets the value of the version property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getVersion() {
+        return version;
+    }
+
+    /**
+     * Sets the value of the version property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setVersion(String value) {
+        this.version = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/IssueManagement.java

@@ -0,0 +1,105 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         Information about the issue tracking (or bug tracking) system used to manage this project.
+ *
+ *
+ * <p>Java class for IssueManagement complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="IssueManagement">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="system" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="url" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "IssueManagement", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class IssueManagement {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String system;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String url;
+
+    /**
+     * Gets the value of the system property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getSystem() {
+        return system;
+    }
+
+    /**
+     * Sets the value of the system property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSystem(String value) {
+        this.system = value;
+    }
+
+    /**
+     * Gets the value of the url property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Sets the value of the url property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUrl(String value) {
+        this.url = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/License.java

@@ -0,0 +1,165 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         Describes the licenses for this project.  This is used to generate
+ *         the license page of the project's web site, as well as being taken into consideration in other reporting and
+ *         validation. The licenses listed for the project are that of the project itself, and not of dependencies.
+ *
+ *
+ * <p>Java class for License complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="License">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="name" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="url" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="distribution" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="comments" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "License", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class License {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String name;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String url;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String distribution;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String comments;
+
+    /**
+     * Gets the value of the name property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Sets the value of the name property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setName(String value) {
+        this.name = value;
+    }
+
+    /**
+     * Gets the value of the url property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Sets the value of the url property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUrl(String value) {
+        this.url = value;
+    }
+
+    /**
+     * Gets the value of the distribution property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getDistribution() {
+        return distribution;
+    }
+
+    /**
+     * Sets the value of the distribution property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDistribution(String value) {
+        this.distribution = value;
+    }
+
+    /**
+     * Gets the value of the comments property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getComments() {
+        return comments;
+    }
+
+    /**
+     * Sets the value of the comments property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setComments(String value) {
+        this.comments = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/MailingList.java

@@ -0,0 +1,296 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         This element describes all of the mailing lists associated with
+ *         a project. The auto-generated site references this information.
+ *
+ *
+ * <p>Java class for MailingList complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="MailingList">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="name" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="subscribe" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="unsubscribe" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="post" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="archive" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="otherArchives" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="otherArchive" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "MailingList", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class MailingList {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String name;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String subscribe;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String unsubscribe;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String post;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String archive;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected MailingList.OtherArchives otherArchives;
+
+    /**
+     * Gets the value of the name property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Sets the value of the name property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setName(String value) {
+        this.name = value;
+    }
+
+    /**
+     * Gets the value of the subscribe property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getSubscribe() {
+        return subscribe;
+    }
+
+    /**
+     * Sets the value of the subscribe property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSubscribe(String value) {
+        this.subscribe = value;
+    }
+
+    /**
+     * Gets the value of the unsubscribe property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUnsubscribe() {
+        return unsubscribe;
+    }
+
+    /**
+     * Sets the value of the unsubscribe property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUnsubscribe(String value) {
+        this.unsubscribe = value;
+    }
+
+    /**
+     * Gets the value of the post property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getPost() {
+        return post;
+    }
+
+    /**
+     * Sets the value of the post property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setPost(String value) {
+        this.post = value;
+    }
+
+    /**
+     * Gets the value of the archive property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getArchive() {
+        return archive;
+    }
+
+    /**
+     * Sets the value of the archive property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setArchive(String value) {
+        this.archive = value;
+    }
+
+    /**
+     * Gets the value of the otherArchives property.
+     *
+     * @return
+     *     possible object is
+     *     {@link MailingList.OtherArchives }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public MailingList.OtherArchives getOtherArchives() {
+        return otherArchives;
+    }
+
+    /**
+     * Sets the value of the otherArchives property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link MailingList.OtherArchives }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setOtherArchives(MailingList.OtherArchives value) {
+        this.otherArchives = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="otherArchive" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "otherArchive"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class OtherArchives {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<String> otherArchive;
+
+        /**
+         * Gets the value of the otherArchive property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the otherArchive property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getOtherArchive().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link String }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<String> getOtherArchive() {
+            if (otherArchive == null) {
+                otherArchive = new ArrayList<String>();
+            }
+            return this.otherArchive;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Notifier.java

@@ -0,0 +1,333 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAnyElement;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+import org.w3c.dom.Element;
+
+
+/**
+ *
+ *         Configures one method for notifying users/developers when a build breaks.
+ *
+ *
+ * <p>Java class for Notifier complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Notifier">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="type" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="sendOnError" type="{http://www.w3.org/2001/XMLSchema}boolean" minOccurs="0"/>
+ *         &lt;element name="sendOnFailure" type="{http://www.w3.org/2001/XMLSchema}boolean" minOccurs="0"/>
+ *         &lt;element name="sendOnSuccess" type="{http://www.w3.org/2001/XMLSchema}boolean" minOccurs="0"/>
+ *         &lt;element name="sendOnWarning" type="{http://www.w3.org/2001/XMLSchema}boolean" minOccurs="0"/>
+ *         &lt;element name="address" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="configuration" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Notifier", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Notifier {
+
+    @XmlElement(defaultValue = "mail")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String type;
+    @XmlElement(defaultValue = "true")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Boolean sendOnError;
+    @XmlElement(defaultValue = "true")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Boolean sendOnFailure;
+    @XmlElement(defaultValue = "true")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Boolean sendOnSuccess;
+    @XmlElement(defaultValue = "true")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Boolean sendOnWarning;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String address;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Notifier.Configuration configuration;
+
+    /**
+     * Gets the value of the type property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getType() {
+        return type;
+    }
+
+    /**
+     * Sets the value of the type property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setType(String value) {
+        this.type = value;
+    }
+
+    /**
+     * Gets the value of the sendOnError property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Boolean isSendOnError() {
+        return sendOnError;
+    }
+
+    /**
+     * Sets the value of the sendOnError property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSendOnError(Boolean value) {
+        this.sendOnError = value;
+    }
+
+    /**
+     * Gets the value of the sendOnFailure property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Boolean isSendOnFailure() {
+        return sendOnFailure;
+    }
+
+    /**
+     * Sets the value of the sendOnFailure property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSendOnFailure(Boolean value) {
+        this.sendOnFailure = value;
+    }
+
+    /**
+     * Gets the value of the sendOnSuccess property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Boolean isSendOnSuccess() {
+        return sendOnSuccess;
+    }
+
+    /**
+     * Sets the value of the sendOnSuccess property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSendOnSuccess(Boolean value) {
+        this.sendOnSuccess = value;
+    }
+
+    /**
+     * Gets the value of the sendOnWarning property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Boolean isSendOnWarning() {
+        return sendOnWarning;
+    }
+
+    /**
+     * Sets the value of the sendOnWarning property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSendOnWarning(Boolean value) {
+        this.sendOnWarning = value;
+    }
+
+    /**
+     * Gets the value of the address property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getAddress() {
+        return address;
+    }
+
+    /**
+     * Sets the value of the address property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setAddress(String value) {
+        this.address = value;
+    }
+
+    /**
+     * Gets the value of the configuration property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Notifier.Configuration }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Notifier.Configuration getConfiguration() {
+        return configuration;
+    }
+
+    /**
+     * Sets the value of the configuration property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Notifier.Configuration }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setConfiguration(Notifier.Configuration value) {
+        this.configuration = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "any"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Configuration {
+
+        @XmlAnyElement
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Element> any;
+
+        /**
+         * Gets the value of the any property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the any property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getAny().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Element }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Element> getAny() {
+            if (any == null) {
+                any = new ArrayList<Element>();
+            }
+            return this.any;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/ObjectFactory.java

@@ -0,0 +1,732 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.xml.bind.JAXBElement;
+import javax.xml.bind.annotation.XmlElementDecl;
+import javax.xml.bind.annotation.XmlRegistry;
+import javax.xml.namespace.QName;
+
+
+/**
+ * This object contains factory methods for each
+ * Java content interface and Java element interface
+ * generated in the org.owasp.dependencycheck.analyzer.pom.generated package.
+ * <p>An ObjectFactory allows you to programmatically
+ * construct new instances of the Java representation
+ * for XML content. The Java representation of XML
+ * content can consist of schema derived interfaces
+ * and classes representing the binding of schema
+ * type definitions, element declarations and model
+ * groups.  Factory methods for each of these are
+ * provided in this class.
+ *
+ */
+@XmlRegistry
+public class ObjectFactory {
+
+    private final static QName _Project_QNAME = new QName("http://maven.apache.org/POM/4.0.0", "project");
+
+    /**
+     * Create a new ObjectFactory that can be used to create new instances of schema derived classes for package: org.owasp.dependencycheck.analyzer.pom.generated
+     *
+     */
+    public ObjectFactory() {
+    }
+
+    /**
+     * Create an instance of {@link Model }
+     *
+     */
+    public Model createModel() {
+        return new Model();
+    }
+
+    /**
+     * Create an instance of {@link Reporting }
+     *
+     */
+    public Reporting createReporting() {
+        return new Reporting();
+    }
+
+    /**
+     * Create an instance of {@link Exclusion }
+     *
+     */
+    public Exclusion createExclusion() {
+        return new Exclusion();
+    }
+
+    /**
+     * Create an instance of {@link Build.Filters }
+     *
+     */
+    public Build.Filters createBuildFilters() {
+        return new Build.Filters();
+    }
+
+    /**
+     * Create an instance of {@link ReportPlugin.Configuration }
+     *
+     */
+    public ReportPlugin.Configuration createReportPluginConfiguration() {
+        return new ReportPlugin.Configuration();
+    }
+
+    /**
+     * Create an instance of {@link IssueManagement }
+     *
+     */
+    public IssueManagement createIssueManagement() {
+        return new IssueManagement();
+    }
+
+    /**
+     * Create an instance of {@link PluginExecution.Goals }
+     *
+     */
+    public PluginExecution.Goals createPluginExecutionGoals() {
+        return new PluginExecution.Goals();
+    }
+
+    /**
+     * Create an instance of {@link ReportPlugin }
+     *
+     */
+    public ReportPlugin createReportPlugin() {
+        return new ReportPlugin();
+    }
+
+    /**
+     * Create an instance of {@link Profile.Properties }
+     *
+     */
+    public Profile.Properties createProfileProperties() {
+        return new Profile.Properties();
+    }
+
+    /**
+     * Create an instance of {@link ActivationProperty }
+     *
+     */
+    public ActivationProperty createActivationProperty() {
+        return new ActivationProperty();
+    }
+
+    /**
+     * Create an instance of {@link Build.Extensions }
+     *
+     */
+    public Build.Extensions createBuildExtensions() {
+        return new Build.Extensions();
+    }
+
+    /**
+     * Create an instance of {@link Plugin }
+     *
+     */
+    public Plugin createPlugin() {
+        return new Plugin();
+    }
+
+    /**
+     * Create an instance of {@link Profile.Dependencies }
+     *
+     */
+    public Profile.Dependencies createProfileDependencies() {
+        return new Profile.Dependencies();
+    }
+
+    /**
+     * Create an instance of {@link Resource.Excludes }
+     *
+     */
+    public Resource.Excludes createResourceExcludes() {
+        return new Resource.Excludes();
+    }
+
+    /**
+     * Create an instance of {@link Scm }
+     *
+     */
+    public Scm createScm() {
+        return new Scm();
+    }
+
+    /**
+     * Create an instance of {@link ReportSet.Reports }
+     *
+     */
+    public ReportSet.Reports createReportSetReports() {
+        return new ReportSet.Reports();
+    }
+
+    /**
+     * Create an instance of {@link PluginManagement }
+     *
+     */
+    public PluginManagement createPluginManagement() {
+        return new PluginManagement();
+    }
+
+    /**
+     * Create an instance of {@link CiManagement.Notifiers }
+     *
+     */
+    public CiManagement.Notifiers createCiManagementNotifiers() {
+        return new CiManagement.Notifiers();
+    }
+
+    /**
+     * Create an instance of {@link Model.PluginRepositories }
+     *
+     */
+    public Model.PluginRepositories createModelPluginRepositories() {
+        return new Model.PluginRepositories();
+    }
+
+    /**
+     * Create an instance of {@link ActivationFile }
+     *
+     */
+    public ActivationFile createActivationFile() {
+        return new ActivationFile();
+    }
+
+    /**
+     * Create an instance of {@link Developer.Roles }
+     *
+     */
+    public Developer.Roles createDeveloperRoles() {
+        return new Developer.Roles();
+    }
+
+    /**
+     * Create an instance of {@link DeploymentRepository }
+     *
+     */
+    public DeploymentRepository createDeploymentRepository() {
+        return new DeploymentRepository();
+    }
+
+    /**
+     * Create an instance of {@link Contributor.Properties }
+     *
+     */
+    public Contributor.Properties createContributorProperties() {
+        return new Contributor.Properties();
+    }
+
+    /**
+     * Create an instance of {@link DistributionManagement }
+     *
+     */
+    public DistributionManagement createDistributionManagement() {
+        return new DistributionManagement();
+    }
+
+    /**
+     * Create an instance of {@link RepositoryPolicy }
+     *
+     */
+    public RepositoryPolicy createRepositoryPolicy() {
+        return new RepositoryPolicy();
+    }
+
+    /**
+     * Create an instance of {@link Model.Licenses }
+     *
+     */
+    public Model.Licenses createModelLicenses() {
+        return new Model.Licenses();
+    }
+
+    /**
+     * Create an instance of {@link Build.TestResources }
+     *
+     */
+    public Build.TestResources createBuildTestResources() {
+        return new Build.TestResources();
+    }
+
+    /**
+     * Create an instance of {@link Plugin.Goals }
+     *
+     */
+    public Plugin.Goals createPluginGoals() {
+        return new Plugin.Goals();
+    }
+
+    /**
+     * Create an instance of {@link Plugin.Executions }
+     *
+     */
+    public Plugin.Executions createPluginExecutions() {
+        return new Plugin.Executions();
+    }
+
+    /**
+     * Create an instance of {@link DependencyManagement }
+     *
+     */
+    public DependencyManagement createDependencyManagement() {
+        return new DependencyManagement();
+    }
+
+    /**
+     * Create an instance of {@link Model.Reports }
+     *
+     */
+    public Model.Reports createModelReports() {
+        return new Model.Reports();
+    }
+
+    /**
+     * Create an instance of {@link Build }
+     *
+     */
+    public Build createBuild() {
+        return new Build();
+    }
+
+    /**
+     * Create an instance of {@link Build.Resources }
+     *
+     */
+    public Build.Resources createBuildResources() {
+        return new Build.Resources();
+    }
+
+    /**
+     * Create an instance of {@link DependencyManagement.Dependencies }
+     *
+     */
+    public DependencyManagement.Dependencies createDependencyManagementDependencies() {
+        return new DependencyManagement.Dependencies();
+    }
+
+    /**
+     * Create an instance of {@link Model.Contributors }
+     *
+     */
+    public Model.Contributors createModelContributors() {
+        return new Model.Contributors();
+    }
+
+    /**
+     * Create an instance of {@link Build.Plugins }
+     *
+     */
+    public Build.Plugins createBuildPlugins() {
+        return new Build.Plugins();
+    }
+
+    /**
+     * Create an instance of {@link Extension }
+     *
+     */
+    public Extension createExtension() {
+        return new Extension();
+    }
+
+    /**
+     * Create an instance of {@link Organization }
+     *
+     */
+    public Organization createOrganization() {
+        return new Organization();
+    }
+
+    /**
+     * Create an instance of {@link License }
+     *
+     */
+    public License createLicense() {
+        return new License();
+    }
+
+    /**
+     * Create an instance of {@link Activation }
+     *
+     */
+    public Activation createActivation() {
+        return new Activation();
+    }
+
+    /**
+     * Create an instance of {@link ActivationOS }
+     *
+     */
+    public ActivationOS createActivationOS() {
+        return new ActivationOS();
+    }
+
+    /**
+     * Create an instance of {@link Model.Modules }
+     *
+     */
+    public Model.Modules createModelModules() {
+        return new Model.Modules();
+    }
+
+    /**
+     * Create an instance of {@link Profile.Repositories }
+     *
+     */
+    public Profile.Repositories createProfileRepositories() {
+        return new Profile.Repositories();
+    }
+
+    /**
+     * Create an instance of {@link Model.Dependencies }
+     *
+     */
+    public Model.Dependencies createModelDependencies() {
+        return new Model.Dependencies();
+    }
+
+    /**
+     * Create an instance of {@link BuildBase.Resources }
+     *
+     */
+    public BuildBase.Resources createBuildBaseResources() {
+        return new BuildBase.Resources();
+    }
+
+    /**
+     * Create an instance of {@link Site }
+     *
+     */
+    public Site createSite() {
+        return new Site();
+    }
+
+    /**
+     * Create an instance of {@link ReportPlugin.ReportSets }
+     *
+     */
+    public ReportPlugin.ReportSets createReportPluginReportSets() {
+        return new ReportPlugin.ReportSets();
+    }
+
+    /**
+     * Create an instance of {@link Plugin.Configuration }
+     *
+     */
+    public Plugin.Configuration createPluginConfiguration() {
+        return new Plugin.Configuration();
+    }
+
+    /**
+     * Create an instance of {@link Profile.PluginRepositories }
+     *
+     */
+    public Profile.PluginRepositories createProfilePluginRepositories() {
+        return new Profile.PluginRepositories();
+    }
+
+    /**
+     * Create an instance of {@link Dependency.Exclusions }
+     *
+     */
+    public Dependency.Exclusions createDependencyExclusions() {
+        return new Dependency.Exclusions();
+    }
+
+    /**
+     * Create an instance of {@link Prerequisites }
+     *
+     */
+    public Prerequisites createPrerequisites() {
+        return new Prerequisites();
+    }
+
+    /**
+     * Create an instance of {@link Model.Profiles }
+     *
+     */
+    public Model.Profiles createModelProfiles() {
+        return new Model.Profiles();
+    }
+
+    /**
+     * Create an instance of {@link Model.Properties }
+     *
+     */
+    public Model.Properties createModelProperties() {
+        return new Model.Properties();
+    }
+
+    /**
+     * Create an instance of {@link BuildBase.Plugins }
+     *
+     */
+    public BuildBase.Plugins createBuildBasePlugins() {
+        return new BuildBase.Plugins();
+    }
+
+    /**
+     * Create an instance of {@link BuildBase }
+     *
+     */
+    public BuildBase createBuildBase() {
+        return new BuildBase();
+    }
+
+    /**
+     * Create an instance of {@link PluginManagement.Plugins }
+     *
+     */
+    public PluginManagement.Plugins createPluginManagementPlugins() {
+        return new PluginManagement.Plugins();
+    }
+
+    /**
+     * Create an instance of {@link Contributor.Roles }
+     *
+     */
+    public Contributor.Roles createContributorRoles() {
+        return new Contributor.Roles();
+    }
+
+    /**
+     * Create an instance of {@link MailingList }
+     *
+     */
+    public MailingList createMailingList() {
+        return new MailingList();
+    }
+
+    /**
+     * Create an instance of {@link CiManagement }
+     *
+     */
+    public CiManagement createCiManagement() {
+        return new CiManagement();
+    }
+
+    /**
+     * Create an instance of {@link Model.MailingLists }
+     *
+     */
+    public Model.MailingLists createModelMailingLists() {
+        return new Model.MailingLists();
+    }
+
+    /**
+     * Create an instance of {@link Model.Developers }
+     *
+     */
+    public Model.Developers createModelDevelopers() {
+        return new Model.Developers();
+    }
+
+    /**
+     * Create an instance of {@link Reporting.Plugins }
+     *
+     */
+    public Reporting.Plugins createReportingPlugins() {
+        return new Reporting.Plugins();
+    }
+
+    /**
+     * Create an instance of {@link Contributor }
+     *
+     */
+    public Contributor createContributor() {
+        return new Contributor();
+    }
+
+    /**
+     * Create an instance of {@link Profile.Reports }
+     *
+     */
+    public Profile.Reports createProfileReports() {
+        return new Profile.Reports();
+    }
+
+    /**
+     * Create an instance of {@link BuildBase.TestResources }
+     *
+     */
+    public BuildBase.TestResources createBuildBaseTestResources() {
+        return new BuildBase.TestResources();
+    }
+
+    /**
+     * Create an instance of {@link Developer.Properties }
+     *
+     */
+    public Developer.Properties createDeveloperProperties() {
+        return new Developer.Properties();
+    }
+
+    /**
+     * Create an instance of {@link Plugin.Dependencies }
+     *
+     */
+    public Plugin.Dependencies createPluginDependencies() {
+        return new Plugin.Dependencies();
+    }
+
+    /**
+     * Create an instance of {@link Resource.Includes }
+     *
+     */
+    public Resource.Includes createResourceIncludes() {
+        return new Resource.Includes();
+    }
+
+    /**
+     * Create an instance of {@link Resource }
+     *
+     */
+    public Resource createResource() {
+        return new Resource();
+    }
+
+    /**
+     * Create an instance of {@link Repository }
+     *
+     */
+    public Repository createRepository() {
+        return new Repository();
+    }
+
+    /**
+     * Create an instance of {@link BuildBase.Filters }
+     *
+     */
+    public BuildBase.Filters createBuildBaseFilters() {
+        return new BuildBase.Filters();
+    }
+
+    /**
+     * Create an instance of {@link ReportSet }
+     *
+     */
+    public ReportSet createReportSet() {
+        return new ReportSet();
+    }
+
+    /**
+     * Create an instance of {@link Notifier.Configuration }
+     *
+     */
+    public Notifier.Configuration createNotifierConfiguration() {
+        return new Notifier.Configuration();
+    }
+
+    /**
+     * Create an instance of {@link Model.Repositories }
+     *
+     */
+    public Model.Repositories createModelRepositories() {
+        return new Model.Repositories();
+    }
+
+    /**
+     * Create an instance of {@link Dependency }
+     *
+     */
+    public Dependency createDependency() {
+        return new Dependency();
+    }
+
+    /**
+     * Create an instance of {@link Relocation }
+     *
+     */
+    public Relocation createRelocation() {
+        return new Relocation();
+    }
+
+    /**
+     * Create an instance of {@link MailingList.OtherArchives }
+     *
+     */
+    public MailingList.OtherArchives createMailingListOtherArchives() {
+        return new MailingList.OtherArchives();
+    }
+
+    /**
+     * Create an instance of {@link ReportSet.Configuration }
+     *
+     */
+    public ReportSet.Configuration createReportSetConfiguration() {
+        return new ReportSet.Configuration();
+    }
+
+    /**
+     * Create an instance of {@link Profile }
+     *
+     */
+    public Profile createProfile() {
+        return new Profile();
+    }
+
+    /**
+     * Create an instance of {@link PluginExecution.Configuration }
+     *
+     */
+    public PluginExecution.Configuration createPluginExecutionConfiguration() {
+        return new PluginExecution.Configuration();
+    }
+
+    /**
+     * Create an instance of {@link Notifier }
+     *
+     */
+    public Notifier createNotifier() {
+        return new Notifier();
+    }
+
+    /**
+     * Create an instance of {@link Parent }
+     *
+     */
+    public Parent createParent() {
+        return new Parent();
+    }
+
+    /**
+     * Create an instance of {@link PluginExecution }
+     *
+     */
+    public PluginExecution createPluginExecution() {
+        return new PluginExecution();
+    }
+
+    /**
+     * Create an instance of {@link Developer }
+     *
+     */
+    public Developer createDeveloper() {
+        return new Developer();
+    }
+
+    /**
+     * Create an instance of {@link Profile.Modules }
+     *
+     */
+    public Profile.Modules createProfileModules() {
+        return new Profile.Modules();
+    }
+
+    /**
+     * Create an instance of {@link JAXBElement }{@code <}{@link Model }{@code >}}
+     *
+     */
+    @XmlElementDecl(namespace = "http://maven.apache.org/POM/4.0.0", name = "project")
+    public JAXBElement<Model> createProject(Model value) {
+        return new JAXBElement<Model>(_Project_QNAME, Model.class, null, value);
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Organization.java

@@ -0,0 +1,103 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ * Specifies the organization that produces this project.
+ *
+ * <p>Java class for Organization complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Organization">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="name" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="url" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Organization", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Organization {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String name;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String url;
+
+    /**
+     * Gets the value of the name property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Sets the value of the name property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setName(String value) {
+        this.name = value;
+    }
+
+    /**
+     * Gets the value of the url property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Sets the value of the url property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUrl(String value) {
+        this.url = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Parent.java

@@ -0,0 +1,163 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *  4.0.0
+ *
+ * <p>Java class for Parent complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Parent">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="artifactId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="groupId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="version" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="relativePath" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Parent", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Parent {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String artifactId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String groupId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String version;
+    @XmlElement(defaultValue = "../pom.xml")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String relativePath;
+
+    /**
+     * Gets the value of the artifactId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getArtifactId() {
+        return artifactId;
+    }
+
+    /**
+     * Sets the value of the artifactId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setArtifactId(String value) {
+        this.artifactId = value;
+    }
+
+    /**
+     * Gets the value of the groupId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getGroupId() {
+        return groupId;
+    }
+
+    /**
+     * Sets the value of the groupId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setGroupId(String value) {
+        this.groupId = value;
+    }
+
+    /**
+     * Gets the value of the version property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getVersion() {
+        return version;
+    }
+
+    /**
+     * Sets the value of the version property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setVersion(String value) {
+        this.version = value;
+    }
+
+    /**
+     * Gets the value of the relativePath property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getRelativePath() {
+        return relativePath;
+    }
+
+    /**
+     * Sets the value of the relativePath property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setRelativePath(String value) {
+        this.relativePath = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Plugin.java

@@ -0,0 +1,603 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAnyElement;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+import org.w3c.dom.Element;
+
+
+/**
+ *  4.0.0
+ *
+ * <p>Java class for Plugin complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Plugin">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="groupId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="artifactId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="version" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="extensions" type="{http://www.w3.org/2001/XMLSchema}boolean" minOccurs="0"/>
+ *         &lt;element name="executions" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="execution" type="{http://maven.apache.org/POM/4.0.0}PluginExecution" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="dependencies" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="dependency" type="{http://maven.apache.org/POM/4.0.0}Dependency" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="goals" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="inherited" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="configuration" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Plugin", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Plugin {
+
+    @XmlElement(defaultValue = "org.apache.maven.plugins")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String groupId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String artifactId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String version;
+    @XmlElement(defaultValue = "false")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Boolean extensions;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Plugin.Executions executions;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Plugin.Dependencies dependencies;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Plugin.Goals goals;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String inherited;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Plugin.Configuration configuration;
+
+    /**
+     * Gets the value of the groupId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getGroupId() {
+        return groupId;
+    }
+
+    /**
+     * Sets the value of the groupId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setGroupId(String value) {
+        this.groupId = value;
+    }
+
+    /**
+     * Gets the value of the artifactId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getArtifactId() {
+        return artifactId;
+    }
+
+    /**
+     * Sets the value of the artifactId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setArtifactId(String value) {
+        this.artifactId = value;
+    }
+
+    /**
+     * Gets the value of the version property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getVersion() {
+        return version;
+    }
+
+    /**
+     * Sets the value of the version property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setVersion(String value) {
+        this.version = value;
+    }
+
+    /**
+     * Gets the value of the extensions property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Boolean isExtensions() {
+        return extensions;
+    }
+
+    /**
+     * Sets the value of the extensions property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setExtensions(Boolean value) {
+        this.extensions = value;
+    }
+
+    /**
+     * Gets the value of the executions property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Plugin.Executions }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Plugin.Executions getExecutions() {
+        return executions;
+    }
+
+    /**
+     * Sets the value of the executions property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Plugin.Executions }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setExecutions(Plugin.Executions value) {
+        this.executions = value;
+    }
+
+    /**
+     * Gets the value of the dependencies property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Plugin.Dependencies }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Plugin.Dependencies getDependencies() {
+        return dependencies;
+    }
+
+    /**
+     * Sets the value of the dependencies property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Plugin.Dependencies }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDependencies(Plugin.Dependencies value) {
+        this.dependencies = value;
+    }
+
+    /**
+     * Gets the value of the goals property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Plugin.Goals }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Plugin.Goals getGoals() {
+        return goals;
+    }
+
+    /**
+     * Sets the value of the goals property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Plugin.Goals }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setGoals(Plugin.Goals value) {
+        this.goals = value;
+    }
+
+    /**
+     * Gets the value of the inherited property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getInherited() {
+        return inherited;
+    }
+
+    /**
+     * Sets the value of the inherited property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setInherited(String value) {
+        this.inherited = value;
+    }
+
+    /**
+     * Gets the value of the configuration property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Plugin.Configuration }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Plugin.Configuration getConfiguration() {
+        return configuration;
+    }
+
+    /**
+     * Sets the value of the configuration property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Plugin.Configuration }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setConfiguration(Plugin.Configuration value) {
+        this.configuration = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "any"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Configuration {
+
+        @XmlAnyElement
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Element> any;
+
+        /**
+         * Gets the value of the any property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the any property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getAny().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Element }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Element> getAny() {
+            if (any == null) {
+                any = new ArrayList<Element>();
+            }
+            return this.any;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="dependency" type="{http://maven.apache.org/POM/4.0.0}Dependency" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "dependency"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Dependencies {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Dependency> dependency;
+
+        /**
+         * Gets the value of the dependency property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the dependency property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getDependency().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Dependency }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Dependency> getDependency() {
+            if (dependency == null) {
+                dependency = new ArrayList<Dependency>();
+            }
+            return this.dependency;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="execution" type="{http://maven.apache.org/POM/4.0.0}PluginExecution" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "execution"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Executions {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<PluginExecution> execution;
+
+        /**
+         * Gets the value of the execution property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the execution property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getExecution().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link PluginExecution }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<PluginExecution> getExecution() {
+            if (execution == null) {
+                execution = new ArrayList<PluginExecution>();
+            }
+            return this.execution;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "any"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Goals {
+
+        @XmlAnyElement
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Element> any;
+
+        /**
+         * Gets the value of the any property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the any property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getAny().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Element }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Element> getAny() {
+            if (any == null) {
+                any = new ArrayList<Element>();
+            }
+            return this.any;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/PluginExecution.java

@@ -0,0 +1,341 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAnyElement;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+import org.w3c.dom.Element;
+
+
+/**
+ *  4.0.0
+ *
+ * <p>Java class for PluginExecution complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="PluginExecution">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="id" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="phase" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="goals" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="goal" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="inherited" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="configuration" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "PluginExecution", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class PluginExecution {
+
+    @XmlElement(defaultValue = "default")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String id;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String phase;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected PluginExecution.Goals goals;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String inherited;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected PluginExecution.Configuration configuration;
+
+    /**
+     * Gets the value of the id property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getId() {
+        return id;
+    }
+
+    /**
+     * Sets the value of the id property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setId(String value) {
+        this.id = value;
+    }
+
+    /**
+     * Gets the value of the phase property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getPhase() {
+        return phase;
+    }
+
+    /**
+     * Sets the value of the phase property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setPhase(String value) {
+        this.phase = value;
+    }
+
+    /**
+     * Gets the value of the goals property.
+     *
+     * @return
+     *     possible object is
+     *     {@link PluginExecution.Goals }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public PluginExecution.Goals getGoals() {
+        return goals;
+    }
+
+    /**
+     * Sets the value of the goals property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link PluginExecution.Goals }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setGoals(PluginExecution.Goals value) {
+        this.goals = value;
+    }
+
+    /**
+     * Gets the value of the inherited property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getInherited() {
+        return inherited;
+    }
+
+    /**
+     * Sets the value of the inherited property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setInherited(String value) {
+        this.inherited = value;
+    }
+
+    /**
+     * Gets the value of the configuration property.
+     *
+     * @return
+     *     possible object is
+     *     {@link PluginExecution.Configuration }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public PluginExecution.Configuration getConfiguration() {
+        return configuration;
+    }
+
+    /**
+     * Sets the value of the configuration property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link PluginExecution.Configuration }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setConfiguration(PluginExecution.Configuration value) {
+        this.configuration = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "any"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Configuration {
+
+        @XmlAnyElement
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Element> any;
+
+        /**
+         * Gets the value of the any property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the any property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getAny().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Element }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Element> getAny() {
+            if (any == null) {
+                any = new ArrayList<Element>();
+            }
+            return this.any;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="goal" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "goal"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Goals {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<String> goal;
+
+        /**
+         * Gets the value of the goal property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the goal property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getGoal().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link String }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<String> getGoal() {
+            if (goal == null) {
+                goal = new ArrayList<String>();
+            }
+            return this.goal;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/PluginManagement.java

@@ -0,0 +1,150 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         Section for management of default plugin information for use in a group of POMs.
+ *
+ *
+ * <p>Java class for PluginManagement complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="PluginManagement">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="plugins" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="plugin" type="{http://maven.apache.org/POM/4.0.0}Plugin" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "PluginManagement", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class PluginManagement {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected PluginManagement.Plugins plugins;
+
+    /**
+     * Gets the value of the plugins property.
+     *
+     * @return
+     *     possible object is
+     *     {@link PluginManagement.Plugins }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public PluginManagement.Plugins getPlugins() {
+        return plugins;
+    }
+
+    /**
+     * Sets the value of the plugins property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link PluginManagement.Plugins }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setPlugins(PluginManagement.Plugins value) {
+        this.plugins = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="plugin" type="{http://maven.apache.org/POM/4.0.0}Plugin" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "plugin"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Plugins {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Plugin> plugin;
+
+        /**
+         * Gets the value of the plugin property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the plugin property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getPlugin().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Plugin }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Plugin> getPlugin() {
+            if (plugin == null) {
+                plugin = new ArrayList<Plugin>();
+            }
+            return this.plugin;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Prerequisites.java

@@ -0,0 +1,76 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ * Describes the prerequisites a project can have.
+ *
+ * <p>Java class for Prerequisites complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Prerequisites">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="maven" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Prerequisites", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Prerequisites {
+
+    @XmlElement(defaultValue = "2.0")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String maven;
+
+    /**
+     * Gets the value of the maven property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getMaven() {
+        return maven;
+    }
+
+    /**
+     * Sets the value of the maven property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setMaven(String value) {
+        this.maven = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Profile.java

@@ -0,0 +1,833 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAnyElement;
+import javax.xml.bind.annotation.XmlType;
+import org.w3c.dom.Element;
+
+
+/**
+ *
+ *         Modifications to the build process which is activated based on environmental parameters or command line arguments.
+ *
+ *
+ * <p>Java class for Profile complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Profile">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="id" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="activation" type="{http://maven.apache.org/POM/4.0.0}Activation" minOccurs="0"/>
+ *         &lt;element name="build" type="{http://maven.apache.org/POM/4.0.0}BuildBase" minOccurs="0"/>
+ *         &lt;element name="modules" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="module" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="repositories" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="repository" type="{http://maven.apache.org/POM/4.0.0}Repository" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="pluginRepositories" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="pluginRepository" type="{http://maven.apache.org/POM/4.0.0}Repository" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="dependencies" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="dependency" type="{http://maven.apache.org/POM/4.0.0}Dependency" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="reports" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="reporting" type="{http://maven.apache.org/POM/4.0.0}Reporting" minOccurs="0"/>
+ *         &lt;element name="dependencyManagement" type="{http://maven.apache.org/POM/4.0.0}DependencyManagement" minOccurs="0"/>
+ *         &lt;element name="distributionManagement" type="{http://maven.apache.org/POM/4.0.0}DistributionManagement" minOccurs="0"/>
+ *         &lt;element name="properties" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Profile", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Profile {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String id;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Activation activation;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected BuildBase build;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Profile.Modules modules;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Profile.Repositories repositories;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Profile.PluginRepositories pluginRepositories;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Profile.Dependencies dependencies;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Profile.Reports reports;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Reporting reporting;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected DependencyManagement dependencyManagement;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected DistributionManagement distributionManagement;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Profile.Properties properties;
+
+    /**
+     * Gets the value of the id property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getId() {
+        return id;
+    }
+
+    /**
+     * Sets the value of the id property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setId(String value) {
+        this.id = value;
+    }
+
+    /**
+     * Gets the value of the activation property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Activation }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Activation getActivation() {
+        return activation;
+    }
+
+    /**
+     * Sets the value of the activation property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Activation }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setActivation(Activation value) {
+        this.activation = value;
+    }
+
+    /**
+     * Gets the value of the build property.
+     *
+     * @return
+     *     possible object is
+     *     {@link BuildBase }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public BuildBase getBuild() {
+        return build;
+    }
+
+    /**
+     * Sets the value of the build property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link BuildBase }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setBuild(BuildBase value) {
+        this.build = value;
+    }
+
+    /**
+     * Gets the value of the modules property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Profile.Modules }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Profile.Modules getModules() {
+        return modules;
+    }
+
+    /**
+     * Sets the value of the modules property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Profile.Modules }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setModules(Profile.Modules value) {
+        this.modules = value;
+    }
+
+    /**
+     * Gets the value of the repositories property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Profile.Repositories }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Profile.Repositories getRepositories() {
+        return repositories;
+    }
+
+    /**
+     * Sets the value of the repositories property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Profile.Repositories }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setRepositories(Profile.Repositories value) {
+        this.repositories = value;
+    }
+
+    /**
+     * Gets the value of the pluginRepositories property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Profile.PluginRepositories }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Profile.PluginRepositories getPluginRepositories() {
+        return pluginRepositories;
+    }
+
+    /**
+     * Sets the value of the pluginRepositories property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Profile.PluginRepositories }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setPluginRepositories(Profile.PluginRepositories value) {
+        this.pluginRepositories = value;
+    }
+
+    /**
+     * Gets the value of the dependencies property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Profile.Dependencies }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Profile.Dependencies getDependencies() {
+        return dependencies;
+    }
+
+    /**
+     * Sets the value of the dependencies property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Profile.Dependencies }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDependencies(Profile.Dependencies value) {
+        this.dependencies = value;
+    }
+
+    /**
+     * Gets the value of the reports property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Profile.Reports }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Profile.Reports getReports() {
+        return reports;
+    }
+
+    /**
+     * Sets the value of the reports property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Profile.Reports }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setReports(Profile.Reports value) {
+        this.reports = value;
+    }
+
+    /**
+     * Gets the value of the reporting property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Reporting }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Reporting getReporting() {
+        return reporting;
+    }
+
+    /**
+     * Sets the value of the reporting property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Reporting }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setReporting(Reporting value) {
+        this.reporting = value;
+    }
+
+    /**
+     * Gets the value of the dependencyManagement property.
+     *
+     * @return
+     *     possible object is
+     *     {@link DependencyManagement }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public DependencyManagement getDependencyManagement() {
+        return dependencyManagement;
+    }
+
+    /**
+     * Sets the value of the dependencyManagement property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link DependencyManagement }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDependencyManagement(DependencyManagement value) {
+        this.dependencyManagement = value;
+    }
+
+    /**
+     * Gets the value of the distributionManagement property.
+     *
+     * @return
+     *     possible object is
+     *     {@link DistributionManagement }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public DistributionManagement getDistributionManagement() {
+        return distributionManagement;
+    }
+
+    /**
+     * Sets the value of the distributionManagement property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link DistributionManagement }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDistributionManagement(DistributionManagement value) {
+        this.distributionManagement = value;
+    }
+
+    /**
+     * Gets the value of the properties property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Profile.Properties }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Profile.Properties getProperties() {
+        return properties;
+    }
+
+    /**
+     * Sets the value of the properties property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Profile.Properties }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setProperties(Profile.Properties value) {
+        this.properties = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="dependency" type="{http://maven.apache.org/POM/4.0.0}Dependency" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "dependency"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Dependencies {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Dependency> dependency;
+
+        /**
+         * Gets the value of the dependency property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the dependency property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getDependency().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Dependency }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Dependency> getDependency() {
+            if (dependency == null) {
+                dependency = new ArrayList<Dependency>();
+            }
+            return this.dependency;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="module" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "module"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Modules {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<String> module;
+
+        /**
+         * Gets the value of the module property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the module property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getModule().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link String }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<String> getModule() {
+            if (module == null) {
+                module = new ArrayList<String>();
+            }
+            return this.module;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="pluginRepository" type="{http://maven.apache.org/POM/4.0.0}Repository" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "pluginRepository"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class PluginRepositories {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Repository> pluginRepository;
+
+        /**
+         * Gets the value of the pluginRepository property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the pluginRepository property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getPluginRepository().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Repository }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Repository> getPluginRepository() {
+            if (pluginRepository == null) {
+                pluginRepository = new ArrayList<Repository>();
+            }
+            return this.pluginRepository;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "any"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Properties {
+
+        @XmlAnyElement
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Element> any;
+
+        /**
+         * Gets the value of the any property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the any property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getAny().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Element }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Element> getAny() {
+            if (any == null) {
+                any = new ArrayList<Element>();
+            }
+            return this.any;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "any"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Reports {
+
+        @XmlAnyElement
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Element> any;
+
+        /**
+         * Gets the value of the any property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the any property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getAny().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Element }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Element> getAny() {
+            if (any == null) {
+                any = new ArrayList<Element>();
+            }
+            return this.any;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="repository" type="{http://maven.apache.org/POM/4.0.0}Repository" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "repository"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Repositories {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Repository> repository;
+
+        /**
+         * Gets the value of the repository property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the repository property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getRepository().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Repository }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Repository> getRepository() {
+            if (repository == null) {
+                repository = new ArrayList<Repository>();
+            }
+            return this.repository;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Relocation.java

@@ -0,0 +1,162 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ * Describes where an artifact has moved to. If any of the values are omitted, it is assumed to be the
+ *         same as it was before.
+ *
+ * <p>Java class for Relocation complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Relocation">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="groupId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="artifactId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="version" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="message" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Relocation", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Relocation {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String groupId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String artifactId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String version;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String message;
+
+    /**
+     * Gets the value of the groupId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getGroupId() {
+        return groupId;
+    }
+
+    /**
+     * Sets the value of the groupId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setGroupId(String value) {
+        this.groupId = value;
+    }
+
+    /**
+     * Gets the value of the artifactId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getArtifactId() {
+        return artifactId;
+    }
+
+    /**
+     * Sets the value of the artifactId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setArtifactId(String value) {
+        this.artifactId = value;
+    }
+
+    /**
+     * Gets the value of the version property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getVersion() {
+        return version;
+    }
+
+    /**
+     * Sets the value of the version property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setVersion(String value) {
+        this.version = value;
+    }
+
+    /**
+     * Gets the value of the message property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getMessage() {
+        return message;
+    }
+
+    /**
+     * Sets the value of the message property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setMessage(String value) {
+        this.message = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/ReportPlugin.java

@@ -0,0 +1,370 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAnyElement;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+import org.w3c.dom.Element;
+
+
+/**
+ *  4.0.0
+ *
+ * <p>Java class for ReportPlugin complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="ReportPlugin">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="groupId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="artifactId" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="version" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="inherited" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="configuration" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="reportSets" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="reportSet" type="{http://maven.apache.org/POM/4.0.0}ReportSet" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "ReportPlugin", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class ReportPlugin {
+
+    @XmlElement(defaultValue = "org.apache.maven.plugins")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String groupId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String artifactId;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String version;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String inherited;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected ReportPlugin.Configuration configuration;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected ReportPlugin.ReportSets reportSets;
+
+    /**
+     * Gets the value of the groupId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getGroupId() {
+        return groupId;
+    }
+
+    /**
+     * Sets the value of the groupId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setGroupId(String value) {
+        this.groupId = value;
+    }
+
+    /**
+     * Gets the value of the artifactId property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getArtifactId() {
+        return artifactId;
+    }
+
+    /**
+     * Sets the value of the artifactId property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setArtifactId(String value) {
+        this.artifactId = value;
+    }
+
+    /**
+     * Gets the value of the version property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getVersion() {
+        return version;
+    }
+
+    /**
+     * Sets the value of the version property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setVersion(String value) {
+        this.version = value;
+    }
+
+    /**
+     * Gets the value of the inherited property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getInherited() {
+        return inherited;
+    }
+
+    /**
+     * Sets the value of the inherited property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setInherited(String value) {
+        this.inherited = value;
+    }
+
+    /**
+     * Gets the value of the configuration property.
+     *
+     * @return
+     *     possible object is
+     *     {@link ReportPlugin.Configuration }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public ReportPlugin.Configuration getConfiguration() {
+        return configuration;
+    }
+
+    /**
+     * Sets the value of the configuration property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link ReportPlugin.Configuration }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setConfiguration(ReportPlugin.Configuration value) {
+        this.configuration = value;
+    }
+
+    /**
+     * Gets the value of the reportSets property.
+     *
+     * @return
+     *     possible object is
+     *     {@link ReportPlugin.ReportSets }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public ReportPlugin.ReportSets getReportSets() {
+        return reportSets;
+    }
+
+    /**
+     * Sets the value of the reportSets property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link ReportPlugin.ReportSets }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setReportSets(ReportPlugin.ReportSets value) {
+        this.reportSets = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "any"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Configuration {
+
+        @XmlAnyElement
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Element> any;
+
+        /**
+         * Gets the value of the any property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the any property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getAny().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Element }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Element> getAny() {
+            if (any == null) {
+                any = new ArrayList<Element>();
+            }
+            return this.any;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="reportSet" type="{http://maven.apache.org/POM/4.0.0}ReportSet" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "reportSet"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class ReportSets {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<ReportSet> reportSet;
+
+        /**
+         * Gets the value of the reportSet property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the reportSet property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getReportSet().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link ReportSet }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<ReportSet> getReportSet() {
+            if (reportSet == null) {
+                reportSet = new ArrayList<ReportSet>();
+            }
+            return this.reportSet;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/ReportSet.java

@@ -0,0 +1,312 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAnyElement;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+import org.w3c.dom.Element;
+
+
+/**
+ * Represents a set of reports and configuration to be used to generate them.
+ *
+ * <p>Java class for ReportSet complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="ReportSet">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="id" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="configuration" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="inherited" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="reports" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="report" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "ReportSet", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class ReportSet {
+
+    @XmlElement(defaultValue = "default")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String id;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected ReportSet.Configuration configuration;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String inherited;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected ReportSet.Reports reports;
+
+    /**
+     * Gets the value of the id property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getId() {
+        return id;
+    }
+
+    /**
+     * Sets the value of the id property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setId(String value) {
+        this.id = value;
+    }
+
+    /**
+     * Gets the value of the configuration property.
+     *
+     * @return
+     *     possible object is
+     *     {@link ReportSet.Configuration }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public ReportSet.Configuration getConfiguration() {
+        return configuration;
+    }
+
+    /**
+     * Sets the value of the configuration property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link ReportSet.Configuration }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setConfiguration(ReportSet.Configuration value) {
+        this.configuration = value;
+    }
+
+    /**
+     * Gets the value of the inherited property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getInherited() {
+        return inherited;
+    }
+
+    /**
+     * Sets the value of the inherited property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setInherited(String value) {
+        this.inherited = value;
+    }
+
+    /**
+     * Gets the value of the reports property.
+     *
+     * @return
+     *     possible object is
+     *     {@link ReportSet.Reports }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public ReportSet.Reports getReports() {
+        return reports;
+    }
+
+    /**
+     * Sets the value of the reports property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link ReportSet.Reports }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setReports(ReportSet.Reports value) {
+        this.reports = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;any processContents='skip' maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "any"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Configuration {
+
+        @XmlAnyElement
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<Element> any;
+
+        /**
+         * Gets the value of the any property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the any property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getAny().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link Element }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<Element> getAny() {
+            if (any == null) {
+                any = new ArrayList<Element>();
+            }
+            return this.any;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="report" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "report"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Reports {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<String> report;
+
+        /**
+         * Gets the value of the report property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the report property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getReport().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link String }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<String> getReport() {
+            if (report == null) {
+                report = new ArrayList<String>();
+            }
+            return this.report;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Reporting.java

@@ -0,0 +1,208 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ * Section for management of reports and their configuration.
+ *
+ * <p>Java class for Reporting complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Reporting">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="excludeDefaults" type="{http://www.w3.org/2001/XMLSchema}boolean" minOccurs="0"/>
+ *         &lt;element name="outputDirectory" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="plugins" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="plugin" type="{http://maven.apache.org/POM/4.0.0}ReportPlugin" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Reporting", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Reporting {
+
+    @XmlElement(defaultValue = "false")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Boolean excludeDefaults;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String outputDirectory;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Reporting.Plugins plugins;
+
+    /**
+     * Gets the value of the excludeDefaults property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Boolean isExcludeDefaults() {
+        return excludeDefaults;
+    }
+
+    /**
+     * Sets the value of the excludeDefaults property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setExcludeDefaults(Boolean value) {
+        this.excludeDefaults = value;
+    }
+
+    /**
+     * Gets the value of the outputDirectory property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getOutputDirectory() {
+        return outputDirectory;
+    }
+
+    /**
+     * Sets the value of the outputDirectory property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setOutputDirectory(String value) {
+        this.outputDirectory = value;
+    }
+
+    /**
+     * Gets the value of the plugins property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Reporting.Plugins }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Reporting.Plugins getPlugins() {
+        return plugins;
+    }
+
+    /**
+     * Sets the value of the plugins property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Reporting.Plugins }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setPlugins(Reporting.Plugins value) {
+        this.plugins = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="plugin" type="{http://maven.apache.org/POM/4.0.0}ReportPlugin" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "plugin"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Plugins {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<ReportPlugin> plugin;
+
+        /**
+         * Gets the value of the plugin property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the plugin property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getPlugin().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link ReportPlugin }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<ReportPlugin> getPlugin() {
+            if (plugin == null) {
+                plugin = new ArrayList<ReportPlugin>();
+            }
+            return this.plugin;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Repository.java

@@ -0,0 +1,223 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         A repository contains the information needed for establishing connections with remote repository.
+ *
+ *
+ * <p>Java class for Repository complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Repository">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="releases" type="{http://maven.apache.org/POM/4.0.0}RepositoryPolicy" minOccurs="0"/>
+ *         &lt;element name="snapshots" type="{http://maven.apache.org/POM/4.0.0}RepositoryPolicy" minOccurs="0"/>
+ *         &lt;element name="id" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="name" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="url" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="layout" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Repository", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Repository {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected RepositoryPolicy releases;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected RepositoryPolicy snapshots;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String id;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String name;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String url;
+    @XmlElement(defaultValue = "default")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String layout;
+
+    /**
+     * Gets the value of the releases property.
+     *
+     * @return
+     *     possible object is
+     *     {@link RepositoryPolicy }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public RepositoryPolicy getReleases() {
+        return releases;
+    }
+
+    /**
+     * Sets the value of the releases property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link RepositoryPolicy }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setReleases(RepositoryPolicy value) {
+        this.releases = value;
+    }
+
+    /**
+     * Gets the value of the snapshots property.
+     *
+     * @return
+     *     possible object is
+     *     {@link RepositoryPolicy }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public RepositoryPolicy getSnapshots() {
+        return snapshots;
+    }
+
+    /**
+     * Sets the value of the snapshots property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link RepositoryPolicy }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setSnapshots(RepositoryPolicy value) {
+        this.snapshots = value;
+    }
+
+    /**
+     * Gets the value of the id property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getId() {
+        return id;
+    }
+
+    /**
+     * Sets the value of the id property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setId(String value) {
+        this.id = value;
+    }
+
+    /**
+     * Gets the value of the name property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Sets the value of the name property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setName(String value) {
+        this.name = value;
+    }
+
+    /**
+     * Gets the value of the url property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Sets the value of the url property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUrl(String value) {
+        this.url = value;
+    }
+
+    /**
+     * Gets the value of the layout property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getLayout() {
+        return layout;
+    }
+
+    /**
+     * Sets the value of the layout property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setLayout(String value) {
+        this.layout = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/RepositoryPolicy.java

@@ -0,0 +1,134 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ * Download policy
+ *
+ * <p>Java class for RepositoryPolicy complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="RepositoryPolicy">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="enabled" type="{http://www.w3.org/2001/XMLSchema}boolean" minOccurs="0"/>
+ *         &lt;element name="updatePolicy" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="checksumPolicy" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "RepositoryPolicy", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class RepositoryPolicy {
+
+    @XmlElement(defaultValue = "true")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Boolean enabled;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String updatePolicy;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String checksumPolicy;
+
+    /**
+     * Gets the value of the enabled property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Boolean isEnabled() {
+        return enabled;
+    }
+
+    /**
+     * Sets the value of the enabled property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setEnabled(Boolean value) {
+        this.enabled = value;
+    }
+
+    /**
+     * Gets the value of the updatePolicy property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUpdatePolicy() {
+        return updatePolicy;
+    }
+
+    /**
+     * Sets the value of the updatePolicy property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUpdatePolicy(String value) {
+        this.updatePolicy = value;
+    }
+
+    /**
+     * Gets the value of the checksumPolicy property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getChecksumPolicy() {
+        return checksumPolicy;
+    }
+
+    /**
+     * Sets the value of the checksumPolicy property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setChecksumPolicy(String value) {
+        this.checksumPolicy = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Resource.java

@@ -0,0 +1,341 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import java.util.ArrayList;
+import java.util.List;
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *         This element describes all of the classpath resources associated with a project or
+ *         unit tests.
+ *
+ *
+ * <p>Java class for Resource complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Resource">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="targetPath" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="filtering" type="{http://www.w3.org/2001/XMLSchema}boolean" minOccurs="0"/>
+ *         &lt;element name="directory" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="includes" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="include" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *         &lt;element name="excludes" minOccurs="0">
+ *           &lt;complexType>
+ *             &lt;complexContent>
+ *               &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *                 &lt;sequence>
+ *                   &lt;element name="exclude" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+ *                 &lt;/sequence>
+ *               &lt;/restriction>
+ *             &lt;/complexContent>
+ *           &lt;/complexType>
+ *         &lt;/element>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Resource", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Resource {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String targetPath;
+    @XmlElement(defaultValue = "false")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Boolean filtering;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String directory;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Resource.Includes includes;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected Resource.Excludes excludes;
+
+    /**
+     * Gets the value of the targetPath property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getTargetPath() {
+        return targetPath;
+    }
+
+    /**
+     * Sets the value of the targetPath property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setTargetPath(String value) {
+        this.targetPath = value;
+    }
+
+    /**
+     * Gets the value of the filtering property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Boolean isFiltering() {
+        return filtering;
+    }
+
+    /**
+     * Sets the value of the filtering property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Boolean }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setFiltering(Boolean value) {
+        this.filtering = value;
+    }
+
+    /**
+     * Gets the value of the directory property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getDirectory() {
+        return directory;
+    }
+
+    /**
+     * Sets the value of the directory property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDirectory(String value) {
+        this.directory = value;
+    }
+
+    /**
+     * Gets the value of the includes property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Resource.Includes }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Resource.Includes getIncludes() {
+        return includes;
+    }
+
+    /**
+     * Sets the value of the includes property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Resource.Includes }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setIncludes(Resource.Includes value) {
+        this.includes = value;
+    }
+
+    /**
+     * Gets the value of the excludes property.
+     *
+     * @return
+     *     possible object is
+     *     {@link Resource.Excludes }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public Resource.Excludes getExcludes() {
+        return excludes;
+    }
+
+    /**
+     * Sets the value of the excludes property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link Resource.Excludes }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setExcludes(Resource.Excludes value) {
+        this.excludes = value;
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="exclude" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "exclude"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Excludes {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<String> exclude;
+
+        /**
+         * Gets the value of the exclude property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the exclude property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getExclude().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link String }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<String> getExclude() {
+            if (exclude == null) {
+                exclude = new ArrayList<String>();
+            }
+            return this.exclude;
+        }
+
+    }
+
+
+    /**
+     * <p>Java class for anonymous complex type.
+     *
+     * <p>The following schema fragment specifies the expected content contained within this class.
+     *
+     * <pre>
+     * &lt;complexType>
+     *   &lt;complexContent>
+     *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+     *       &lt;sequence>
+     *         &lt;element name="include" type="{http://www.w3.org/2001/XMLSchema}string" maxOccurs="unbounded" minOccurs="0"/>
+     *       &lt;/sequence>
+     *     &lt;/restriction>
+     *   &lt;/complexContent>
+     * &lt;/complexType>
+     * </pre>
+     *
+     *
+     */
+    @XmlAccessorType(XmlAccessType.FIELD)
+    @XmlType(name = "", propOrder = {
+        "include"
+    })
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public static class Includes {
+
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        protected List<String> include;
+
+        /**
+         * Gets the value of the include property.
+         *
+         * <p>
+         * This accessor method returns a reference to the live list,
+         * not a snapshot. Therefore any modification you make to the
+         * returned list will be present inside the JAXB object.
+         * This is why there is not a <CODE>set</CODE> method for the include property.
+         *
+         * <p>
+         * For example, to add a new item, do as follows:
+         * <pre>
+         *    getInclude().add(newItem);
+         * </pre>
+         *
+         *
+         * <p>
+         * Objects of the following type(s) are allowed in the list
+         * {@link String }
+         *
+         *
+         */
+        @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+        public List<String> getInclude() {
+            if (include == null) {
+                include = new ArrayList<String>();
+            }
+            return this.include;
+        }
+
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Scm.java

@@ -0,0 +1,163 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *  4.0.0
+ *
+ * <p>Java class for Scm complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Scm">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="connection" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="developerConnection" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="tag" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="url" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Scm", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Scm {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String connection;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String developerConnection;
+    @XmlElement(defaultValue = "HEAD")
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String tag;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String url;
+
+    /**
+     * Gets the value of the connection property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getConnection() {
+        return connection;
+    }
+
+    /**
+     * Sets the value of the connection property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setConnection(String value) {
+        this.connection = value;
+    }
+
+    /**
+     * Gets the value of the developerConnection property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getDeveloperConnection() {
+        return developerConnection;
+    }
+
+    /**
+     * Sets the value of the developerConnection property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setDeveloperConnection(String value) {
+        this.developerConnection = value;
+    }
+
+    /**
+     * Gets the value of the tag property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getTag() {
+        return tag;
+    }
+
+    /**
+     * Sets the value of the tag property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setTag(String value) {
+        this.tag = value;
+    }
+
+    /**
+     * Gets the value of the url property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Sets the value of the url property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUrl(String value) {
+        this.url = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/Site.java

@@ -0,0 +1,134 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+
+package org.owasp.dependencycheck.analyzer.pom.generated;
+
+import javax.annotation.Generated;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlType;
+
+
+/**
+ *
+ *          Contains the information needed for deploying websites.
+ *
+ *
+ * <p>Java class for Site complex type.
+ *
+ * <p>The following schema fragment specifies the expected content contained within this class.
+ *
+ * <pre>
+ * &lt;complexType name="Site">
+ *   &lt;complexContent>
+ *     &lt;restriction base="{http://www.w3.org/2001/XMLSchema}anyType">
+ *       &lt;all>
+ *         &lt;element name="id" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="name" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *         &lt;element name="url" type="{http://www.w3.org/2001/XMLSchema}string" minOccurs="0"/>
+ *       &lt;/all>
+ *     &lt;/restriction>
+ *   &lt;/complexContent>
+ * &lt;/complexType>
+ * </pre>
+ *
+ *
+ */
+@XmlAccessorType(XmlAccessType.FIELD)
+@XmlType(name = "Site", propOrder = {
+
+})
+@Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+public class Site {
+
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String id;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String name;
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    protected String url;
+
+    /**
+     * Gets the value of the id property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getId() {
+        return id;
+    }
+
+    /**
+     * Sets the value of the id property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setId(String value) {
+        this.id = value;
+    }
+
+    /**
+     * Gets the value of the name property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Sets the value of the name property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setName(String value) {
+        this.name = value;
+    }
+
+    /**
+     * Gets the value of the url property.
+     *
+     * @return
+     *     possible object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Sets the value of the url property.
+     *
+     * @param value
+     *     allowed object is
+     *     {@link String }
+     *
+     */
+    @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+    public void setUrl(String value) {
+        this.url = value;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/analyzer/pom/generated/package-info.java

@@ -0,0 +1,9 @@
+//
+// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, vJAXB 2.1.10 in JDK 6
+// See <a href="http://java.sun.com/xml/jaxb">http://java.sun.com/xml/jaxb</a>
+// Any modifications to this file will be lost upon recompilation of the source schema.
+// Generated on: 2012.11.09 at 12:33:57 PM EST
+//
+
+@javax.xml.bind.annotation.XmlSchema(namespace = "http://maven.apache.org/POM/4.0.0", elementFormDefault = javax.xml.bind.annotation.XmlNsForm.QUALIFIED)
+package org.owasp.dependencycheck.analyzer.pom.generated;

src/main/java/org/owasp/dependencycheck/data/CachedWebDataSource.java

@@ -0,0 +1,38 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data;
+
+/**
+ * Defines an Index who's data is retrieved from the Internet. This data can be
+ * downloaded and the index updated.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public interface CachedWebDataSource {
+
+    /**
+     * Determines if an update to the current index is needed, if it is the new
+     * data is downloaded from the Internet and imported into the current Lucene
+     * Index.
+     *
+     * @throws UpdateException is thrown if there is an exception updating the
+     * index.
+     */
+    void update() throws UpdateException;
+}

src/main/java/org/owasp/dependencycheck/data/UpdateException.java

@@ -0,0 +1,66 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data;
+
+import java.io.IOException;
+
+/**
+ * An exception used when an error occurs reading a setting.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class UpdateException extends IOException {
+
+    private static final long serialVersionUID = 1L;
+
+    /**
+     * Creates a new UpdateException.
+     */
+    public UpdateException() {
+        super();
+    }
+
+    /**
+     * Creates a new UpdateException.
+     *
+     * @param msg a message for the exception.
+     */
+    public UpdateException(String msg) {
+        super(msg);
+    }
+
+    /**
+     * Creates a new UpdateException.
+     *
+     * @param ex the cause of the update exception.
+     */
+    public UpdateException(Throwable ex) {
+        super(ex);
+    }
+
+    /**
+     * Creates a new UpdateException.
+     *
+     * @param msg a message for the exception.
+     * @param ex the cause of the update exception.
+     */
+    public UpdateException(String msg, Throwable ex) {
+        super(msg, ex);
+    }
+}

src/main/java/org/owasp/dependencycheck/data/UpdateService.java

@@ -0,0 +1,61 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data;
+
+import java.util.Iterator;
+import java.util.ServiceLoader;
+
+/**
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class UpdateService {
+
+    private static UpdateService service;
+    private final ServiceLoader<CachedWebDataSource> loader;
+
+    /**
+     * Creates a new instance of UpdateService
+     */
+    private UpdateService() {
+        loader = ServiceLoader.load(CachedWebDataSource.class);
+    }
+
+    /**
+     * Retrieve the singleton instance of UpdateService.
+     *
+     * @return a singleton UpdateService.
+     */
+    public static synchronized UpdateService getInstance() {
+        if (service == null) {
+            service = new UpdateService();
+        }
+        return service;
+    }
+
+    /**
+     * Returns an Iterator for all instances of the CachedWebDataSource
+     * interface.
+     *
+     * @return an iterator of CachedWebDataSource.
+     */
+    public Iterator<CachedWebDataSource> getDataSources() {
+        return loader.iterator();
+    }
+}

src/main/java/org/owasp/dependencycheck/data/cpe/CPEAnalyzer.java

@@ -0,0 +1,507 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.cpe;
+
+import java.io.IOException;
+import java.net.URLEncoder;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.StringTokenizer;
+import org.apache.lucene.document.Document;
+import org.apache.lucene.index.CorruptIndexException;
+import org.apache.lucene.queryparser.classic.ParseException;
+import org.apache.lucene.search.ScoreDoc;
+import org.apache.lucene.search.TopDocs;
+import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.analyzer.AnalysisException;
+import org.owasp.dependencycheck.analyzer.AnalysisPhase;
+import org.owasp.dependencycheck.data.lucene.LuceneUtils;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.Evidence;
+import org.owasp.dependencycheck.dependency.Evidence.Confidence;
+import org.owasp.dependencycheck.dependency.EvidenceCollection;
+
+/**
+ * CPEAnalyzer is a utility class that takes a project dependency and attempts
+ * to discern if there is an associated CPE. It uses the evidence contained
+ * within the dependency to search the Lucene index.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class CPEAnalyzer implements org.owasp.dependencycheck.analyzer.Analyzer {
+
+    /**
+     * The maximum number of query results to return.
+     */
+    static final int MAX_QUERY_RESULTS = 10;
+    /**
+     * The weighting boost to give terms when constructing the Lucene query.
+     */
+    static final String WEIGHTING_BOOST = "^5";
+    /**
+     * A string representation of a regular expression defining characters
+     * utilized within the CPE Names.
+     */
+    static final String CLEANSE_CHARACTER_RX = "[^A-Za-z0-9 ._-]";
+    /*
+     * A string representation of a regular expression used to remove all but
+     * alpha characters.
+     */
+    static final String CLEANSE_NONALPHA_RX = "[^A-Za-z]*";
+    /**
+     * The additional size to add to a new StringBuilder to account for extra
+     * data that will be written into the string.
+     */
+    static final int STRING_BUILDER_BUFFER = 20;
+    /**
+     * The CPE Index.
+     */
+    protected Index cpe = null;
+
+    /**
+     * Opens the data source.
+     *
+     * @throws IOException when the Lucene directory to be queried does not
+     * exist or is corrupt.
+     */
+    public void open() throws IOException {
+        cpe = new Index();
+        cpe.open();
+    }
+
+    /**
+     * Closes the data source.
+     */
+    public void close() {
+        cpe.close();
+    }
+
+    /**
+     * Returns the status of the data source - is the index open.
+     *
+     * @return true or false.
+     */
+    public boolean isOpen() {
+        return (cpe != null) && cpe.isOpen();
+    }
+
+    /**
+     * Ensures that the Lucene index is closed.
+     *
+     * @throws Throwable when a throwable is thrown.
+     */
+    @Override
+    protected void finalize() throws Throwable {
+        super.finalize();
+        if (isOpen()) {
+            close();
+        }
+    }
+
+    /**
+     * Searches the data store of CPE entries, trying to identify the CPE for
+     * the given dependency based on the evidence contained within. The
+     * dependency passed in is updated with any identified CPE values.
+     *
+     * @param dependency the dependency to search for CPE entries on.
+     * @throws CorruptIndexException is thrown when the Lucene index is corrupt.
+     * @throws IOException is thrown when an IOException occurs.
+     * @throws ParseException is thrown when the Lucene query cannot be parsed.
+     */
+    protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException {
+        Confidence vendorConf = Confidence.HIGH;
+        Confidence productConf = Confidence.HIGH;
+        Confidence versionConf = Confidence.HIGH;
+
+        String vendors = addEvidenceWithoutDuplicateTerms("", dependency.getVendorEvidence(), vendorConf);
+        String products = addEvidenceWithoutDuplicateTerms("", dependency.getProductEvidence(), productConf);
+        String versions = addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), versionConf);
+
+        boolean found = false;
+        int ctr = 0;
+        do {
+            List<Entry> entries = searchCPE(vendors, products, versions, dependency.getProductEvidence().getWeighting(),
+                    dependency.getVendorEvidence().getWeighting());
+
+
+            for (Entry e : entries) {
+                if (verifyEntry(e, dependency)) {
+                    found = true;
+                    dependency.addIdentifier(
+                            "cpe",
+                            e.getName(),
+                            "http://web.nvd.nist.gov/view/vuln/search?cpe="
+                            + URLEncoder.encode(e.getName(), "UTF-8"));
+                }
+            }
+
+            if (!found) {
+                int round = ctr % 3;
+                if (round == 0) {
+                    vendorConf = reduceConfidence(vendorConf);
+                    if (dependency.getVendorEvidence().contains(vendorConf)) {
+                        //vendors += " " + dependency.getVendorEvidence().toString(vendorConf);
+                        vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), vendorConf);
+                    } else {
+                        ctr += 1;
+                        round += 1;
+                    }
+                }
+                if (round == 1) {
+                    productConf = reduceConfidence(productConf);
+                    if (dependency.getProductEvidence().contains(productConf)) {
+                        //products += " " + dependency.getProductEvidence().toString(productConf);
+                        products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), productConf);
+                    } else {
+                        ctr += 1;
+                        round += 1;
+                    }
+                }
+                if (round == 2) {
+                    versionConf = reduceConfidence(versionConf);
+                    if (dependency.getVersionEvidence().contains(versionConf)) {
+                        //versions += " " + dependency.getVersionEvidence().toString(versionConf);
+                        versions = addEvidenceWithoutDuplicateTerms(versions, dependency.getVersionEvidence(), versionConf);
+                    }
+                }
+            }
+        } while (!found && (++ctr) < 9);
+    }
+
+    /**
+     * Returns the text created by concatenating the text and the values from
+     * the EvidenceCollection (filtered for a specific confidence). This
+     * attempts to prevent duplicate terms from being added.<br/<br/> Note, if
+     * the evidence is longer then 200 characters it will be truncated.
+     *
+     * @param text the base text.
+     * @param ec an EvidenceCollection
+     * @param confidenceFilter a Confidence level to filter the evidence by.
+     * @return the new evidence text
+     */
+    private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) {
+        String txt = (text == null) ? "" : text;
+        StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size()));
+        sb.append(txt);
+        for (Evidence e : ec.iterator(confidenceFilter)) {
+            String value = e.getValue();
+
+            //hack to get around the fact that lucene does a really good job of recognizing domains and not
+            // splitting them. TODO - put together a better lucene analyzer specific to the domain.
+            if (value.startsWith("http://")) {
+                value = value.substring(7).replaceAll("\\.", " ");
+            }
+            if (value.startsWith("https://")) {
+                value = value.substring(8).replaceAll("\\.", " ");
+            }
+            if (sb.indexOf(value) < 0) {
+                sb.append(value).append(' ');
+            }
+        }
+        return sb.toString();
+    }
+
+    /**
+     * Reduces the given confidence by one level. This returns LOW if the
+     * confidence passed in is not HIGH.
+     *
+     * @param c the confidence to reduce.
+     * @return One less then the confidence passed in.
+     */
+    private Confidence reduceConfidence(final Confidence c) {
+        if (c == Confidence.HIGH) {
+            return Confidence.MEDIUM;
+        } else {
+            return Confidence.LOW;
+        }
+    }
+
+    /**
+     * <p>Searches the Lucene CPE index to identify possible CPE entries
+     * associated with the supplied vendor, product, and version.</p>
+     *
+     * <p>If either the vendorWeightings or productWeightings lists have been
+     * populated this data is used to add weighting factors to the search.</p>
+     *
+     * @param vendor the text used to search the vendor field.
+     * @param product the text used to search the product field.
+     * @param version the text used to search the version field.
+     * @param vendorWeightings a list of strings to use to add weighting factors
+     * to the vendor field.
+     * @param productWeightings Adds a list of strings that will be used to add
+     * weighting factors to the product search.
+     * @return a list of possible CPE values.
+     * @throws CorruptIndexException when the Lucene index is corrupt.
+     * @throws IOException when the Lucene index is not found.
+     * @throws ParseException when the generated query is not valid.
+     */
+    protected List<Entry> searchCPE(String vendor, String product, String version,
+            Set<String> vendorWeightings, Set<String> productWeightings)
+            throws CorruptIndexException, IOException, ParseException {
+        ArrayList<Entry> ret = new ArrayList<Entry>(MAX_QUERY_RESULTS);
+
+        String searchString = buildSearch(vendor, product, version, vendorWeightings, productWeightings);
+        if (searchString == null) {
+            return ret;
+        }
+        TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
+        for (ScoreDoc d : docs.scoreDocs) {
+            Document doc = cpe.getDocument(d.doc);
+            Entry entry = Entry.parse(doc);
+            entry.setSearchScore(d.score);
+            if (!ret.contains(entry)) {
+                ret.add(entry);
+            }
+        }
+        return ret;
+    }
+
+    /**
+     * <p>Builds a Lucene search string by properly escaping data and
+     * constructing a valid search query.</p>
+     *
+     * <p>If either the possibleVendor or possibleProducts lists have been
+     * populated this data is used to add weighting factors to the search string
+     * generated.</p>
+     *
+     * @param vendor text to search the vendor field.
+     * @param product text to search the product field.
+     * @param version text to search the version field.
+     * @param vendorWeighting a list of strings to apply to the vendor to boost
+     * the terms weight.
+     * @param productWeightings a list of strings to apply to the product to
+     * boost the terms weight.
+     * @return the Lucene query.
+     */
+    protected String buildSearch(String vendor, String product, String version,
+            Set<String> vendorWeighting, Set<String> productWeightings) {
+
+        StringBuilder sb = new StringBuilder(vendor.length() + product.length()
+                + version.length() + Fields.PRODUCT.length() + Fields.VERSION.length()
+                + Fields.VENDOR.length() + STRING_BUILDER_BUFFER);
+
+        if ("".equals(version)) {
+            return null;
+        }
+
+        if (!appendWeightedSearch(sb, Fields.PRODUCT, product, productWeightings)) {
+            return null;
+        }
+        sb.append(" AND ");
+        if (!appendWeightedSearch(sb, Fields.VENDOR, vendor, vendorWeighting)) {
+            return null;
+        }
+        sb.append(" AND ");
+
+        sb.append(Fields.VERSION).append(":(");
+        if (sb.indexOf("^") > 0) {
+            //if we have a weighting on something else, reduce the weighting on the version a lot
+            for (String v : version.split(" ")) {
+                LuceneUtils.appendEscapedLuceneQuery(sb, cleanseText(v));
+                sb.append("^0.2 ");
+            }
+        } else {
+            //LuceneUtils.appendEscapedLuceneQuery(sb, version);
+            //if we have a weighting on something else, reduce the weighting on the version a lot
+            for (String v : version.split(" ")) {
+                LuceneUtils.appendEscapedLuceneQuery(sb, cleanseText(v));
+                sb.append("^0.7 ");
+            }
+        }
+        sb.append(")");
+
+        return sb.toString();
+    }
+
+    /**
+     * This method constructs a Lucene query for a given field. The searchText
+     * is split into separate words and if the word is within the list of
+     * weighted words then an additional weighting is applied to the term as it
+     * is appended into the query.
+     *
+     * @param sb a StringBuilder that the query text will be appended to.
+     * @param field the field within the Lucene index that the query is
+     * searching.
+     * @param searchText text used to construct the query.
+     * @param weightedText a list of terms that will be considered higher
+     * importance when searching.
+     * @return if the append was successful.
+     */
+    private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) {
+        //TODO add a mutator or special analyzer that combines words next to each other and adds them as a key.
+        sb.append(" ").append(field).append(":( ");
+
+        String cleanText = cleanseText(searchText);
+
+        if ("".equals(cleanText)) {
+            return false;
+        }
+
+        if (weightedText == null || weightedText.isEmpty()) {
+            LuceneUtils.appendEscapedLuceneQuery(sb, cleanText);
+        } else {
+            StringTokenizer tokens = new StringTokenizer(cleanText);
+            while (tokens.hasMoreElements()) {
+                String word = tokens.nextToken();
+                String temp = null;
+                for (String weighted : weightedText) {
+                    String weightedStr = cleanseText(weighted);
+                    if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
+                        temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
+                        if (!word.equalsIgnoreCase(weightedStr)) {
+                            temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST;
+                        }
+                    }
+                }
+                if (temp == null) {
+                    temp = LuceneUtils.escapeLuceneQuery(word);
+                }
+                sb.append(" ").append(temp);
+            }
+        }
+        sb.append(" ) ");
+        return true;
+    }
+
+    /**
+     * Removes characters from the input text that are not used within the CPE
+     * index.
+     *
+     * @param text is the text to remove the characters from.
+     * @return the text having removed some characters.
+     */
+    private String cleanseText(String text) {
+        return text.replaceAll(CLEANSE_CHARACTER_RX, " ");
+    }
+
+    /**
+     * Compares two strings after lower casing them and removing the non-alpha
+     * characters.
+     *
+     * @param l string one to compare.
+     * @param r string two to compare.
+     * @return whether or not the two strings are similar.
+     */
+    private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) {
+        if (l == null || r == null) {
+            return false;
+        }
+
+        String left = l.replaceAll(CLEANSE_NONALPHA_RX, "");
+        String right = r.replaceAll(CLEANSE_NONALPHA_RX, "");
+        return left.equalsIgnoreCase(right);
+    }
+
+    /**
+     * Ensures that the CPE Identified matches the dependency. This validates
+     * that the product, vendor, and version information for the CPE are
+     * contained within the dependencies evidence.
+     *
+     * @param entry a CPE entry.
+     * @param dependency the dependency that the CPE entries could be for.
+     * @return whether or not the entry is valid.
+     */
+    private boolean verifyEntry(final Entry entry, final Dependency dependency) {
+        boolean isValid = false;
+
+        if (collectionContainsStrings(dependency.getProductEvidence(), entry.getProduct())
+                && collectionContainsStrings(dependency.getVendorEvidence(), entry.getVendor())
+                && collectionContainsStrings(dependency.getVersionEvidence(), entry.getVersion())) {
+            isValid = true;
+        }
+        return isValid;
+    }
+
+    private boolean collectionContainsStrings(EvidenceCollection ec, String text) {
+        String[] words = text.split("[\\s_-]");
+        boolean contains = true;
+        for (String word : words) {
+            contains &= ec.containsUsedString(word);
+        }
+        return contains;
+    }
+
+    /**
+     * Analyzes a dependency and attempts to determine if there are any CPE
+     * identifiers for this dependency.
+     *
+     * @param dependency The Dependency to analyze.
+     * @param engine The analysis engine
+     * @throws AnalysisException is thrown if there is an issue analyzing the
+     * dependency.
+     */
+    public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+        try {
+            determineCPE(dependency);
+        } catch (CorruptIndexException ex) {
+            throw new AnalysisException("CPE Index is corrupt.", ex);
+        } catch (IOException ex) {
+            throw new AnalysisException("Failure opening the CPE Index.", ex);
+        } catch (ParseException ex) {
+            throw new AnalysisException("Unable to parse the generated Lucene query for this dependency.", ex);
+        }
+    }
+
+    /**
+     * Returns true because this analyzer supports all dependency types.
+     *
+     * @return true.
+     */
+    public Set<String> getSupportedExtensions() {
+        return null;
+    }
+
+    /**
+     * Returns the name of this analyzer.
+     *
+     * @return the name of this analyzer.
+     */
+    public String getName() {
+        return "CPE Analyzer";
+    }
+
+    /**
+     * Returns true because this analyzer supports all dependency types.
+     *
+     * @param extension the file extension of the dependency being analyzed.
+     * @return true.
+     */
+    public boolean supportsExtension(String extension) {
+        return true;
+    }
+
+    /**
+     * Returns the analysis phase that this analyzer should run in.
+     *
+     * @return the analysis phase that this analyzer should run in.
+     */
+    public AnalysisPhase getAnalysisPhase() {
+        return AnalysisPhase.IDENTIFIER_ANALYSIS;
+    }
+
+    /**
+     * Opens the CPE Lucene Index.
+     *
+     * @throws Exception is thrown if there is an issue opening the index.
+     */
+    public void initialize() throws Exception {
+        this.open();
+    }
+}

src/main/java/org/owasp/dependencycheck/data/cpe/Entry.java

@@ -0,0 +1,240 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.cpe;
+
+import java.io.Serializable;
+import java.io.UnsupportedEncodingException;
+import java.net.URLDecoder;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.apache.lucene.document.Document;
+
+/**
+ * A CPE entry containing the name, vendor, product, and version.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class Entry implements Serializable {
+
+    static final long serialVersionUID = 8011924485946326934L;
+
+    /**
+     * This parse method does not fully convert a Lucene Document into a CPE
+     * Entry; it only sets the Entry.Name.
+     *
+     * @param doc a Lucene Document.
+     * @return a CPE Entry.
+     */
+    public static Entry parse(Document doc) {
+        Entry entry = new Entry();
+        try {
+            entry.parseName(doc.get(Fields.NAME));
+        } catch (UnsupportedEncodingException ex) {
+            Logger.getLogger(Entry.class.getName()).log(Level.SEVERE, null, ex);
+            entry.name = doc.get(Fields.NAME);
+        }
+        return entry;
+    }
+    /**
+     * The name of the CPE entry.
+     */
+    protected String name;
+
+    /**
+     * Get the value of name
+     *
+     * @return the value of name
+     */
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Set the value of name
+     *
+     * @param name new value of name
+     */
+    public void setName(String name) {
+        this.name = name;
+    }
+    /**
+     * The vendor name.
+     */
+    protected String vendor;
+
+    /**
+     * Get the value of vendor
+     *
+     * @return the value of vendor
+     */
+    public String getVendor() {
+        return vendor;
+    }
+
+    /**
+     * Set the value of vendor
+     *
+     * @param vendor new value of vendor
+     */
+    public void setVendor(String vendor) {
+        this.vendor = vendor;
+    }
+    /**
+     * The product name.
+     */
+    protected String product;
+
+    /**
+     * Get the value of product
+     *
+     * @return the value of product
+     */
+    public String getProduct() {
+        return product;
+    }
+
+    /**
+     * Set the value of product
+     *
+     * @param product new value of product
+     */
+    public void setProduct(String product) {
+        this.product = product;
+    }
+    /**
+     * The product version.
+     */
+    protected String version;
+
+    /**
+     * Get the value of version
+     *
+     * @return the value of version
+     */
+    public String getVersion() {
+        return version;
+    }
+
+    /**
+     * Set the value of version
+     *
+     * @param version new value of version
+     */
+    public void setVersion(String version) {
+        this.version = version;
+    }
+    /**
+     * The product revision.
+     */
+    protected String revision;
+
+    /**
+     * Get the value of revision
+     *
+     * @return the value of revision
+     */
+    public String getRevision() {
+        return revision;
+    }
+
+    /**
+     * Set the value of revision
+     *
+     * @param revision new value of revision
+     */
+    public void setRevision(String revision) {
+        this.revision = revision;
+    }
+    /**
+     * The search score.
+     */
+    protected float searchScore;
+
+    /**
+     * Get the value of searchScore
+     *
+     * @return the value of searchScore
+     */
+    public float getSearchScore() {
+        return searchScore;
+    }
+
+    /**
+     * Set the value of searchScore
+     *
+     * @param searchScore new value of searchScore
+     */
+    public void setSearchScore(float searchScore) {
+        this.searchScore = searchScore;
+    }
+
+    /**
+     * <p>Parses a name attribute value, from the cpe.xml, into its
+     * corresponding parts: vendor, product, version, revision.</p>
+     * <p>Example:</p>
+     * <code>&nbsp;&nbsp;&nbsp;cpe:/a:apache:struts:1.1:rc2</code>
+     *
+     * <p>Results in:</p> <ul> <li>Vendor: apache</li> <li>Product: struts</li>
+     * <li>Version: 1.1</li> <li>Revision: rc2</li> </ul>
+     *
+     * @param cpeName the cpe name
+     * @throws UnsupportedEncodingException should never be thrown...
+     */
+    public void parseName(String cpeName) throws UnsupportedEncodingException {
+        this.name = cpeName;
+        if (cpeName != null && cpeName.length() > 7) {
+            String[] data = cpeName.substring(7).split(":");
+            if (data.length >= 1) {
+                vendor = URLDecoder.decode(data[0], "UTF-8").replaceAll("[_-]", " ");
+                if (data.length >= 2) {
+                    product = URLDecoder.decode(data[1], "UTF-8").replaceAll("[_-]", " ");
+                    if (data.length >= 3) {
+                        version = URLDecoder.decode(data[2], "UTF-8");
+                        if (data.length >= 4) {
+                            revision = URLDecoder.decode(data[3], "UTF-8");
+                        }
+                        //ignore edition and language fields.. don't really see them used in the a:
+                    }
+                }
+            }
+        }
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (obj == null) {
+            return false;
+        }
+        if (getClass() != obj.getClass()) {
+            return false;
+        }
+        final Entry other = (Entry) obj;
+        if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) {
+            return false;
+        }
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int hash = 5;
+        hash = 83 * hash + (this.name != null ? this.name.hashCode() : 0);
+        return hash;
+    }
+}

src/main/java/org/owasp/dependencycheck/data/cpe/Fields.java

@@ -0,0 +1,46 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.cpe;
+
+/**
+ * Fields is a collection of field names used within the Lucene index for CPE
+ * entries.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public abstract class Fields {
+
+    /**
+     * The key for the name field.
+     */
+    public static final String NAME = "name";
+    /**
+     * The key for the vendor field.
+     */
+    public static final String VENDOR = "vendor";
+    /**
+     * The key for the product field.
+     */
+    public static final String PRODUCT = "product";
+    /**
+     * The key for the version field.
+     */
+    public static final String VERSION = "version";
+    //public static final String REVISION = "revision";
+}

src/main/java/org/owasp/dependencycheck/data/cpe/Index.java

@@ -0,0 +1,206 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.cpe;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.URLDecoder;
+import java.util.HashMap;
+import java.util.Map;
+import org.apache.lucene.analysis.Analyzer;
+import org.apache.lucene.analysis.core.KeywordAnalyzer;
+import org.apache.lucene.analysis.miscellaneous.PerFieldAnalyzerWrapper;
+import org.apache.lucene.document.Document;
+import org.apache.lucene.document.Field;
+import org.apache.lucene.document.StoredField;
+import org.apache.lucene.document.TextField;
+import org.apache.lucene.index.CorruptIndexException;
+import org.apache.lucene.index.Term;
+import org.apache.lucene.queryparser.classic.QueryParser;
+import org.apache.lucene.store.Directory;
+import org.apache.lucene.store.FSDirectory;
+import org.apache.lucene.util.Version;
+import org.owasp.dependencycheck.data.lucene.AbstractIndex;
+import org.owasp.dependencycheck.utils.Settings;
+import org.owasp.dependencycheck.data.lucene.FieldAnalyzer;
+import org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer;
+import org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer;
+import org.owasp.dependencycheck.data.lucene.VersionAnalyzer;
+
+/**
+ * The Index class is used to utilize and maintain the CPE Index.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class Index extends AbstractIndex {
+
+    /**
+     * Returns the directory that holds the CPE Index.
+     *
+     * @return the Directory containing the CPE Index.
+     * @throws IOException is thrown if an IOException occurs.
+     */
+    public Directory getDirectory() throws IOException {
+        File path = getDataDirectory();
+        Directory dir = FSDirectory.open(path);
+
+        return dir;
+    }
+
+    /**
+     * Retrieves the directory that the JAR file exists in so that
+     * we can ensure we always use a common data directory.
+     *
+     * @return the data directory for this index.
+     * @throws IOException is thrown if an IOException occurs of course...
+     */
+    public File getDataDirectory() throws IOException {
+        String fileName = Settings.getString(Settings.KEYS.CPE_INDEX);
+        String filePath = Index.class.getProtectionDomain().getCodeSource().getLocation().getPath();
+        String decodedPath = URLDecoder.decode(filePath, "UTF-8");
+        File exePath = new File(decodedPath);
+        if (exePath.getName().toLowerCase().endsWith(".jar")) {
+            exePath = exePath.getParentFile();
+        } else {
+            exePath = new File(".");
+        }
+        File path = new File(exePath.getCanonicalFile() + File.separator + fileName);
+        path = new File(path.getCanonicalPath());
+        if (!path.exists()) {
+            if (!path.mkdirs()) {
+                throw new IOException("Unable to create CPE Data directory");
+            }
+        }
+        return path;
+    }
+
+    /**
+     * Creates an Analyzer for the CPE Index.
+     *
+     * @return the CPE Analyzer.
+     */
+    @SuppressWarnings("unchecked")
+    public Analyzer createIndexingAnalyzer() {
+        Map fieldAnalyzers = new HashMap();
+
+        //fieldAnalyzers.put(Fields.VERSION, new KeywordAnalyzer());
+        fieldAnalyzers.put(Fields.VERSION, new VersionAnalyzer(Version.LUCENE_40));
+        fieldAnalyzers.put(Fields.NAME, new KeywordAnalyzer());
+
+        PerFieldAnalyzerWrapper wrapper = new PerFieldAnalyzerWrapper(
+                new FieldAnalyzer(Version.LUCENE_40), fieldAnalyzers);
+
+        return wrapper;
+    }
+    private SearchFieldAnalyzer productSearchFieldAnalyzer = null;
+    private SearchFieldAnalyzer vendorSearchFieldAnalyzer = null;
+
+    /**
+     * Creates an Analyzer for searching the CPE Index.
+     *
+     * @return the CPE Analyzer.
+     */
+    @SuppressWarnings("unchecked")
+    public Analyzer createSearchingAnalyzer() {
+        Map fieldAnalyzers = new HashMap();
+
+        fieldAnalyzers.put(Fields.NAME, new KeywordAnalyzer());
+        //fieldAnalyzers.put(Fields.VERSION, new KeywordAnalyzer());
+        fieldAnalyzers.put(Fields.VERSION, new SearchVersionAnalyzer(Version.LUCENE_40));
+        productSearchFieldAnalyzer = new SearchFieldAnalyzer(Version.LUCENE_40);
+        vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(Version.LUCENE_40);
+        fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer);
+        fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer);
+
+        PerFieldAnalyzerWrapper wrapper = new PerFieldAnalyzerWrapper(
+                new FieldAnalyzer(Version.LUCENE_40), fieldAnalyzers);
+
+        return wrapper;
+    }
+
+    /**
+     * Creates the Lucene QueryParser used when querying the index
+     * @return a QueryParser.
+     */
+    public QueryParser createQueryParser() {
+        return new QueryParser(Version.LUCENE_40, Fields.NAME, getSearchingAnalyzer());
+    }
+
+    /**
+     * Resets the searching analyzers
+     */
+    protected void resetSearchingAnalyzer() {
+        if (productSearchFieldAnalyzer != null) {
+            productSearchFieldAnalyzer.clear();
+        }
+        if (vendorSearchFieldAnalyzer != null) {
+            vendorSearchFieldAnalyzer.clear();
+        }
+    }
+
+    /**
+     * Saves a CPE Entry into the Lucene index.
+     *
+     * @param entry a CPE entry.
+     * @throws CorruptIndexException is thrown if the index is corrupt.
+     * @throws IOException is thrown if an IOException occurs.
+     */
+    public void saveEntry(Entry entry) throws CorruptIndexException, IOException {
+        Document doc = convertEntryToDoc(entry);
+        //Term term = new Term(Fields.NVDID, LuceneUtils.escapeLuceneQuery(entry.getNvdId()));
+        Term term = new Term(Fields.NAME, entry.getName());
+        indexWriter.updateDocument(term, doc);
+    }
+
+    /**
+     * Converts a CPE entry into a Lucene Document.
+     *
+     * @param entry a CPE Entry.
+     * @return a Lucene Document containing a CPE Entry.
+     */
+    protected Document convertEntryToDoc(Entry entry) {
+        Document doc = new Document();
+
+        Field name = new StoredField(Fields.NAME, entry.getName());
+        doc.add(name);
+
+        Field vendor = new TextField(Fields.VENDOR, entry.getVendor(), Field.Store.NO);
+        vendor.setBoost(5.0F);
+        doc.add(vendor);
+
+        Field product = new TextField(Fields.PRODUCT, entry.getProduct(), Field.Store.NO);
+        product.setBoost(5.0F);
+        doc.add(product);
+
+        //TODO revision should likely be its own field
+        if (entry.getVersion() != null) {
+            Field version = null;
+            if (entry.getRevision() != null) {
+                version = new TextField(Fields.VERSION, entry.getVersion() + " "
+                        + entry.getRevision(), Field.Store.NO);
+            } else {
+                version = new TextField(Fields.VERSION, entry.getVersion(),
+                        Field.Store.NO);
+            }
+            version.setBoost(0.8F);
+            doc.add(version);
+        }
+        return doc;
+    }
+}

src/main/java/org/owasp/dependencycheck/data/cpe/package-info.java

@@ -0,0 +1,12 @@
+/**
+ * <html>
+ * <head>
+ * <title>org.owasp.dependencycheck.data.cpe</title>
+ * </head>
+ * <body>
+ * Contains classes for working with the CPE Lucene Index.
+ * </body>
+ * </html>
+*/
+
+package org.owasp.dependencycheck.data.cpe;

src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java

@@ -0,0 +1,75 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.cwe;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.ObjectInputStream;
+import java.util.HashMap;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+/**
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class CweDB {
+
+    private CweDB() {
+        //empty constructor for utility class
+    }
+    private static final HashMap<String, String> CWE = loadData();
+
+    private static HashMap<String, String> loadData() {
+        ObjectInputStream oin = null;
+        try {
+            String filePath = "data/cwe.hashmap.serialized";
+            InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath);
+            oin = new ObjectInputStream(input);
+            @SuppressWarnings("unchecked")
+            HashMap<String, String> data = (HashMap<String, String>) oin.readObject();
+            return data;
+        } catch (ClassNotFoundException ex) {
+            Logger.getLogger(CweDB.class.getName()).log(Level.SEVERE, null, ex);
+        } catch (IOException ex) {
+            Logger.getLogger(CweDB.class.getName()).log(Level.SEVERE, null, ex);
+        } finally {
+            if (oin != null) {
+                try {
+                    oin.close();
+                } catch (IOException ex) {
+                    Logger.getLogger(CweDB.class.getName()).log(Level.SEVERE, null, ex);
+                }
+            }
+        }
+        return null;
+    }
+
+    /**
+     * <p>Returns the full CWE name from the CWE ID.</p>
+     * @param cweId te CWE ID
+     * @return the full name of the CWE
+     */
+    public static String getCweName(String cweId) {
+        if (cweId != null) {
+            return CWE.get(cweId);
+        }
+        return null;
+    }
+}

src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java

@@ -0,0 +1,52 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.cwe;
+
+import java.util.HashMap;
+import org.xml.sax.Attributes;
+import org.xml.sax.SAXException;
+import org.xml.sax.helpers.DefaultHandler;
+
+/**
+ * A SAX Handler that will parse the CWE XML.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class CweHandler extends DefaultHandler {
+
+    private HashMap<String, String> cwe = new HashMap<String, String>();
+
+    /**
+     * Returns the HashMap of CWE entries (CWE-ID, Full CWE Name).
+     * @return a HashMap of CWE entries <String, String>
+     */
+    public HashMap<String, String> getCwe() {
+        return cwe;
+    }
+
+    @Override
+    public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
+
+        if ("Weakness".equals(qName) || "Category".equals(qName)) {
+            String id = "CWE-" + attributes.getValue("ID");
+            String name = attributes.getValue("Name");
+            cwe.put(id, name);
+        }
+    }
+}

src/main/java/org/owasp/dependencycheck/data/cwe/package-info.java

@@ -0,0 +1,12 @@
+/**
+ * <html>
+ * <head>
+ * <title>org.owasp.dependencycheck.data.cwe</title>
+ * </head>
+ * <body>
+ * Contains classes for working with the CWE Database.
+ * </body>
+ * </html>
+*/
+
+package org.owasp.dependencycheck.data.cwe;

src/main/java/org/owasp/dependencycheck/data/lucene/AbstractIndex.java

@@ -0,0 +1,322 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.lucene;
+
+import java.io.IOException;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.apache.lucene.analysis.Analyzer;
+import org.apache.lucene.document.Document;
+import org.apache.lucene.index.CorruptIndexException;
+import org.apache.lucene.index.DirectoryReader;
+import org.apache.lucene.index.IndexReader;
+import org.apache.lucene.index.IndexWriter;
+import org.apache.lucene.index.IndexWriterConfig;
+import org.apache.lucene.queryparser.classic.ParseException;
+import org.apache.lucene.queryparser.classic.QueryParser;
+import org.apache.lucene.search.IndexSearcher;
+import org.apache.lucene.search.Query;
+import org.apache.lucene.search.TopDocs;
+import org.apache.lucene.store.Directory;
+import org.apache.lucene.store.LockObtainFailedException;
+import org.apache.lucene.util.Version;
+
+/**
+ * The base Index for other index objects. Implements the open and close
+ * methods.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public abstract class AbstractIndex {
+
+    /**
+     * The Lucene directory containing the index.
+     */
+    protected Directory directory = null;
+    /**
+     * The IndexWriter for the Lucene index.
+     */
+    protected IndexWriter indexWriter = null;
+    /**
+     * The Lucene IndexReader.
+     */
+    private IndexReader indexReader = null;
+    /**
+     * The Lucene IndexSearcher.
+     */
+    private IndexSearcher indexSearcher = null;
+    /**
+     * The Lucene Analyzer used for Indexing.
+     */
+    private Analyzer indexingAnalyzer = null;
+    /**
+     * The Lucene Analyzer used for Searching
+     */
+    private Analyzer searchingAnalyzer = null;
+    /**
+     * The Lucene QueryParser used for Searching
+     */
+    private QueryParser queryParser = null;
+    /**
+     * Indicates whether or not the Lucene Index is open.
+     */
+    private boolean indexOpen = false;
+
+    /**
+     * Opens the CPE Index.
+     *
+     * @throws IOException is thrown if an IOException occurs opening the index.
+     */
+    public void open() throws IOException {
+        directory = this.getDirectory();
+        indexingAnalyzer = this.getIndexingAnalyzer();
+        searchingAnalyzer = this.getSearchingAnalyzer();
+        indexOpen = true;
+    }
+
+    /**
+     * Closes the CPE Index.
+     */
+    public void close() {
+        if (indexWriter != null) {
+            try {
+                indexWriter.commit();
+            } catch (CorruptIndexException ex) {
+                Logger.getLogger(AbstractIndex.class.getName()).log(Level.SEVERE, null, ex);
+            } catch (IOException ex) {
+                Logger.getLogger(AbstractIndex.class.getName()).log(Level.SEVERE, null, ex);
+            }
+            try {
+                indexWriter.close(true);
+            } catch (CorruptIndexException ex) {
+                Logger.getLogger(AbstractIndex.class.getName()).log(Level.SEVERE, null, ex);
+            } catch (IOException ex) {
+                Logger.getLogger(AbstractIndex.class.getName()).log(Level.SEVERE, null, ex);
+            } finally {
+                indexWriter = null;
+            }
+        }
+        if (indexSearcher != null) {
+            indexSearcher = null;
+        }
+
+        if (indexingAnalyzer != null) {
+            indexingAnalyzer.close();
+            indexingAnalyzer = null;
+        }
+
+        if (searchingAnalyzer != null) {
+            searchingAnalyzer.close();
+            searchingAnalyzer = null;
+        }
+
+        try {
+            directory.close();
+        } catch (IOException ex) {
+            Logger.getLogger(AbstractIndex.class.getName()).log(Level.SEVERE, null, ex);
+        } finally {
+            directory = null;
+        }
+        indexOpen = false;
+    }
+
+    /**
+     * Returns the status of the data source - is the index open.
+     *
+     * @return true or false.
+     */
+    public boolean isOpen() {
+        return indexOpen;
+    }
+
+    /**
+     * Opens the Lucene Index Writer.
+     *
+     * @throws CorruptIndexException is thrown if the Lucene index is corrupt.
+     * @throws IOException is thrown if an IOException occurs opening the index.
+     */
+    public void openIndexWriter() throws CorruptIndexException, IOException {
+        if (!isOpen()) {
+            open();
+        }
+        IndexWriterConfig conf = new IndexWriterConfig(Version.LUCENE_40, indexingAnalyzer);
+        indexWriter = new IndexWriter(directory, conf);
+    }
+
+    /**
+     * Retrieves the IndexWriter for the Lucene Index.
+     *
+     * @return an IndexWriter.
+     * @throws CorruptIndexException is thrown if the Lucene Index is corrupt.
+     * @throws LockObtainFailedException is thrown if there is an exception
+     * obtaining a lock on the Lucene index.
+     * @throws IOException is thrown if an IOException occurs opening the index.
+     */
+    public IndexWriter getIndexWriter() throws CorruptIndexException, LockObtainFailedException, IOException {
+        if (indexWriter == null) {
+            openIndexWriter();
+        }
+        return indexWriter;
+    }
+
+    /**
+     * Opens the Lucene Index for reading.
+     *
+     * @throws CorruptIndexException is thrown if the index is corrupt.
+     * @throws IOException is thrown if there is an exception reading the index.
+     */
+    public void openIndexReader() throws CorruptIndexException, IOException {
+        if (!isOpen()) {
+            open();
+        }
+        //indexReader = IndexReader.open(directory, true);
+        indexReader = DirectoryReader.open(directory);
+    }
+
+    /**
+     * Returns an IndexSearcher for the Lucene Index.
+     *
+     * @return an IndexSearcher.
+     * @throws CorruptIndexException is thrown if the index is corrupt.
+     * @throws IOException is thrown if there is an exception reading the index.
+     */
+    protected IndexSearcher getIndexSearcher() throws CorruptIndexException, IOException {
+        if (indexReader == null) {
+            openIndexReader();
+        }
+        if (indexSearcher == null) {
+            indexSearcher = new IndexSearcher(indexReader);
+        }
+        return indexSearcher;
+    }
+
+    /**
+     * Returns an Analyzer to be used when indexing.
+     *
+     * @return an Analyzer.
+     */
+    public Analyzer getIndexingAnalyzer() {
+        if (indexingAnalyzer == null) {
+            indexingAnalyzer = createIndexingAnalyzer();
+        }
+        return indexingAnalyzer;
+    }
+
+    /**
+     * Returns an analyzer used for searching the index
+     * @return a lucene analyzer
+     */
+    protected Analyzer getSearchingAnalyzer() {
+        if (searchingAnalyzer == null) {
+            searchingAnalyzer = createSearchingAnalyzer();
+        }
+        return searchingAnalyzer;
+    }
+
+    /**
+     * Gets a query parser
+     * @return a query parser
+     */
+    protected QueryParser getQueryParser() {
+        if (queryParser == null) {
+            queryParser = createQueryParser();
+        }
+        return queryParser;
+    }
+
+    /**
+     * Searches the index using the given search string
+     * @param searchString the query text
+     * @param maxQueryResults the maximum number of documents to return
+     * @return the TopDocs found by the search
+     * @throws ParseException thrown when the searchString is invalid
+     * @throws IOException is thrown if there is an issue with the underlying Index
+     */
+    public TopDocs search(String searchString, int maxQueryResults) throws ParseException, IOException {
+
+        QueryParser parser = getQueryParser();
+
+        Query query = parser.parse(searchString);
+
+        resetSearchingAnalyzer();
+
+        IndexSearcher is = getIndexSearcher();
+
+        TopDocs docs = is.search(query, maxQueryResults);
+
+        return docs;
+    }
+
+    /**
+     * Searches the index using the given query
+     * @param query the query used to search the index
+     * @param maxQueryResults the max number of results to return
+     * @return the TopDocs found be the query
+     * @throws CorruptIndexException thrown if the Index is corrupt
+     * @throws IOException thrown if there is an IOException
+     */
+    public TopDocs search(Query query, int maxQueryResults) throws CorruptIndexException, IOException {
+        IndexSearcher is = getIndexSearcher();
+        return is.search(query, maxQueryResults);
+    }
+
+    /**
+     * Retrieves a document from the Index
+     * @param documentId the id of the document to retrieve
+     * @return the Document
+     * @throws IOException thrown if there is an IOException
+     */
+    public Document getDocument(int documentId) throws IOException {
+        IndexSearcher is = getIndexSearcher();
+        return is.doc(documentId);
+    }
+
+    /**
+     * Gets the directory that contains the Lucene Index
+     *
+     * @return a Lucene Directory
+     * @throws IOException is thrown when an IOException occurs
+     */
+    public abstract Directory getDirectory() throws IOException;
+
+    /**
+     * Creates the Lucene Analyzer used when indexing
+     *
+     * @return a Lucene Analyzer
+     */
+    public abstract Analyzer createIndexingAnalyzer();
+
+    /**
+     * Creates the Lucene Analyzer used when querying the index
+     *
+     * @return a Lucene Analyzer
+     */
+    public abstract Analyzer createSearchingAnalyzer();
+
+    /**
+     * Creates the Lucene QueryParser used when querying the index
+     * @return a QueryParser
+     */
+    public abstract QueryParser createQueryParser();
+
+    /**
+     * Resets the searching analyzers
+     */
+    protected abstract void resetSearchingAnalyzer();
+}

src/main/java/org/owasp/dependencycheck/data/lucene/DependencySimilarity.java

@@ -0,0 +1,47 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.lucene;
+
+import org.apache.lucene.search.similarities.DefaultSimilarity;
+
+/**
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class DependencySimilarity extends DefaultSimilarity {
+
+    private static final long serialVersionUID = 1L;
+
+    /**
+     * <p>Override the default idf implementation so that frequency within all
+     * document is ignored.</p>
+     *
+     * See <a
+     * href="http://www.lucenetutorial.com/advanced-topics/scoring.html">this
+     * article</a> for more details.
+     *
+     * @param docFreq - the number of documents which contain the term
+     * @param numDocs - the total number of documents in the collection
+     * @return 1
+     */
+    @Override
+    public float idf(long docFreq, long numDocs) {
+        return 1;
+    }
+}

src/main/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java

@@ -0,0 +1,81 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.lucene;
+
+import java.io.Reader;
+import org.apache.lucene.analysis.Analyzer;
+import org.apache.lucene.analysis.TokenStream;
+import org.apache.lucene.analysis.Tokenizer;
+import org.apache.lucene.analysis.core.WhitespaceTokenizer;
+import org.apache.lucene.analysis.core.LowerCaseFilter;
+import org.apache.lucene.analysis.core.StopAnalyzer;
+import org.apache.lucene.analysis.core.StopFilter;
+import org.apache.lucene.analysis.miscellaneous.WordDelimiterFilter;
+import org.apache.lucene.util.Version;
+
+/**
+ * <p>A Lucene Analyzer that utilizes the WhitespaceTokenizer, WordDelimiterFilter,
+ * LowerCaseFilter, and StopFilter. The intended purpose of this Analyzer is
+ * to index the CPE fields vendor and product.</p>
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class FieldAnalyzer extends Analyzer {
+
+    /**
+     * The Lucene Version used
+     */
+    private Version version = null;
+
+    /**
+     * Creates a new FieldAnalyzer
+     * @param version the Lucene version
+     */
+    public FieldAnalyzer(Version version) {
+        this.version = version;
+    }
+
+    /**
+     * Creates the TokenStreamComponents
+     *
+     * @param fieldName the field name being analyzed
+     * @param reader the reader containing the input
+     * @return the TokenStreamComponents
+     */
+    @Override
+    protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
+        Tokenizer source = new WhitespaceTokenizer(version, reader);
+
+        TokenStream stream = source;
+
+        stream = new WordDelimiterFilter(stream,
+                WordDelimiterFilter.CATENATE_WORDS
+                | WordDelimiterFilter.GENERATE_WORD_PARTS
+                | WordDelimiterFilter.GENERATE_NUMBER_PARTS
+                | WordDelimiterFilter.PRESERVE_ORIGINAL
+                | WordDelimiterFilter.SPLIT_ON_CASE_CHANGE
+                | WordDelimiterFilter.SPLIT_ON_NUMERICS
+                | WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null);
+
+        stream = new LowerCaseFilter(version, stream);
+        stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
+
+        return new TokenStreamComponents(source, stream);
+    }
+}

src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java

@@ -0,0 +1,100 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.lucene;
+
+/**
+ * <p>Lucene utils is a set of utilize written to make constructing Lucene
+ * queries simpler.</p>
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public final class LuceneUtils {
+
+    /**
+     * Private constructor as this is a utility class.
+     */
+    private LuceneUtils() {
+    }
+
+    /**
+     * Appends the text to the supplied StringBuilder escaping Lucene control
+     * characters in the process.
+     *
+     * @param buf a StringBuilder to append the escaped text to
+     * @param text the data to be escaped
+     */
+    @SuppressWarnings("fallthrough")
+    public static void appendEscapedLuceneQuery(StringBuilder buf,
+            final CharSequence text) {
+
+        if (text == null || buf == null) {
+            return;
+        }
+
+        for (int i = 0; i < text.length(); i++) {
+            char c = text.charAt(i);
+            switch (c) {
+                case '+':
+                case '-':
+                case '&':
+                case '|':
+                case '!':
+                case '(':
+                case ')':
+                case '{':
+                case '}':
+                case '[':
+                case ']':
+                case '^':
+                case '"':
+                case '~':
+                case '*':
+                case '?':
+                case ':':
+                case '\\': //it is supposed to fall through here
+                    buf.append('\\');
+                default:
+                    buf.append(c);
+                    break;
+            }
+        }
+    }
+
+    /**
+     * Escapes the text passed in so that it is treated as data instead of
+     * control characters.
+     *
+     * @param text data to be escaped
+     * @return the escaped text.
+     */
+    public static String escapeLuceneQuery(final CharSequence text) {
+
+        if (text == null) {
+            return null;
+        }
+
+        int size = text.length();
+        size = size >> 1;
+        StringBuilder buf = new StringBuilder(size);
+
+        appendEscapedLuceneQuery(buf, text);
+
+        return buf.toString();
+    }
+}

src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java

@@ -0,0 +1,93 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.lucene;
+
+import java.io.Reader;
+import org.apache.lucene.analysis.Analyzer;
+import org.apache.lucene.analysis.TokenStream;
+import org.apache.lucene.analysis.Tokenizer;
+import org.apache.lucene.analysis.core.WhitespaceTokenizer;
+import org.apache.lucene.analysis.core.LowerCaseFilter;
+import org.apache.lucene.analysis.core.StopAnalyzer;
+import org.apache.lucene.analysis.core.StopFilter;
+import org.apache.lucene.analysis.miscellaneous.WordDelimiterFilter;
+import org.apache.lucene.util.Version;
+
+/**
+ * A Lucene field analyzer used to analyzer queries against the CPE data.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class SearchFieldAnalyzer extends Analyzer {
+
+    /**
+     * The Lucene Version used
+     */
+    private Version version = null;
+    /**
+     * A local reference to the TokenPairConcatenatingFilter so that we
+     * can clear any left over state if this analyzer is re-used.
+     */
+    private TokenPairConcatenatingFilter concatenatingFilter = null;
+
+    /**
+     * Constructs a new SearchFieldAnalyzer
+     * @param version the Lucene version
+     */
+    public SearchFieldAnalyzer(Version version) {
+        this.version = version;
+    }
+
+    /**
+     * Creates a the TokenStreamComponents used to analyze the stream.
+     * @param fieldName the field that this lucene analyzer will process
+     * @param reader a reader containing the tokens
+     * @return the token stream filter chain
+     */
+    @Override
+    protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
+        Tokenizer source = new WhitespaceTokenizer(version, reader);
+
+        TokenStream stream = source;
+
+        stream = new WordDelimiterFilter(stream,
+                WordDelimiterFilter.GENERATE_WORD_PARTS
+                | WordDelimiterFilter.GENERATE_NUMBER_PARTS
+                | WordDelimiterFilter.PRESERVE_ORIGINAL
+                | WordDelimiterFilter.SPLIT_ON_CASE_CHANGE
+                | WordDelimiterFilter.SPLIT_ON_NUMERICS
+                | WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null);
+
+        stream = new LowerCaseFilter(version, stream);
+        concatenatingFilter = new TokenPairConcatenatingFilter(stream);
+        stream = concatenatingFilter;
+        stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
+
+        return new TokenStreamComponents(source, stream);
+    }
+
+    /**
+     * <p>Resets the analyzer and clears any internal state data that may
+     * have been left-over from previous uses of the analyzer.</p>
+     * <p><b>If this analyzer is re-used this method must be called between uses.</b></p>
+     */
+    public void clear() {
+        concatenatingFilter.clear();
+    }
+}

src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java

@@ -0,0 +1,70 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.lucene;
+
+import java.io.Reader;
+import org.apache.lucene.analysis.Analyzer;
+import org.apache.lucene.analysis.TokenStream;
+import org.apache.lucene.analysis.Tokenizer;
+import org.apache.lucene.analysis.core.LowerCaseFilter;
+import org.apache.lucene.analysis.core.WhitespaceTokenizer;
+import org.apache.lucene.util.Version;
+
+/**
+ * SearchVersionAnalyzer is a Lucene Analyzer used to analyze version information.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class SearchVersionAnalyzer extends Analyzer {
+    //TODO consider implementing payloads/custom attributes...
+    // use custom attributes for major, minor, x, x, x, rcx
+    // these can then be used to weight the score for searches on the version.
+    // see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description
+    // look at this article to implement
+    // http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/
+
+    /**
+     * The Lucene Version used
+     */
+    private Version version = null;
+
+    /**
+     * Creates a new SearchVersionAnalyzer
+     * @param version the Lucene version
+     */
+    public SearchVersionAnalyzer(Version version) {
+        this.version = version;
+    }
+
+    /**
+     * Creates the TokenStreamComponents
+     *
+     * @param fieldName the field name being analyzed
+     * @param reader the reader containing the input
+     * @return the TokenStreamComponents
+     */
+    @Override
+    protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
+        Tokenizer source = new WhitespaceTokenizer(version, reader);
+        TokenStream stream = source;
+        stream = new LowerCaseFilter(version, stream);
+        stream = new VersionTokenizingFilter(stream);
+        return new TokenStreamComponents(source, stream);
+    }
+}

src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java

@@ -0,0 +1,97 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.lucene;
+
+import java.io.IOException;
+import java.util.LinkedList;
+import org.apache.lucene.analysis.TokenFilter;
+import org.apache.lucene.analysis.TokenStream;
+import org.apache.lucene.analysis.tokenattributes.CharTermAttribute;
+import org.apache.lucene.analysis.tokenattributes.PositionIncrementAttribute;
+
+/**
+ * <p>Takes a TokenStream and adds additional tokens by concatenating pairs of words.</p>
+ * <p><b>Example:</b> "Spring Framework Core" -> "Spring SpringFramework Framework FrameworkCore Core".</p>
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public final class TokenPairConcatenatingFilter extends TokenFilter {
+
+    private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class);
+    private final PositionIncrementAttribute posIncAtt = addAttribute(PositionIncrementAttribute.class);
+    private String previousWord = null;
+    private LinkedList<String> words = null;
+
+    /**
+     * Constructs a new TokenPairConcatenatingFilter
+     * @param stream the TokenStream that this filter will process
+     */
+    public TokenPairConcatenatingFilter(TokenStream stream) {
+        super(stream);
+        words = new LinkedList<String>();
+    }
+
+    /**
+     * Increments the underlying TokenStream and sets CharTermAttributes to
+     * construct an expanded set of tokens by concatenating tokens with the
+     * previous token.
+     *
+     * @return whether or not we have hit the end of the TokenStream
+     * @throws IOException is thrown when an IOException occurs
+     */
+    @Override
+    public boolean incrementToken() throws IOException {
+
+        //collect all the terms into the words collection
+        while (input.incrementToken()) {
+            String word = new String(termAtt.buffer(), 0, termAtt.length());
+            words.add(word);
+        }
+
+        //if we have a previousTerm - write it out as its own token concatenated
+        // with the current word (if one is available).
+        if (previousWord != null && words.size() > 0) {
+            String word = words.getFirst();
+            clearAttributes();
+            termAtt.append(previousWord).append(word);
+            posIncAtt.setPositionIncrement(0);
+            previousWord = null;
+            return true;
+        }
+        //if we have words, write it out as a single token
+        if (words.size() > 0) {
+            String word = words.removeFirst();
+            clearAttributes();
+            termAtt.append(word);
+            previousWord = word;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * <p>Resets the Filter and clears any internal state data that may
+     * have been left-over from previous uses of the Filter.</p>
+     * <p><b>If this Filter is re-used this method must be called between uses.</b></p>
+     */
+    public void clear() {
+        previousWord = null;
+        words.clear();
+    }
+}

src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java

@@ -0,0 +1,69 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.lucene;
+
+import java.io.Reader;
+import org.apache.lucene.analysis.Analyzer;
+import org.apache.lucene.analysis.TokenStream;
+import org.apache.lucene.analysis.Tokenizer;
+import org.apache.lucene.analysis.core.LowerCaseFilter;
+import org.apache.lucene.analysis.core.WhitespaceTokenizer;
+import org.apache.lucene.util.Version;
+
+/**
+ * VersionAnalyzer is a Lucene Analyzer used to analyze version information.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class VersionAnalyzer extends Analyzer {
+    //TODO consider implementing payloads/custom attributes...
+    // use custom attributes for major, minor, x, x, x, rcx
+    // these can then be used to weight the score for searches on the version.
+    // see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description
+    // look at this article to implement
+    // http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/
+
+    /**
+     * The Lucene Version used
+     */
+    private Version version = null;
+
+    /**
+     * Creates a new VersionAnalyzer
+     * @param version the Lucene version
+     */
+    public VersionAnalyzer(Version version) {
+        this.version = version;
+    }
+
+    /**
+     * Creates the TokenStreamComponents
+     *
+     * @param fieldName the field name being analyzed
+     * @param reader the reader containing the input
+     * @return the TokenStreamComponents
+     */
+    @Override
+    protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
+        Tokenizer source = new WhitespaceTokenizer(version, reader);
+        TokenStream stream = source;
+        stream = new LowerCaseFilter(version, stream);
+        return new TokenStreamComponents(source, stream);
+    }
+}

src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java

@@ -0,0 +1,99 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.lucene;
+
+import java.io.IOException;
+import java.util.LinkedList;
+import org.apache.lucene.analysis.TokenFilter;
+import org.apache.lucene.analysis.TokenStream;
+import org.apache.lucene.analysis.tokenattributes.CharTermAttribute;
+
+/**
+ * <p>Takes a TokenStream and splits or adds tokens to correctly index version numbers.</p>
+ * <p><b>Example:</b> "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE 3.0.0.RELEASE".</p>
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public final class VersionTokenizingFilter extends TokenFilter {
+
+    private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class);
+    /**
+     * A collection of tokens to add to the stream.
+     */
+    protected LinkedList<String> tokens = null;
+
+    /**
+     * Constructs a new VersionTokenizingFilter
+     * @param stream the TokenStream that this filter will process
+     */
+    public VersionTokenizingFilter(TokenStream stream) {
+        super(stream);
+        tokens = new LinkedList<String>();
+    }
+
+    /**
+     * Increments the underlying TokenStream and sets CharTermAttributes to
+     * construct an expanded set of tokens by concatenating tokens with the
+     * previous token.
+     *
+     * @return whether or not we have hit the end of the TokenStream
+     * @throws IOException is thrown when an IOException occurs
+     */
+    @Override
+    public boolean incrementToken() throws IOException {
+        if (tokens.size() == 0 && input.incrementToken()) {
+            String version = new String(termAtt.buffer(), 0, termAtt.length());
+            analyzeVersion(version);
+        }
+        return addTerm();
+    }
+
+    /**
+     * Adds a term, if one exists, from the tokens collection.
+     * @return whether or not a new term was added
+     */
+    private boolean addTerm() {
+        boolean termAdded = tokens.size() > 0;
+        if (termAdded) {
+            String version = tokens.pop();
+            clearAttributes();
+            termAtt.append(version);
+        }
+        return termAdded;
+    }
+
+    //major.minor[.maintenance[.build]]
+    private void analyzeVersion(String version) {
+        //todo should we also be splitting on dash or underscore? we would need
+        //  to incorporate the dash or underscore back in...
+        String[] versionParts = version.split("\\.");
+        String dottedVersion = null;
+        for (String current : versionParts) {
+            if (!current.matches("^/d+$")) {
+                tokens.add(current);
+            }
+            if (dottedVersion == null) {
+                dottedVersion = current;
+            } else {
+                dottedVersion = dottedVersion + "." + current;
+            }
+            tokens.add(dottedVersion);
+        }
+    }
+}

src/main/java/org/owasp/dependencycheck/data/lucene/package-info.java

@@ -0,0 +1,12 @@
+/**
+ * <html>
+ * <head>
+ * <title>org.owasp.dependencycheck.data.lucene</title>
+ * </head>
+ * <body>
+ * Contains classes used to work with the Lucene Indexes.
+ * </body>
+ * </html>
+*/
+
+package org.owasp.dependencycheck.data.lucene;

src/main/java/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java

@@ -0,0 +1,48 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.nvdcve;
+
+/**
+ * An exception used to indicate the db4o database is corrupt.
+ * This could be due to invalid data or a complete failure of the db.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+class CorruptDatabaseException extends DatabaseException {
+    private static final long serialVersionUID = 1L;
+
+    /**
+     * Creates an CorruptDatabaseException
+     *
+     * @param msg the exception message
+     */
+    public CorruptDatabaseException(String msg) {
+        super(msg);
+    }
+
+    /**
+     * Creates an CorruptDatabaseException
+     *
+     * @param msg the exception message
+     * @param ex the cause of the exception
+     */
+    public CorruptDatabaseException(String msg, Exception ex) {
+        super(msg, ex);
+    }
+}

src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java

@@ -0,0 +1,472 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.nvdcve;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.net.URLDecoder;
+import java.sql.CallableStatement;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.owasp.dependencycheck.data.cpe.Entry;
+import org.owasp.dependencycheck.data.cwe.CweDB;
+import org.owasp.dependencycheck.dependency.Reference;
+import org.owasp.dependencycheck.dependency.Vulnerability;
+import org.owasp.dependencycheck.dependency.VulnerableSoftware;
+import org.owasp.dependencycheck.utils.Settings;
+
+/**
+ * The database holding information about the NVD CVE data.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class CveDB {
+
+    //<editor-fold defaultstate="collapsed" desc="Constants to create, maintain, and retrieve data from the CVE Database">
+    /**
+     * SQL Statement to create an index on the reference table
+     */
+    public static final String CREATE_INDEX_IDXREFERENCE = "CREATE INDEX IF NOT EXISTS idxReference ON reference(cveid)";
+    /**
+     * SQL Statement to create an index on the software for finding CVE entries based on CPE data
+     */
+    public static final String CREATE_INDEX_IDXSOFTWARE = "CREATE INDEX IF NOT EXISTS idxSoftware ON software(product, vendor, version)";
+    /**
+     * SQL Statement to create an index for retrieving software by CVEID
+     */
+    public static final String CREATE_INDEX_IDXSOFTWARECVE = "CREATE INDEX IF NOT EXISTS idxSoftwareCve ON software(cveid)";
+    /**
+     * SQL Statement to create an index on the vulnerability table
+     */
+    public static final String CREATE_INDEX_IDXVULNERABILITY = "CREATE INDEX IF NOT EXISTS idxVulnerability ON vulnerability(cveid)";
+    /**
+     * SQL Statement to create the reference table
+     */
+    public static final String CREATE_TABLE_REFERENCE = "CREATE TABLE IF NOT EXISTS reference (cveid CHAR(13), "
+            + "name varchar(1000), url varchar(1000), source varchar(255))";
+    /**
+     * SQL Statement to create the software table
+     */
+    public static final String CREATE_TABLE_SOFTWARE = "CREATE TABLE IF NOT EXISTS software (cveid CHAR(13), cpe varchar(500), "
+            + "vendor varchar(255), product varchar(255), version varchar(50), previousVersion varchar(50))";
+    /**
+     * SQL Statement to create the vulnerability table
+     */
+    public static final String CREATE_TABLE_VULNERABILITY = "CREATE TABLE IF NOT EXISTS vulnerability (cveid CHAR(13) PRIMARY KEY, "
+            + "description varchar(8000), cwe varchar(10), cvssScore DECIMAL(3,1), cvssAccessVector varchar(20), "
+            + "cvssAccessComplexity varchar(20), cvssAuthentication varchar(20), cvssConfidentialityImpact varchar(20), "
+            + "cvssIntegrityImpact varchar(20), cvssAvailabilityImpact varchar(20))";
+    /**
+     * SQL Statement to delete references by CVEID
+     */
+    public static final String DELETE_REFERENCE = "DELETE FROM reference WHERE cveid = ?";
+    /**
+     * SQL Statement to delete software by CVEID
+     */
+    public static final String DELETE_SOFTWARE = "DELETE FROM software WHERE cveid = ?";
+    /**
+     * SQL Statement to delete a vulnerability by CVEID
+     */
+    public static final String DELETE_VULNERABILITY = "DELETE FROM vulnerability WHERE cveid = ?";
+    /**
+     * SQL Statement to insert a new reference
+     */
+    public static final String INSERT_REFERENCE = "INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?)";
+    /**
+     * SQL Statement to insert a new software
+     */
+    public static final String INSERT_SOFTWARE = "INSERT INTO software (cveid, cpe, vendor, product, version, previousVersion) "
+            + "VALUES (?, ?, ?, ?, ?, ?)";
+    /**
+     * SQL Statement to insert a new vulnerability
+     */
+    public static final String INSERT_VULNERABILITY = "INSERT INTO vulnerability (cveid, description, cwe, cvssScore, cvssAccessVector, "
+            + "cvssAccessComplexity, cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact) "
+            + "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
+    /**
+     * SQL Statement to find CVE entries based on CPE data
+     */
+    public static final String SELECT_CVE_FROM_SOFTWARE = "SELECT cveid FROM software WHERE Vendor = ? AND Product = ? AND "
+            + "(version = '-' OR previousVersion IS NOT NULL OR version=?)";
+    /**
+     * SQL Statement to select references by CVEID
+     */
+    public static final String SELECT_REFERENCE = "SELECT source, name, url FROM reference WHERE cveid = ?";
+    /**
+     * SQL Statement to select software by CVEID
+     */
+    public static final String SELECT_SOFTWARE = "SELECT cpe, previousVersion FROM software WHERE cveid = ?";
+    /**
+     * SQL Statement to select a vulnerability by CVEID
+     */
+    public static final String SELECT_VULNERABILITY = "SELECT cveid, description, cwe, cvssScore, cvssAccessVector, cvssAccessComplexity, "
+            + "cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact FROM vulnerability WHERE cveid = ?";
+    //</editor-fold>
+    //<editor-fold defaultstate="collapsed" desc="Collection of CallableStatements to work with the DB">
+    /**
+     * delete reference - parameters (cveid)
+     */
+    private CallableStatement deleteReferences = null;
+    /**
+     * delete software - parameters (cveid)
+     */
+    private CallableStatement deleteSoftware = null;
+    /**
+     * delete vulnerability - parameters (cveid)
+     */
+    private CallableStatement deleteVulnerabilities = null;
+    /**
+     * insert reference - parameters (cveid, name, url, source)
+     */
+    private CallableStatement insertReference = null;
+    /**
+     * insert software - parameters (cveid, cpe, vendor, product, version, previousVersion)
+     */
+    private CallableStatement insertSoftware = null;
+    /**
+     * insert vulnerability - parameters (cveid, description, cwe, cvssScore, cvssAccessVector,
+     * cvssAccessComplexity, cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact)
+     */
+    private CallableStatement insertVulnerability = null;
+    /**
+     * select cve from software - parameters (vendor, product, version)
+     */
+    private CallableStatement selectCveFromSoftware = null;
+    /**
+     * select vulnerability - parameters (cveid)
+     */
+    private CallableStatement selectVulnerability = null;
+    /**
+     * select reference - parameters (cveid)
+     */
+    private CallableStatement selectReferences = null;
+    /**
+     * select software - parameters (cveid)
+     */
+    private CallableStatement selectSoftware = null;
+    //</editor-fold>
+    /**
+     * Database connection
+     */
+    protected Connection conn = null;
+
+    /**
+     * Opens the database connection. If the database does not exist, it will
+     * create a new one.
+     *
+     * @throws IOException thrown if there is an IO Exception
+     * @throws SQLException thrown if there is a SQL Exception
+     * @throws DatabaseException thrown if there is an error initializing a new database
+     */
+    public void open() throws IOException, SQLException, DatabaseException {
+        String fileName = CveDB.getDataDirectory().getCanonicalPath()
+                + File.separator
+                + "cve";
+        File f = new File(fileName);
+        boolean createTables = !f.exists();
+        String connStr = "jdbc:h2:file:" + fileName;
+        conn = DriverManager.getConnection(connStr, "sa", "");
+        if (createTables) {
+            createTables();
+        }
+        buildStatements();
+    }
+
+    /**
+     * Cleans up the object and ensures that "close" has been called.
+     * @throws Throwable thrown if there is a problem
+     */
+    @Override
+    protected void finalize() throws Throwable {
+        close();
+        super.finalize(); //not necessary if extending Object.
+    }
+
+    /**
+     * Closes the DB4O database. Close should be called on
+     * this object when it is done being used.
+     */
+    public void close() {
+        if (conn != null) {
+            try {
+                conn.close();
+            } catch (SQLException ex) {
+                Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, null, ex);
+            }
+            conn = null;
+        }
+    }
+
+    /**
+     * Retrieves the vulnerabilities associated with the specified CPE cpe.
+     *
+     * @param cpeStr the CPE cpe name
+     * @return a list of Vulnerabilities
+     * @throws DatabaseException thrown if there is an exception retrieving data
+     */
+    public List<Vulnerability> getVulnerabilities(String cpeStr) throws DatabaseException {
+        ResultSet rs = null;
+        final Entry cpe = new Entry();
+        try {
+            cpe.parseName(cpeStr);
+        } catch (UnsupportedEncodingException ex) {
+            Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, null, ex);
+        }
+        List<Vulnerability> vulnerabilities = new ArrayList<Vulnerability>();
+
+        try {
+            selectCveFromSoftware.setString(1, cpe.getVendor());
+            selectCveFromSoftware.setString(2, cpe.getProduct());
+            selectCveFromSoftware.setString(3, cpe.getVersion());
+            rs = selectCveFromSoftware.executeQuery();
+            while (rs.next()) {
+                Vulnerability v = getVulnerability(rs.getString("cveid"));
+                vulnerabilities.add(v);
+            }
+        } catch (SQLException ex) {
+            throw new DatabaseException("Exception retrieving vulnerability for " + cpeStr, ex);
+        } finally {
+            if (rs != null) {
+                try {
+                    rs.close();
+                } catch (SQLException ex) {
+                    Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, null, ex);
+                }
+            }
+        }
+        return vulnerabilities;
+    }
+
+    private Vulnerability getVulnerability(String cve) throws DatabaseException {
+        ResultSet rsV = null;
+        ResultSet rsR = null;
+        ResultSet rsS = null;
+        Vulnerability vuln = null;
+        try {
+            selectVulnerability.setString(1, cve);
+            rsV = selectVulnerability.executeQuery();
+            if (rsV.next()) {
+                vuln = new Vulnerability();
+                vuln.setName(cve);
+                vuln.setDescription(rsV.getString(2));
+                String cwe = rsV.getString(3);
+                if (cwe != null) {
+                    String name = CweDB.getCweName(cwe);
+                    if (name != null) {
+                        cwe += " " + name;
+                    }
+                }
+                vuln.setCwe(cwe);
+                vuln.setCvssScore(rsV.getFloat(4));
+                vuln.setCvssAccessVector(rsV.getString(5));
+                vuln.setCvssAccessComplexity(rsV.getString(6));
+                vuln.setCvssAuthentication(rsV.getString(7));
+                vuln.setCvssConfidentialityImpact(rsV.getString(8));
+                vuln.setCvssIntegrityImpact(rsV.getString(9));
+                vuln.setCvssAvailabilityImpact(rsV.getString(10));
+
+                selectReferences.setString(1, cve);
+                rsR = selectReferences.executeQuery();
+                while (rsR.next()) {
+                    vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3));
+                }
+                selectSoftware.setString(1, cve);
+                rsS = selectSoftware.executeQuery();
+                while (rsS.next()) {
+                    String cpe = rsS.getString(1);
+                    String prevVers = rsS.getString(2);
+                    if (prevVers == null) {
+                        vuln.addVulnerableSoftware(cpe);
+                    } else {
+                        vuln.addVulnerableSoftware(cpe, prevVers);
+                    }
+                }
+            }
+        } catch (SQLException ex) {
+            throw new DatabaseException("Error retrieving " + cve, ex);
+        } finally {
+            if (rsV != null) {
+                try {
+                    rsV.close();
+                } catch (SQLException ex) {
+                    Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, null, ex);
+                }
+            }
+            if (rsR != null) {
+                try {
+                    rsR.close();
+                } catch (SQLException ex) {
+                    Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, null, ex);
+                }
+            }
+            if (rsS != null) {
+                try {
+                    rsS.close();
+                } catch (SQLException ex) {
+                    Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, null, ex);
+                }
+            }
+        }
+        return vuln;
+    }
+
+    /**
+     * Updates the vulnerability within the database. If the vulnerability does not
+     * exist it will be added.
+     *
+     * @param vuln the vulnerability to add to the database
+     * @throws DatabaseException is thrown if the database
+     */
+    public void updateVulnerability(Vulnerability vuln) throws DatabaseException {
+        try {
+            // first delete any existing vulnerability info.
+            deleteReferences.setString(1, vuln.getName());
+            deleteReferences.execute();
+            deleteSoftware.setString(1, vuln.getName());
+            deleteSoftware.execute();
+            deleteVulnerabilities.setString(1, vuln.getName());
+            deleteVulnerabilities.execute();
+
+            insertVulnerability.setString(1, vuln.getName());
+            insertVulnerability.setString(2, vuln.getDescription());
+            insertVulnerability.setString(3, vuln.getCwe());
+            insertVulnerability.setFloat(4, vuln.getCvssScore());
+            insertVulnerability.setString(5, vuln.getCvssAccessVector());
+            insertVulnerability.setString(6, vuln.getCvssAccessComplexity());
+            insertVulnerability.setString(7, vuln.getCvssAuthentication());
+            insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact());
+            insertVulnerability.setString(9, vuln.getCvssIntegrityImpact());
+            insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact());
+            insertVulnerability.execute();
+
+            insertReference.setString(1, vuln.getName());
+            for (Reference r : vuln.getReferences()) {
+                insertReference.setString(2, r.getName());
+                insertReference.setString(3, r.getUrl());
+                insertReference.setString(4, r.getSource());
+                insertReference.execute();
+            }
+            insertSoftware.setString(1, vuln.getName());
+            for (VulnerableSoftware s : vuln.getVulnerableSoftware()) {
+                //cveid, cpe, vendor, product, version, previousVersion
+                insertSoftware.setString(2, s.getName());
+                insertSoftware.setString(3, s.getVendor());
+                insertSoftware.setString(4, s.getProduct());
+                insertSoftware.setString(5, s.getVersion());
+                if (s.hasPreviousVersion()) {
+                    insertSoftware.setString(6, s.getPreviousVersion());
+                } else {
+                    insertSoftware.setNull(6, java.sql.Types.VARCHAR);
+                }
+                insertSoftware.execute();
+            }
+
+        } catch (SQLException ex) {
+            Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, null, ex);
+            throw new DatabaseException("Error updating '" + vuln.getName() + "'", ex);
+        }
+    }
+
+    /**
+     * Retrieves the directory that the JAR file exists in so that
+     * we can ensure we always use a common data directory.
+     *
+     * @return the data directory for this index.
+     * @throws IOException is thrown if an IOException occurs of course...
+     */
+    public static File getDataDirectory() throws IOException {
+        String fileName = Settings.getString(Settings.KEYS.CVE_INDEX);
+        String filePath = CveDB.class.getProtectionDomain().getCodeSource().getLocation().getPath();
+        String decodedPath = URLDecoder.decode(filePath, "UTF-8");
+        File exePath = new File(decodedPath);
+
+        if (exePath.getName().toLowerCase().endsWith(".jar")) {
+            exePath = exePath.getParentFile();
+        } else {
+            exePath = new File(".");
+        }
+        File path = new File(exePath.getCanonicalFile() + File.separator + fileName);
+        path = new File(path.getCanonicalPath());
+
+        if (!path.exists()) {
+            if (!path.mkdirs()) {
+                throw new IOException("Unable to create NVD CVE Data directory");
+            }
+        }
+        return path;
+    }
+
+    /**
+     * Creates the database structure (tables and indexes) to store the CVE data
+     *
+     * @throws SQLException thrown if there is a sql exception
+     * @throws DatabaseException thrown if there is a database exception
+     */
+    protected void createTables() throws SQLException, DatabaseException {
+        Statement statement = null;
+        try {
+            statement = conn.createStatement();
+            statement.execute(CREATE_TABLE_VULNERABILITY);
+            statement.execute(CREATE_TABLE_REFERENCE);
+            statement.execute(CREATE_TABLE_SOFTWARE);
+            statement.execute(CREATE_INDEX_IDXSOFTWARE);
+            statement.execute(CREATE_INDEX_IDXREFERENCE);
+            statement.execute(CREATE_INDEX_IDXVULNERABILITY);
+            statement.execute(CREATE_INDEX_IDXSOFTWARECVE);
+        } finally {
+            if (statement != null) {
+                try {
+                    statement.close();
+                } catch (SQLException ex) {
+                    Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, null, ex);
+                }
+            }
+        }
+    }
+
+    /**
+     * Builds the CallableStatements used by the application.
+     * @throws DatabaseException
+     */
+    private void buildStatements() throws DatabaseException {
+        try {
+            deleteReferences = conn.prepareCall(DELETE_REFERENCE);
+            deleteSoftware = conn.prepareCall(DELETE_SOFTWARE);
+            deleteVulnerabilities = conn.prepareCall(DELETE_VULNERABILITY);
+            insertReference = conn.prepareCall(INSERT_REFERENCE);
+            insertSoftware = conn.prepareCall(INSERT_SOFTWARE);
+            insertVulnerability = conn.prepareCall(INSERT_VULNERABILITY);
+            selectCveFromSoftware = conn.prepareCall(SELECT_CVE_FROM_SOFTWARE);
+            selectVulnerability = conn.prepareCall(SELECT_VULNERABILITY);
+            selectReferences = conn.prepareCall(SELECT_REFERENCE);
+            selectSoftware = conn.prepareCall(SELECT_SOFTWARE);
+        } catch (SQLException ex) {
+            throw new DatabaseException("Unable to prepare statements", ex);
+        }
+
+    }
+}

src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseException.java

@@ -0,0 +1,46 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.nvdcve;
+
+/**
+ * An exception thrown if an operation against the database fails.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class DatabaseException extends Exception {
+
+    /**
+     * Creates an DatabaseException
+     *
+     * @param msg the exception message
+     */
+    public DatabaseException(String msg) {
+        super(msg);
+    }
+
+    /**
+     * Creates an DatabaseException
+     *
+     * @param msg the exception message
+     * @param ex the cause of the exception
+     */
+    public DatabaseException(String msg, Exception ex) {
+        super(msg, ex);
+    }
+}

src/main/java/org/owasp/dependencycheck/data/nvdcve/NvdCveAnalyzer.java

@@ -0,0 +1,162 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.nvdcve;
+
+import java.io.IOException;
+import java.sql.SQLException;
+import java.util.List;
+import java.util.Set;
+import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.analyzer.AnalysisException;
+import org.owasp.dependencycheck.analyzer.AnalysisPhase;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.Vulnerability;
+import org.owasp.dependencycheck.dependency.Identifier;
+
+/**
+ * NvdCveAnalyzer is a utility class that takes a project dependency and
+ * attempts to discern if there is an associated CVEs. It uses the the
+ * identifiers found by other analyzers to lookup the CVE data.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class NvdCveAnalyzer implements org.owasp.dependencycheck.analyzer.Analyzer {
+
+    /**
+     * The maximum number of query results to return.
+     */
+    static final int MAX_QUERY_RESULTS = 100;
+    /**
+     * The CVE Index.
+     */
+    protected CveDB cveDB = null;
+
+    /**
+     * Opens the data source.
+     *
+     * @throws SQLException thrown when there is a SQL Exception
+     * @throws IOException thrown when there is an IO Exception
+     * @throws DatabaseException thrown when there is a database exceptions
+     */
+    public void open() throws SQLException, IOException, DatabaseException {
+        cveDB = new CveDB();
+        cveDB.open();
+    }
+
+    /**
+     * Closes the data source.
+     */
+    public void close() {
+        cveDB.close();
+        cveDB = null;
+    }
+
+    /**
+     * Returns the status of the data source - is the database open.
+     *
+     * @return true or false.
+     */
+    public boolean isOpen() {
+        return (cveDB != null);
+    }
+
+    /**
+     * Ensures that the CVE Database is closed.
+     *
+     * @throws Throwable when a throwable is thrown.
+     */
+    @Override
+    protected void finalize() throws Throwable {
+        super.finalize();
+        if (isOpen()) {
+            close();
+        }
+    }
+
+    /**
+     * Analyzes a dependency and attempts to determine if there are any CPE
+     * identifiers for this dependency.
+     *
+     * @param dependency The Dependency to analyze
+     * @param engine The analysis engine
+     * @throws AnalysisException is thrown if there is an issue analyzing the
+     * dependency
+     */
+    public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+        for (Identifier id : dependency.getIdentifiers()) {
+            if ("cpe".equals(id.getType())) {
+                try {
+                    String value = id.getValue();
+                    List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
+                    for (Vulnerability v : vulns) {
+                        dependency.addVulnerability(v);
+                    }
+                } catch (DatabaseException ex) {
+                    throw new AnalysisException(ex);
+                }
+            }
+        }
+    }
+
+    /**
+     * Returns true because this analyzer supports all dependency types.
+     *
+     * @return true.
+     */
+    public Set<String> getSupportedExtensions() {
+        return null;
+    }
+
+    /**
+     * Returns the name of this analyzer.
+     *
+     * @return the name of this analyzer.
+     */
+    public String getName() {
+        return "NVD CVE Analyzer";
+    }
+
+    /**
+     * Returns true because this analyzer supports all dependency types.
+     *
+     * @param extension the file extension of the dependency being analyzed.
+     * @return true.
+     */
+    public boolean supportsExtension(String extension) {
+        return true;
+    }
+
+    /**
+     * Returns the analysis phase that this analyzer should run in.
+     *
+     * @return the analysis phase that this analyzer should run in.
+     */
+    public AnalysisPhase getAnalysisPhase() {
+        return AnalysisPhase.FINDING_ANALYSIS;
+    }
+
+    /**
+     * Opens the NVD CVE Lucene Index.
+     *
+     * @throws Exception is thrown if there is an issue opening the index.
+     */
+    public void initialize() throws Exception {
+        this.open();
+    }
+}

src/main/java/org/owasp/dependencycheck/data/nvdcve/package-info.java

@@ -0,0 +1,12 @@
+/**
+ * <html>
+ * <head>
+ * <title>org.owasp.dependencycheck.data.nvdcve</title>
+ * </head>
+ * <body>
+ * Contains classes used to work with the NVD CVE data.
+ * </body>
+ * </html>
+*/
+
+package org.owasp.dependencycheck.data.nvdcve;

src/main/java/org/owasp/dependencycheck/data/nvdcve/xml/DatabaseUpdater.java

@@ -0,0 +1,553 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.nvdcve.xml;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import javax.xml.parsers.ParserConfigurationException;
+import org.owasp.dependencycheck.data.CachedWebDataSource;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.sql.SQLException;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+import org.owasp.dependencycheck.data.UpdateException;
+import org.owasp.dependencycheck.data.cpe.Index;
+import org.owasp.dependencycheck.data.nvdcve.CveDB;
+import org.owasp.dependencycheck.dependency.VulnerableSoftware;
+import org.owasp.dependencycheck.utils.DownloadFailedException;
+import org.owasp.dependencycheck.utils.Downloader;
+import org.owasp.dependencycheck.utils.FileUtils;
+import org.owasp.dependencycheck.utils.InvalidSettingException;
+import org.owasp.dependencycheck.utils.Settings;
+import org.xml.sax.SAXException;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+
+/**
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class DatabaseUpdater implements CachedWebDataSource {
+
+    /**
+     * The name of the properties file containing the timestamp of the last
+     * update.
+     */
+    private static final String UPDATE_PROPERTIES_FILE = "lastupdated.prop";
+    /**
+     * The properties file key for the last updated field - used to store the
+     * last updated time of the Modified NVD CVE xml file.
+     */
+    private static final String LAST_UPDATED_MODIFIED = "lastupdated.modified";
+    /**
+     * Stores the last updated time for each of the NVD CVE files. These
+     * timestamps should be updated if we process the modified file within 7
+     * days of the last update.
+     */
+    private static final String LAST_UPDATED_BASE = "lastupdated.";
+    /**
+     * The current version of the database
+     */
+    public static final String DATABASE_VERSION = "2.2";
+
+    /**
+     * <p>Downloads the latest NVD CVE XML file from the web and imports it into
+     * the current CVE Database.</p>
+     *
+     * @throws UpdateException is thrown if there is an error updating the database
+     */
+    public void update() throws UpdateException {
+        try {
+            Map<String, NvdCveUrl> update = updateNeeded();
+            int maxUpdates = 0;
+            for (NvdCveUrl cve : update.values()) {
+                if (cve.getNeedsUpdate()) {
+                    maxUpdates += 1;
+                }
+            }
+            if (maxUpdates > 3) {
+                Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.WARNING,
+                        "NVD CVE requires several updates; this could take a couple of minutes.");
+            }
+            int count = 0;
+            for (NvdCveUrl cve : update.values()) {
+                if (cve.getNeedsUpdate()) {
+                    count += 1;
+                    Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.WARNING,
+                            "Updating NVD CVE ({0} of {1})", new Object[]{count, maxUpdates});
+                    URL url = new URL(cve.getUrl());
+                    File outputPath = null;
+                    File outputPath12 = null;
+                    try {
+                        Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.WARNING,
+                                "Downloading {0}", cve.getUrl());
+
+                        outputPath = File.createTempFile("cve" + cve.getId() + "_", ".xml");
+                        Downloader.fetchFile(url, outputPath, false);
+
+                        url = new URL(cve.getOldSchemaVersionUrl());
+                        outputPath12 = File.createTempFile("cve_1_2_" + cve.getId() + "_", ".xml");
+                        Downloader.fetchFile(url, outputPath12, false);
+
+                        Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.WARNING,
+                                "Processing {0}", cve.getUrl());
+                        importXML(outputPath, outputPath12);
+
+                        Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.WARNING,
+                                "Completed updated {0} of {1}", new Object[]{count, maxUpdates});
+                    } catch (FileNotFoundException ex) {
+                        throw new UpdateException(ex);
+                    } catch (ParserConfigurationException ex) {
+                        throw new UpdateException(ex);
+                    } catch (SAXException ex) {
+                        throw new UpdateException(ex);
+                    } catch (IOException ex) {
+                        throw new UpdateException(ex);
+                    } catch (SQLException ex) {
+                        throw new UpdateException(ex);
+                    } catch (DatabaseException ex) {
+                        throw new UpdateException(ex);
+                    } finally {
+                        try {
+                            if (outputPath != null && outputPath.exists()) {
+                                outputPath.delete();
+                            }
+                        } finally {
+                            if (outputPath != null && outputPath.exists()) {
+                                outputPath.deleteOnExit();
+                            }
+                        }
+                    }
+                }
+            }
+            if (maxUpdates >= 1) {
+                writeLastUpdatedPropertyFile(update);
+            }
+        } catch (MalformedURLException ex) {
+            throw new UpdateException(ex);
+        } catch (DownloadFailedException ex) {
+            throw new UpdateException(ex);
+        }
+    }
+
+    /**
+     * Imports the NVD CVE XML File into the Lucene Index.
+     *
+     * @param file the file containing the NVD CVE XML
+     * @param oldVersion contains the file containing the NVD CVE XML 1.2
+     */
+    private void importXML(File file, File oldVersion)
+            throws ParserConfigurationException, SAXException, IOException, SQLException, DatabaseException {
+        CveDB cveDB = null;
+        Index cpeIndex = null;
+
+        try {
+            cveDB = new CveDB();
+            cveDB.open();
+
+            cpeIndex = new Index();
+            cpeIndex.openIndexWriter();
+
+            SAXParserFactory factory = SAXParserFactory.newInstance();
+            SAXParser saxParser = factory.newSAXParser();
+
+            NvdCve12Handler cve12Handler = new NvdCve12Handler();
+            saxParser.parse(oldVersion, cve12Handler);
+            Map<String, List<VulnerableSoftware>> prevVersionVulnMap = cve12Handler.getVulnerabilities();
+            cve12Handler = null;
+
+            NvdCve20Handler cve20Handler = new NvdCve20Handler();
+            cve20Handler.setCveDB(cveDB);
+            cve20Handler.setPrevVersionVulnMap(prevVersionVulnMap);
+            cve20Handler.setCpeIndex(cpeIndex);
+            saxParser.parse(file, cve20Handler);
+            cve20Handler = null;
+        } finally {
+            if (cpeIndex != null) {
+                cpeIndex.close();
+                cpeIndex = null;
+            }
+            if (cveDB != null) {
+                cveDB.close();
+                cveDB = null;
+            }
+        }
+    }
+
+    //<editor-fold defaultstate="collapsed" desc="Code to read/write properties files regarding the last update dates">
+
+    /**
+     * Writes a properties file containing the last updated date to the
+     * VULNERABLE_CPE directory.
+     *
+     * @param updated a map of the updated nvdcve.
+     */
+    private void writeLastUpdatedPropertyFile(Map<String, NvdCveUrl> updated) throws UpdateException {
+        String dir;
+        try {
+
+            dir = CveDB.getDataDirectory().getCanonicalPath();
+        } catch (IOException ex) {
+            Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.SEVERE, null, ex);
+            throw new UpdateException("Unable to locate last updated properties file.", ex);
+        }
+        File cveProp = new File(dir + File.separatorChar + UPDATE_PROPERTIES_FILE);
+        Properties prop = new Properties();
+        prop.put("version", DATABASE_VERSION);
+        for (NvdCveUrl cve : updated.values()) {
+            prop.put(LAST_UPDATED_BASE + cve.id, String.valueOf(cve.getTimestamp()));
+        }
+
+        OutputStream os = null;
+        OutputStreamWriter out = null;
+        try {
+            os = new FileOutputStream(cveProp);
+            out = new OutputStreamWriter(os, "UTF-8");
+            prop.store(out, dir);
+        } catch (FileNotFoundException ex) {
+            Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.SEVERE, null, ex);
+            throw new UpdateException("Unable to find last updated properties file.", ex);
+        } catch (IOException ex) {
+            Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.SEVERE, null, ex);
+            throw new UpdateException("Unable to update last updated properties file.", ex);
+        } finally {
+            if (out != null) {
+                try {
+                    out.close();
+                } catch (IOException ex) {
+                    Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.SEVERE, null, ex);
+                }
+            }
+        }
+    }
+
+    /**
+     * Determines if the index needs to be updated. This is done by fetching the
+     * nvd cve meta data and checking the last update date. If the data needs to
+     * be refreshed this method will return the NvdCveUrl for the files that
+     * need to be updated.
+     *
+     * @return the NvdCveUrl of the files that need to be updated.
+     * @throws MalformedURLException is thrown if the URL for the NVD CVE Meta
+     * data is incorrect.
+     * @throws DownloadFailedException is thrown if there is an error.
+     * downloading the nvd cve download data file.
+     * @throws UpdateException Is thrown if there is an issue with the last updated properties file.
+     */
+    public Map<String, NvdCveUrl> updateNeeded() throws MalformedURLException, DownloadFailedException, UpdateException {
+
+        Map<String, NvdCveUrl> currentlyPublished;
+        try {
+            currentlyPublished = retrieveCurrentTimestampsFromWeb();
+        } catch (InvalidDataException ex) {
+            Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.SEVERE, null, ex);
+            throw new DownloadFailedException("Unable to retrieve valid timestamp from nvd cve downloads page", ex);
+
+        } catch (InvalidSettingException ex) {
+            Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.SEVERE, null, ex);
+            throw new DownloadFailedException("Invalid settings", ex);
+        }
+
+        if (currentlyPublished == null) {
+            throw new DownloadFailedException("Unable to retrieve valid timestamp from nvd cve downloads page");
+        }
+        String dir;
+        try {
+            dir = CveDB.getDataDirectory().getCanonicalPath();
+        } catch (IOException ex) {
+            Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.SEVERE, null, ex);
+            throw new UpdateException("Unable to locate last updated properties file.", ex);
+        }
+
+        File f = new File(dir);
+        if (f.exists()) {
+            File cveProp = new File(dir + File.separatorChar + UPDATE_PROPERTIES_FILE);
+            if (cveProp.exists()) {
+                Properties prop = new Properties();
+                InputStream is = null;
+                try {
+                    is = new FileInputStream(cveProp);
+                    prop.load(is);
+
+                    boolean deleteAndRecreate = false;
+                    float version = 0;
+
+                    if (prop.getProperty("version") == null) {
+                        deleteAndRecreate = true;
+                    } else {
+                        try {
+                            version = Float.parseFloat(prop.getProperty("version"));
+                            float currentVersion = Float.parseFloat(DATABASE_VERSION);
+                            if (currentVersion > version) {
+                                deleteAndRecreate = true;
+                            }
+                        } catch (NumberFormatException ex) {
+                            deleteAndRecreate = true;
+                        }
+                    }
+                    if (deleteAndRecreate) {
+                        Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.WARNING, "Index version is old. Rebuilding the index.");
+                        is.close();
+                        //this is an old version of the lucene index - just delete it
+                        FileUtils.delete(f);
+
+                        //this importer also updates the CPE index and it is also using an old version
+                        org.owasp.dependencycheck.data.cpe.Index cpeid = new org.owasp.dependencycheck.data.cpe.Index();
+                        File cpeDir = cpeid.getDataDirectory();
+                        FileUtils.delete(cpeDir);
+                        return currentlyPublished;
+                    }
+
+                    long lastUpdated = Long.parseLong(prop.getProperty(LAST_UPDATED_MODIFIED));
+                    Date now = new Date();
+                    int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS);
+                    int maxEntries = Settings.getInt(Settings.KEYS.CVE_URL_COUNT);
+                    if (lastUpdated == currentlyPublished.get("modified").timestamp) {
+                        currentlyPublished.clear(); //we don't need to update anything.
+                    } else if (withinRange(lastUpdated, now.getTime(), days)) {
+                        currentlyPublished.get("modified").setNeedsUpdate(true);
+                        for (int i = 1; i <= maxEntries; i++) {
+                            currentlyPublished.get(String.valueOf(i)).setNeedsUpdate(false);
+                        }
+                    } else { //we figure out which of the several XML files need to be downloaded.
+                        currentlyPublished.get("modified").setNeedsUpdate(false);
+                        for (int i = 1; i <= maxEntries; i++) {
+                            NvdCveUrl cve = currentlyPublished.get(String.valueOf(i));
+                            long currentTimestamp = 0;
+                            try {
+                                currentTimestamp = Long.parseLong(prop.getProperty(LAST_UPDATED_BASE + String.valueOf(i), "0"));
+                            } catch (NumberFormatException ex) {
+                                Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.FINEST, "Error parsing " + LAST_UPDATED_BASE
+                                        + String.valueOf(i) + " from nvdcve.lastupdated", ex);
+                            }
+                            if (currentTimestamp == cve.getTimestamp()) {
+                                cve.setNeedsUpdate(false); //they default to true.
+                            }
+                        }
+                    }
+                } catch (FileNotFoundException ex) {
+                    Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.FINEST, null, ex);
+                } catch (IOException ex) {
+                    Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.FINEST, null, ex);
+                } catch (NumberFormatException ex) {
+                    Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.FINEST, null, ex);
+                } finally {
+                    if (is != null) {
+                        try {
+                            is.close();
+                        } catch (IOException ex) {
+                            Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.SEVERE, null, ex);
+                        }
+                    }
+                }
+            }
+        }
+        return currentlyPublished;
+    }
+
+    /**
+     * Determines if the epoch date is within the range specified of the
+     * compareTo epoch time. This takes the (compareTo-date)/1000/60/60/24 to
+     * get the number of days. If the calculated days is less then the range the
+     * date is considered valid.
+     *
+     * @param date the date to be checked.
+     * @param compareTo the date to compare to.
+     * @param range the range in days to be considered valid.
+     * @return whether or not the date is within the range.
+     */
+    private boolean withinRange(long date, long compareTo, int range) {
+        double differenceInDays = (compareTo - date) / 1000.0 / 60.0 / 60.0 / 24.0;
+        return differenceInDays < range;
+    }
+
+    /**
+     * Retrieves the timestamps from the NVD CVE meta data file.
+     *
+     * @return the timestamp from the currently published nvdcve downloads page
+     * @throws MalformedURLException thrown if the URL for the NVD CCE Meta
+     * data is incorrect.
+     * @throws DownloadFailedException thrown if there is an error
+     * downloading the nvd cve meta data file
+     * @throws InvalidDataException thrown if there is an exception parsing
+     * the timestamps
+     * @throws InvalidSettingException thrown if the settings are invalid
+     */
+    protected Map<String, NvdCveUrl> retrieveCurrentTimestampsFromWeb()
+            throws MalformedURLException, DownloadFailedException, InvalidDataException, InvalidSettingException {
+
+        Map<String, NvdCveUrl> map = new HashMap<String, NvdCveUrl>();
+        String retrieveUrl = Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL);
+
+        NvdCveUrl item = new NvdCveUrl();
+        item.setNeedsUpdate(false); //the others default to true, to make life easier later this should default to false.
+        item.setId("modified");
+        item.setUrl(retrieveUrl);
+        item.setOldSchemaVersionUrl(Settings.getString(Settings.KEYS.CVE_MODIFIED_12_URL));
+
+        item.timestamp = Downloader.getLastModified(new URL(retrieveUrl));
+        map.put("modified", item);
+
+        int max = Settings.getInt(Settings.KEYS.CVE_URL_COUNT);
+        for (int i = 1; i <= max; i++) {
+            retrieveUrl = Settings.getString(Settings.KEYS.CVE_BASE_URL + Settings.KEYS.CVE_SCHEMA_2_0 + i);
+            item = new NvdCveUrl();
+            item.setId(Integer.toString(i));
+            item.setUrl(retrieveUrl);
+            item.setOldSchemaVersionUrl(Settings.getString(Settings.KEYS.CVE_BASE_URL + Settings.KEYS.CVE_SCHEMA_1_2 + i));
+            item.setTimestamp(Downloader.getLastModified(new URL(retrieveUrl)));
+            map.put(item.id, item);
+        }
+        return map;
+    }
+
+    /**
+     * A pojo that contains the Url and timestamp of the current NvdCve XML
+     * files.
+     */
+    protected static class NvdCveUrl {
+
+        /**
+         * an id.
+         */
+        private String id;
+
+        /**
+         * Get the value of id
+         *
+         * @return the value of id
+         */
+        public String getId() {
+            return id;
+        }
+
+        /**
+         * Set the value of id
+         *
+         * @param id new value of id
+         */
+        public void setId(String id) {
+            this.id = id;
+        }
+        /**
+         * a url.
+         */
+        private String url;
+
+        /**
+         * Get the value of url
+         *
+         * @return the value of url
+         */
+        public String getUrl() {
+            return url;
+        }
+
+        /**
+         * Set the value of url
+         *
+         * @param url new value of url
+         */
+        public void setUrl(String url) {
+            this.url = url;
+        }
+        /**
+         * The 1.2 schema URL
+         */
+        protected String oldSchemaVersionUrl;
+
+        /**
+         * Get the value of oldSchemaVersionUrl
+         *
+         * @return the value of oldSchemaVersionUrl
+         */
+        public String getOldSchemaVersionUrl() {
+            return oldSchemaVersionUrl;
+        }
+
+        /**
+         * Set the value of oldSchemaVersionUrl
+         *
+         * @param oldSchemaVersionUrl new value of oldSchemaVersionUrl
+         */
+        public void setOldSchemaVersionUrl(String oldSchemaVersionUrl) {
+            this.oldSchemaVersionUrl = oldSchemaVersionUrl;
+        }
+
+
+        /**
+         * a timestamp - epoch time.
+         */
+        private long timestamp;
+
+        /**
+         * Get the value of timestamp - epoch time
+         *
+         * @return the value of timestamp - epoch time
+         */
+        public long getTimestamp() {
+            return timestamp;
+        }
+
+        /**
+         * Set the value of timestamp - epoch time
+         *
+         * @param timestamp new value of timestamp - epoch time
+         */
+        public void setTimestamp(long timestamp) {
+            this.timestamp = timestamp;
+        }
+        /**
+         * indicates whether or not this item should be updated.
+         */
+        private boolean needsUpdate = true;
+
+        /**
+         * Get the value of needsUpdate
+         *
+         * @return the value of needsUpdate
+         */
+        public boolean getNeedsUpdate() {
+            return needsUpdate;
+        }
+
+        /**
+         * Set the value of needsUpdate
+         *
+         * @param needsUpdate new value of needsUpdate
+         */
+        public void setNeedsUpdate(boolean needsUpdate) {
+            this.needsUpdate = needsUpdate;
+        }
+    }
+    //</editor-fold>
+}

src/main/java/org/owasp/dependencycheck/data/nvdcve/xml/InvalidDataException.java

@@ -0,0 +1,48 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.nvdcve.xml;
+
+/**
+ * An InvalidDataDataException is a generic exception used when trying to load
+ * the nvd cve meta data.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class InvalidDataException extends Exception {
+    private static final long serialVersionUID = 1L;
+
+    /**
+     * Creates an InvalidDataException
+     *
+     * @param msg the exception message
+     */
+    public InvalidDataException(String msg) {
+        super(msg);
+    }
+
+    /**
+     * Creates an InvalidDataException
+     *
+     * @param msg the exception message
+     * @param ex the cause of the exception
+     */
+    public InvalidDataException(String msg, Exception ex) {
+        super(msg, ex);
+    }
+}

src/main/java/org/owasp/dependencycheck/data/nvdcve/xml/NvdCve12Handler.java

@@ -0,0 +1,216 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.nvdcve.xml;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import org.owasp.dependencycheck.dependency.VulnerableSoftware;
+import org.xml.sax.Attributes;
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotSupportedException;
+import org.xml.sax.helpers.DefaultHandler;
+
+/**
+ * A SAX Handler that will parse the NVD CVE XML (schema version 1.2). This
+ * parses the xml and retrieves a listing of CPEs that have previous versions
+ * specified. The previous version information is not in the 2.0 version of the
+ * schema and is useful to ensure accurate identification (or at least complete).
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class NvdCve12Handler extends DefaultHandler {
+
+    private static final String CURRENT_SCHEMA_VERSION = "1.2";
+    private String vulnerability = null;
+    private List<VulnerableSoftware> software = null;
+    private String vendor = null;
+    private String product = null;
+    private boolean skip = false;
+    private boolean hasPreviousVersion = false;
+    private Element current = new Element();
+    private Map<String, List<VulnerableSoftware>> vulnerabilities = null;
+
+    /**
+     * Get the value of vulnerabilities
+     *
+     * @return the value of vulnerabilities
+     */
+    public Map<String, List<VulnerableSoftware>> getVulnerabilities() {
+        return vulnerabilities;
+    }
+
+    @Override
+    public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
+        current.setNode(qName);
+        if (current.isEntryNode()) {
+            vendor = null;
+            product = null;
+            hasPreviousVersion = false;
+            String reject = attributes.getValue("reject");
+            skip = (reject != null && reject.equals("1"));
+            if (!skip) {
+                vulnerability = attributes.getValue("name");
+                software = new ArrayList<VulnerableSoftware>();
+            } else {
+                vulnerability = null;
+                software = null;
+            }
+        } else if (!skip && current.isProdNode()) {
+
+            vendor = attributes.getValue("vendor");
+            product = attributes.getValue("name");
+        } else if (!skip && current.isVersNode()) {
+            String prev = attributes.getValue("prev");
+            if (prev != null && "1".equals(prev)) {
+                hasPreviousVersion = true;
+                String edition = attributes.getValue("edition");
+                String num = attributes.getValue("num");
+
+                /*yes yes, this may not actually be an "a" - it could be an OS, etc. but for our
+                purposes this is good enough as we won't use this if we don't find a corresponding "a"
+                in the nvd cve 2.0. */
+                String cpe = "cpe:/a:" + vendor + ":" + product;
+                if (num != null) {
+                    cpe += ":" + num;
+                }
+                if (edition != null) {
+                    cpe += ":" + edition;
+                }
+                VulnerableSoftware vs = new VulnerableSoftware();
+                vs.setCpe(cpe);
+                vs.setPreviousVersion(prev);
+                software.add(vs);
+            }
+        } else if (current.isNVDNode()) {
+            String nvdVer = attributes.getValue("nvd_xml_version");
+            if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
+                throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported");
+            }
+            vulnerabilities = new HashMap<String, List<VulnerableSoftware>>();
+        }
+    }
+
+    @Override
+    public void endElement(String uri, String localName, String qName) throws SAXException {
+        current.setNode(qName);
+        if (current.isEntryNode()) {
+            if (!skip && hasPreviousVersion) {
+                vulnerabilities.put(vulnerability, software);
+            }
+            vulnerability = null;
+            software = null;
+        }
+    }
+
+    // <editor-fold defaultstate="collapsed" desc="The Element Class that maintains state information about the current node">
+    /**
+     * A simple class to maintain information about the current element while
+     * parsing the NVD CVE XML.
+     */
+    protected static class Element {
+
+        /**
+         * A node type in the NVD CVE Schema 1.2
+         */
+        public static final String NVD = "nvd";
+        /**
+         * A node type in the NVD CVE Schema 1.2
+         */
+        public static final String ENTRY = "entry";
+        /**
+         * A node type in the NVD CVE Schema 1.2
+         */
+        public static final String VULN_SOFTWARE = "vuln_soft";
+        /**
+         * A node type in the NVD CVE Schema 1.2
+         */
+        public static final String PROD = "prod";
+        /**
+         * A node type in the NVD CVE Schema 1.2
+         */
+        public static final String VERS = "vers";
+        private String node = null;
+
+        /**
+         * Gets the value of node
+         *
+         * @return the value of node
+         */
+        public String getNode() {
+            return this.node;
+        }
+
+        /**
+         * Sets the value of node
+         *
+         * @param node new value of node
+         */
+        public void setNode(String node) {
+            this.node = node;
+        }
+
+        /**
+         * Checks if the handler is at the NVD node
+         *
+         * @return true or false
+         */
+        public boolean isNVDNode() {
+            return NVD.equals(node);
+        }
+
+        /**
+         * Checks if the handler is at the ENTRY node
+         *
+         * @return true or false
+         */
+        public boolean isEntryNode() {
+            return ENTRY.equals(node);
+        }
+
+        /**
+         * Checks if the handler is at the VULN_SOFTWARE node
+         *
+         * @return true or false
+         */
+        public boolean isVulnSoftwareNode() {
+            return VULN_SOFTWARE.equals(node);
+        }
+
+        /**
+         * Checks if the handler is at the PROD node
+         *
+         * @return true or false
+         */
+        public boolean isProdNode() {
+            return PROD.equals(node);
+        }
+
+        /**
+         * Checks if the handler is at the VERS node
+         *
+         * @return true or false
+         */
+        public boolean isVersNode() {
+            return VERS.equals(node);
+        }
+    }
+    // </editor-fold>
+}

src/main/java/org/owasp/dependencycheck/data/nvdcve/xml/NvdCve20Handler.java

@@ -0,0 +1,448 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.nvdcve.xml;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.Map;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.apache.lucene.index.CorruptIndexException;
+import org.owasp.dependencycheck.data.cpe.Index;
+import org.owasp.dependencycheck.data.nvdcve.CveDB;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+import org.owasp.dependencycheck.dependency.Reference;
+import org.owasp.dependencycheck.dependency.Vulnerability;
+import org.owasp.dependencycheck.dependency.VulnerableSoftware;
+import org.xml.sax.Attributes;
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotSupportedException;
+import org.xml.sax.helpers.DefaultHandler;
+
+/**
+ * A SAX Handler that will parse the NVD CVE XML (schema version 2.0).
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class NvdCve20Handler extends DefaultHandler {
+
+    private static final String CURRENT_SCHEMA_VERSION = "2.0";
+    private Element current = new Element();
+    StringBuilder nodeText = null;
+    Vulnerability vulnerability = null;
+    Reference reference = null;
+    boolean hasApplicationCpe = false;
+
+    @Override
+    public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
+        current.setNode(qName);
+        if (current.isEntryNode()) {
+            hasApplicationCpe = false;
+            vulnerability = new Vulnerability();
+            vulnerability.setName(attributes.getValue("id"));
+        } else if (current.isVulnProductNode()) {
+            nodeText = new StringBuilder(100);
+        } else if (current.isVulnReferencesNode()) {
+            String lang = attributes.getValue("xml:lang");
+            if ("en".equals(lang)) {
+                reference = new Reference();
+            } else {
+                reference = null;
+            }
+        } else if (reference != null && current.isVulnReferenceNode()) {
+            reference.setUrl(attributes.getValue("href"));
+            nodeText = new StringBuilder(130);
+        } else if (reference != null && current.isVulnSourceNode()) {
+            nodeText = new StringBuilder(30);
+        } else if (current.isVulnSummaryNode()) {
+            nodeText = new StringBuilder(500);
+        } else if (current.isNVDNode()) {
+            String nvdVer = attributes.getValue("nvd_xml_version");
+            if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
+                throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported");
+            }
+        } else if (current.isVulnCWENode()) {
+            vulnerability.setCwe(attributes.getValue("id"));
+        } else if (current.isCVSSScoreNode()) {
+            nodeText = new StringBuilder(5);
+        } else if (current.isCVSSAccessVectorNode()) {
+            nodeText = new StringBuilder(20);
+        } else if (current.isCVSSAccessComplexityNode()) {
+            nodeText = new StringBuilder(20);
+        } else if (current.isCVSSAuthenticationNode()) {
+            nodeText = new StringBuilder(20);
+        } else if (current.isCVSSAvailabilityImpactNode()) {
+            nodeText = new StringBuilder(20);
+        } else if (current.isCVSSConfidentialityImpactNode()) {
+            nodeText = new StringBuilder(20);
+        } else if (current.isCVSSIntegrityImpactNode()) {
+            nodeText = new StringBuilder(20);
+        }
+    }
+
+    @Override
+    public void characters(char[] ch, int start, int length) throws SAXException {
+        if (nodeText != null) {
+            nodeText.append(ch, start, length);
+        }
+    }
+
+    @Override
+    public void endElement(String uri, String localName, String qName) throws SAXException {
+        current.setNode(qName);
+        if (current.isEntryNode()) {
+            if (hasApplicationCpe) {
+                try {
+                    saveEntry(vulnerability);
+                } catch (DatabaseException ex) {
+                    throw new SAXException(ex);
+                } catch (CorruptIndexException ex) {
+                    throw new SAXException(ex);
+                } catch (IOException ex) {
+                    throw new SAXException(ex);
+                }
+            }
+            vulnerability = null;
+        } else if (current.isCVSSScoreNode()) {
+            try {
+                float score = Float.parseFloat(nodeText.toString());
+                vulnerability.setCvssScore(score);
+            } catch (NumberFormatException ex) {
+                Logger.getLogger(NvdCve20Handler.class.getName()).log(Level.SEVERE, null, ex);
+            }
+            nodeText = null;
+        } else if (current.isCVSSAccessVectorNode()) {
+            vulnerability.setCvssAccessVector(nodeText.toString());
+            nodeText = null;
+        } else if (current.isCVSSAccessComplexityNode()) {
+            vulnerability.setCvssAccessComplexity(nodeText.toString());
+            nodeText = null;
+        } else if (current.isCVSSAuthenticationNode()) {
+            vulnerability.setCvssAuthentication(nodeText.toString());
+            nodeText = null;
+        } else if (current.isCVSSAvailabilityImpactNode()) {
+            vulnerability.setCvssAvailabilityImpact(nodeText.toString());
+            nodeText = null;
+        } else if (current.isCVSSConfidentialityImpactNode()) {
+            vulnerability.setCvssConfidentialityImpact(nodeText.toString());
+            nodeText = null;
+        } else if (current.isCVSSIntegrityImpactNode()) {
+            vulnerability.setCvssIntegrityImpact(nodeText.toString());
+            nodeText = null;
+        } else if (current.isVulnProductNode()) {
+            String cpe = nodeText.toString();
+            if (cpe.startsWith("cpe:/a:")) {
+                hasApplicationCpe = true;
+                vulnerability.addVulnerableSoftware(cpe);
+            }
+            nodeText = null;
+        } else if (reference != null && current.isVulnReferencesNode()) {
+            vulnerability.addReference(reference);
+            reference = null;
+        } else if (reference != null && current.isVulnReferenceNode()) {
+            reference.setName(nodeText.toString());
+            nodeText = null;
+        } else if (reference != null && current.isVulnSourceNode()) {
+            reference.setSource(nodeText.toString());
+            nodeText = null;
+        } else if (current.isVulnSummaryNode()) {
+            vulnerability.setDescription(nodeText.toString());
+            nodeText = null;
+        }
+    }
+    private CveDB cveDB = null;
+
+    /**
+     * Sets the cveDB
+     * @param db a reference to the CveDB
+     */
+    public void setCveDB(CveDB db) {
+        cveDB = db;
+    }
+    /**
+     * A list of CVE entries and associated VulnerableSoftware entries that contain
+     * previous entries.
+     */
+    private Map<String, List<VulnerableSoftware>> prevVersionVulnMap = null;
+
+    /**
+     * Sets the prevVersionVulnMap.
+     * @param map the map of vulnerable software with previous versions being vulnerable
+     */
+    public void setPrevVersionVulnMap(Map<String, List<VulnerableSoftware>> map) {
+        prevVersionVulnMap = map;
+    }
+
+    /**
+     * Saves a vulnerability to the CVE Database. This is a callback method
+     * called by the Sax Parser Handler {@link org.owasp.dependencycheck.data.nvdcve.xml.NvdCve20Handler}.
+     *
+     * @param vuln the vulnerability to store in the database
+     * @throws DatabaseException thrown if there is an error writing to the database
+     * @throws CorruptIndexException is thrown if the CPE Index is corrupt
+     * @throws IOException thrown if there is an IOException with the CPE Index
+     */
+    public void saveEntry(Vulnerability vuln) throws DatabaseException, CorruptIndexException, IOException {
+        if (cveDB == null) {
+            return;
+        }
+        String cveName = vuln.getName();
+        if (prevVersionVulnMap.containsKey(cveName)) {
+            List<VulnerableSoftware> vulnSoftware = prevVersionVulnMap.get(cveName);
+            for (VulnerableSoftware vs : vulnSoftware) {
+                vuln.updateVulnerableSoftware(vs);
+            }
+        }
+        for (VulnerableSoftware vs : vuln.getVulnerableSoftware()) {
+            if (cpeIndex != null) {
+                cpeIndex.saveEntry(vs);
+            }
+        }
+        cveDB.updateVulnerability(vuln);
+    }
+    private Index cpeIndex = null;
+
+    /**
+     * Sets the cpe index
+     * @param index the CPE Lucene Index
+     */
+    void setCpeIndex(Index index) {
+        cpeIndex = index;
+    }
+
+    // <editor-fold defaultstate="collapsed" desc="The Element Class that maintains state information about the current node">
+    /**
+     * A simple class to maintain information about the current element while
+     * parsing the NVD CVE XML.
+     */
+    protected static class Element {
+
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String NVD = "nvd";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String ENTRY = "entry";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String VULN_PRODUCT = "vuln:product";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String VULN_REFERENCES = "vuln:references";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String VULN_SOURCE = "vuln:source";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String VULN_REFERENCE = "vuln:reference";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String VULN_SUMMARY = "vuln:summary";
+
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String VULN_CWE = "vuln:cwe";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String CVSS_SCORE = "cvss:score";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String CVSS_ACCESS_VECTOR = "cvss:access-vector";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String CVSS_ACCESS_COMPLEXITY = "cvss:access-complexity";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String CVSS_AUTHENTICATION = "cvss:authentication";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String CVSS_CONFIDENTIALITY_IMPACT = "cvss:confidentiality-impact";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String CVSS_INTEGRITY_IMPACT = "cvss:integrity-impact";
+        /**
+         * A node type in the NVD CVE Schema 2.0
+         */
+        public static final String CVSS_AVAILABILITY_IMPACT = "cvss:availability-impact";
+
+        private String node = null;
+
+        /**
+         * Gets the value of node
+         *
+         * @return the value of node
+         */
+        public String getNode() {
+            return this.node;
+        }
+
+        /**
+         * Sets the value of node
+         *
+         * @param node new value of node
+         */
+        public void setNode(String node) {
+            this.node = node;
+        }
+
+        /**
+         * Checks if the handler is at the NVD node
+         *
+         * @return true or false
+         */
+        public boolean isNVDNode() {
+            return NVD.equals(node);
+        }
+
+        /**
+         * Checks if the handler is at the ENTRY node
+         *
+         * @return true or false
+         */
+        public boolean isEntryNode() {
+            return ENTRY.equals(node);
+        }
+
+        /**
+         * Checks if the handler is at the VULN_PRODUCT node
+         *
+         * @return true or false
+         */
+        public boolean isVulnProductNode() {
+            return VULN_PRODUCT.equals(node);
+        }
+
+        /**
+         * Checks if the handler is at the REFERENCES node
+         *
+         * @return true or false
+         */
+        public boolean isVulnReferencesNode() {
+            return VULN_REFERENCES.equals(node);
+        }
+
+        /**
+         * Checks if the handler is at the REFERENCE node
+         *
+         * @return true or false
+         */
+        public boolean isVulnReferenceNode() {
+            return VULN_REFERENCE.equals(node);
+        }
+
+        /**
+         * Checks if the handler is at the VULN_SOURCE node
+         *
+         * @return true or false
+         */
+        public boolean isVulnSourceNode() {
+            return VULN_SOURCE.equals(node);
+        }
+
+        /**
+         * Checks if the handler is at the VULN_SUMMARY node
+         *
+         * @return true or false
+         */
+        public boolean isVulnSummaryNode() {
+            return VULN_SUMMARY.equals(node);
+        }
+
+        /**
+         * Checks if the handler is at the VULN_CWE node
+         *
+         * @return true or false
+         */
+        public boolean isVulnCWENode() {
+            return VULN_CWE.equals(node);
+        }
+        /**
+         * Checks if the handler is at the CVSS_SCORE node
+         *
+         * @return true or false
+         */
+        public boolean isCVSSScoreNode() {
+            return CVSS_SCORE.equals(node);
+        }
+        /**
+         * Checks if the handler is at the CVSS_ACCESS_VECTOR node
+         *
+         * @return true or false
+         */
+        public boolean isCVSSAccessVectorNode() {
+            return CVSS_ACCESS_VECTOR.equals(node);
+        }
+        /**
+         * Checks if the handler is at the CVSS_ACCESS_COMPLEXITY node
+         *
+         * @return true or false
+         */
+        public boolean isCVSSAccessComplexityNode() {
+            return CVSS_ACCESS_COMPLEXITY.equals(node);
+        }
+        /**
+         * Checks if the handler is at the CVSS_AUTHENTICATION node
+         *
+         * @return true or false
+         */
+        public boolean isCVSSAuthenticationNode() {
+            return CVSS_AUTHENTICATION.equals(node);
+        }
+        /**
+         * Checks if the handler is at the CVSS_CONFIDENTIALITY_IMPACT node
+         *
+         * @return true or false
+         */
+        public boolean isCVSSConfidentialityImpactNode() {
+            return CVSS_CONFIDENTIALITY_IMPACT.equals(node);
+        }
+        /**
+         * Checks if the handler is at the CVSS_INTEGRITY_IMPACT node
+         *
+         * @return true or false
+         */
+        public boolean isCVSSIntegrityImpactNode() {
+            return CVSS_INTEGRITY_IMPACT.equals(node);
+        }
+        /**
+         * Checks if the handler is at the CVSS_AVAILABILITY_IMPACT node
+         *
+         * @return true or false
+         */
+        public boolean isCVSSAvailabilityImpactNode() {
+            return CVSS_AVAILABILITY_IMPACT.equals(node);
+        }
+
+    }
+    // </editor-fold>
+}

src/main/java/org/owasp/dependencycheck/data/nvdcve/xml/package-info.java

@@ -0,0 +1,18 @@
+/**
+ * <html>
+ * <head>
+ * <title>org.owasp.dependencycheck.data.nvdcve.xml</title>
+ * </head>
+ * <body>
+ * <p>Contains classes used to parse the NVD CVE XML file.</p>
+ * <p>The basic use is that the Importer is called to import
+ * an NVD CVE file. The Importer instantiates an Indexer object
+ * (which extends Index). The Indexer creates a partial-unmarshalling
+ * SAX parser (implemented in the NvdCveXmlFilter) that extracts
+ * VulnerabilityTypes (aka Entry) from the NVD CVE data file and
+ * stores these into a Lucene Index.</p>
+ * </body>
+ * </html>
+*/
+
+package org.owasp.dependencycheck.data.nvdcve.xml;

src/main/java/org/owasp/dependencycheck/data/package-info.java

@@ -0,0 +1,12 @@
+/**
+ * <html>
+ * <head>
+ * <title>org.owasp.dependencycheck.data</title>
+ * </head>
+ * <body>
+ * Contains classes used to work with the data sources.
+ * </body>
+ * </html>
+*/
+
+package org.owasp.dependencycheck.data;

src/main/java/org/owasp/dependencycheck/dependency/Dependency.java

@@ -0,0 +1,440 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.dependency;
+
+import java.io.File;
+import java.io.IOException;
+import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.SortedSet;
+import java.util.TreeSet;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.owasp.dependencycheck.utils.Checksum;
+import org.owasp.dependencycheck.utils.FileUtils;
+
+/**
+ * A program dependency. This object is one of the core components within
+ * DependencyCheck. It is used to collect information about the dependency in
+ * the form of evidence. The Evidence is then used to determine if there are any
+ * known, published, vulnerabilities associated with the program dependency.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class Dependency {
+
+    /**
+     * The actual file path of the dependency on disk.
+     */
+    private String actualFilePath = null;
+    /**
+     * The file path to display.
+     */
+    private String filePath = null;
+    /**
+     * The file name of the dependency.
+     */
+    private String fileName = null;
+    /**
+     * The file extension of the dependency.
+     */
+    private String fileExtension = null;
+    /**
+     * The md5 hash of the dependency.
+     */
+    private String md5sum = null;
+    /**
+     * The SHA1 hash of the dependency.
+     */
+    private String sha1sum = null;
+    /**
+     * A list of Identifiers.
+     */
+    private List<Identifier> identifiers = null;
+    /**
+     * A collection of vendor evidence.
+     */
+    protected EvidenceCollection vendorEvidence = null;
+    /**
+     * A collection of product evidence.
+     */
+    protected EvidenceCollection productEvidence = null;
+    /**
+     * A collection of version evidence.
+     */
+    protected EvidenceCollection versionEvidence = null;
+
+    /**
+     * Constructs a new Dependency object.
+     */
+    public Dependency() {
+        vendorEvidence = new EvidenceCollection();
+        productEvidence = new EvidenceCollection();
+        versionEvidence = new EvidenceCollection();
+        identifiers = new ArrayList<Identifier>();
+        vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
+    }
+
+    /**
+     * Constructs a new Dependency object.
+     *
+     * @param file the File to create the dependency object from.
+     */
+    public Dependency(File file) {
+        this();
+        this.actualFilePath = file.getPath();
+        this.filePath = this.actualFilePath;
+        this.fileName = file.getName();
+        this.fileExtension = FileUtils.getFileExtension(fileName);
+        determineHashes(file);
+    }
+
+    /**
+     * Returns the file name of the dependency.
+     *
+     * @return the file name of the dependency.
+     */
+    public String getFileName() {
+        return this.fileName;
+    }
+
+    /**
+     * Sets the file name of the dependency.
+     *
+     * @param fileName the file name of the dependency.
+     */
+    public void setFileName(String fileName) {
+        this.fileName = fileName;
+    }
+
+    /**
+     * Sets the actual file path of the dependency on disk.
+     *
+     * @param actualFilePath the file path of the dependency.
+     */
+    public void setActualFilePath(String actualFilePath) {
+        this.actualFilePath = actualFilePath;
+    }
+
+    /**
+     * Gets the file path of the dependency.
+     *
+     * @return the file path of the dependency.
+     */
+    public String getActualFilePath() {
+        return this.actualFilePath;
+    }
+
+    /**
+     * Sets the file path of the dependency.
+     *
+     * @param filePath the file path of the dependency.
+     */
+    public void setFilePath(String filePath) {
+        this.filePath = filePath;
+    }
+
+    /**
+     * <p>Gets the file path of the dependency.</p> <p><b>NOTE:</b> This may not
+     * be the actual path of the file on disk. The actual path of the file on
+     * disk can be obtained via the getActualFilePath().</p>
+     *
+     * @return the file path of the dependency.
+     */
+    public String getFilePath() {
+        return this.filePath;
+    }
+
+    /**
+     * Sets the file name of the dependency.
+     *
+     * @param fileExtension the file name of the dependency.
+     */
+    public void setFileExtension(String fileExtension) {
+        this.fileExtension = fileExtension;
+    }
+
+    /**
+     * Gets the file extension of the dependency.
+     *
+     * @return the file extension of the dependency.
+     */
+    public String getFileExtension() {
+        return this.fileExtension;
+    }
+
+    /**
+     * Returns the MD5 Checksum of the dependency file.
+     *
+     * @return the MD5 Checksum
+     */
+    public String getMd5sum() {
+        return this.md5sum;
+    }
+
+    /**
+     * Sets the MD5 Checksum of the dependency.
+     *
+     * @param md5sum the MD5 Checksum
+     */
+    public void setMd5sum(String md5sum) {
+        this.md5sum = md5sum;
+    }
+
+    /**
+     * Returns the SHA1 Checksum of the dependency.
+     *
+     * @return the SHA1 Checksum
+     */
+    public String getSha1sum() {
+        return this.sha1sum;
+    }
+
+    /**
+     * Sets the SHA1 Checksum of the dependency.
+     *
+     * @param sha1sum the SHA1 Checksum
+     */
+    public void setSha1sum(String sha1sum) {
+        this.sha1sum = sha1sum;
+    }
+
+    /**
+     * Returns a List of Identifiers.
+     *
+     * @return an ArrayList of Identifiers.
+     */
+    public List<Identifier> getIdentifiers() {
+        return this.identifiers;
+    }
+
+    /**
+     * Sets a List of Identifiers.
+     *
+     * @param identifiers A list of Identifiers.
+     */
+    public void setIdentifiers(List<Identifier> identifiers) {
+        this.identifiers = identifiers;
+    }
+
+    /**
+     * Adds an entry to the list of detected Identifiers for the dependency
+     * file.
+     *
+     * @param type the type of identifier (such as CPE).
+     * @param value the value of the identifier.
+     * @param url the URL of the identifier.
+     */
+    public void addIdentifier(String type, String value, String url) {
+        Identifier i = new Identifier(type, value, url);
+        this.identifiers.add(i);
+    }
+
+    /**
+     * Returns the evidence used to identify this dependency.
+     *
+     * @return an EvidenceCollection.
+     */
+    public EvidenceCollection getEvidence() {
+        return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence);
+    }
+
+    /**
+     * Returns the evidence used to identify this dependency.
+     *
+     * @return an EvidenceCollection.
+     */
+    public EvidenceCollection getEvidenceUsed() {
+        return EvidenceCollection.mergeUsed(this.productEvidence, this.vendorEvidence, this.versionEvidence);
+    }
+
+    /**
+     * Gets the Vendor Evidence.
+     *
+     * @return an EvidenceCollection.
+     */
+    public EvidenceCollection getVendorEvidence() {
+        return this.vendorEvidence;
+    }
+
+    /**
+     * Gets the Product Evidence.
+     *
+     * @return an EvidenceCollection.
+     */
+    public EvidenceCollection getProductEvidence() {
+        return this.productEvidence;
+    }
+
+    /**
+     * Gets the Version Evidence.
+     *
+     * @return an EvidenceCollection.
+     */
+    public EvidenceCollection getVersionEvidence() {
+        return this.versionEvidence;
+    }
+    /**
+     * A list of exceptions that occurred during analysis of this dependency.
+     */
+    protected List<Exception> analysisExceptions = new ArrayList<Exception>();
+
+    /**
+     * Get the value of analysisExceptions
+     *
+     * @return the value of analysisExceptions
+     */
+    public List<Exception> getAnalysisExceptions() {
+        return analysisExceptions;
+    }
+
+    /**
+     * Set the value of analysisExceptions
+     *
+     * @param analysisExceptions new value of analysisExceptions
+     */
+    public void setAnalysisExceptions(List<Exception> analysisExceptions) {
+        this.analysisExceptions = analysisExceptions;
+    }
+
+    /**
+     * Adds an exception to the analysis exceptions collection.
+     *
+     * @param ex an exception.
+     */
+    public void addAnalysisException(Exception ex) {
+        this.analysisExceptions.add(ex);
+    }
+    /**
+     * The description of the JAR file.
+     */
+    protected String description;
+
+    /**
+     * Get the value of description
+     *
+     * @return the value of description
+     */
+    public String getDescription() {
+        return description;
+    }
+
+    /**
+     * Set the value of description
+     *
+     * @param description new value of description
+     */
+    public void setDescription(String description) {
+        this.description = description;
+    }
+    /**
+     * The license that this dependency uses.
+     */
+    private String license;
+
+    /**
+     * Get the value of license
+     *
+     * @return the value of license
+     */
+    public String getLicense() {
+        return license;
+    }
+
+    /**
+     * Set the value of license
+     *
+     * @param license new value of license
+     */
+    public void setLicense(String license) {
+        this.license = license;
+    }
+
+    /**
+     * Determines if the specified string was used when searching. This is
+     * currently only used in test.
+     *
+     * @param str is the string that is being checked if it was used.
+     * @return true or false.
+     */
+    public boolean containsUsedString(String str) {
+        if (str == null) {
+            return false;
+        }
+
+        if (vendorEvidence.containsUsedString(str)) {
+            return true;
+        }
+        if (productEvidence.containsUsedString(str)) {
+            return true;
+        }
+        if (versionEvidence.containsUsedString(str)) {
+            return true;
+        }
+        return false;
+    }
+    /**
+     * A list of vulnerabilities for this dependency
+     */
+    private SortedSet<Vulnerability> vulnerabilities;
+
+    /**
+     * Get the list of vulnerabilities
+     *
+     * @return the list of vulnerabilities
+     */
+    public Set<Vulnerability> getVulnerabilities() {
+        return vulnerabilities;
+    }
+
+    /**
+     * Set the value of vulnerabilities
+     *
+     * @param vulnerabilities new value of vulnerabilities
+     */
+    public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) {
+        this.vulnerabilities = vulnerabilities;
+    }
+
+    private void determineHashes(File file) {
+        String md5 = null;
+        String sha1 = null;
+        try {
+            md5 = Checksum.getMD5Checksum(file);
+            sha1 = Checksum.getSHA1Checksum(file);
+        } catch (IOException ex) {
+            Logger.getLogger(Dependency.class.getName()).log(Level.SEVERE, null, ex);
+        } catch (NoSuchAlgorithmException ex) {
+            Logger.getLogger(Dependency.class.getName()).log(Level.SEVERE, null, ex);
+        }
+        this.setMd5sum(md5);
+        this.setSha1sum(sha1);
+    }
+
+    /**
+     * Adds a vulnerability to the dependency.
+     *
+     * @param vulnerability a vulnerability outlining a vulnerability.
+     */
+    public void addVulnerability(Vulnerability vulnerability) {
+        this.vulnerabilities.add(vulnerability);
+    }
+}

src/main/java/org/owasp/dependencycheck/dependency/Evidence.java

@@ -0,0 +1,225 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.dependency;
+
+/**
+ * Evidence is a piece of information about a Dependency.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class Evidence {
+
+    /**
+     * The confidence that the evidence is "high" quality.
+     */
+    public enum Confidence {
+
+        /**
+         * High confidence evidence.
+         */
+        HIGH,
+        /**
+         * Medium confidence evidence.
+         */
+        MEDIUM,
+        /**
+         * Low confidence evidence.
+         */
+        LOW
+    }
+
+    /**
+     * Creates a new Evidence object.
+     */
+    public Evidence() {
+    }
+
+    /**
+     * Creates a new Evidence objects.
+     *
+     * @param source the source of the evidence.
+     * @param name the name of the evidence.
+     * @param value the value of the evidence.
+     * @param confidence the confidence of the evidence.
+     */
+    public Evidence(String source, String name, String value, Confidence confidence) {
+        this.source = source;
+        this.name = name;
+        this.value = value;
+        this.confidence = confidence;
+    }
+    /**
+     * The name of the evidence.
+     */
+    protected String name;
+
+    /**
+     * Get the value of name
+     *
+     * @return the value of name
+     */
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Set the value of name
+     *
+     * @param name new value of name
+     */
+    public void setName(String name) {
+        this.name = name;
+    }
+    /**
+     * The source of the evidence.
+     */
+    protected String source;
+
+    /**
+     * Get the value of source
+     *
+     * @return the value of source
+     */
+    public String getSource() {
+        return source;
+    }
+
+    /**
+     * Set the value of source
+     *
+     * @param source new value of source
+     */
+    public void setSource(String source) {
+        this.source = source;
+    }
+    /**
+     * The value of the evidence.
+     */
+    protected String value;
+
+    /**
+     * Get the value of value
+     *
+     * @return the value of value
+     */
+    public String getValue() {
+        used = true;
+        return value;
+    }
+
+    /**
+     * Set the value of value
+     *
+     * @param value new value of value
+     */
+    public void setValue(String value) {
+        this.value = value;
+    }
+    /**
+     * A value indicating if the Evidence has been "used" (aka read).
+     */
+    protected boolean used;
+
+    /**
+     * Get the value of used
+     *
+     * @return the value of used
+     */
+    public boolean isUsed() {
+        return used;
+    }
+
+    /**
+     * Set the value of used
+     *
+     * @param used new value of used
+     */
+    public void setUsed(boolean used) {
+        this.used = used;
+    }
+    /**
+     * The confidence level for the evidence.
+     */
+    protected Confidence confidence;
+
+    /**
+     * Get the value of confidence
+     *
+     * @return the value of confidence
+     */
+    public Confidence getConfidence() {
+        return confidence;
+    }
+
+    /**
+     * Set the value of confidence
+     *
+     * @param confidence new value of confidence
+     */
+    public void setConfidence(Confidence confidence) {
+        this.confidence = confidence;
+    }
+
+    /**
+     * Implements the hashCode for Evidence.
+     *
+     * @return hash code.
+     */
+    @Override
+    public int hashCode() {
+        int hash = 3;
+        hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0);
+        hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0);
+        hash = 67 * hash + (this.value != null ? this.value.hashCode() : 0);
+        hash = 67 * hash + (this.confidence != null ? this.confidence.hashCode() : 0);
+        return hash;
+    }
+
+    /**
+     * Implements equals for Evidence.
+     *
+     * @param that an object to check the equality of.
+     * @return whether the two objects are equal.
+     */
+    @Override
+    public boolean equals(Object that) {
+        if (this == that) {
+            return true;
+        }
+        if (!(that instanceof Evidence)) {
+            return false;
+        }
+        Evidence e = (Evidence) that;
+
+        return testEquality(name, e.name) && testEquality(source, e.source) && testEquality(value, e.value)
+                && (confidence == null ? e.confidence == null : confidence == e.confidence);
+    }
+
+    /**
+     * Simple equality test for use within the equals method. This does a case
+     * insensitive compare.
+     *
+     * @param l a string to compare.
+     * @param r another string to compare.
+     * @return whether the two strings are the same.
+     */
+    private boolean testEquality(String l, String r) {
+        return l == null ? r == null : l.equalsIgnoreCase(r);
+    }
+}

src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java

@@ -0,0 +1,266 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.dependency;
+
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Set;
+import org.owasp.dependencycheck.utils.Filter;
+
+/**
+ * Used to maintain a collection of Evidence.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class EvidenceCollection implements Iterable<Evidence> {
+
+    /**
+     * Used to iterate over high confidence evidence contained in the
+     * collection.
+     */
+    private static final Filter<Evidence> HIGH_CONFIDENCE =
+            new Filter<Evidence>() {
+
+                public boolean passes(Evidence evidence) {
+                    return evidence.getConfidence() == Evidence.Confidence.HIGH;
+                }
+            };
+    /**
+     * Used to iterate over medium confidence evidence contained in the
+     * collection.
+     */
+    private static final Filter<Evidence> MEDIUM_CONFIDENCE =
+            new Filter<Evidence>() {
+
+                public boolean passes(Evidence evidence) {
+                    return evidence.getConfidence() == Evidence.Confidence.MEDIUM;
+                }
+            };
+    /*
+     * Used to iterate over low confidence evidence contained in the collection.
+     */
+    private static final Filter<Evidence> LOW_CONFIDENCE =
+            new Filter<Evidence>() {
+
+                public boolean passes(Evidence evidence) {
+                    return evidence.getConfidence() == Evidence.Confidence.LOW;
+                }
+            };
+    /**
+     * Used to iterate over evidence that has was used (aka read) from the
+     * collection.
+     */
+    private static final Filter<Evidence> EVIDENCE_USED =
+            new Filter<Evidence>() {
+
+                public boolean passes(Evidence evidence) {
+                    return evidence.isUsed();
+                }
+            };
+
+    /**
+     * Used to iterate over evidence of the specified confidence.
+     *
+     * @param confidence the confidence level for the evidence to be iterated
+     * over.
+     * @return Iterable<Evidence>.
+     */
+    public final Iterable<Evidence> iterator(Evidence.Confidence confidence) {
+        if (confidence == Evidence.Confidence.HIGH) {
+            return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list);
+        } else if (confidence == Evidence.Confidence.MEDIUM) {
+            return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list);
+        } else {
+            return EvidenceCollection.LOW_CONFIDENCE.filter(this.list);
+        }
+    }
+    private Set<Evidence> list = null;
+    private Set<String> weightedStrings = null;
+
+    /**
+     * Creates a new EvidenceCollection.
+     */
+    public EvidenceCollection() {
+        list = new HashSet<Evidence>();
+        weightedStrings = new HashSet<String>();
+    }
+
+    /**
+     * Adds evidence to the collection.
+     *
+     * @param e Evidence.
+     */
+    public void addEvidence(Evidence e) {
+        list.add(e);
+    }
+
+    /**
+     * Creates an Evidence object from the parameters and adds the resulting
+     * object to the collection.
+     *
+     * @param source the source of the Evidence.
+     * @param name the name of the Evidence.
+     * @param value the value of the Evidence.
+     * @param confidence the confidence of the Evidence.
+     */
+    public void addEvidence(String source, String name, String value, Evidence.Confidence confidence) {
+        Evidence e = new Evidence(source, name, value, confidence);
+        addEvidence(e);
+    }
+
+    /**
+     * Adds term to the weighting collection. The terms added here are used
+     * later to boost the score of other terms. This is a way of combining
+     * evidence from multiple sources to boost the confidence of the given
+     * evidence.
+     *
+     * Example: The term 'Apache' is found in the manifest of a JAR and is added
+     * to the Collection. When we parse the package names within the JAR file we
+     * may add these package names to the "weighted" strings collection to boost
+     * the score in the Lucene query. That way when we construct the Lucene
+     * query we find the term Apache in the collection AND in the weighted
+     * strings; as such, we will boost the confidence of the term Apache.
+     *
+     * @param str to add to the weighting collection.
+     */
+    public void addWeighting(String str) {
+        weightedStrings.add(str);
+    }
+
+    /**
+     * Returns a set of Weightings - a list of terms that are believed to be of
+     * higher confidence when also found in another location.
+     *
+     * @return Set<String>
+     */
+    public Set<String> getWeighting() {
+        return weightedStrings;
+    }
+
+    /**
+     * Returns the set of evidence.
+     *
+     * @return the set of evidence.
+     */
+    public Set<Evidence> getEvidence() {
+        return list;
+    }
+
+    /**
+     * Implements the iterator interface for the Evidence Collection.
+     *
+     * @return an Iterator<Evidence>.
+     */
+    public Iterator<Evidence> iterator() {
+        return list.iterator();
+    }
+
+    /**
+     * Used to determine if a given string was used (aka read).
+     *
+     * @param text the string to search for.
+     * @return whether or not the string was used.
+     */
+    public boolean containsUsedString(String text) {
+        if (text == null) {
+            return false;
+        }
+        text = text.toLowerCase();
+
+        for (Evidence e : this.list) {
+            if (e.used && e.value.toLowerCase().contains(text)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Returns whether or not the collection contains evidence of a specified
+     * Confidence.
+     *
+     * @param confidence A Confidence value.
+     * @return boolean.
+     */
+    public boolean contains(Evidence.Confidence confidence) {
+        for (Evidence e : list) {
+            if (e.confidence == confidence) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Merges multiple EvidenceCollections together, only merging evidence that
+     * was used, into a new EvidenceCollection.
+     *
+     * @param ec One or more EvidenceCollections.
+     * @return a new EvidenceCollection containing the used evidence.
+     */
+    public static EvidenceCollection mergeUsed(EvidenceCollection... ec) {
+        EvidenceCollection ret = new EvidenceCollection();
+        for (EvidenceCollection col : ec) {
+            for (Evidence e : col.list) {
+                if (e.isUsed()) {
+                    ret.addEvidence(e);
+                }
+            }
+        }
+        return ret;
+    }
+
+    /**
+     * Merges multiple EvidenceCollections together.
+     *
+     * @param ec One or more EvidenceCollections.
+     * @return a new EvidenceCollection.
+     */
+    public static EvidenceCollection merge(EvidenceCollection... ec) {
+        EvidenceCollection ret = new EvidenceCollection();
+        for (EvidenceCollection col : ec) {
+            ret.list.addAll(col.list);
+            ret.weightedStrings.addAll(col.weightedStrings);
+        }
+        return ret;
+    }
+
+    /**
+     * Returns a string of evidence 'values'.
+     *
+     * @return a string containing the evidence.
+     */
+    @Override
+    public String toString() {
+        StringBuilder sb = new StringBuilder();
+        for (Evidence e : this.list) {
+            sb.append(e.getValue()).append(' ');
+        }
+        return sb.toString();
+    }
+
+    /**
+     * Returns the number of elements in the EvidenceCollection.
+     *
+     * @return the number of elements in the collection.
+     */
+    public int size() {
+        return list.size();
+    }
+}

src/main/java/org/owasp/dependencycheck/dependency/Identifier.java

@@ -0,0 +1,168 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.dependency;
+
+/**
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class Identifier {
+
+    /**
+     * Constructs a new Identifier with the specified data.
+     *
+     * @param type the identifier type.
+     * @param value the identifier value.
+     * @param url the identifier url.
+     */
+    Identifier(String type, String value, String url) {
+        this.type = type;
+        this.value = value;
+        this.url = url;
+    }
+
+    /**
+     * Constructs a new Identifier with the specified data.
+     *
+     * @param type the identifier type.
+     * @param value the identifier value.
+     * @param url the identifier url.
+     * @param description the description of the identifier.
+     */
+    Identifier(String type, String value, String url, String description) {
+        this(type, value, url);
+        this.description = description;
+    }
+    /**
+     * The value of the identifier
+     */
+    protected String value;
+
+    /**
+     * Get the value of value
+     *
+     * @return the value of value
+     */
+    public String getValue() {
+        return value;
+    }
+
+    /**
+     * Set the value of value
+     *
+     * @param value new value of value
+     */
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    /**
+     * The url for the identifier
+     */
+    protected String url;
+
+    /**
+     * Get the value of url
+     *
+     * @return the value of url
+     */
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Set the value of url
+     *
+     * @param url new value of url
+     */
+    public void setUrl(String url) {
+        this.url = url;
+    }
+    /**
+     * The type of the identifier
+     */
+    protected String type;
+
+    /**
+     * Get the value of type
+     *
+     * @return the value of type
+     */
+    public String getType() {
+        return type;
+    }
+
+    /**
+     * <p>Set the value of type.</p><p>Example would be "CPE".</p>
+     *
+     * @param type new value of type
+     */
+    public void setType(String type) {
+        this.type = type;
+    }
+    /**
+     * A description of the identifier.
+     */
+    protected String description;
+
+    /**
+     * Get the value of description
+     *
+     * @return the value of description
+     */
+    public String getDescription() {
+        return description;
+    }
+
+    /**
+     * Set the value of description
+     *
+     * @param description new value of description
+     */
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (obj == null) {
+            return false;
+        }
+        if (getClass() != obj.getClass()) {
+            return false;
+        }
+        final Identifier other = (Identifier) obj;
+        if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) {
+            return false;
+        }
+        if ((this.type == null) ? (other.type != null) : !this.type.equals(other.type)) {
+            return false;
+        }
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int hash = 5;
+        hash = 53 * hash + (this.value != null ? this.value.hashCode() : 0);
+        hash = 53 * hash + (this.type != null ? this.type.hashCode() : 0);
+        return hash;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/dependency/Reference.java

@@ -0,0 +1,129 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.dependency;
+
+import java.io.Serializable;
+
+/**
+ * An external reference for a vulnerability. This contains a name, URL, and a
+ * source.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class Reference implements Serializable {
+
+    private static final long serialVersionUID = -3444464824563008021L;
+    /**
+     * The name of the reference.
+     */
+    private String name;
+
+    /**
+     * Get the value of name
+     *
+     * @return the value of name
+     */
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Set the value of name
+     *
+     * @param name new value of name
+     */
+    public void setName(String name) {
+        this.name = name;
+    }
+    /**
+     * the url for the reference
+     */
+    private String url;
+
+    /**
+     * Get the value of url
+     *
+     * @return the value of url
+     */
+    public String getUrl() {
+        return url;
+    }
+
+    /**
+     * Set the value of url
+     *
+     * @param url new value of url
+     */
+    public void setUrl(String url) {
+        this.url = url;
+    }
+    /**
+     * the source of the reference.
+     */
+    private String source;
+
+    /**
+     * Get the value of source
+     *
+     * @return the value of source
+     */
+    public String getSource() {
+        return source;
+    }
+
+    /**
+     * Set the value of source
+     *
+     * @param source new value of source
+     */
+    public void setSource(String source) {
+        this.source = source;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (obj == null) {
+            return false;
+        }
+        if (getClass() != obj.getClass()) {
+            return false;
+        }
+        final Reference other = (Reference) obj;
+        if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) {
+            return false;
+        }
+        if ((this.url == null) ? (other.url != null) : !this.url.equals(other.url)) {
+            return false;
+        }
+        if ((this.source == null) ? (other.source != null) : !this.source.equals(other.source)) {
+            return false;
+        }
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int hash = 5;
+        hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0);
+        hash = 67 * hash + (this.url != null ? this.url.hashCode() : 0);
+        hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0);
+        return hash;
+    }
+
+}

src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java

@@ -0,0 +1,387 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.dependency;
+
+import java.io.Serializable;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * Contains the information about a vulnerability.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class Vulnerability implements Serializable, Comparable<Vulnerability> {
+
+    private static final long serialVersionUID = 307319490326651052L;
+    /**
+     * The name of the vulnerability
+     */
+    private String name;
+
+    /**
+     * Get the value of name
+     *
+     * @return the value of name
+     */
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Set the value of name
+     *
+     * @param name new value of name
+     */
+    public void setName(String name) {
+        this.name = name;
+    }
+    /**
+     * the description of the vulnerability
+     */
+    private String description;
+
+    /**
+     * Get the value of description
+     *
+     * @return the value of description
+     */
+    public String getDescription() {
+        return description;
+    }
+
+    /**
+     * Set the value of description
+     *
+     * @param description new value of description
+     */
+    public void setDescription(String description) {
+        this.description = description;
+    }
+    /**
+     * References for this vulnerability
+     */
+    private Set<Reference> references = new HashSet<Reference>();
+
+    /**
+     * Get the value of references
+     *
+     * @return the value of references
+     */
+    public Set<Reference> getReferences() {
+        return references;
+    }
+
+    /**
+     * Set the value of references
+     *
+     * @param references new value of references
+     */
+    public void setReferences(Set<Reference> references) {
+        this.references = references;
+    }
+
+    /**
+     * Adds a reference to the references collection
+     *
+     * @param ref a reference for the vulnerability
+     */
+    public void addReference(Reference ref) {
+        this.references.add(ref);
+    }
+
+    /**
+     * Adds a reference
+     * @param referenceSource the source of the reference
+     * @param referenceName the referenceName of the reference
+     * @param referenceUrl the url of the reference
+     */
+    public void addReference(String referenceSource, String referenceName, String referenceUrl) {
+        Reference ref = new Reference();
+        ref.setSource(referenceSource);
+        ref.setName(referenceName);
+        ref.setUrl(referenceUrl);
+        this.references.add(ref);
+    }
+    /**
+     * a set of vulnerable software
+     */
+    protected Set<VulnerableSoftware> vulnerableSoftware = new HashSet<VulnerableSoftware>();
+
+    /**
+     * Get the value of vulnerableSoftware
+     *
+     * @return the value of vulnerableSoftware
+     */
+    public Set<VulnerableSoftware> getVulnerableSoftware() {
+        return vulnerableSoftware;
+    }
+
+    /**
+     * Set the value of vulnerableSoftware
+     *
+     * @param vulnerableSoftware new value of vulnerableSoftware
+     */
+    public void setVulnerableSoftware(Set<VulnerableSoftware> vulnerableSoftware) {
+        this.vulnerableSoftware = vulnerableSoftware;
+    }
+
+    /**
+     * Adds an entry for vulnerable software
+     * @param cpe string representation of a CPE entry
+     * @return if the add succeeded
+     */
+    public boolean addVulnerableSoftware(String cpe) {
+        return addVulnerableSoftware(cpe, null);
+    }
+
+    /**
+     * Adds an entry for vulnerable software
+     * @param cpe string representation of a cpe
+     * @param previousVersion the previous version (previousVersion - cpe would be considered vulnerable)
+     * @return if the add succeeded
+     */
+    public boolean addVulnerableSoftware(String cpe, String previousVersion) {
+        VulnerableSoftware vs = new VulnerableSoftware();
+        vs.setCpe(cpe);
+        if (previousVersion != null) {
+            vs.setPreviousVersion(previousVersion);
+        }
+        return updateVulnerableSoftware(vs);
+    }
+
+    /**
+     * Adds or updates a vulnerable software entry
+     * @param vulnSoftware the vulnerable software
+     * @return if the update succeeded
+     */
+    public boolean updateVulnerableSoftware(VulnerableSoftware vulnSoftware) {
+        if (vulnerableSoftware.contains(vulnSoftware)) {
+            vulnerableSoftware.remove(vulnSoftware);
+        }
+        return vulnerableSoftware.add(vulnSoftware);
+    }
+    /**
+     * The CWE for the vulnerability
+     */
+    protected String cwe;
+
+    /**
+     * Get the value of cwe
+     *
+     * @return the value of cwe
+     */
+    public String getCwe() {
+        return cwe;
+    }
+
+    /**
+     * Set the value of cwe
+     *
+     * @param cwe new value of cwe
+     */
+    public void setCwe(String cwe) {
+        this.cwe = cwe;
+    }
+    /**
+     * CVSS Score
+     */
+    protected float cvssScore;
+
+    /**
+     * Get the value of cvssScore
+     *
+     * @return the value of cvssScore
+     */
+    public float getCvssScore() {
+        return cvssScore;
+    }
+
+    /**
+     * Set the value of cvssScore
+     *
+     * @param cvssScore new value of cvssScore
+     */
+    public void setCvssScore(float cvssScore) {
+        this.cvssScore = cvssScore;
+    }
+    /**
+     * CVSS Access Vector
+     */
+    protected String cvssAccessVector;
+
+    /**
+     * Get the value of cvssAccessVector
+     *
+     * @return the value of cvssAccessVector
+     */
+    public String getCvssAccessVector() {
+        return cvssAccessVector;
+    }
+
+    /**
+     * Set the value of cvssAccessVector
+     *
+     * @param cvssAccessVector new value of cvssAccessVector
+     */
+    public void setCvssAccessVector(String cvssAccessVector) {
+        this.cvssAccessVector = cvssAccessVector;
+    }
+    /**
+     * CVSS Access Complexity
+     */
+    protected String cvssAccessComplexity;
+
+    /**
+     * Get the value of cvssAccessComplexity
+     *
+     * @return the value of cvssAccessComplexity
+     */
+    public String getCvssAccessComplexity() {
+        return cvssAccessComplexity;
+    }
+
+    /**
+     * Set the value of cvssAccessComplexity
+     *
+     * @param cvssAccessComplexity new value of cvssAccessComplexity
+     */
+    public void setCvssAccessComplexity(String cvssAccessComplexity) {
+        this.cvssAccessComplexity = cvssAccessComplexity;
+    }
+    /**
+     * CVSS Authentication
+     */
+    protected String cvssAuthentication;
+
+    /**
+     * Get the value of cvssAuthentication
+     *
+     * @return the value of cvssAuthentication
+     */
+    public String getCvssAuthentication() {
+        return cvssAuthentication;
+    }
+
+    /**
+     * Set the value of cvssAuthentication
+     *
+     * @param cvssAuthentication new value of cvssAuthentication
+     */
+    public void setCvssAuthentication(String cvssAuthentication) {
+        this.cvssAuthentication = cvssAuthentication;
+    }
+    /**
+     * CVSS Confidentiality Impact
+     */
+    protected String cvssConfidentialityImpact;
+
+    /**
+     * Get the value of cvssConfidentialityImpact
+     *
+     * @return the value of cvssConfidentialityImpact
+     */
+    public String getCvssConfidentialityImpact() {
+        return cvssConfidentialityImpact;
+    }
+
+    /**
+     * Set the value of cvssConfidentialityImpact
+     *
+     * @param cvssConfidentialityImpact new value of cvssConfidentialityImpact
+     */
+    public void setCvssConfidentialityImpact(String cvssConfidentialityImpact) {
+        this.cvssConfidentialityImpact = cvssConfidentialityImpact;
+    }
+    /**
+     * CVSS Integrity Impact
+     */
+    protected String cvssIntegrityImpact;
+
+    /**
+     * Get the value of cvssIntegrityImpact
+     *
+     * @return the value of cvssIntegrityImpact
+     */
+    public String getCvssIntegrityImpact() {
+        return cvssIntegrityImpact;
+    }
+
+    /**
+     * Set the value of cvssIntegrityImpact
+     *
+     * @param cvssIntegrityImpact new value of cvssIntegrityImpact
+     */
+    public void setCvssIntegrityImpact(String cvssIntegrityImpact) {
+        this.cvssIntegrityImpact = cvssIntegrityImpact;
+    }
+    /**
+     * CVSS Availability Impact
+     */
+    protected String cvssAvailabilityImpact;
+
+    /**
+     * Get the value of cvssAvailabilityImpact
+     *
+     * @return the value of cvssAvailabilityImpact
+     */
+    public String getCvssAvailabilityImpact() {
+        return cvssAvailabilityImpact;
+    }
+
+    /**
+     * Set the value of cvssAvailabilityImpact
+     *
+     * @param cvssAvailabilityImpact new value of cvssAvailabilityImpact
+     */
+    public void setCvssAvailabilityImpact(String cvssAvailabilityImpact) {
+        this.cvssAvailabilityImpact = cvssAvailabilityImpact;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (obj == null) {
+            return false;
+        }
+        if (getClass() != obj.getClass()) {
+            return false;
+        }
+        final Vulnerability other = (Vulnerability) obj;
+        if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) {
+            return false;
+        }
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int hash = 5;
+        hash = 41 * hash + (this.name != null ? this.name.hashCode() : 0);
+        return hash;
+    }
+    /**
+     * Compares two vulnerabilities
+     *
+     * @param v a vulnerability to be compared
+     * @return a negative integer, zero, or a positive integer as this object is less than, equal to, or greater than the specified vulnerability
+     */
+    public int compareTo(Vulnerability v) {
+        return v.getName().compareTo(this.getName());
+    }
+}

src/main/java/org/owasp/dependencycheck/dependency/VulnerabilityComparator.java

@@ -0,0 +1,40 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.dependency;
+
+import java.io.Serializable;
+import java.util.Comparator;
+
+/**
+ * Comparator for Vulnerability objects.
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class VulnerabilityComparator implements Comparator<Vulnerability>, Serializable {
+    private static final long serialVersionUID = 1L;
+
+    /**
+     * Implements the comparison of vulnerabilities.
+     * @param o1 a vulnerability
+     * @param o2 a second vulnerability
+     * @return the comparison
+     */
+    public int compare(Vulnerability o1, Vulnerability o2) {
+        return o2.getName().compareTo(o1.getName());
+    }
+}

src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java

@@ -0,0 +1,104 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.dependency;
+
+import java.io.Serializable;
+import java.io.UnsupportedEncodingException;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.owasp.dependencycheck.data.cpe.Entry;
+
+/**
+ * A record containing information about vulnerable software. This
+ * is referenced from a vulnerability.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class VulnerableSoftware extends Entry implements Serializable {
+
+    private static final long serialVersionUID = 307319490326651052L;
+
+    /**
+     * Parse a CPE entry from the cpe string representation
+     *
+     * @param cpe a cpe entry (e.g. cpe:/a:vendor:software:version)
+     */
+    public void setCpe(String cpe) {
+        try {
+            parseName(cpe);
+        } catch (UnsupportedEncodingException ex) {
+            Logger.getLogger(VulnerableSoftware.class.getName()).log(Level.SEVERE, null, ex);
+            setName(cpe);
+        }
+    }
+
+    /**
+     * If present, indicates that previous version are vulnerable
+     */
+    protected String previousVersion = null;
+
+    /**
+     * Indicates if previous versions of this software are vulnerable
+     *
+     * @return if previous versions of this software are vulnerable
+     */
+    public boolean hasPreviousVersion() {
+        return previousVersion != null;
+    }
+
+    /**
+     * Get the value of previousVersion
+     *
+     * @return the value of previousVersion
+     */
+    public String getPreviousVersion() {
+        return previousVersion;
+    }
+
+    /**
+     * Set the value of previousVersion
+     *
+     * @param previousVersion new value of previousVersion
+     */
+    public void setPreviousVersion(String previousVersion) {
+        this.previousVersion = previousVersion;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (obj == null) {
+            return false;
+        }
+        if (getClass() != obj.getClass()) {
+            return false;
+        }
+        final VulnerableSoftware other = (VulnerableSoftware) obj;
+        if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) {
+            return false;
+        }
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int hash = 7;
+        hash = 83 * hash + (this.name != null ? this.name.hashCode() : 0);
+        return hash;
+    }
+}

src/main/java/org/owasp/dependencycheck/dependency/package-info.java

@@ -0,0 +1,12 @@
+/**
+ * <html>
+ * <head>
+ * <title>org.owasp.dependencycheck.dependency</title>
+ * </head>
+ * <body>
+ * Contains the core Dependency implementation.
+ * </body>
+ * </html>
+*/
+
+package org.owasp.dependencycheck.dependency;

src/main/java/org/owasp/dependencycheck/package-info.java

@@ -0,0 +1,12 @@
+/**
+ * <html>
+ * <head>
+ * <title>org.owasp.dependencycheck</title>
+ * </head>
+ * <body>
+ * Includes the main entry point for the DependencyChecker.
+ * </body>
+ * </html>
+*/
+
+package org.owasp.dependencycheck;

src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java

@@ -0,0 +1,184 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.reporting;
+
+import java.io.FileInputStream;
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.apache.velocity.app.VelocityEngine;
+import org.apache.velocity.context.Context;
+import org.apache.velocity.runtime.RuntimeConstants;
+import org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader;
+import org.apache.velocity.tools.ToolManager;
+import org.apache.velocity.tools.config.EasyFactoryConfiguration;
+import org.owasp.dependencycheck.analyzer.Analyzer;
+import org.owasp.dependencycheck.dependency.Dependency;
+
+/**
+ * The ReportGenerator is used to, as the name implies, generate reports. Internally
+ * the generator uses the Velocity Templating Engine. The ReportGenerator exposes
+ * a list of Dependencies to the template when generating the report.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class ReportGenerator {
+
+    /**
+     * The Velocity Engine.
+     */
+    private VelocityEngine engine = null;
+    /**
+     * The Velocity Engine Context.
+     */
+    private Context context = null;
+
+    /**
+     * Constructs a new ReportGenerator.
+     *
+     * @param applicationName the application name being analyzed
+     * @param dependencies the list of dependencies
+     * @param analyzers the list of analyzers used.
+     */
+    public ReportGenerator(String applicationName, List<Dependency> dependencies, List<Analyzer> analyzers) {
+        engine = createVelocityEngine();
+        context = createContext();
+
+        engine.init();
+
+        context.put("applicationName", applicationName);
+        context.put("dependencies", dependencies);
+        context.put("analyzers", analyzers);
+    }
+
+    /**
+     * Creates a new Velocity Engine.
+     * @return a velocity engine.
+     */
+    private VelocityEngine createVelocityEngine() {
+        VelocityEngine ve = new VelocityEngine();
+        ve.setProperty(RuntimeConstants.RESOURCE_LOADER, "classpath");
+        ve.setProperty("classpath.resource.loader.class", ClasspathResourceLoader.class.getName());
+        return ve;
+    }
+
+    /**
+     * Creates a new Velocity Context initialized with escape and date tools.
+     * @return a Velocity Context.
+     */
+    private Context createContext() {
+        ToolManager manager = new ToolManager();
+        Context c = manager.createContext();
+        EasyFactoryConfiguration config = new EasyFactoryConfiguration();
+        config.addDefaultTools();
+        config.toolbox("application").tool("esc", "org.apache.velocity.tools.generic.EscapeTool").tool("org.apache.velocity.tools.generic.DateTool");
+        manager.configure(config);
+        return c;
+    }
+
+    /**
+     * Generates the Dependency Reports for the identified dependencies.
+     *
+     * @param outputDir the path where the reports should be written.
+     * @param outputFormat the format the report should be written in.
+     * @throws IOException is thrown when the template file does not exist.
+     * @throws Exception is thrown if there is an error writing out the
+     * reports.
+     */
+    public void generateReports(String outputDir, String outputFormat) throws IOException, Exception {
+        if (outputFormat.equalsIgnoreCase("XML")) {
+            generateReport("XmlReport", outputDir + File.separator + "DependencyCheck-Report.xml");
+        } else {
+            generateReport("HtmlReport", outputDir + File.separator + "DependencyCheck-Report.html");
+        }
+    }
+
+    /**
+     * Generates a report from a given Velocity Template. The template name
+     * provided can be the name of a template contained in the jar file, such as
+     * 'XmlReport' or 'HtmlReport', or the template name can be the path to a template file.
+     *
+     * @param templateName the name of the template to load.
+     * @param outFileName the filename and path to write the report to.
+     * @throws IOException is thrown when the template file does not exist.
+     * @throws Exception is thrown when an exception occurs.
+     */
+    public void generateReport(String templateName, String outFileName) throws IOException, Exception {
+        InputStream input = null;
+        String templatePath = null;
+        File f = new File(templateName);
+        if (f.exists() && f.isFile()) {
+            try {
+                templatePath = templateName;
+                input = new FileInputStream(f);
+            } catch (FileNotFoundException ex) {
+                Logger.getLogger(ReportGenerator.class.getName()).log(Level.SEVERE, null, ex);
+            }
+        } else {
+            templatePath = "templates/" + templateName + ".vsl";
+            input = this.getClass().getClassLoader().getResourceAsStream(templatePath);
+        }
+        if (input == null) {
+            throw new IOException("Template file doesn't exist");
+        }
+
+        InputStreamReader reader = new InputStreamReader(input, "UTF-8");
+        OutputStreamWriter writer = null;
+        OutputStream outputStream = null;
+
+        try {
+            outputStream = new FileOutputStream(outFileName);
+            writer = new OutputStreamWriter(outputStream, "UTF-8");
+            //writer = new BufferedWriter(oswriter);
+
+            if (!engine.evaluate(context, writer, templatePath, reader)) {
+                throw new Exception("Failed to convert the template into html.");
+            }
+            writer.flush();
+        } finally {
+            if (writer != null) {
+                try {
+                    writer.close();
+                } catch (Exception ex) {
+                    Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex);
+                }
+            }
+            if (outputStream != null) {
+                try {
+                    outputStream.close();
+                } catch (Exception ex) {
+                    Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex);
+                }
+            }
+            try {
+                reader.close();
+            } catch (Exception ex) {
+                Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex);
+            }
+        }
+    }
+}

src/main/java/org/owasp/dependencycheck/reporting/package-info.java

@@ -0,0 +1,12 @@
+/**
+ * <html>
+ * <head>
+ * <title>org.owasp.dependencycheck.reporting</title>
+ * </head>
+ * <body>
+ * Contains classes used to generate reports.
+ * </body>
+ * </html>
+*/
+
+package org.owasp.dependencycheck.reporting;

src/main/java/org/owasp/dependencycheck/utils/Checksum.java

@@ -0,0 +1,107 @@
+package org.owasp.dependencycheck.utils;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+/**
+ * Includes methods to generate the MD5 and SHA1 checksum.
+ *
+ * This code was copied from Real's How To. It has been slightly modified.
+ *
+ * Written and compiled by Réal Gagnon ©1998-2012
+ *
+ * @author Real's How To: http://www.rgagnon.com/javadetails/java-0416.html
+ *
+ */
+public class Checksum {
+
+    /**
+     * <p>Creates the cryptographic checksum of a given file using the specified
+     * algorithm.</p> <p>This algorithm was copied and heavily modified from
+     * Real's How To: http://www.rgagnon.com/javadetails/java-0416.html</p>
+     *
+     * @param algorithm the algorithm to use to calculate the checksum
+     * @param file the file to calculate the checksum for
+     * @return the checksum
+     * @throws IOException when the file does not exist
+     * @throws NoSuchAlgorithmException when an algorithm is specified that does
+     * not exist
+     */
+    public static byte[] getChecksum(String algorithm, File file) throws NoSuchAlgorithmException, IOException {
+        InputStream fis = null;
+        byte[] buffer = new byte[1024];
+        MessageDigest complete = MessageDigest.getInstance(algorithm);
+        int numRead;
+        try {
+            fis = new FileInputStream(file);
+            do {
+                numRead = fis.read(buffer);
+                if (numRead > 0) {
+                    complete.update(buffer, 0, numRead);
+                }
+            } while (numRead != -1);
+        } finally {
+            if (fis != null) {
+                try {
+                    fis.close();
+                } catch (IOException ex) {
+                    Logger.getLogger(Checksum.class.getName()).log(Level.SEVERE, null, ex);
+                }
+            }
+        }
+        return complete.digest();
+    }
+
+    /**
+     * Calculates the MD5 checksum of a specified file.
+     *
+     * @param file the file to generate the MD5 checksum
+     * @return the hex representation of the MD5 hash
+     * @throws IOException when the file passed in does not exist
+     * @throws NoSuchAlgorithmException when the MD5 algorithm is not available
+     */
+    public static String getMD5Checksum(File file) throws IOException, NoSuchAlgorithmException {
+        byte[] b = getChecksum("MD5", file);
+        return getHex(b);
+    }
+
+    /**
+     * Calculates the SHA1 checksum of a specified file.
+     *
+     * @param file the file to generate the MD5 checksum
+     * @return the hex representation of the SHA1 hash
+     * @throws IOException when the file passed in does not exist
+     * @throws NoSuchAlgorithmException when the SHA1 algorithm is not available
+     */
+    public static String getSHA1Checksum(File file) throws IOException, NoSuchAlgorithmException {
+        byte[] b = getChecksum("SHA1", file);
+        return getHex(b);
+    }
+    private static final String HEXES = "0123456789ABCDEF";
+
+    /**
+     * <p>Converts a byte array into a hex string.</p>
+     *
+     * <p>This method was copied from <a
+     * href="http://www.rgagnon.com/javadetails/java-0596.html">http://www.rgagnon.com/javadetails/java-0596.html</a></p>
+     *
+     * @param raw a byte array
+     * @return the hex representation of the byte array
+     */
+    public static String getHex(byte[] raw) {
+        if (raw == null) {
+            return null;
+        }
+        final StringBuilder hex = new StringBuilder(2 * raw.length);
+        for (final byte b : raw) {
+            hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt((b & 0x0F)));
+        }
+        return hex.toString();
+    }
+}

src/main/java/org/owasp/dependencycheck/utils/CliParser.java

@@ -0,0 +1,415 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.utils;
+
+import java.io.File;
+import java.io.FileNotFoundException;
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.CommandLineParser;
+import org.apache.commons.cli.HelpFormatter;
+import org.apache.commons.cli.Option;
+import org.apache.commons.cli.OptionBuilder;
+import org.apache.commons.cli.OptionGroup;
+import org.apache.commons.cli.Options;
+import org.apache.commons.cli.ParseException;
+import org.apache.commons.cli.PosixParser;
+
+/**
+ * A utility to parse command line arguments for the DependencyCheck.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public final class CliParser {
+
+    /**
+     * The command line.
+     */
+    private CommandLine line = null;
+    /**
+     * The options for the command line parser.
+     */
+    private Options options = createCommandLineOptions();
+    /**
+     * indicates whether the arguments are valid.
+     */
+    boolean isValid = true;
+
+    /**
+     * Parses the arguments passed in and captures the results for later use.
+     *
+     * @param args the command line arguments
+     * @throws FileNotFoundException is thrown when a 'file' argument does not
+     * point to a file that exists.
+     * @throws ParseException is thrown when a Parse Exception occurs.
+     */
+    public void parse(String[] args) throws FileNotFoundException, ParseException {
+        line = parseArgs(args);
+
+        if (line != null) {
+            validateArgs();
+        }
+    }
+
+    /**
+     * Parses the command line arguments.
+     *
+     * @param args the command line arguments
+     * @return the results of parsing the command line arguments
+     * @throws ParseException if the arguments are invalid
+     */
+    private CommandLine parseArgs(String[] args) throws ParseException {
+        CommandLineParser parser = new PosixParser();
+        CommandLine ln = parser.parse(options, args);
+        return ln;
+    }
+
+    /**
+     * Validates that the command line arguments are valid.
+     *
+     * @throws FileNotFoundException if there is a file specified by either the
+     * SCAN or CPE command line arguments that does not exist.
+     */
+    private void validateArgs() throws FileNotFoundException, ParseException {
+        if (isRunScan()) {
+            validatePathExists(getScanFiles());
+            if (!line.hasOption(ArgumentName.OUT)) {
+                //TODO - need a new exception type here, this isn't really a ParseException.
+                throw new ParseException("Scan cannot be run without specifying a directory "
+                        + "to write the reports to via the 'out' argument.");
+            } else {
+                String p = line.getOptionValue(ArgumentName.OUT, "");
+                File f = new File(p);
+                if ("".equals(p) || !(f.exists() && f.isDirectory())) {
+                    //TODO - need a new exception type here, this isn't really a ParseException.
+                    throw new ParseException("A valid directory name must be specified for "
+                            + "the 'out' argument.");
+                }
+            }
+            if (!line.hasOption(ArgumentName.APPNAME)) {
+                throw new ParseException("Scan cannot be run without specifying an application "
+                        + "name via the 'app' argument.");
+            }
+            if (line.hasOption(ArgumentName.OUTPUT_FORMAT)) {
+                String format = line.getOptionValue(ArgumentName.OUTPUT_FORMAT);
+                if (!(format.equalsIgnoreCase("XML") || format.equalsIgnoreCase("HTML"))) {
+                    throw new ParseException("Supported output formats are XML and HTML");
+                }
+            }
+        }
+    }
+
+    /**
+     * Validates whether or not the path(s) points at a file that exists; if the
+     * path(s) does not point to an existing file a FileNotFoundException is
+     * thrown.
+     *
+     * @param paths the paths to validate if they exists
+     * @throws FileNotFoundException is thrown if one of the paths being
+     * validated does not exist.
+     */
+    private void validatePathExists(String[] paths) throws FileNotFoundException {
+        for (String path : paths) {
+            validatePathExists(path);
+        }
+    }
+
+    /**
+     * Validates whether or not the path points at a file that exists; if the
+     * path does not point to an existing file a FileNotFoundException is
+     * thrown.
+     *
+     * @param path the paths to validate if they exists
+     * @throws FileNotFoundException is thrown if the path being validated does
+     * not exist.
+     */
+    private void validatePathExists(String path) throws FileNotFoundException {
+        File f = new File(path);
+        if (!f.exists()) {
+            isValid = false;
+            throw new FileNotFoundException("Invalid file argument: " + path);
+        }
+    }
+
+    /**
+     * Generates an Options collection that is used to parse the command line
+     * and to display the help message.
+     *
+     * @return the command line options used for parsing the command line
+     */
+    @SuppressWarnings("static-access")
+    private Options createCommandLineOptions() {
+        Option help = new Option(ArgumentName.HELP_SHORT, ArgumentName.HELP, false,
+                "print this message.");
+
+        Option advancedHelp = new Option(ArgumentName.ADVANCED_HELP_SHORT, ArgumentName.ADVANCED_HELP, false,
+                "shows additional help regarding properties file.");
+
+        Option version = new Option(ArgumentName.VERSION_SHORT, ArgumentName.VERSION,
+                false, "print the version information.");
+
+        Option noupdate = new Option(ArgumentName.DISABLE_AUTO_UPDATE_SHORT, ArgumentName.DISABLE_AUTO_UPDATE,
+                false, "disables the automatic updating of the CPE data.");
+
+        Option appname = OptionBuilder.withArgName("name").hasArg().withLongOpt(ArgumentName.APPNAME)
+                .withDescription("the name of the application being scanned.")
+                .create(ArgumentName.APPNAME_SHORT);
+
+        Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.SCAN)
+                .withDescription("the path to scan - this option can be specified multiple times.")
+                .create(ArgumentName.SCAN_SHORT);
+
+        Option props = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.PROP)
+                .withDescription("a property file to load.")
+                .create(ArgumentName.PROP_SHORT);
+
+        Option out = OptionBuilder.withArgName("folder").hasArg().withLongOpt(ArgumentName.OUT)
+                .withDescription("the folder to write reports to.")
+                .create(ArgumentName.OUT_SHORT);
+
+        Option outputformat = OptionBuilder.withArgName("format").hasArg().withLongOpt(ArgumentName.OUTPUT_FORMAT)
+                .withDescription("the output format to write to.")
+                .create(ArgumentName.OUTPUT_FORMAT_SHORT);
+
+        //TODO add the ability to load a properties file to override the defaults...
+
+        OptionGroup og = new OptionGroup();
+        og.addOption(path);
+
+        Options opts = new Options();
+        opts.addOptionGroup(og);
+        opts.addOption(out);
+        opts.addOption(outputformat);
+        opts.addOption(appname);
+        opts.addOption(version);
+        opts.addOption(help);
+        opts.addOption(noupdate);
+        opts.addOption(props);
+        opts.addOption(advancedHelp);
+        return opts;
+    }
+
+    /**
+     * Determines if the 'version' command line argument was passed in.
+     *
+     * @return whether or not the 'version' command line argument was passed in
+     */
+    public boolean isGetVersion() {
+        return (line != null) && line.hasOption(ArgumentName.VERSION);
+    }
+
+    /**
+     * Determines if the 'help' command line argument was passed in.
+     *
+     * @return whether or not the 'help' command line argument was passed in
+     */
+    public boolean isGetHelp() {
+        return (line != null) && line.hasOption(ArgumentName.HELP);
+    }
+
+    /**
+     * Determines if the 'scan' command line argument was passed in.
+     *
+     * @return whether or not the 'scan' command line argument was passed in
+     */
+    public boolean isRunScan() {
+        return (line != null) && isValid && line.hasOption(ArgumentName.SCAN);
+    }
+
+    /**
+     * Displays the command line help message to the standard output.
+     */
+    public void printHelp() {
+        HelpFormatter formatter = new HelpFormatter();
+        String nl = System.getProperty("line.separator");
+        String advancedHelp = null;
+        if (line.hasOption(ArgumentName.ADVANCED_HELP)) {
+            advancedHelp = nl + nl
+                    + "Additionally, the following properties are supported and can be specified either"
+                    + "using the -p <file> argument or by passing them in as system properties." + nl
+                    + nl + " " + Settings.KEYS.PROXY_URL + "\t\t    the proxy URL to use when downloading resources."
+                    + nl + " " + Settings.KEYS.PROXY_PORT + "\t\t    the proxy port to use when downloading resources."
+                    + nl + " " + Settings.KEYS.CONNECTION_TIMEOUT + "\t    the connection timeout (in milliseconds) to use"
+                    + nl + "\t\t\t    when downloading resources.";
+        }
+
+        formatter.printHelp(Settings.getString("application.name", "DependencyCheck"),
+                nl + Settings.getString("application.name", "DependencyCheck")
+                + " can be used to identify if there are any known CVE vulnerabilities in libraries utilized by an application. "
+                + Settings.getString("application.name", "DependencyCheck")
+                + " will automatically update required data from the Internet, such as the CVE and CPE data files from nvd.nist.gov." + nl + nl,
+                options,
+                "",
+                true);
+        if (advancedHelp != null) {
+            System.out.println(advancedHelp);
+        }
+    }
+
+    /**
+     * Retrieves the file command line parameter(s) specified for the 'scan'
+     * argument.
+     *
+     * @return the file paths specified on the command line for scan
+     */
+    public String[] getScanFiles() {
+        return line.getOptionValues(ArgumentName.SCAN);
+
+    }
+
+    /**
+     * returns the directory to write the reports to specified on the command
+     * line.
+     *
+     * @return the path to the reports directory.
+     */
+    public String getReportDirectory() {
+        return line.getOptionValue(ArgumentName.OUT);
+    }
+
+    /**
+     * Returns the output format specified on the command line. Defaults to
+     * HTML if no format was specified.
+     *
+     * @return the output format name.
+     */
+    public String getReportFormat() {
+        return line.getOptionValue(ArgumentName.OUTPUT_FORMAT, "HTML");
+    }
+
+    /**
+     * Returns the application name specified on the command line.
+     *
+     * @return the application name.
+     */
+    public String getApplicationName() {
+        return line.getOptionValue(ArgumentName.APPNAME);
+    }
+
+    /**
+     * <p>Prints the manifest information to standard output:</p>
+     * <ul><li>Implementation-Title: ${pom.name}</li>
+     * <li>Implementation-Version: ${pom.version}</li></ul>
+     */
+    public void printVersionInfo() {
+        String version = String.format("%s version %s",
+                Settings.getString("application.name", "DependencyCheck"),
+                Settings.getString("application.version", "Unknown"));
+        System.out.println(version);
+    }
+
+    /**
+     * Checks if the auto update feature has been disabled. If it has been
+     * disabled via the command line this will return false.
+     *
+     * @return if auto-update is allowed.
+     */
+    public boolean isAutoUpdate() {
+        return (line == null) || !line.hasOption(ArgumentName.DISABLE_AUTO_UPDATE);
+    }
+
+    /**
+     * A collection of static final strings that represent the possible command
+     * line arguments.
+     */
+    public static class ArgumentName {
+
+        /**
+         * The long CLI argument name specifying the directory/file to scan
+         */
+        public static final String SCAN = "scan";
+        /**
+         * The short CLI argument name specifying the directory/file to scan
+         */
+        public static final String SCAN_SHORT = "s";
+        /**
+         * The long CLI argument name specifying that the CPE/CVE/etc. data
+         * should not be automatically updated.
+         */
+        public static final String DISABLE_AUTO_UPDATE = "noupdate";
+        /**
+         * The short CLI argument name specifying that the CPE/CVE/etc. data
+         * should not be automatically updated.
+         */
+        public static final String DISABLE_AUTO_UPDATE_SHORT = "n";
+        /**
+         * The long CLI argument name specifying the directory to write the
+         * reports to.
+         */
+        public static final String OUT = "out";
+        /**
+         * The short CLI argument name specifying the directory to write the
+         * reports to.
+         */
+        public static final String OUT_SHORT = "o";
+        /**
+         * The long CLI argument name specifying the output format to write the
+         * reports to.
+         */
+        public static final String OUTPUT_FORMAT = "format";
+        /**
+         * The short CLI argument name specifying the output format to write the
+         * reports to.
+         */
+        public static final String OUTPUT_FORMAT_SHORT = "f";
+        /**
+         * The long CLI argument name specifying the name of the application to
+         * be scanned.
+         */
+        public static final String APPNAME = "app";
+        /**
+         * The short CLI argument name specifying the name of the application to
+         * be scanned.
+         */
+        public static final String APPNAME_SHORT = "a";
+        /**
+         * The long CLI argument name asking for help.
+         */
+        public static final String HELP = "help";
+        /**
+         * The short CLI argument name asking for help.
+         */
+        public static final String HELP_SHORT = "h";
+        /**
+         * The long CLI argument name asking for the version.
+         */
+        public static final String VERSION_SHORT = "v";
+        /**
+         * The short CLI argument name asking for the version.
+         */
+        public static final String VERSION = "version";
+        /**
+         * The CLI argument name asking for advanced help.
+         */
+        public static final String ADVANCED_HELP_SHORT = "ah";
+        /**
+         * The short CLI argument name asking for advanced help.
+         */
+        public static final String ADVANCED_HELP = "advancedhelp";
+        /**
+         * The short CLI argument name for setting the location of an additional
+         * properties file.
+         */
+        public static final String PROP_SHORT = "p";
+        /**
+         * The CLI argument name for setting the location of an additional
+         * properties file.
+         */
+        public static final String PROP = "propertyfile";
+    }
+}

src/main/java/org/owasp/dependencycheck/utils/DownloadFailedException.java

@@ -0,0 +1,66 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.utils;
+
+import java.io.IOException;
+
+/**
+ * An exception used when a download fails.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class DownloadFailedException extends IOException {
+
+    private static final long serialVersionUID = 1L;
+
+    /**
+     * Creates a new DownloadFailedException.
+     */
+    public DownloadFailedException() {
+        super();
+    }
+
+    /**
+     * Creates a new DownloadFailedException.
+     *
+     * @param msg a message for the exception.
+     */
+    public DownloadFailedException(String msg) {
+        super(msg);
+    }
+
+    /**
+     * Creates a new DownloadFailedException.
+     *
+     * @param ex the cause of the download failure.
+     */
+    public DownloadFailedException(Throwable ex) {
+        super(ex);
+    }
+
+    /**
+     * Creates a new DownloadFailedException.
+     *
+     * @param msg a message for the exception.
+     * @param ex the cause of the download failure.
+     */
+    public DownloadFailedException(String msg, Throwable ex) {
+        super(msg, ex);
+    }
+}

src/main/java/org/owasp/dependencycheck/utils/Downloader.java

@@ -0,0 +1,230 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.utils;
+
+import java.io.BufferedOutputStream;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.HttpURLConnection;
+import java.net.InetSocketAddress;
+import java.net.Proxy;
+import java.net.SocketAddress;
+import java.net.URL;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import java.util.zip.GZIPInputStream;
+import java.util.zip.InflaterInputStream;
+
+/**
+ * A utility to download files from the Internet.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class Downloader {
+
+    /**
+     * Private constructor for utility class.
+     */
+    private Downloader() {
+    }
+
+    /**
+     * Retrieves a file from a given URL and saves it to the outputPath.
+     *
+     * @param url the URL of the file to download.
+     * @param outputPath the path to the save the file to.
+     * @throws DownloadFailedException is thrown if there is an error
+     * downloading the file.
+     */
+    public static void fetchFile(URL url, String outputPath) throws DownloadFailedException {
+        fetchFile(url, outputPath, false);
+    }
+
+    /**
+     * Retrieves a file from a given URL and saves it to the outputPath.
+     *
+     * @param url the URL of the file to download.
+     * @param outputPath the path to the save the file to.
+     * @param unzip true/false indicating that the file being retrieved is
+     * gzipped and if true, should be uncompressed before writing to the file.
+     * @throws DownloadFailedException is thrown if there is an error
+     * downloading the file.
+     */
+    public static void fetchFile(URL url, String outputPath, boolean unzip) throws DownloadFailedException {
+        File f = new File(outputPath);
+        fetchFile(url, f, unzip);
+    }
+
+    /**
+     * Retrieves a file from a given URL and saves it to the outputPath.
+     *
+     * @param url the URL of the file to download.
+     * @param outputPath the path to the save the file to.
+     * @throws DownloadFailedException is thrown if there is an error
+     * downloading the file.
+     */
+    public static void fetchFile(URL url, File outputPath) throws DownloadFailedException {
+        fetchFile(url, outputPath, false);
+    }
+
+    /**
+     * Retrieves a file from a given URL and saves it to the outputPath.
+     *
+     * @param url the URL of the file to download.
+     * @param outputPath the path to the save the file to.
+     * @param unzip true/false indicating that the file being retrieved is
+     * gzipped and if true, should be uncompressed before writing to the file.
+     * @throws DownloadFailedException is thrown if there is an error
+     * downloading the file.
+     */
+    public static void fetchFile(URL url, File outputPath, boolean unzip) throws DownloadFailedException {
+        HttpURLConnection conn = null;
+        try {
+            conn = Downloader.getConnection(url);
+            conn.setRequestProperty("Accept-Encoding", "gzip, deflate");
+            conn.connect();
+        } catch (IOException ex) {
+            try {
+                if (conn != null) {
+                    conn.disconnect();
+                }
+            } finally {
+                conn = null;
+            }
+            throw new DownloadFailedException("Error downloading file.", ex);
+        }
+        String encoding = conn.getContentEncoding();
+
+        BufferedOutputStream writer = null;
+        InputStream reader = null;
+        try {
+            if (unzip || (encoding != null && "gzip".equalsIgnoreCase(encoding))) {
+                reader = new GZIPInputStream(conn.getInputStream());
+            } else if (encoding != null && "deflate".equalsIgnoreCase(encoding)) {
+                reader = new InflaterInputStream(conn.getInputStream());
+            } else {
+                reader = conn.getInputStream();
+            }
+
+            writer = new BufferedOutputStream(new FileOutputStream(outputPath));
+            byte[] buffer = new byte[4096];
+            int bytesRead = 0;
+            while ((bytesRead = reader.read(buffer)) > 0) {
+                writer.write(buffer, 0, bytesRead);
+            }
+        } catch (Exception ex) {
+            throw new DownloadFailedException("Error saving downloaded file.", ex);
+        } finally {
+            if (writer != null) {
+                try {
+                    writer.close();
+                    writer = null;
+                } catch (Exception ex) {
+                    Logger.getLogger(Downloader.class.getName()).log(Level.FINEST,
+                            "Error closing the writer in Downloader.", ex);
+                }
+            }
+            if (reader != null) {
+                try {
+                    reader.close();
+                    reader = null;
+                } catch (Exception ex) {
+
+                    Logger.getLogger(Downloader.class.getName()).log(Level.FINEST,
+                            "Error closing the reader in Downloader.", ex);
+                }
+            }
+            try {
+                conn.disconnect();
+            } finally {
+                conn = null;
+            }
+        }
+    }
+
+    /**
+     * Makes an HTTP Head request to retrieve the last modified date of the given URL.
+     *
+     * @param url the URL to retrieve the timestamp from
+     * @return an epoch timestamp
+     * @throws DownloadFailedException is thrown if an exception occurs making the HTTP request
+     */
+    public static long getLastModified(URL url) throws DownloadFailedException {
+        HttpURLConnection conn = null;
+        long timestamp = 0;
+        try {
+            conn = Downloader.getConnection(url);
+            conn.setRequestMethod("HEAD");
+            conn.connect();
+            timestamp = conn.getLastModified();
+        } catch (Exception ex) {
+            throw new DownloadFailedException("Error making HTTP HEAD request.", ex);
+        } finally {
+            if (conn != null) {
+                try {
+                    conn.disconnect();
+                } finally {
+                    conn = null;
+                }
+            }
+        }
+        return timestamp;
+    }
+
+    /**
+     * Utility method to get an HttpURLConnection. If the app is configured to
+     * use a proxy this method will retrieve the proxy settings and use them
+     * when setting up the connection.
+     *
+     * @param url the url to connect to
+     * @return an HttpURLConnection
+     * @throws DownloadFailedException thrown if there is an exception
+     */
+    private static HttpURLConnection getConnection(URL url) throws DownloadFailedException {
+        HttpURLConnection conn = null;
+        Proxy proxy = null;
+        String proxyUrl = Settings.getString(Settings.KEYS.PROXY_URL);
+        try {
+            if (proxyUrl != null) {
+                int proxyPort = Settings.getInt(Settings.KEYS.PROXY_PORT);
+                SocketAddress addr = new InetSocketAddress(proxyUrl, proxyPort);
+                proxy = new Proxy(Proxy.Type.HTTP, addr);
+                conn = (HttpURLConnection) url.openConnection(proxy);
+            } else {
+                conn = (HttpURLConnection) url.openConnection();
+            }
+            if (Settings.getString(Settings.KEYS.CONNECTION_TIMEOUT) != null) {
+                int timeout = Settings.getInt(Settings.KEYS.CONNECTION_TIMEOUT);
+                conn.setConnectTimeout(timeout);
+            }
+        } catch (IOException ex) {
+            try {
+                if (conn != null) {
+                    conn.disconnect();
+                }
+            } finally {
+                conn = null;
+            }
+            throw new DownloadFailedException("Error getting connection.", ex);
+        }
+        return conn;
+    }
+}

src/main/java/org/owasp/dependencycheck/utils/FileUtils.java

@@ -0,0 +1,70 @@
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option) any
+ * later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.utils;
+
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+
+/**
+ * A collection of utilities for processing information about files.
+ *
+ * @author Jeremy Long (jeremy.long@gmail.com)
+ */
+public class FileUtils {
+
+    /**
+     * Private constructor for a utility class.
+     */
+    private FileUtils() {
+    }
+
+    /**
+     * Returns the (lowercase) file extension for a specified file.
+     *
+     * @param fileName the file name to retrieve the file extension from.
+     * @return the file extension.
+     */
+    public static String getFileExtension(String fileName) {
+        String ret = null;
+        int pos = fileName.lastIndexOf(".");
+        if (pos >= 0) {
+            ret = fileName.substring(pos + 1, fileName.length()).toLowerCase();
+        }
+        return ret;
+    }
+
+    /**
+     * Deletes a file. If the File is a directory it will recursively delete
+     * the contents.
+     *
+     * @param file the File to delete
+     * @throws IOException is thrown if the file could not be deleted
+     */
+    public static void delete(File file) throws IOException {
+        if (file.isDirectory()) {
+            for (File c : file.listFiles()) {
+                delete(c);
+            }
+        }
+        if (!file.delete()) {
+            throw new FileNotFoundException("Failed to delete file: " + file);
+        }
+    }
+}

src/main/java/org/owasp/dependencycheck/utils/Filter.java

@@ -0,0 +1,70 @@
+package org.owasp.dependencycheck.utils;
+
+import java.util.Iterator;
+import java.util.NoSuchElementException;
+
+/*
+ * This is an abstract filter that can be used to filter iterable list.
+ *
+ * This Filter class was copied from:
+ * http://erikras.com/2008/01/18/the-filter-pattern-java-conditional-abstraction-with-iterables/
+ *
+ * Erik Rasmussen - © 2006 - 2012 All Rights Reserved. @author Erik Rasmussen
+ * https://plus.google.com/115403795880834599019/?rel=author
+ */
+public abstract class Filter<T> {
+
+    public abstract boolean passes(T object);
+
+    public Iterator<T> filter(Iterator<T> iterator) {
+        return new FilterIterator(iterator);
+    }
+
+    public Iterable<T> filter(final Iterable<T> iterable) {
+        return new Iterable<T>() {
+
+            public Iterator<T> iterator() {
+                return filter(iterable.iterator());
+            }
+        };
+    }
+
+    private class FilterIterator implements Iterator<T> {
+
+        private Iterator<T> iterator;
+        private T next;
+
+        private FilterIterator(Iterator<T> iterator) {
+            this.iterator = iterator;
+            toNext();
+        }
+
+        public boolean hasNext() {
+            return next != null;
+        }
+
+        public T next() {
+            if (next == null) {
+                throw new NoSuchElementException();
+            }
+            T returnValue = next;
+            toNext();
+            return returnValue;
+        }
+
+        public void remove() {
+            throw new UnsupportedOperationException();
+        }
+
+        private void toNext() {
+            next = null;
+            while (iterator.hasNext()) {
+                T item = iterator.next();
+                if (item != null && passes(item)) {
+                    next = item;
+                    break;
+                }
+            }
+        }
+    }
+}