DependencyCheck/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://www.owasp.org/index.php/OWASP_Dependency_Check_Suppression">
    <suppress base="true">
        <notes><![CDATA[
        This suppresses false positives identified on spring security.
        ]]></notes>
        <gav regex="true">org\.springframework\.security:spring.*</gav>
        <cpe>cpe:/a:mod_security:mod_security</cpe>
        <cpe>cpe:/a:springsource:spring_framework</cpe>
        <cpe>cpe:/a:vmware:springsource_spring_framework</cpe>
    </suppress>
    <suppress base="true">
        <notes><![CDATA[
        This suppreses additional false positives for the xstream library that occur because spring has a copy of this library.
            com.springsource.com.thoughtworks.xstream-1.3.1.jar
        ]]></notes>
        <gav regex="true">com\.thoughtworks\.xstream:xstream:.*</gav>
        <cpe>cpe:/a:springsource:spring_framework</cpe>
    </suppress>
    <suppress base="true">
        <notes><![CDATA[
        Suppresses false positives on velocity tools.
        ]]></notes>
        <gav regex="true">org\.apache\.velocity:velocity-tools:.*</gav>
        <cpe>cpe:/a:apache:struts</cpe>
    </suppress>
    <suppress base="true">
        <notes><![CDATA[
        Sandbox is a php blog platform and should not be flagged as a CPE for java or .net dependencies.
        ]]></notes>
        <filePath regex="true">.*\.(jar|dll|exe|ear|war|pom)</filePath>
        <cpe>cpe:/a:sandbox:sandbox</cpe>
    </suppress>
    <suppress base="true">
        <notes><![CDATA[
        Suppresses false positives on Jersey core client.
        ]]></notes>
        <gav regex="true">org\.glassfish\.jersey\.core:jersey-(client|common):.*</gav>
        <cpe>cpe:/a:oracle:glassfish</cpe>
    </suppress>
</suppressions>