DependencyCheck/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://www.owasp.org/index.php/OWASP_Dependency_Check_Suppression">
    <suppress>
        <notes><![CDATA[
        This suppresses false positives identified on spring security.
        ]]></notes>
        <gav regex="true">org\.springframework\.security:spring.*</gav>
        <cpe>cpe:/a:mod_security:mod_security</cpe>
        <cpe>cpe:/a:springsource:spring_framework</cpe>
        <cpe>cpe:/a:vmware:springsource_spring_framework</cpe>
    </suppress>
    <suppress>
        <notes><![CDATA[
        This suppreses additional false positives for the xstream library that occur because spring has a copy of this library.
            com.springsource.com.thoughtworks.xstream-1.3.1.jar
        ]]></notes>
        <gav regex="true">com\.thoughtworks\.xstream:xstream:.*</gav>
        <cpe>cpe:/a:springsource:spring_framework</cpe>
    </suppress>
    <suppress>
        <notes><![CDATA[
        Suppresses false positives on velocity tools.
        ]]></notes>
        <gav regex="true">org.apache.velocity:velocity-tools:.*</gav>
        <cpe>cpe:/a:apache:struts</cpe>
    </suppress>
</suppressions>