@( projectsWithSelection: ProjectsWithSelection, tagOption: Option[(Int, LibraryTag)], statistics: LibDepStatistics )(implicit messagesApi: MessagesApi, requestHeader: DefaultRequest) @main( title = s"details for ${projectsWithSelection.projectNameText}${tagOption.map(_._2.name).fold("")(" and tag "+_)}", projectsOption = Some((projectsWithSelection, x => routes.Statistics.vulnerabilities(x, tagOption.map(_._1)))) ){ @healthReport(statistics.failedProjects) We have @statistics.vulnerabilitiesToDependencies.size vulnerabilities of @statistics.vulnerabilitiesToDependencies.flatMap(_._2).toSet.size dependencies (@statistics.vulnerabilitiesToDependencies.flatMap(_._2.flatMap(_.plainLibraryIdentifiers)).toSet.size libraries). @if(!projectsWithSelection.isProjectSpecified){ They are affecting @statistics.vulnerabilitiesToDependencies.flatMap(_._2.flatMap(_.projects)).toSet.size projects. }else{ Showing only project matching the selected filter.
When a filter is applied, YSVSS might differ, as it is computed over a subset of subprojects. As a result, order of vulnerabilities might differ from their order at all-projects view.
}
Vulnerabilities are sorted by number of affected projects multiplied by their severity. If the score is the same, then they are sorted by severity. If even this matches, they are sorted by name (which is related to vulnerability age).
@for((vulnerability, dependencies) <- statistics.vulnerabilitiesToDependencies.toSeq.sortBy{case (vuln, deps) => ( vuln.ysvssScore(deps).map(-_), // total score vuln.cvssScore.map(-_), // CVSS score vuln.name // make it deterministic ) }){

@vulnerability.name (@(vulnerability.cvss.score.getOrElse{"?"}) × @dependencies.flatMap(_.projects).toSet.size = @(vulnerability.ysvssScore(dependencies).fold{"?"}{d => f"$d%2.2f"}) )

@vulnerability.description

@*

@dependencies.map(_.identifiers)

*@ @*

@dependencies.flatMap(_.projects).toSet

*@ } }