diff --git a/package.json b/package.json
index 79a61cbd2b..9bc5d99bad 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "eslint": "eslint -c .eslintrc src",
     "tslint": "tslint --project tsconfig.json --format stylish --exclude **/src/**/*.js",
     "prepare": "npm run build",
-    "tap": "tap test/*.test.* -Rspec --timeout=180 --node-path ts-node --test-file-pattern '/\\.[tj]s$/'",
+    "tap": "tap test/*.test.* -Rspec --timeout=300 --node-path ts-node --test-file-pattern '/\\.[tj]s$/'",
     "test": "npm run test-common && npm run tap",
     "test-common": "npm run check-tests && npm run lint && node --require ts-node/register src/cli test --org=snyk",
     "lint": "npm run eslint && npm run tslint",
@@ -42,6 +42,8 @@
   "author": "snyk.io",
   "license": "Apache-2.0",
   "dependencies": {
+    "@snyk/dep-graph": "1.1.1",
+    "@snyk/gemfile": "1.1.0",
     "abbrev": "^1.1.1",
     "ansi-escapes": "^3.1.0",
     "chalk": "^2.4.1",
diff --git a/src/lib/plugins/rubygems/gemfile-lock-to-dependencies.js b/src/lib/plugins/rubygems/gemfile-lock-to-dependencies.js
new file mode 100644
index 0000000000..ca370dde24
--- /dev/null
+++ b/src/lib/plugins/rubygems/gemfile-lock-to-dependencies.js
@@ -0,0 +1,49 @@
+const gemfile = require('@snyk/gemfile');
+
+module.exports = gemfileLockToDependencies;
+
+const detectCycles = (dep, chain) => {
+  if (chain.indexOf(dep) >= 0) {
+    const error = Error('Cyclic dependency detected in lockfile');
+    const UNPROCESSABLE_ENTITY = 422;
+    error.code = UNPROCESSABLE_ENTITY;
+    error.meta = {dep, chain};
+    throw error;
+  }
+};
+
+const gemfileReducer = (lockFile, allDeps, ancestors) => (deps, dep) => {
+  const gemspec = lockFile.specs[dep];
+  // If for some reason a dependency isn't included in the specs then its
+  // better to just ignore it (otherwise all processing fails).
+  // This happens for bundler itself, it isn't included in the Gemfile.lock
+  // specs, even if its a dependency! (and that isn't documented anywhere)
+  if (gemspec) {
+    detectCycles(dep, ancestors);
+    if (allDeps.has(dep)) {
+      deps[dep] = allDeps.get(dep);
+    } else {
+      deps[dep] = {
+        name: dep,
+        version: gemspec.version,
+      };
+      allDeps.set(dep, deps[dep]);
+      deps[dep].dependencies = Object
+        .keys(gemspec)
+        .filter(k => k !== 'version')
+        .reduce(gemfileReducer(lockFile, allDeps, ancestors.concat([dep])), {});
+    }
+  }
+  return deps;
+};
+
+function gemfileLockToDependencies(fileContents) {
+  const lockFile = gemfile.interpret(fileContents, true);
+
+  return Object
+    .keys(lockFile.dependencies || {})
+    // this is required to sanitise git deps with no exact version
+    // listed as `rspec!`
+    .map(dep => dep.match(/[^!]+/)[0])
+    .reduce(gemfileReducer(lockFile, new Map(), []), {});
+}
diff --git a/src/lib/snyk-test/legacy.ts b/src/lib/snyk-test/legacy.ts
new file mode 100644
index 0000000000..6ef6face4c
--- /dev/null
+++ b/src/lib/snyk-test/legacy.ts
@@ -0,0 +1,240 @@
+import * as _ from 'lodash';
+import * as depGraphLib from '@snyk/dep-graph';
+
+export {
+  convertTestDepGraphResultToLegacy,
+};
+
+interface Pkg {
+  name: string;
+  version?: string;
+}
+
+interface IssueData {
+  id: string;
+  packageName: string;
+  moduleName?: string;
+  semver: {
+    vulnerable: string | string[];
+    vulnerableHashes?: string[];
+    vulnerableByDistro?: {
+      [distroNameAndVersion: string]: string[];
+    }
+  };
+  patches: object[];
+  description: string;
+}
+
+interface AnnotatedIssue extends IssueData {
+  name: string;
+  version: string;
+  from: Array<string | boolean>;
+  upgradePath: Array<string | boolean>;
+  isUpgradable: boolean;
+  isPatchable: boolean;
+}
+
+interface LegacyVulnApiResult {
+  vulnerabilities: AnnotatedIssue[];
+  ok: boolean;
+  dependencyCount: number;
+  org: string;
+  policy: string;
+  isPrivate: boolean;
+  licensesPolicy: object | null;
+  packageManager: string;
+  ignoreSettings: object | null;
+  summary: string;
+  docker?: object;
+  severityThreshold?: string;
+}
+
+interface UpgradePathItem {
+  name: string;
+  version: string;
+  newVersion?: string;
+  isDropped?: boolean;
+}
+
+interface UpgradePath {
+  path: UpgradePathItem[];
+}
+
+interface FixInfo {
+  upgradePaths: UpgradePath[];
+  isPatchable: boolean;
+}
+
+interface TestDepGraphResult {
+  issuesData: {
+    [issueId: string]: IssueData;
+  };
+  affectedPkgs: {
+    [pkgId: string]: {
+      pkg: Pkg;
+      issues: {
+        [issueId: string]: {
+          issueId: string;
+          fixInfo: FixInfo;
+        };
+      };
+    };
+  };
+  docker: object;
+}
+
+interface TestDepGraphMeta {
+  isPublic: boolean;
+  isLicensesEnabled: boolean;
+  licensesPolicy?: {
+    severities: {
+      [type: string]: string;
+    };
+  };
+  ignoreSettings?: object;
+  policy: string;
+  org: string;
+}
+
+interface TestDeGraphResponse {
+  result: TestDepGraphResult;
+  meta: TestDepGraphMeta;
+}
+
+function convertTestDepGraphResultToLegacy(
+    res: TestDeGraphResponse,
+    depGraph: depGraphLib.DepGraph,
+    packageManager: string,
+    severityThreshold?: string): LegacyVulnApiResult {
+
+  const result = res.result;
+
+  const upgradePathsMap = new Map<string, string[]>();
+
+  for (const pkgInfo of _.values(result.affectedPkgs)) {
+    for (const pkgIssue of _.values(pkgInfo.issues)) {
+      if (pkgIssue.fixInfo && pkgIssue.fixInfo.upgradePaths) {
+        for (const upgradePath of pkgIssue.fixInfo.upgradePaths) {
+          const legacyFromPath = pkgPathToLegacyPath(upgradePath.path);
+          const vulnPathString = getVulnPathString(pkgIssue.issueId, legacyFromPath);
+          upgradePathsMap[vulnPathString] = toLegacyUpgradePath(upgradePath.path);
+        }
+      }
+    }
+  }
+
+  // generate the legacy vulns array (vuln-data + metada per vulnerable path).
+  //   use the upgradePathsMap to find available upgrade-paths
+  const vulns: AnnotatedIssue[] = [];
+
+  for (const pkgInfo of _.values(result.affectedPkgs)) {
+    for (const vulnPkgPath of depGraph.pkgPathsToRoot(pkgInfo.pkg)) {
+      const legacyFromPath = pkgPathToLegacyPath(vulnPkgPath.reverse());
+      for (const pkgIssue of _.values(pkgInfo.issues)) {
+        const vulnPathString = getVulnPathString(pkgIssue.issueId, legacyFromPath);
+        const upgradePath = upgradePathsMap[vulnPathString] || [];
+
+        // TODO: we need the full issue-data for every path only for the --json output,
+        //   consider picking only the required fields,
+        //   and append the full data only for --json, to minimize chance of out-of-memory
+        const annotatedIssue = Object.assign({}, result.issuesData[pkgIssue.issueId], {
+          from: legacyFromPath,
+          upgradePath,
+          isUpgradable: !!upgradePath[0] || !!upgradePath[1],
+          isPatchable: pkgIssue.fixInfo.isPatchable,
+          name: pkgInfo.pkg.name,
+          version: pkgInfo.pkg.version as string,
+        });
+
+        vulns.push(annotatedIssue);
+      }
+    }
+  }
+
+  const meta = res.meta || {};
+
+  severityThreshold = (severityThreshold === 'low') ? undefined : severityThreshold;
+
+  const legacyRes: LegacyVulnApiResult = {
+    vulnerabilities: vulns,
+    ok: vulns.length === 0,
+    dependencyCount: depGraph.getPkgs().length - 1,
+    org: meta.org,
+    policy: meta.policy,
+    isPrivate: !meta.isPublic,
+    licensesPolicy: meta.licensesPolicy || null,
+    packageManager,
+    ignoreSettings: meta.ignoreSettings || null,
+    docker: result.docker,
+    summary: getSummary(vulns, severityThreshold),
+    severityThreshold,
+  };
+
+  return legacyRes;
+}
+
+function getVulnPathString(issueId: string, vulnPath: string[]) {
+  return issueId + '|' +  JSON.stringify(vulnPath);
+}
+
+function pkgPathToLegacyPath(pkgPath: Pkg[]): string[] {
+  return pkgPath.map(toLegacyPkgId);
+}
+
+function toLegacyUpgradePath(upgradePath: UpgradePathItem[]): Array<string|boolean> {
+  return upgradePath
+    .filter((item) => !item.isDropped)
+    .map((item) => {
+      if (!item.newVersion) {
+        return false;
+      }
+
+      return `${item.name}@${item.newVersion}`;
+    });
+}
+
+function toLegacyPkgId(pkg: Pkg) {
+  return `${pkg.name}@${pkg.version || '*'}`;
+}
+
+function getSummary(vulns: object[], severityThreshold?: string): string {
+  const count = vulns.length;
+  let countText = '' + count;
+  const severityFilters: string[] = [];
+
+  const SEVERITIES = ['low', 'medium', 'high'];
+
+  if (severityThreshold) {
+    SEVERITIES.slice(SEVERITIES.indexOf(severityThreshold)).forEach((sev) => {
+      severityFilters.push(sev);
+    });
+  }
+
+  if (!count) {
+    if (severityFilters.length) {
+      return `No ${severityFilters.join(' or ')} severity vulnerabilities`;
+    }
+    return 'No known vulnerabilities';
+  }
+
+  if (severityFilters.length) {
+    countText += ' ' + severityFilters.join(' or ') + ' severity';
+  }
+
+  return `${countText} vulnerable dependency ${pl('path', count)}`;
+}
+
+function pl(word, count) {
+  const ext = {
+    y: 'ies',
+    default: 's',
+  };
+
+  const last = word.split('').pop();
+
+  if (count > 1) {
+    return word.slice(0, -1) + (ext[last] || last + ext.default);
+  }
+
+  return word;
+}
diff --git a/src/lib/snyk-test/npm/index.js b/src/lib/snyk-test/npm/index.js
index 71aa790333..0534b1d09b 100644
--- a/src/lib/snyk-test/npm/index.js
+++ b/src/lib/snyk-test/npm/index.js
@@ -79,6 +79,7 @@ function test(root, options) {
           if (!pkg.name) {
             pkg.name = path.basename(path.resolve(root));
           }
+
           policyLocations = policyLocations.concat(pluckPolicies(pkg));
           debug('policies found', policyLocations);
           analytics.add('policies', policyLocations.length);
diff --git a/src/lib/snyk-test/run-test.ts b/src/lib/snyk-test/run-test.ts
index b1ecec748f..2133362e28 100644
--- a/src/lib/snyk-test/run-test.ts
+++ b/src/lib/snyk-test/run-test.ts
@@ -1,7 +1,8 @@
 import * as _ from 'lodash';
 import fs = require('then-fs');
-import moduleToObject = require('snyk-module');
 import pathUtil = require('path');
+import moduleToObject = require('snyk-module');
+import * as depGraphLib from '@snyk/dep-graph';
 
 import analytics = require('../analytics');
 import config = require('../config');
@@ -13,6 +14,8 @@ import request = require('../request');
 import snyk = require('../');
 import spinner = require('../spinner');
 import common = require('./common');
+import gemfileLockToDependencies = require('../../lib/plugins/rubygems/gemfile-lock-to-dependencies');
+import {convertTestDepGraphResultToLegacy} from './legacy';
 
 // tslint:disable-next-line:no-var-requires
 const debug = require('debug')('snyk');
@@ -28,11 +31,15 @@ async function runTest(packageManager: string, root: string , options): Promise<
   try {
     const payload = await assemblePayload(root, options, policyLocations);
     const filesystemPolicy = payload.body && !!payload.body.policy;
+    const depGraph = payload.body && payload.body.depGraph;
 
     await spinner(spinnerLbl);
-
     let res = await sendPayload(payload, hasDevDependencies);
 
+    if (depGraph) {
+      res = convertTestDepGraphResultToLegacy(res, depGraph, packageManager, options.severityThreshold);
+    }
+
     analytics.add('vulns-pre-policy', res.vulnerabilities.length);
     res.filesystemPolicy = filesystemPolicy;
     if (!options['ignore-policy']) {
@@ -67,7 +74,11 @@ interface Payload {
     authorization: string;
   };
   body?: {
+    depGraph: depGraphLib.DepGraph,
     policy: string;
+    targetFile?: string;
+    projectNameOverride?: string;
+    docker?: any;
   };
   qs?: object | null;
 }
@@ -126,7 +137,7 @@ function assemblePayload(root: string, options, policyLocations: string[]): Prom
   return assembleRemotePayload(root, options);
 }
 
-async function assembleLocalPayload(root, options, policyLocations) {
+async function assembleLocalPayload(root, options, policyLocations): Promise<Payload> {
   options.file = options.file || detect.detectPackageFile(root);
   const plugin = plugins.loadPlugin(options.packageManager, options);
   const moduleInfo = ModuleInfo(plugin, options.policy);
@@ -146,27 +157,26 @@ async function assembleLocalPayload(root, options, policyLocations) {
       pkg.docker = pkg.docker || {};
       pkg.docker.baseImage = options['base-image'];
     }
+
+    if (_.get(pkg, 'files.gemfileLock.contents')) {
+      const gemfileLockBase64 = pkg.files.gemfileLock.contents;
+      const gemfileLockContents = Buffer.from(gemfileLockBase64, 'base64').toString();
+      pkg.dependencies = gemfileLockToDependencies(gemfileLockContents);
+    }
+
+    const depGraph = await depGraphLib.legacy.depTreeToGraph(
+      pkg, options.packageManager);
+
     analytics.add('policies', policyLocations.length);
     analytics.add('packageManager', options.packageManager);
     analytics.add('packageName', pkg.name);
     analytics.add('packageVersion', pkg.version);
     analytics.add('package', pkg.name + '@' + pkg.version);
-    const payload: Payload = {
-      method: 'POST',
-      url: vulnUrl(options.packageManager),
-      json: true,
-      headers: {
-        'x-is-ci': isCI,
-        'authorization': 'token ' + (snyk as any).api,
-      },
-      body: pkg,
-    };
-    payload.qs = common.assembleQueryString(options);
 
+    let policy;
     if (policyLocations.length > 0) {
       try {
-        const policy = await snyk.policy.load(policyLocations, options);
-        (payload.body as any).policy = policy.toString();
+        policy = await snyk.policy.load(policyLocations, options);
       } catch (err) {
         // note: inline catch, to handle error from .load
         //   if the .snyk file wasn't found, it is fine
@@ -175,23 +185,42 @@ async function assembleLocalPayload(root, options, policyLocations) {
         }
       }
     }
+
+    const payload: Payload = {
+      method: 'POST',
+      url: config.API + '/test-dep-graph',
+      json: true,
+      headers: {
+        'x-is-ci': isCI,
+        'authorization': 'token ' + (snyk as any).api,
+      },
+      qs: common.assembleQueryString(options),
+      body: {
+        depGraph,
+        targetFile: pkg.targetFile || options.file,
+        projectNameOverride: options.projectName,
+        policy: policy && policy.toString(),
+        docker: pkg.docker,
+      },
+    };
+
     return payload;
   } finally {
     spinner.clear(spinnerLbl)();
   }
 }
 
-async function assembleRemotePayload(root, options) {
+async function assembleRemotePayload(root, options): Promise<Payload> {
   const pkg = moduleToObject(root);
-  const encodedName = encodeURIComponent(pkg.name + '@' + pkg.version);
   debug('testing remote: %s', pkg.name + '@' + pkg.version);
   analytics.add('packageName', pkg.name);
   analytics.add('packageVersion', pkg.version);
   analytics.add('packageManager', options.packageManager);
   analytics.add('package', pkg.name + '@' + pkg.version);
+  const encodedName = encodeURIComponent(pkg.name + '@' + pkg.version);
   const payload: Payload = {
     method: 'GET',
-    url: vulnUrl(options.packageManager) + '/' + encodedName,
+    url: `${config.API}/vuln/${options.packageManager}/${encodedName}`,
     json: true,
     headers: {
       'x-is-ci': isCI,
@@ -201,7 +230,3 @@ async function assembleRemotePayload(root, options) {
   payload.qs = common.assembleQueryString(options);
   return payload;
 }
-
-function vulnUrl(packageManager) {
-  return config.API + '/vuln/' + packageManager;
-}
diff --git a/tap b/tap
new file mode 100755
index 0000000000..2d4f13ad6b
--- /dev/null
+++ b/tap
@@ -0,0 +1,6 @@
+#! /usr/bin/env sh
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+export NODE_OPTIONS=--no-deprecation
+
+exec "${SCRIPT_DIR}/node_modules/.bin/tap" --node-path "${SCRIPT_DIR}/node_modules/.bin/ts-node" --node-arg "--project=${SCRIPT_DIR}/tsconfig.json" --test-file-pattern '/\.test\.[tj]s$/' "$@"
diff --git a/test/acceptance/cli.acceptance.test.js b/test/acceptance/cli.acceptance.test.js
index 955e117ebe..69f7d11d6a 100644
--- a/test/acceptance/cli.acceptance.test.js
+++ b/test/acceptance/cli.acceptance.test.js
@@ -1,7 +1,13 @@
-var test = require('tap').test;
+var tap = require('tap');
+var {test, only} = tap;
+tap.runOnly = false; // <- for debug. set to true, and replace a test to only(..)
+
 var path = require('path');
 var fs = require('fs');
 var sinon = require('sinon');
+var depGraphLib = require('@snyk/dep-graph');
+var _ = require('lodash');
+
 var apiKey = '123456789';
 var oldkey;
 var oldendpoint;
@@ -13,15 +19,14 @@ var server = require('./fake-server')(process.env.SNYK_API, apiKey);
 var subProcess = require('../../src/lib/sub-process');
 var plugins = require('../../src/lib/plugins');
 var needle = require('needle');
-var config = require('../../src/lib/config');
 
 // ensure this is required *after* the demo server, since this will
 // configure our fake configuration too
 var cli = require('../../src/cli/commands');
 var snykPolicy = require('snyk-policy');
 
-var before = test;
-var after = test;
+var before = tap.runOnly ? only : test;
+var after = tap.runOnly ? only : test;
 
 // @later: remove this config stuff.
 // Was copied straight from ../src/cli-server.js
@@ -205,37 +210,301 @@ test('`test ruby-app-no-lockfile --file=Gemfile`', function (t) {
   });
 });
 
-test('`test ruby-app --file=Gemfile.lock` sends Gemfile and Lockfile',
-function (t) {
+test('`test ruby-app --file=Gemfile.lock`', async (t) => {
   chdirWorkspaces();
-  return cli.test('ruby-app', {file: 'Gemfile.lock'})
-  .then(function () {
-    var req = server.popRequest();
-    var files = req.body.files;
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/rubygems', 'posts to correct url');
-    t.equal(req.body.targetFile, 'Gemfile.lock', 'specifies target');
-    t.match(decode64(files.gemfile.contents),
-      'source :rubygems', 'attaches Gemfile');
-    t.match(decode64(files.gemfileLock.contents),
-      'remote: http://rubygems.org/', 'attaches Gemfile.lock');
-  });
+  await cli.test('ruby-app', {file: 'Gemfile.lock'});
+
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+
+  const depGraph = req.body.depGraph;
+  t.equal(depGraph.pkgManager.name, 'rubygems');
+  t.same(
+    depGraph.pkgs.map((p) => p.id).sort(),
+    ['ruby-app@', 'json@2.0.2', 'lynx@0.4.0'].sort(),
+    'depGraph looks fine');
 });
 
-test('`test ruby-app` returns correct meta', function (t) {
+test('`test ruby-app` meta when no vulns',  async (t) => {
   chdirWorkspaces();
-  return cli.test('ruby-app')
-  .then(function (res) {
+  const res = await cli.test('ruby-app');
+
+  var meta = res.slice(res.indexOf('Organisation:')).split('\n');
+  t.match(meta[0], /Organisation:\s+test-org/, 'organisation displayed');
+  t.match(meta[1], /Package manager:\s+rubygems/,
+    'package manager displayed');
+  t.match(meta[2], /Target file:\s+Gemfile/, 'target file displayed');
+  t.match(meta[3], /Open source:\s+no/, 'open source displayed');
+  t.match(meta[4], /Project path:\s+ruby-app/, 'path displayed');
+  t.notMatch(meta[5], /Local Snyk policy:\s+found/,
+    'local policy not displayed');
+});
+
+test('`test ruby-app-thresholds`', async (t) => {
+  chdirWorkspaces();
+
+  server.setNextResponse(
+    require('./workspaces/ruby-app-thresholds/test-graph-result.json'));
+
+  try {
+    await cli.test('ruby-app-thresholds');
+    t.fail('should have thrown');
+  } catch (err) {
+    const res = err.message;
+
+    t.match(res,
+      'Tested 7 dependencies for known vulnerabilities, found 6 vulnerabilities, 7 vulnerable paths',
+      '6 vulns');
+
     var meta = res.slice(res.indexOf('Organisation:')).split('\n');
     t.match(meta[0], /Organisation:\s+test-org/, 'organisation displayed');
     t.match(meta[1], /Package manager:\s+rubygems/,
       'package manager displayed');
     t.match(meta[2], /Target file:\s+Gemfile/, 'target file displayed');
     t.match(meta[3], /Open source:\s+no/, 'open source displayed');
-    t.match(meta[4], /Project path:\s+ruby-app/, 'path displayed');
+    t.match(meta[4], /Project path:\s+ruby-app-thresholds/, 'path displayed');
     t.notMatch(meta[5], /Local Snyk policy:\s+found/,
       'local policy not displayed');
+  }
+});
+
+test('`test ruby-app-thresholds --severity-threshold=low --json`', async (t) => {
+  chdirWorkspaces();
+
+  server.setNextResponse(
+    require('./workspaces/ruby-app-thresholds/test-graph-result-low-severity.json'));
+
+  try {
+    await cli.test('ruby-app-thresholds', {
+      severityThreshold: 'low',
+      json: true,
+    });
+    t.fail('should have thrown');
+  } catch (err) {
+    var req = server.popRequest();
+    t.is(req.query.severityThreshold, 'low');
+
+    const res = JSON.parse(err.message);
+
+    const expected =
+      require('./workspaces/ruby-app-thresholds/legacy-res-json-low-severity.json');
+
+    t.deepEqual(
+      _.omit(res, ['vulnerabilities']),
+      _.omit(expected, ['vulnerabilities']),
+      'metadata is ok');
+    t.deepEqual(
+      _.sortBy(res.vulnerabilities, 'id'),
+      _.sortBy(expected.vulnerabilities, 'id'),
+      'vulns are the same');
+  }
+});
+
+test('`test ruby-app-thresholds --severity-threshold=medium`', async (t) => {
+  chdirWorkspaces();
+
+  server.setNextResponse(
+    require('./workspaces/ruby-app-thresholds/test-graph-result-medium-severity.json'));
+
+  try {
+    await cli.test('ruby-app-thresholds', {
+      severityThreshold: 'medium',
+    });
+    t.fail('should have thrown');
+  } catch (err) {
+    var req = server.popRequest();
+    t.is(req.query.severityThreshold, 'medium');
+
+    const res = err.message;
+
+    t.match(res,
+      'Tested 7 dependencies for known vulnerabilities, found 5 vulnerabilities, 6 vulnerable paths',
+      '5 vulns');
+  }
+});
+
+test('`test ruby-app-thresholds --severity-threshold=medium --json`', async (t) => {
+  chdirWorkspaces();
+
+  server.setNextResponse(
+    require('./workspaces/ruby-app-thresholds/test-graph-result-medium-severity.json'));
+
+  try {
+    await cli.test('ruby-app-thresholds', {
+      severityThreshold: 'medium',
+      json: true,
+    });
+    t.fail('should have thrown');
+  } catch (err) {
+    var req = server.popRequest();
+    t.is(req.query.severityThreshold, 'medium');
+
+    const res = JSON.parse(err.message);
+
+    const expected =
+      require('./workspaces/ruby-app-thresholds/legacy-res-json-medium-severity.json');
+
+    t.deepEqual(
+      _.omit(res, ['vulnerabilities']),
+      _.omit(expected, ['vulnerabilities']),
+      'metadata is ok');
+    t.deepEqual(
+      _.sortBy(res.vulnerabilities, 'id'),
+      _.sortBy(expected.vulnerabilities, 'id'),
+      'vulns are the same');
+  }
+});
+
+test('`test ruby-app-thresholds --severity-threshold=high', async (t) => {
+  chdirWorkspaces();
+
+  server.setNextResponse(
+    require('./workspaces/ruby-app-thresholds/test-graph-result-high-severity.json'));
+
+  try {
+    await cli.test('ruby-app-thresholds', {
+      severityThreshold: 'high',
+    });
+    t.fail('should have thrown');
+  } catch (err) {
+    var req = server.popRequest();
+    t.is(req.query.severityThreshold, 'high');
+
+    const res = err.message;
+
+    t.match(res,
+      'Tested 7 dependencies for known vulnerabilities, found 3 vulnerabilities, 4 vulnerable paths',
+      '3 vulns');
+  }
+});
+
+test('`test ruby-app-thresholds --severity-threshold=high --json`', async (t) => {
+  chdirWorkspaces();
+
+  server.setNextResponse(
+    require('./workspaces/ruby-app-thresholds/test-graph-result-high-severity.json'));
+
+  try {
+    await cli.test('ruby-app-thresholds', {
+      severityThreshold: 'high',
+      json: true,
+    });
+    t.fail('should have thrown');
+  } catch (err) {
+    var req = server.popRequest();
+    t.is(req.query.severityThreshold, 'high');
+
+    const res = JSON.parse(err.message);
+
+    const expected =
+      require('./workspaces/ruby-app-thresholds/legacy-res-json-high-severity.json');
+
+    t.deepEqual(
+      _.omit(res, ['vulnerabilities']),
+      _.omit(expected, ['vulnerabilities']),
+      'metadata is ok');
+    t.deepEqual(
+      _.sortBy(res.vulnerabilities, 'id'),
+      _.sortBy(expected.vulnerabilities, 'id'),
+      'vulns are the same');
+  }
+});
+
+test('`test ruby-app-policy`', async (t) => {
+  chdirWorkspaces();
+
+  server.setNextResponse(
+    require('./workspaces/ruby-app-policy/test-graph-result.json'));
+
+  try {
+    await cli.test('ruby-app-policy', {
+      json: true,
+    });
+    t.fail('should have thrown');
+  } catch (err) {
+    const res = JSON.parse(err.message);
+
+    const expected =
+      require('./workspaces/ruby-app-policy/legacy-res-json.json');
+
+    t.deepEqual(
+      _.omit(res, ['vulnerabilities']),
+      _.omit(expected, ['vulnerabilities']),
+      'metadata is ok');
+    t.deepEqual(
+      _.sortBy(res.vulnerabilities, 'id'),
+      _.sortBy(expected.vulnerabilities, 'id'),
+      'vulns are the same');
+  }
+});
+
+test('`test ruby-app-policy` with cloud ignores', async (t) => {
+  chdirWorkspaces();
+
+  server.setNextResponse(
+    require('./workspaces/ruby-app-policy/test-graph-result-cloud-ignore.json'));
+
+  try {
+    await cli.test('ruby-app-policy', {
+      json: true,
+    });
+    t.fail('should have thrown');
+  } catch (err) {
+    const res = JSON.parse(err.message);
+
+    const expected =
+      require('./workspaces/ruby-app-policy/legacy-res-json-cloud-ignore.json');
+
+    t.deepEqual(
+      _.omit(res, ['vulnerabilities']),
+      _.omit(expected, ['vulnerabilities']),
+      'metadata is ok');
+    t.deepEqual(
+      _.sortBy(res.vulnerabilities, 'id'),
+      _.sortBy(expected.vulnerabilities, 'id'),
+      'vulns are the same');
+  }
+});
+
+test('`test ruby-app-no-vulns`', async (t) => {
+  chdirWorkspaces();
+
+  server.setNextResponse(
+    require('./workspaces/ruby-app-no-vulns/test-graph-result.json'));
+
+  const outText = await cli.test('ruby-app-no-vulns', {
+    json: true,
+  });
+
+  const res = JSON.parse(outText);
+
+  const expected =
+    require('./workspaces/ruby-app-no-vulns/legacy-res-json.json');
+
+  t.deepEqual(res, expected, '--json output is the same');
+});
+
+test('`test ruby-app-no-vulns`', async (t) => {
+  chdirWorkspaces();
+
+  const apiResponse = Object.assign(
+    {}, require('./workspaces/ruby-app-no-vulns/test-graph-result.json'));
+  apiResponse.meta.isPublic = true;
+  server.setNextResponse(apiResponse);
+
+  const outText = await cli.test('ruby-app-no-vulns', {
+    json: true,
   });
+
+  const res = JSON.parse(outText);
+
+  const expected = Object.assign(
+    {},
+    require('./workspaces/ruby-app-no-vulns/legacy-res-json.json'),
+    {isPrivate: false});
+
+  t.deepEqual(res, expected, '--json output is the same');
 });
 
 test('`test gradle-app` returns correct meta', function (t) {
@@ -264,23 +533,6 @@ test('`test gradle-app` returns correct meta', function (t) {
   });
 });
 
-test('`test` returns correct meta for a vulnerable result', function (t) {
-  chdirWorkspaces();
-  return cli.test('ruby-app', { org: 'org-with-vulns' })
-  .catch(function (res) {
-    var meta = res.message.slice(res.message.indexOf('Organisation:'))
-      .split('\n');
-    t.match(meta[0], /Organisation:\s+test-org/, 'organisation displayed');
-    t.match(meta[1], /Package manager:\s+rubygems/,
-      'package manager displayed');
-    t.match(meta[2], /Target file:\s+Gemfile/, 'target file displayed');
-    t.match(meta[3], /Open source:\s+no/, 'open source displayed');
-    t.match(meta[4], /Project path:\s+ruby-app/, 'path displayed');
-    t.notMatch(meta[5], /Local Snyk policy:\s+found/,
-      'local policy not displayed');
-  });
-});
-
 test('`test` returns correct meta when target file specified', function (t) {
   chdirWorkspaces();
   return cli.test('ruby-app', {file: 'Gemfile.lock'})
@@ -305,52 +557,55 @@ test('`test npm-package-policy` returns correct meta', function (t) {
 });
 
 
-test('`test ruby-gem-no-lockfile --file=ruby-gem.gemspec` sends gemspec',
-function (t) {
+test('`test ruby-gem-no-lockfile --file=ruby-gem.gemspec`', async (t) => {
   chdirWorkspaces();
-  return cli.test('ruby-gem-no-lockfile', {file: 'ruby-gem.gemspec'})
-  .then(function () {
-    var req = server.popRequest();
-    var files = req.body.files;
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/rubygems', 'posts to correct url');
-    t.equal(req.body.targetFile, 'ruby-gem.gemspec', 'specifies target');
-    t.match(decode64(files.gemspec.contents),
-      'Example Gemspec', 'attaches gemspec file');
-  });
+  await cli.test('ruby-gem-no-lockfile', {file: 'ruby-gem.gemspec'});
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+
+  const depGraph = req.body.depGraph;
+  t.equal(depGraph.pkgManager.name, 'rubygems');
+  t.same(depGraph.pkgs.map((p) => p.id),
+    ['ruby-gem-no-lockfile@'],
+    'no deps as we dont really support gemspecs yet');
 });
 
-test('`test ruby-gem --file=ruby-gem.gemspec` sends gemspec and Lockfile',
-function (t) {
+test('`test ruby-gem --file=ruby-gem.gemspec`', async (t) => {
   chdirWorkspaces();
-  return cli.test('ruby-gem', {file: 'ruby-gem.gemspec'})
-  .then(function () {
-    var req = server.popRequest();
-    var files = req.body.files;
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/rubygems', 'posts to correct url');
-    t.equal(req.body.targetFile, 'ruby-gem.gemspec', 'specifies target');
-    t.match(decode64(files.gemspec.contents),
-      'Example Gemspec', 'attaches gemspec file');
-    t.match(decode64(files.gemfileLock.contents),
-      'ruby-gem (0.1.0)', 'attaches Gemfile.lock');
-  });
+  await cli.test('ruby-gem', {file: 'ruby-gem.gemspec'});
+
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+
+  const depGraph = req.body.depGraph;
+  t.equal(depGraph.pkgManager.name, 'rubygems');
+  t.same(
+    depGraph.pkgs.map((p) => p.id).sort(),
+    ['ruby-gem@', 'ruby-gem@0.1.0', 'rake@10.5.0'].sort(),
+    'depGraph looks fine');
 });
 
 test('`test ruby-app` auto-detects Gemfile', function (t) {
   chdirWorkspaces();
   return cli.test('ruby-app')
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/rubygems', 'posts to correct url');
-    t.equal(req.body.targetFile, 'Gemfile', 'specifies target');
-  });
+    .then(function () {
+      var req = server.popRequest();
+      t.equal(req.method, 'POST', 'makes POST request');
+      t.match(req.url, '/test-dep-graph', 'posts to correct url');
+
+      const depGraph = req.body.depGraph;
+      t.equal(depGraph.pkgManager.name, 'rubygems');
+      t.same(
+        depGraph.pkgs.map((p) => p.id).sort(),
+        ['ruby-app@', 'json@2.0.2', 'lynx@0.4.0'].sort(),
+        'depGraph looks fine');
+      t.equal(req.body.targetFile, 'Gemfile', 'specifies target');
+    });
 });
 
-
-test('`test nuget-app-2 auto-detects project.assets.json`',
-function (t) {
+test('`test nuget-app-2 auto-detects project.assets.json`', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -362,28 +617,27 @@ function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('nuget')
-  .returns(plugin);
+    .withArgs('nuget')
+    .returns(plugin);
 
-  return cli.test('nuget-app-2')
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/nuget', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['nuget-app-2', 'project.assets.json', {
-        args: null,
-        file: 'project.assets.json',
-        org: null,
-        packageManager: 'nuget',
-        path: 'nuget-app-2',
-        showVulnPaths: true,
-      },], 'calls nuget plugin');
-  });
+  await cli.test('nuget-app-2');
+
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'nuget');
+  t.same(plugin.inspect.getCall(0).args,
+    ['nuget-app-2', 'project.assets.json', {
+      args: null,
+      file: 'project.assets.json',
+      org: null,
+      packageManager: 'nuget',
+      path: 'nuget-app-2',
+      showVulnPaths: true,
+    }], 'calls nuget plugin');
 });
 
-test('`test nuget-app-2.1 auto-detects obj/project.assets.json`',
-function (t) {
+test('`test nuget-app-2.1 auto-detects obj/project.assets.json`', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -395,29 +649,27 @@ function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('nuget')
-  .returns(plugin);
+    .withArgs('nuget')
+    .returns(plugin);
 
-  return cli.test('nuget-app-2.1')
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/nuget', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['nuget-app-2.1', 'obj/project.assets.json', {
-        args: null,
-        file: 'obj/project.assets.json',
-        org: null,
-        packageManager: 'nuget',
-        path: 'nuget-app-2.1',
-        showVulnPaths: true,
-      },], 'calls nuget plugin');
-  });
-});
+  await cli.test('nuget-app-2.1');
 
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'nuget');
+  t.same(plugin.inspect.getCall(0).args,
+    ['nuget-app-2.1', 'obj/project.assets.json', {
+      args: null,
+      file: 'obj/project.assets.json',
+      org: null,
+      packageManager: 'nuget',
+      path: 'nuget-app-2.1',
+      showVulnPaths: true,
+    }], 'calls nuget plugin');
+});
 
-test('`test nuget-app-4 auto-detects packages.config`',
-function (t) {
+test('`test nuget-app-4 auto-detects packages.config`', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -429,59 +681,61 @@ function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('nuget')
-  .returns(plugin);
+    .withArgs('nuget')
+    .returns(plugin);
 
-  return cli.test('nuget-app-4')
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/nuget', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['nuget-app-4', 'packages.config', {
-        args: null,
-        file: 'packages.config',
-        org: null,
-        packageManager: 'nuget',
-        path: 'nuget-app-4',
-        showVulnPaths: true,
-      },], 'calls nuget plugin');
-  });
+  await cli.test('nuget-app-4');
+
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'nuget');
+  t.same(plugin.inspect.getCall(0).args,
+    ['nuget-app-4', 'packages.config', {
+      args: null,
+      file: 'packages.config',
+      org: null,
+      packageManager: 'nuget',
+      path: 'nuget-app-4',
+      showVulnPaths: true,
+    }], 'calls nuget plugin');
 });
 
-test('`test monorepo --file=sub-ruby-app/Gemfile`', function (t) {
+test('`test monorepo --file=sub-ruby-app/Gemfile`', async (t) => {
   chdirWorkspaces();
-  return cli.test('monorepo', {file: 'sub-ruby-app/Gemfile'})
-  .then(function () {
-    var req = server.popRequest();
-    var files = req.body.files;
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/rubygems', 'posts to correct url');
-    t.equal(req.body.targetFile, path.join('sub-ruby-app', 'Gemfile'),
-      'specifies target');
-    t.equal(files.gemfile.name, path.join('sub-ruby-app', 'Gemfile'),
-    'specifies name');
-  });
+  await cli.test('monorepo', {file: 'sub-ruby-app/Gemfile'});
+
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+
+  const depGraph = req.body.depGraph;
+  t.equal(depGraph.pkgManager.name, 'rubygems');
+  t.same(
+    depGraph.pkgs.map((p) => p.id).sort(),
+    ['monorepo@', 'json@2.0.2', 'lynx@0.4.0'].sort(),
+    'depGraph looks fine');
+
+  t.equal(req.body.targetFile, path.join('sub-ruby-app', 'Gemfile'),
+    'specifies target');
 });
 
-test('`test maven-app --file=pom.xml --dev` sends package info',
-function (t) {
+test('`test maven-app --file=pom.xml --dev` sends package info', async (t) => {
   chdirWorkspaces();
   stubExec(t, 'maven-app/mvn-dep-tree-stdout.txt');
-  return cli.test('maven-app',
-    {file: 'pom.xml', org: 'nobelprize.org', dev: true})
-  .then(function () {
-    var req = server.popRequest();
-    var pkg = req.body;
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/maven', 'posts to correct url');
-    t.equal(pkg.name, 'com.mycompany.app:maven-app', 'specifies name');
-    t.ok(pkg.dependencies['axis:axis'], 'specifies dependency');
-    t.ok(pkg.dependencies['junit:junit'], 'specifies dependency');
-    t.equal(pkg.dependencies['junit:junit'].name, 'junit:junit',
-            'specifies dependency name');
-    t.equal(req.query.org, 'nobelprize.org', 'org sent as a query in request');
-  });
+  await cli.test('maven-app', {file: 'pom.xml', org: 'nobelprize.org', dev: true});
+
+  const req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.query.org, 'nobelprize.org', 'org sent as a query in request');
+
+  const depGraph = depGraphLib.createFromJSON(req.body.depGraph);
+  t.equal(depGraph.rootPkg.name, 'com.mycompany.app:maven-app', 'root name');
+  const pkgs = depGraph.getPkgs().map((x) => `${x.name}@${x.version}`);
+  t.ok(pkgs.indexOf('com.mycompany.app:maven-app@1.0-SNAPSHOT') >= 0);
+  t.ok(pkgs.indexOf('axis:axis@1.4') >= 0);
+  t.ok(pkgs.indexOf('junit:junit@3.8.2') >= 0);
 });
 
 test('`test npm-package` sends pkg info', function (t) {
@@ -648,8 +902,7 @@ function (t) {
   });
 });
 
-test('`test pip-app --file=requirements.txt`',
-function (t) {
+test('`test pip-app --file=requirements.txt`', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -661,30 +914,28 @@ function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('pip')
-  .returns(plugin);
+    .withArgs('pip')
+    .returns(plugin);
 
-  return cli.test('pip-app', {
+  await cli.test('pip-app', {
     file: 'requirements.txt',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/pip', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['pip-app', 'requirements.txt', {
-        args: null,
-        file: 'requirements.txt',
-        org: null,
-        packageManager: 'pip',
-        path: 'pip-app',
-        showVulnPaths: true,
-      }], 'calls python plugin');
   });
-});
-
-test('`test pipenv-app --file=Pipfile`',
-function (t) {
+  const req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'pip');
+  t.same(plugin.inspect.getCall(0).args,
+    ['pip-app', 'requirements.txt', {
+      args: null,
+      file: 'requirements.txt',
+      org: null,
+      packageManager: 'pip',
+      path: 'pip-app',
+      showVulnPaths: true,
+    }], 'calls python plugin');
+});
+
+test('`test pipenv-app --file=Pipfile`', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -696,29 +947,28 @@ function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('pip')
-  .returns(plugin);
+    .withArgs('pip')
+    .returns(plugin);
 
-  return cli.test('pipenv-app', {
+  await cli.test('pipenv-app', {
     file: 'Pipfile',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/pip', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['pipenv-app', 'Pipfile', {
-        args: null,
-        file: 'Pipfile',
-        org: null,
-        packageManager: 'pip',
-        path: 'pipenv-app',
-        showVulnPaths: true,
-      }], 'calls python plugin');
   });
-});
-
-test('`test nuget-app --file=project.assets.json`', function (t) {
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'pip');
+  t.same(plugin.inspect.getCall(0).args,
+    ['pipenv-app', 'Pipfile', {
+      args: null,
+      file: 'Pipfile',
+      org: null,
+      packageManager: 'pip',
+      path: 'pipenv-app',
+      showVulnPaths: true,
+    }], 'calls python plugin');
+});
+
+test('`test nuget-app --file=project.assets.json`', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -730,29 +980,28 @@ test('`test nuget-app --file=project.assets.json`', function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('nuget')
-  .returns(plugin);
+    .withArgs('nuget')
+    .returns(plugin);
 
-  return cli.test('nuget-app', {
+  await cli.test('nuget-app', {
     file: 'project.assets.json',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/nuget', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['nuget-app', 'project.assets.json', {
-        args: null,
-        file: 'project.assets.json',
-        org: null,
-        packageManager: 'nuget',
-        path: 'nuget-app',
-        showVulnPaths: true,
-      },], 'calls nuget plugin');
   });
-});
-
-test('`test nuget-app --file=packages.config`', function (t) {
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'nuget');
+  t.same(plugin.inspect.getCall(0).args,
+    ['nuget-app', 'project.assets.json', {
+      args: null,
+      file: 'project.assets.json',
+      org: null,
+      packageManager: 'nuget',
+      path: 'nuget-app',
+      showVulnPaths: true,
+    }], 'calls nuget plugin');
+});
+
+test('`test nuget-app --file=packages.config`', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -764,29 +1013,28 @@ test('`test nuget-app --file=packages.config`', function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('nuget')
-  .returns(plugin);
+    .withArgs('nuget')
+    .returns(plugin);
 
-  return cli.test('nuget-app', {
+  await cli.test('nuget-app', {
     file: 'packages.config',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/nuget', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['nuget-app', 'packages.config', {
-        args: null,
-        file: 'packages.config',
-        org: null,
-        packageManager: 'nuget',
-        path: 'nuget-app',
-        showVulnPaths: true,
-      },], 'calls nuget plugin');
   });
-});
-
-test('`test nuget-app --file=project.json`', function (t) {
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'nuget');
+  t.same(plugin.inspect.getCall(0).args,
+    ['nuget-app', 'packages.config', {
+      args: null,
+      file: 'packages.config',
+      org: null,
+      packageManager: 'nuget',
+      path: 'nuget-app',
+      showVulnPaths: true,
+    }], 'calls nuget plugin');
+});
+
+test('`test nuget-app --file=project.json`', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -798,30 +1046,28 @@ test('`test nuget-app --file=project.json`', function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('nuget')
-  .returns(plugin);
+    .withArgs('nuget')
+    .returns(plugin);
 
-  return cli.test('nuget-app', {
+  await cli.test('nuget-app', {
     file: 'project.json',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/nuget', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['nuget-app', 'project.json', {
-        args: null,
-        file: 'project.json',
-        org: null,
-        packageManager: 'nuget',
-        path: 'nuget-app',
-        showVulnPaths: true,
-      },], 'calls nuget plugin');
   });
-});
-
-test('`test golang-app --file=Gopkg.lock`',
-function (t) {
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'nuget');
+  t.same(plugin.inspect.getCall(0).args,
+    ['nuget-app', 'project.json', {
+      args: null,
+      file: 'project.json',
+      org: null,
+      packageManager: 'nuget',
+      path: 'nuget-app',
+      showVulnPaths: true,
+    }], 'calls nuget plugin');
+});
+
+test('`test golang-app --file=Gopkg.lock`', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -833,30 +1079,28 @@ function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('golangdep')
-  .returns(plugin);
+    .withArgs('golangdep')
+    .returns(plugin);
 
-  return cli.test('golang-app', {
+  await cli.test('golang-app', {
     file: 'Gopkg.lock',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/golangdep', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['golang-app', 'Gopkg.lock', {
-        args: null,
-        file: 'Gopkg.lock',
-        org: null,
-        packageManager: 'golangdep',
-        path: 'golang-app',
-        showVulnPaths: true,
-      },], 'calls golang plugin');
   });
-});
-
-test('`test golang-app --file=vendor/vendor.json`',
-function (t) {
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'golangdep');
+  t.same(plugin.inspect.getCall(0).args,
+    ['golang-app', 'Gopkg.lock', {
+      args: null,
+      file: 'Gopkg.lock',
+      org: null,
+      packageManager: 'golangdep',
+      path: 'golang-app',
+      showVulnPaths: true,
+    }], 'calls golang plugin');
+});
+
+test('`test golang-app --file=vendor/vendor.json`', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -868,30 +1112,28 @@ function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('govendor')
-  .returns(plugin);
+    .withArgs('govendor')
+    .returns(plugin);
 
-  return cli.test('golang-app', {
+  await cli.test('golang-app', {
     file: 'vendor/vendor.json',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/govendor', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['golang-app', 'vendor/vendor.json', {
-        args: null,
-        file: 'vendor/vendor.json',
-        org: null,
-        packageManager: 'govendor',
-        path: 'golang-app',
-        showVulnPaths: true,
-      },], 'calls golang plugin');
   });
-});
-
-test('`test golang-app` auto-detects golang/dep',
-function (t) {
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'govendor');
+  t.same(plugin.inspect.getCall(0).args,
+    ['golang-app', 'vendor/vendor.json', {
+      args: null,
+      file: 'vendor/vendor.json',
+      org: null,
+      packageManager: 'govendor',
+      path: 'golang-app',
+      showVulnPaths: true,
+    }], 'calls golang plugin');
+});
+
+test('`test golang-app` auto-detects golang/dep', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -903,28 +1145,26 @@ function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('golangdep')
-  .returns(plugin);
-
-  return cli.test('golang-app')
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/golangdep', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['golang-app', 'Gopkg.lock', {
-        args: null,
-        file: 'Gopkg.lock',
-        org: null,
-        packageManager: 'golangdep',
-        path: 'golang-app',
-        showVulnPaths: true,
-      },], 'calls golang plugin');
-  });
-});
+    .withArgs('golangdep')
+    .returns(plugin);
 
-test('`test golang-app-govendor` auto-detects govendor',
-function (t) {
+  await cli.test('golang-app');
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'golangdep');
+  t.same(plugin.inspect.getCall(0).args,
+    ['golang-app', 'Gopkg.lock', {
+      args: null,
+      file: 'Gopkg.lock',
+      org: null,
+      packageManager: 'golangdep',
+      path: 'golang-app',
+      showVulnPaths: true,
+    }], 'calls golang plugin');
+});
+
+test('`test golang-app-govendor` auto-detects govendor', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -936,28 +1176,26 @@ function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('govendor')
-  .returns(plugin);
-
-  return cli.test('golang-app-govendor')
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/govendor', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['golang-app-govendor', 'vendor/vendor.json', {
-        args: null,
-        file: 'vendor/vendor.json',
-        org: null,
-        packageManager: 'govendor',
-        path: 'golang-app-govendor',
-        showVulnPaths: true,
-      },], 'calls golang plugin');
-  });
-});
+    .withArgs('govendor')
+    .returns(plugin);
 
-test('`test composer-app --file=composer.lock`',
-function (t) {
+  await cli.test('golang-app-govendor');
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'govendor');
+  t.same(plugin.inspect.getCall(0).args,
+    ['golang-app-govendor', 'vendor/vendor.json', {
+      args: null,
+      file: 'vendor/vendor.json',
+      org: null,
+      packageManager: 'govendor',
+      path: 'golang-app-govendor',
+      showVulnPaths: true,
+    }], 'calls golang plugin');
+});
+
+test('`test composer-app --file=composer.lock`', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -969,62 +1207,28 @@ function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('composer')
-  .returns(plugin);
+    .withArgs('composer')
+    .returns(plugin);
 
-  return cli.test('composer-app', {
+  await cli.test('composer-app', {
     file: 'composer.lock',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/composer', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['composer-app', 'composer.lock', {
-        args: null,
-        file: 'composer.lock',
-        org: null,
-        packageManager: 'composer',
-        path: 'composer-app',
-        showVulnPaths: true,
-      },], 'calls composer plugin');
-  });
-});
-
-test('`test composer-app` auto-detects composer.lock', function (t) {
-  chdirWorkspaces();
-  var plugin = {
-    inspect: function () {
-      return Promise.resolve({package: {}});
-    },
-  };
-  sinon.spy(plugin, 'inspect');
-
-  sinon.stub(plugins, 'loadPlugin');
-  t.teardown(plugins.loadPlugin.restore);
-  plugins.loadPlugin
-  .withArgs('composer')
-  .returns(plugin);
-
-  return cli.test('composer-app')
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/composer', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['composer-app', 'composer.lock', {
-        args: null,
-        file: 'composer.lock',
-        org: null,
-        packageManager: 'composer',
-        path: 'composer-app',
-        showVulnPaths: true,
-      },], 'calls composer plugin');
   });
-});
-
-test('`test composer-app` auto-detects composer.lock',
-function (t) {
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'composer');
+  t.same(plugin.inspect.getCall(0).args,
+    ['composer-app', 'composer.lock', {
+      args: null,
+      file: 'composer.lock',
+      org: null,
+      packageManager: 'composer',
+      path: 'composer-app',
+      showVulnPaths: true,
+    }], 'calls composer plugin');
+});
+
+test('`test composer-app` auto-detects composer.lock', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -1036,28 +1240,26 @@ function (t) {
   sinon.stub(plugins, 'loadPlugin');
   t.teardown(plugins.loadPlugin.restore);
   plugins.loadPlugin
-  .withArgs('composer')
-  .returns(plugin);
-
-  return cli.test('composer-app')
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/composer', 'posts to correct url');
-    t.same(plugin.inspect.getCall(0).args,
-      ['composer-app', 'composer.lock', {
-        args: null,
-        file: 'composer.lock',
-        org: null,
-        packageManager: 'composer',
-        path: 'composer-app',
-        showVulnPaths: true,
-      },], 'calls composer plugin');
-  });
-});
+    .withArgs('composer')
+    .returns(plugin);
 
-test('`test composer-app golang-app nuget-app` auto-detects all three projects',
-function (t) {
+  await cli.test('composer-app');
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'composer');
+  t.same(plugin.inspect.getCall(0).args,
+    ['composer-app', 'composer.lock', {
+      args: null,
+      file: 'composer.lock',
+      org: null,
+      packageManager: 'composer',
+      path: 'composer-app',
+      showVulnPaths: true,
+    }], 'calls composer plugin');
+});
+
+test('`test composer-app golang-app nuget-app` auto-detects all three projects', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -1072,58 +1274,59 @@ function (t) {
   plugins.loadPlugin.withArgs('golangdep').returns(plugin);
   plugins.loadPlugin.withArgs('nuget').returns(plugin);
 
-  return cli.test('composer-app', 'golang-app', 'nuget-app', {org: 'test-org'})
-  .then(function () {
-    // assert three API calls made, each with a different url
-    var reqs = Array.from({length:3})
-      .map(function () { return server.popRequest(); });
-
-    t.same(reqs.map(function (r) { return r.method; }),
-      ['POST', 'POST', 'POST'], 'all post requests');
-
-    t.same(reqs.map(function (r) { return r.url; }).sort(), [
-      '/api/v1/vuln/composer?org=test-org',
-      '/api/v1/vuln/golangdep?org=test-org',
-      '/api/v1/vuln/nuget?org=test-org',
-    ], 'all urls are present');
-
-    // assert three plugin.inspect calls, each with a different app
-    var calls = plugin.inspect.getCalls().sort(function (call1, call2) {
-      return call1.args[0] < call2.args[1] ? -1 :
-              (call1.args[0] > call2.args[0] ? 1 : 0);
-    });
-    t.same(calls[0].args,
-      ['composer-app', 'composer.lock', {
-        args: null,
-        org: 'test-org',
-        file: 'composer.lock',
-        packageManager: 'composer',
-        path: 'composer-app',
-        showVulnPaths: true,
-      },], 'calls composer plugin');
-    t.same(calls[1].args,
-      ['golang-app', 'Gopkg.lock', {
-        args: null,
-        org: 'test-org',
-        file: 'Gopkg.lock',
-        packageManager: 'golangdep',
-        path: 'golang-app',
-        showVulnPaths: true,
-      },], 'calls golangdep plugin');
-    t.same(calls[2].args,
-      ['nuget-app', 'project.assets.json', {
-        args: null,
-        org: 'test-org',
-        file: 'project.assets.json',
-        packageManager: 'nuget',
-        path: 'nuget-app',
-        showVulnPaths: true,
-      },], 'calls nuget plugin');
-  });
-});
-
-test('`test foo:latest --docker`',
-function (t) {
+  await cli.test('composer-app', 'golang-app', 'nuget-app', {org: 'test-org'});
+  // assert three API calls made, each with a different url
+  var reqs = Array.from({length: 3})
+    .map(() => server.popRequest());
+
+  t.same(reqs.map((r) => r.method),
+    ['POST', 'POST', 'POST'], 'all post requests');
+
+  t.same(reqs.map((r) => r.url), [
+    '/api/v1/test-dep-graph?org=test-org',
+    '/api/v1/test-dep-graph?org=test-org',
+    '/api/v1/test-dep-graph?org=test-org',
+  ], 'all urls are present');
+
+  t.same(reqs.map((r) => r.body.depGraph.pkgManager.name).sort(),
+    ['composer', 'golangdep', 'nuget'],
+    'all urls are present');
+
+  // assert three plugin.inspect calls, each with a different app
+  var calls = plugin.inspect.getCalls().sort(function (call1, call2) {
+    return call1.args[0] < call2.args[1] ? -1 :
+      (call1.args[0] > call2.args[0] ? 1 : 0);
+  });
+  t.same(calls[0].args,
+    ['composer-app', 'composer.lock', {
+      args: null,
+      org: 'test-org',
+      file: 'composer.lock',
+      packageManager: 'composer',
+      path: 'composer-app',
+      showVulnPaths: true,
+    }], 'calls composer plugin');
+  t.same(calls[1].args,
+    ['golang-app', 'Gopkg.lock', {
+      args: null,
+      org: 'test-org',
+      file: 'Gopkg.lock',
+      packageManager: 'golangdep',
+      path: 'golang-app',
+      showVulnPaths: true,
+    }], 'calls golangdep plugin');
+  t.same(calls[2].args,
+    ['nuget-app', 'project.assets.json', {
+      args: null,
+      org: 'test-org',
+      file: 'project.assets.json',
+      packageManager: 'nuget',
+      path: 'nuget-app',
+      showVulnPaths: true,
+    }], 'calls nuget plugin');
+});
+
+test('`test foo:latest --docker`', async (t) => {
   var plugin = {
     inspect: function () {
       return Promise.resolve({
@@ -1141,37 +1344,49 @@ function (t) {
     .returns(plugin);
   t.teardown(plugins.loadPlugin.restore);
 
-  return cli.test('foo:latest', {
+  await cli.test('foo:latest', {
     docker: true,
     org: 'explicit-org',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/deb',
-      'posts to correct url (uses package manager from plugin response)');
-    t.same(plugin.inspect.getCall(0).args,
-      ['foo:latest', null, {
-        args: null,
-        file: null,
-        docker: true,
-        org: 'explicit-org',
-        packageManager: null,
-        path: 'foo:latest',
-        showVulnPaths: true,
-      }], 'calls docker plugin with expected arguments');
   });
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'deb');
+  t.same(plugin.inspect.getCall(0).args,
+    ['foo:latest', null, {
+      args: null,
+      file: null,
+      docker: true,
+      org: 'explicit-org',
+      packageManager: null,
+      path: 'foo:latest',
+      showVulnPaths: true,
+    }], 'calls docker plugin with expected arguments');
 });
 
-test('`test foo:latest --docker vulnerable paths`',
-function (t) {
-  var plugin = {
+test('`test foo:latest --docker vulnerable paths`', async (t) => {
+  const plugin = {
     inspect: function () {
       return Promise.resolve({
         plugin: {
           packageManager: 'deb',
         },
-        package: {},
+        package: {
+          name: 'docker-image',
+          dependencies: {
+            'apt/libapt-pkg5.0': {
+              version: '1.6.3ubuntu0.1',
+              dependencies: {
+                'bzip2/libbz2-1.0': {
+                  version: '1.0.6-8.1',
+                },
+              },
+            },
+            'bzip2/libbz2-1.0': {
+              version: '1.0.6-8.1',
+            },
+          },
+        },
       });
     },
   };
@@ -1182,22 +1397,26 @@ function (t) {
     .returns(plugin);
   t.teardown(plugins.loadPlugin.restore);
 
-  var vulns = require('./fixtures/docker/vulns.json');
+  const vulns = require('./fixtures/docker/find-result.json');
   server.setNextResponse(vulns);
 
-  return cli.test('foo:latest', {
-    docker: true,
-    org: 'explicit-org',
-  })
-  .catch(function (res) {
-    var req = server.popRequest();
-    t.false(res.message.includes('vulnerable paths'),
-     'docker should not includes number of vulnerable paths');
-  });
+  try {
+    await cli.test('foo:latest', {
+      docker: true,
+      org: 'explicit-org',
+    });
+    t.fail('should have found vuln');
+  } catch (err) {
+    const msg = err.message;
+    t.match(msg, 'Tested 2 dependencies for known vulnerabilities, found 1 vulnerability');
+    t.match(msg, 'From: bzip2/libbz2-1.0@1.0.6-8.1');
+    t.match(msg, 'From: apt/libapt-pkg5.0@1.6.3ubuntu0.1 > bzip2/libbz2-1.0@1.0.6-8.1');
+    t.false(msg.includes('vulnerable paths'),
+      'docker should not includes number of vulnerable paths');
+  }
 });
 
-test('`test foo:latest --docker --file=Dockerfile`',
-function (t) {
+test('`test foo:latest --docker --file=Dockerfile`', async (t) => {
   var plugin = {
     inspect: function () {
       return Promise.resolve({
@@ -1219,33 +1438,84 @@ function (t) {
     .returns(plugin);
   t.teardown(plugins.loadPlugin.restore);
 
-  return cli.test('foo:latest', {
+  await cli.test('foo:latest', {
     docker: true,
     org: 'explicit-org',
     file: 'Dockerfile',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/deb',
-      'posts to correct url (uses package manager from plugin response)');
-    t.equal(req.body.docker.baseImage, 'ubuntu:14.04',
-      'posts docker baseImage');
-    t.same(plugin.inspect.getCall(0).args,
-      ['foo:latest', 'Dockerfile', {
-        args: null,
-        file: 'Dockerfile',
-        docker: true,
-        org: 'explicit-org',
-        packageManager: null,
-        path: 'foo:latest',
-        showVulnPaths: true,
-      }], 'calls docker plugin with expected arguments');
   });
+
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'deb');
+  t.equal(req.body.docker.baseImage, 'ubuntu:14.04',
+    'posts docker baseImage');
+  t.same(plugin.inspect.getCall(0).args,
+    ['foo:latest', 'Dockerfile', {
+      args: null,
+      file: 'Dockerfile',
+      docker: true,
+      org: 'explicit-org',
+      packageManager: null,
+      path: 'foo:latest',
+      showVulnPaths: true,
+    }], 'calls docker plugin with expected arguments');
 });
 
-test('`test foo:latest --docker` doesnt collect policy from cwd',
-function (t) {
+test('`test foo:latest --docker --file=Dockerfile remediation advice`', async (t) => {
+  const plugin = {
+    inspect: function () {
+      return Promise.resolve({
+        plugin: {
+          packageManager: 'deb',
+        },
+        package: {
+          name: 'docker-image',
+          docker: {
+            baseImage: 'ubuntu:14.04',
+          },
+          dependencies: {
+            'apt/libapt-pkg5.0': {
+              version: '1.6.3ubuntu0.1',
+              dependencies: {
+                'bzip2/libbz2-1.0': {
+                  version: '1.0.6-8.1',
+                },
+              },
+            },
+            'bzip2/libbz2-1.0': {
+              version: '1.0.6-8.1',
+            },
+          },
+        },
+      });
+    },
+  };
+  sinon.spy(plugin, 'inspect');
+
+  sinon.stub(plugins, 'loadPlugin')
+    .withArgs(sinon.match.any, sinon.match({docker: true}))
+    .returns(plugin);
+  t.teardown(plugins.loadPlugin.restore);
+
+  const vulns = require('./fixtures/docker/find-result-remediation.json');
+  server.setNextResponse(vulns);
+
+  try {
+    await cli.test('foo:latest', {
+      docker: true,
+      org: 'explicit-org',
+      file: 'Dockerfile',
+    });
+    t.fail('should have found vuln');
+  } catch (err) {
+    const msg = err.message;
+    t.match(msg, 'Base Image');
+    t.match(msg, 'Recommendations for base image upgrade');
+  }
+});
+
+test('`test foo:latest --docker` doesnt collect policy from cwd', async (t) => {
   chdirWorkspaces('npm-package-policy');
   var plugin = {
     inspect: function () {
@@ -1264,32 +1534,29 @@ function (t) {
     .returns(plugin);
   t.teardown(plugins.loadPlugin.restore);
 
-  return cli.test('foo:latest', {
+  await cli.test('foo:latest', {
     docker: true,
     org: 'explicit-org',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/deb',
-      'posts to correct url (uses package manager from plugin response)');
-    t.same(plugin.inspect.getCall(0).args,
-      ['foo:latest', null, {
-        args: null,
-        file: null,
-        docker: true,
-        org: 'explicit-org',
-        packageManager: null,
-        path: 'foo:latest',
-        showVulnPaths: true,
-      }], 'calls docker plugin with expected arguments');
-    var policyString = req.body.policy;
-    t.false(policyString, 'policy not sent');
   });
+  var req = server.popRequest();
+  t.equal(req.method, 'POST', 'makes POST request');
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'deb');
+  t.same(plugin.inspect.getCall(0).args,
+    ['foo:latest', null, {
+      args: null,
+      file: null,
+      docker: true,
+      org: 'explicit-org',
+      packageManager: null,
+      path: 'foo:latest',
+      showVulnPaths: true,
+    }], 'calls docker plugin with expected arguments');
+  var policyString = req.body.policy;
+  t.false(policyString, 'policy not sent');
 });
 
-test('`test foo:latest --docker` supports custom policy',
-function (t) {
+test('`test foo:latest --docker` supports custom policy', async (t) => {
   chdirWorkspaces();
   var plugin = {
     inspect: function () {
@@ -1308,34 +1575,31 @@ function (t) {
     .returns(plugin);
   t.teardown(plugins.loadPlugin.restore);
 
-  return cli.test('foo:latest', {
+  await cli.test('foo:latest', {
     docker: true,
     org: 'explicit-org',
     'policy-path': 'npm-package-policy/custom-location',
-  })
-  .then(function () {
-    var req = server.popRequest();
-    t.equal(req.method, 'POST', 'makes POST request');
-    t.match(req.url, '/vuln/deb',
-      'posts to correct url (uses package manager from plugin response)');
-    t.same(plugin.inspect.getCall(0).args,
-      ['foo:latest', null, {
-        args: null,
-        file: null,
-        docker: true,
-        org: 'explicit-org',
-        packageManager: null,
-        path: 'foo:latest',
-        showVulnPaths: true,
-        'policy-path': 'npm-package-policy/custom-location',
-      }], 'calls docker plugin with expected arguments');
-
-    var expected = fs.readFileSync(
-      path.join('npm-package-policy/custom-location', '.snyk'),
-      'utf8');
-    var policyString = req.body.policy;
-    t.equal(policyString, expected, 'sends correct policy');
   });
+  var req = server.popRequest();
+  t.match(req.url, '/test-dep-graph', 'posts to correct url');
+  t.equal(req.body.depGraph.pkgManager.name, 'deb');
+  t.same(plugin.inspect.getCall(0).args,
+    ['foo:latest', null, {
+      args: null,
+      file: null,
+      docker: true,
+      org: 'explicit-org',
+      packageManager: null,
+      path: 'foo:latest',
+      showVulnPaths: true,
+      'policy-path': 'npm-package-policy/custom-location',
+    }], 'calls docker plugin with expected arguments');
+
+  var expected = fs.readFileSync(
+    path.join('npm-package-policy/custom-location', '.snyk'),
+    'utf8');
+  var policyString = req.body.policy;
+  t.equal(policyString, expected, 'sends correct policy');
 });
 
 test('`test --policy-path`', function (t) {
@@ -1445,6 +1709,52 @@ test('`test npm-package-with-git-url ` handles git url with patch policy', funct
     });
 });
 
+test('`test sbt-simple-struts`', async (t) => {
+  chdirWorkspaces();
+
+  const plugin = {
+    inspect: () => {
+      return Promise.resolve({
+        plugin: {},
+        package: require('./workspaces/sbt-simple-struts/dep-tree.json'),
+      });
+    },
+  };
+  sinon.stub(plugins, 'loadPlugin').returns(plugin);
+
+  t.teardown(() => {
+    plugins.loadPlugin.restore();
+  });
+
+  server.setNextResponse(
+    require('./workspaces/sbt-simple-struts/test-graph-result.json'));
+
+  try {
+    await cli.test('sbt-simple-struts', {json: true});
+
+    t.fail('should have thrown');
+
+  } catch (err) {
+    const res = JSON.parse(err.message);
+
+    const expected =
+      require('./workspaces/sbt-simple-struts/legacy-res-json.json');
+
+    t.deepEqual(
+      _.omit(res, ['vulnerabilities', 'packageManager']),
+      _.omit(expected, ['vulnerabilities', 'packageManager']),
+      'metadata is ok');
+    // NOTE: decided to keep this discrepancy
+    t.is(res.packageManager, 'sbt',
+      'pacakgeManager is sbt, altough it was mavn with the legacy api');
+    t.deepEqual(
+      _.sortBy(res.vulnerabilities, 'id'),
+      _.sortBy(expected.vulnerabilities, 'id'),
+      'vulns are the same');
+  }
+});
+
+
 /**
  * `monitor`
  */
diff --git a/test/acceptance/fake-server.js b/test/acceptance/fake-server.js
index 6242c5905a..e0e65f5c4b 100644
--- a/test/acceptance/fake-server.js
+++ b/test/acceptance/fake-server.js
@@ -70,33 +70,6 @@ module.exports = function (root, apikey) {
       });
       return next();
     }
-    if (req.query.org && req.query.org === 'org-with-vulns') {
-      vulnerabilities.push({
-        title: 'XML External Entity (XXE) Injection',
-        credit: [],
-        description: '',
-        moduleName: 'nokogiri',
-        language: 'ruby',
-        packageManager: 'rubygems',
-        semver: { unaffected: {}, vulnerable: {} },
-        identifiers: { CWE: [], CVE: [] },
-        CVSSv3: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L',
-        severity: 'high',
-        creationTime: '2017-01-12T12:37:00.000Z',
-        modificationTime: '2017-01-12T12:37:00.000Z',
-        publicationTime: '2017-01-16T21:00:00.000Z',
-        disclosureTime: '2017-01-11T21:00:00.000Z',
-        id: 'SNYK-RUBY-NOKOGIRI-20299',
-        packageName: 'nokogiri',
-        cvssScore: 7.3,
-        from: [ 'nokogiri@1.8.1' ],
-        upgradePath: [],
-        version: '1.8.1',
-        name: 'nokogiri',
-        isUpgradable: false,
-        isPatchable: false,
-      });
-    }
     res.send({
       vulnerabilities: vulnerabilities,
       org: 'test-org',
@@ -112,6 +85,29 @@ module.exports = function (root, apikey) {
     return next();
   });
 
+  server.post(root + '/test-dep-graph', function (req, res, next) {
+    if (req.query.org && req.query.org === 'missing-org') {
+      res.status(404);
+      res.send({
+        code: 404,
+        userMessage: 'cli error message',
+      });
+      return next();
+    }
+
+    res.send({
+      result: {
+        issuesData: {},
+        affectedPkgs: {},
+      },
+      meta: {
+        org: 'test-org',
+        isPublic: false,
+      },
+    });
+    return next();
+  });
+
   server.put(root + '/monitor/:registry', function (req, res, next) {
     res.send({
       id: 'test',
diff --git a/test/acceptance/fixtures/docker/find-result-remediation.json b/test/acceptance/fixtures/docker/find-result-remediation.json
new file mode 100644
index 0000000000..22f0ed556f
--- /dev/null
+++ b/test/acceptance/fixtures/docker/find-result-remediation.json
@@ -0,0 +1,141 @@
+{
+  "result": {
+    "docker": {
+      "baseImage": "ubuntu:14.04",
+      "baseImageRemediation": {
+        "code": "REMEDIATION_AVAILABLE",
+        "advice": [
+          {
+            "message": "Base Image    Vulnerabilities  Severity\nubuntu:14.04  34               6 high, 11 medium, 17 low\n"
+          },
+          {
+            "message": "Recommendations for base image upgrade:\n",
+            "bold": true
+          },
+          {
+            "message": "Base Image              Vulnerabilities  Severity\nubuntu:devel            0                0 high, 0 medium, 0 low\nubuntu:cosmic           0                0 high, 0 medium, 0 low\nubuntu:18.10            0                0 high, 0 medium, 0 low\nubuntu:rolling          0                0 high, 0 medium, 0 low\nubuntu:19.04            0                0 high, 0 medium, 0 low\nubuntu:disco            0                0 high, 0 medium, 0 low\nubuntu:disco-20181112   0                0 high, 0 medium, 0 low\nubuntu:cosmic-20181114  0                0 high, 0 medium, 0 low"
+          }
+        ]
+      }
+    },
+    "affectedPkgs": {
+      "bzip2/libbz2-1.0@1.0.6-8.1": {
+        "pkg": {
+          "version": "1.0.6-8.1",
+          "name": "bzip2/libbz2-1.0"
+        },
+        "issues": {
+          "SNYK-LINUX-BZIP2-106947": {
+            "issueId": "SNYK-LINUX-BZIP2-106947",
+            "fixInfo": {
+              "upgradePaths": [],
+              "isPatchable": false
+            }
+          }
+        }
+      }
+    },
+    "issuesData": {
+      "SNYK-LINUX-BZIP2-106947": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
+        "alternativeIds": [],
+        "creationTime": "2018-06-27T16:12:23.571063Z",
+        "credit": [
+          ""
+        ],
+        "cvssScore": 6.5,
+        "description": "## Overview\nUse-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.\n\n## References\n- [GENTOO](https://security.gentoo.org/glsa/201708-08)\n- [CONFIRM](https://bugzilla.redhat.com/show_bug.cgi?id=1319648)\n- [SECTRACK](http://www.securitytracker.com/id/1036132)\n- [BID](http://www.securityfocus.com/bid/91297)\n- [CONFIRM](http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html)\n- [MLIST](http://www.openwall.com/lists/oss-security/2016/06/20/1)\n",
+        "disclosureTime": null,
+        "id": "SNYK-LINUX-BZIP2-106947",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-3189"
+          ],
+          "CWE": []
+        },
+        "internal": {},
+        "language": "linux",
+        "modificationTime": "2018-10-22T04:31:58.564093Z",
+        "packageManager": "linux",
+        "packageName": "bzip2",
+        "patches": [],
+        "publicationTime": "2016-06-30T17:59:00Z",
+        "references": [
+          {
+            "title": "GENTOO",
+            "url": "https://security.gentoo.org/glsa/201708-08"
+          },
+          {
+            "title": "CONFIRM",
+            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1319648"
+          },
+          {
+            "title": "SECTRACK",
+            "url": "http://www.securitytracker.com/id/1036132"
+          },
+          {
+            "title": "BID",
+            "url": "http://www.securityfocus.com/bid/91297"
+          },
+          {
+            "title": "CONFIRM",
+            "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
+          },
+          {
+            "title": "MLIST",
+            "url": "http://www.openwall.com/lists/oss-security/2016/06/20/1"
+          }
+        ],
+        "semver": {
+          "vulnerableByDistro": {
+            "alpine:3.4": [
+              "<1.0.6-r5"
+            ],
+            "alpine:3.5": [
+              "<1.0.6-r5"
+            ],
+            "alpine:3.6": [
+              "<1.0.6-r5"
+            ],
+            "alpine:3.7": [
+              "<1.0.6-r5"
+            ],
+            "alpine:3.8": [
+              "<1.0.6-r5"
+            ],
+            "debian:10": [
+              "<1.0.6-8.1"
+            ],
+            "debian:8": [
+              "*"
+            ],
+            "debian:9": [
+              "<1.0.6-8.1"
+            ],
+            "debian:unstable": [
+              "<1.0.6-8.1"
+            ],
+            "ubuntu:12.04": [
+              "*"
+            ],
+            "ubuntu:14.04": [
+              "*"
+            ],
+            "ubuntu:16.04": [
+              "*"
+            ],
+            "ubuntu:18.04": [
+              "*"
+            ]
+          },
+          "vulnerable": [
+            "*"
+          ]
+        },
+        "severity": "low",
+        "title": "Denial of Service (DoS)"
+      }
+    }
+  },
+  "meta": {}
+}
diff --git a/test/acceptance/fixtures/docker/find-result.json b/test/acceptance/fixtures/docker/find-result.json
new file mode 100644
index 0000000000..8f1bf0c27f
--- /dev/null
+++ b/test/acceptance/fixtures/docker/find-result.json
@@ -0,0 +1,123 @@
+{
+    "result": {
+        "affectedPkgs": {
+            "bzip2/libbz2-1.0@1.0.6-8.1": {
+                "pkg": {
+                    "version": "1.0.6-8.1",
+                    "name": "bzip2/libbz2-1.0"
+                },
+                "issues": {
+                    "SNYK-LINUX-BZIP2-106947": {
+                        "issueId": "SNYK-LINUX-BZIP2-106947",
+                        "fixInfo": {
+                            "upgradePaths": [],
+                            "isPatchable": false
+                        }
+                    }
+                }
+            }
+        },
+        "issuesData": {
+            "SNYK-LINUX-BZIP2-106947": {
+                "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
+                "alternativeIds": [],
+                "creationTime": "2018-06-27T16:12:23.571063Z",
+                "credit": [
+                    ""
+                ],
+                "cvssScore": 6.5,
+                "description": "## Overview\nUse-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.\n\n## References\n- [GENTOO](https://security.gentoo.org/glsa/201708-08)\n- [CONFIRM](https://bugzilla.redhat.com/show_bug.cgi?id=1319648)\n- [SECTRACK](http://www.securitytracker.com/id/1036132)\n- [BID](http://www.securityfocus.com/bid/91297)\n- [CONFIRM](http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html)\n- [MLIST](http://www.openwall.com/lists/oss-security/2016/06/20/1)\n",
+                "disclosureTime": null,
+                "id": "SNYK-LINUX-BZIP2-106947",
+                "identifiers": {
+                    "CVE": [
+                        "CVE-2016-3189"
+                    ],
+                    "CWE": []
+                },
+                "internal": {},
+                "language": "linux",
+                "modificationTime": "2018-10-22T04:31:58.564093Z",
+                "packageManager": "linux",
+                "packageName": "bzip2",
+                "patches": [],
+                "publicationTime": "2016-06-30T17:59:00Z",
+                "references": [
+                    {
+                        "title": "GENTOO",
+                        "url": "https://security.gentoo.org/glsa/201708-08"
+                    },
+                    {
+                        "title": "CONFIRM",
+                        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1319648"
+                    },
+                    {
+                        "title": "SECTRACK",
+                        "url": "http://www.securitytracker.com/id/1036132"
+                    },
+                    {
+                        "title": "BID",
+                        "url": "http://www.securityfocus.com/bid/91297"
+                    },
+                    {
+                        "title": "CONFIRM",
+                        "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
+                    },
+                    {
+                        "title": "MLIST",
+                        "url": "http://www.openwall.com/lists/oss-security/2016/06/20/1"
+                    }
+                ],
+                "semver": {
+                    "vulnerableByDistro": {
+                        "alpine:3.4": [
+                            "<1.0.6-r5"
+                        ],
+                        "alpine:3.5": [
+                            "<1.0.6-r5"
+                        ],
+                        "alpine:3.6": [
+                            "<1.0.6-r5"
+                        ],
+                        "alpine:3.7": [
+                            "<1.0.6-r5"
+                        ],
+                        "alpine:3.8": [
+                            "<1.0.6-r5"
+                        ],
+                        "debian:10": [
+                            "<1.0.6-8.1"
+                        ],
+                        "debian:8": [
+                            "*"
+                        ],
+                        "debian:9": [
+                            "<1.0.6-8.1"
+                        ],
+                        "debian:unstable": [
+                            "<1.0.6-8.1"
+                        ],
+                        "ubuntu:12.04": [
+                            "*"
+                        ],
+                        "ubuntu:14.04": [
+                            "*"
+                        ],
+                        "ubuntu:16.04": [
+                            "*"
+                        ],
+                        "ubuntu:18.04": [
+                            "*"
+                        ]
+                    },
+                    "vulnerable": [
+                        "*"
+                    ]
+                },
+                "severity": "low",
+                "title": "Denial of Service (DoS)"
+            }
+        }
+    },
+    "meta": {}
+}
diff --git a/test/acceptance/fixtures/docker/vulns.json b/test/acceptance/fixtures/docker/vulns.json
deleted file mode 100644
index b3cd90932b..0000000000
--- a/test/acceptance/fixtures/docker/vulns.json
+++ /dev/null
@@ -1,139 +0,0 @@
-{
-  "ok": false,
-  "vulnerabilities": [
-    {
-        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
-        "alternativeIds": [],
-        "creationTime": "2018-06-27T16:12:23.571063Z",
-        "credit": [""],
-        "cvssScore": 6.5,
-        "description": "## Overview\nUse-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.\n\n## References\n- [GENTOO](https://security.gentoo.org/glsa/201708-08)\n- [CONFIRM](https://bugzilla.redhat.com/show_bug.cgi?id=1319648)\n- [SECTRACK](http://www.securitytracker.com/id/1036132)\n- [BID](http://www.securityfocus.com/bid/91297)\n- [CONFIRM](http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html)\n- [MLIST](http://www.openwall.com/lists/oss-security/2016/06/20/1)\n",
-        "disclosureTime": null,
-        "id": "SNYK-LINUX-BZIP2-106947",
-        "identifiers": {
-            "CVE": ["CVE-2016-3189"],
-            "CWE": []
-        },
-        "internal": {},
-        "language": "linux",
-        "modificationTime": "2018-10-22T04:31:58.564093Z",
-        "packageManager": "linux",
-        "packageName": "bzip2",
-        "patches": [],
-        "publicationTime": "2016-06-30T17:59:00Z",
-        "references": [{
-            "title": "GENTOO",
-            "url": "https://security.gentoo.org/glsa/201708-08"
-        }, {
-            "title": "CONFIRM",
-            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1319648"
-        }, {
-            "title": "SECTRACK",
-            "url": "http://www.securitytracker.com/id/1036132"
-        }, {
-            "title": "BID",
-            "url": "http://www.securityfocus.com/bid/91297"
-        }, {
-            "title": "CONFIRM",
-            "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
-        }, {
-            "title": "MLIST",
-            "url": "http://www.openwall.com/lists/oss-security/2016/06/20/1"
-        }],
-        "semver": {
-            "vulnerableByDistro": {
-                "alpine:3.4": ["<1.0.6-r5"],
-                "alpine:3.5": ["<1.0.6-r5"],
-                "alpine:3.6": ["<1.0.6-r5"],
-                "alpine:3.7": ["<1.0.6-r5"],
-                "alpine:3.8": ["<1.0.6-r5"],
-                "debian:10": ["<1.0.6-8.1"],
-                "debian:8": ["*"],
-                "debian:9": ["<1.0.6-8.1"],
-                "debian:unstable": ["<1.0.6-8.1"],
-                "ubuntu:12.04": ["*"],
-                "ubuntu:14.04": ["*"],
-                "ubuntu:16.04": ["*"],
-                "ubuntu:18.04": ["*"]
-            },
-            "vulnerable": ["*"]
-        },
-        "severity": "low",
-        "title": "Denial of Service (DoS)",
-        "from": ["ubuntu@18.04", "bzip2/libbz2-1.0@1.0.6-8.1"],
-        "upgradePath": [],
-        "version": "1.0.6-8.1",
-        "name": "bzip2/libbz2-1.0",
-        "isUpgradable": false,
-        "isPatchable": false
-    },
-    {
-    	"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
-    	"alternativeIds": [],
-    	"creationTime": "2018-06-27T16:12:23.571063Z",
-    	"credit": [""],
-    	"cvssScore": 6.5,
-    	"description": "## Overview\nUse-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.\n\n## References\n- [GENTOO](https://security.gentoo.org/glsa/201708-08)\n- [CONFIRM](https://bugzilla.redhat.com/show_bug.cgi?id=1319648)\n- [SECTRACK](http://www.securitytracker.com/id/1036132)\n- [BID](http://www.securityfocus.com/bid/91297)\n- [CONFIRM](http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html)\n- [MLIST](http://www.openwall.com/lists/oss-security/2016/06/20/1)\n",
-    	"disclosureTime": null,
-    	"id": "SNYK-LINUX-BZIP2-106947",
-    	"identifiers": {
-    		"CVE": ["CVE-2016-3189"],
-    		"CWE": []
-    	},
-    	"internal": {},
-    	"language": "linux",
-    	"modificationTime": "2018-10-22T04:31:58.564093Z",
-    	"packageManager": "linux",
-    	"packageName": "bzip2",
-    	"patches": [],
-    	"publicationTime": "2016-06-30T17:59:00Z",
-    	"references": [{
-    		"title": "GENTOO",
-    		"url": "https://security.gentoo.org/glsa/201708-08"
-    	}, {
-    		"title": "CONFIRM",
-    		"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1319648"
-    	}, {
-    		"title": "SECTRACK",
-    		"url": "http://www.securitytracker.com/id/1036132"
-    	}, {
-    		"title": "BID",
-    		"url": "http://www.securityfocus.com/bid/91297"
-    	}, {
-    		"title": "CONFIRM",
-    		"url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
-    	}, {
-    		"title": "MLIST",
-    		"url": "http://www.openwall.com/lists/oss-security/2016/06/20/1"
-    	}],
-    	"semver": {
-    		"vulnerableByDistro": {
-    			"alpine:3.4": ["<1.0.6-r5"],
-    			"alpine:3.5": ["<1.0.6-r5"],
-    			"alpine:3.6": ["<1.0.6-r5"],
-    			"alpine:3.7": ["<1.0.6-r5"],
-    			"alpine:3.8": ["<1.0.6-r5"],
-    			"debian:10": ["<1.0.6-8.1"],
-    			"debian:8": ["*"],
-    			"debian:9": ["<1.0.6-8.1"],
-    			"debian:unstable": ["<1.0.6-8.1"],
-    			"ubuntu:12.04": ["*"],
-    			"ubuntu:14.04": ["*"],
-    			"ubuntu:16.04": ["*"],
-    			"ubuntu:18.04": ["*"]
-    		},
-    		"vulnerable": ["*"]
-    	},
-    	"severity": "low",
-    	"title": "Denial of Service (DoS)",
-    	"from": ["ubuntu@18.04", "apt/libapt-pkg5.0@1.6.3ubuntu0.1", "bzip2/libbz2-1.0@1.0.6-8.1"],
-    	"upgradePath": [],
-    	"version": "1.0.6-8.1",
-    	"name": "bzip2/libbz2-1.0",
-    	"isUpgradable": false,
-    	"isPatchable": false
-    }
-
-
-  ]
-}
diff --git a/test/acceptance/workspaces/ruby-app-no-vulns/Gemfile b/test/acceptance/workspaces/ruby-app-no-vulns/Gemfile
new file mode 100644
index 0000000000..bb09d4f811
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-no-vulns/Gemfile
@@ -0,0 +1,4 @@
+source :rubygems
+
+gem "json"
+gem "xml-simple"
diff --git a/test/acceptance/workspaces/ruby-app-no-vulns/Gemfile.lock b/test/acceptance/workspaces/ruby-app-no-vulns/Gemfile.lock
new file mode 100644
index 0000000000..a27628ddb7
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-no-vulns/Gemfile.lock
@@ -0,0 +1,15 @@
+GEM
+  remote: http://rubygems.org/
+  specs:
+    json (2.0.2)
+    xml-simple (1.1.5)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  json
+  xml-simple
+
+BUNDLED WITH
+   1.17.1
diff --git a/test/acceptance/workspaces/ruby-app-no-vulns/legacy-res-json.json b/test/acceptance/workspaces/ruby-app-no-vulns/legacy-res-json.json
new file mode 100644
index 0000000000..5a7131084a
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-no-vulns/legacy-res-json.json
@@ -0,0 +1,15 @@
+{
+  "ok": true,
+  "vulnerabilities": [],
+  "dependencyCount": 2,
+  "org": "test-org",
+  "licensesPolicy": null,
+  "isPrivate": true,
+  "packageManager": "rubygems",
+  "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+  "ignoreSettings": null,
+  "summary": "No known vulnerabilities",
+  "filesystemPolicy": false,
+  "uniqueCount": 0,
+  "path": "ruby-app-no-vulns"
+}
diff --git a/test/acceptance/workspaces/ruby-app-no-vulns/test-graph-result.json b/test/acceptance/workspaces/ruby-app-no-vulns/test-graph-result.json
new file mode 100644
index 0000000000..bec90fad65
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-no-vulns/test-graph-result.json
@@ -0,0 +1,15 @@
+{
+  "result": {
+    "affectedPkgs": {},
+    "issuesData": {}
+  },
+  "meta": {
+    "isPublic": false,
+    "isLicensesEnabled": false,
+    "licensesPolicy": null,
+    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+    "ignoreSettings": null,
+    "org": "test-org"
+  },
+  "filesystemPolicy": false
+}
diff --git a/test/acceptance/workspaces/ruby-app-policy/.snyk b/test/acceptance/workspaces/ruby-app-policy/.snyk
new file mode 100644
index 0000000000..d9589ff213
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-policy/.snyk
@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.13.1
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  SNYK-RUBY-LYNX-20160:
+    - '*':
+        reason: will check again in 2100
+        expires: 2100-01-01T00:00:00.000Z
+patch: {}
diff --git a/test/acceptance/workspaces/ruby-app-policy/Gemfile b/test/acceptance/workspaces/ruby-app-policy/Gemfile
new file mode 100644
index 0000000000..88d27cc9f0
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-policy/Gemfile
@@ -0,0 +1,5 @@
+source :rubygems
+
+gem "sanitize", "4.6.2"
+gem "yard", "0.8.0"
+gem "lynx", "0.4.0"
diff --git a/test/acceptance/workspaces/ruby-app-policy/Gemfile.lock b/test/acceptance/workspaces/ruby-app-policy/Gemfile.lock
new file mode 100644
index 0000000000..1471006e88
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-policy/Gemfile.lock
@@ -0,0 +1,26 @@
+GEM
+  remote: http://rubygems.org/
+  specs:
+    crass (1.0.4)
+    lynx (0.4.0)
+    mini_portile2 (2.3.0)
+    nokogiri (1.8.5)
+      mini_portile2 (~> 2.3.0)
+    nokogumbo (1.5.0)
+      nokogiri
+    sanitize (4.6.2)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.4.4)
+      nokogumbo (~> 1.4)
+    yard (0.8.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  lynx (= 0.4.0)
+  sanitize (= 4.6.2)
+  yard (= 0.8.0)
+
+BUNDLED WITH
+   1.16.5
diff --git a/test/acceptance/workspaces/ruby-app-policy/legacy-res-json-cloud-ignore.json b/test/acceptance/workspaces/ruby-app-policy/legacy-res-json-cloud-ignore.json
new file mode 100644
index 0000000000..b0231b09bd
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-policy/legacy-res-json-cloud-ignore.json
@@ -0,0 +1,431 @@
+{
+  "ok": false,
+  "vulnerabilities": [
+    {
+      "CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2016-09-21T12:36:57Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 4,
+      "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable due to a flaw in `command/basic.rb` that exposes password information in plaintext in the process table. This may allow a local attacker to gain access to password information.\n\n## References\n- http://rubysec.com/advisories/CVE-2014-5002\n",
+      "disclosureTime": "2014-06-29T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-LYNX-20161",
+      "identifiers": {
+        "CVE": [
+          "CVE-2014-5002"
+        ],
+        "CWE": [
+          "CWE-200"
+        ],
+        "OSVDB": [
+          "OSVDB-108580"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:42.664828Z",
+      "moduleName": "lynx",
+      "packageManager": "rubygems",
+      "packageName": "lynx",
+      "patches": [],
+      "publicationTime": "2014-06-29T21:00:00Z",
+      "references": [
+        {
+          "title": "RUBYSEC.COM",
+          "url": "http://rubysec.com/advisories/CVE-2014-5002"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 0"
+        ]
+      },
+      "severity": "medium",
+      "title": "Local Plaintext Password Disclosure",
+      "from": [
+        "ruby-app-policy@*",
+        "lynx@0.4.0"
+      ],
+      "upgradePath": [],
+      "version": "0.4.0",
+      "name": "lynx",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-01-12T12:37:00Z",
+      "credit": [
+        "Snyk Security Research Team"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+      "disclosureTime": "2017-01-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-NOKOGIRI-20299",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-611"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-22T10:10:06.539065Z",
+      "moduleName": "nokogiri",
+      "packageManager": "rubygems",
+      "packageName": "nokogiri",
+      "patches": [],
+      "publicationTime": "2017-01-16T21:00:00Z",
+      "references": [
+        {
+          "title": "CVE-2016-9318",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+        },
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 1.5.4"
+        ]
+      },
+      "severity": "high",
+      "title": "XML External Entity (XXE) Injection",
+      "from": [
+        "ruby-app-policy@*",
+        "sanitize@4.6.2",
+        "nokogiri@1.8.5"
+      ],
+      "upgradePath": [],
+      "version": "1.8.5",
+      "name": "nokogiri",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-01-12T12:37:00Z",
+      "credit": [
+        "Snyk Security Research Team"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+      "disclosureTime": "2017-01-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-NOKOGIRI-20299",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-611"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-22T10:10:06.539065Z",
+      "moduleName": "nokogiri",
+      "packageManager": "rubygems",
+      "packageName": "nokogiri",
+      "patches": [],
+      "publicationTime": "2017-01-16T21:00:00Z",
+      "references": [
+        {
+          "title": "CVE-2016-9318",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+        },
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 1.5.4"
+        ]
+      },
+      "severity": "high",
+      "title": "XML External Entity (XXE) Injection",
+      "from": [
+        "ruby-app-policy@*",
+        "sanitize@4.6.2",
+        "nokogumbo@1.5.0",
+        "nokogiri@1.8.5"
+      ],
+      "upgradePath": [],
+      "version": "1.8.5",
+      "name": "nokogiri",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-05-04T11:52:51.329000Z",
+      "credit": [
+        "Loren Segal"
+      ],
+      "cvssScore": 3.1,
+      "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of the package are vulnerable to Cross-site Scripting (XSS). Strings parsed from the anchor in the address bar were not sanitized, allowing for arbitrary HTML to be embedded into the page.\n\n## Details\nCross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s browser to execute malicious JavaScript code in the context of a victim’s domain. Such scripts can steal the user’s session cookies for the domain, scrape or modify its content, and perform or modify actions on the user’s behalf, actions typically blocked by the browser’s Same Origin Policy.\n\nThese attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a \"new\" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like `<` `>` `\"` `'` are not escaped properly.\n\nThere are a few types of XSS:\n- **Persistent XSS** is an attack in which the malicious code persists into the web app’s database.\n- **Reflected XSS** is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.\n- **DOM-based XSS** is an that occurs purely in the browser when client-side JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is notoriously hard to detect, as the server never gets a chance to see the attack taking place.\n\n\nYou can read more about `Cross-site Scripting (XSS)` on our [blog](https://snyk.io/blog/xss-attacks-the-next-wave/).\n\n## Remediation\nUpgrade `yard` to version 0.8.7.1 or higher.\n\n## References\n- [Github Commit](https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802)\n",
+      "disclosureTime": "2013-09-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-YARD-20430",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-79"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:43.140701Z",
+      "moduleName": "yard",
+      "packageManager": "rubygems",
+      "packageName": "yard",
+      "patches": [],
+      "publicationTime": "2017-09-14T09:12:31.394000Z",
+      "references": [
+        {
+          "title": "Github Commit",
+          "url": "https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "<0.8.7.1, >=0.8.0"
+        ]
+      },
+      "severity": "low",
+      "title": "Cross-site Scripting (XSS)",
+      "from": [
+        "ruby-app-policy@*",
+        "yard@0.8.0"
+      ],
+      "upgradePath": [
+        false,
+        "yard@0.8.7.1"
+      ],
+      "version": "0.8.0",
+      "name": "yard",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-12-24T17:44:10.116000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 7.5,
+      "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of this package are vulnerable to Directory Traversal via the `lib/yard/core_ext/file.rb` method in the server. It does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [GitHub Commit](https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17042)\n",
+      "disclosureTime": "2017-11-23T17:44:10.116000Z",
+      "functions": [],
+      "id": "SNYK-RUBY-YARD-22004",
+      "identifiers": {
+        "CVE": [
+          "CVE-2017-17042"
+        ],
+        "CWE": [
+          "CWE-22"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:51.823161Z",
+      "moduleName": "yard",
+      "packageManager": "rubygems",
+      "packageName": "yard",
+      "patches": [],
+      "publicationTime": "2017-12-25T15:44:10.116000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17042"
+        },
+        {
+          "title": "GitHub Commit",
+          "url": "https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "< 0.9.11"
+        ]
+      },
+      "severity": "high",
+      "title": "Directory Traversal",
+      "from": [
+        "ruby-app-policy@*",
+        "yard@0.8.0"
+      ],
+      "upgradePath": [
+        false,
+        "yard@0.9.11"
+      ],
+      "version": "0.8.0",
+      "name": "yard",
+      "isUpgradable": true,
+      "isPatchable": false
+    }
+  ],
+  "dependencyCount": 7,
+  "org": "test-org",
+  "licensesPolicy": null,
+  "isPrivate": true,
+  "packageManager": "rubygems",
+  "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\n# ignores vulnerabilities until expiry date; change duration by modifying expiry date\nignore:\n  SNYK-RUBY-LYNX-20160:\n    - '*':\n        reason: will check again in 2100\n        expires: 2100-01-01T00:00:00.000Z\n        source: cli\n  SNYK-RUBY-SANITIZE-22024:\n    - '*':\n        reason: who needs sanitization anyway\n        created: '2018-11-23T07:33:16.687Z'\n        ignoredBy:\n          id: 3c2d7dd6-e86e-4842-8124-5766bf55e060\n          name: brian@doogdog.com\n          email: brian@doogdog.com\n        reasonType: temporary-ignore\n        disregardIfFixable: false\n        source: api\npatch: {}\n",
+  "ignoreSettings": null,
+  "summary": "7 vulnerable dependency paths",
+  "filesystemPolicy": true,
+  "filtered": {
+    "ignore": [
+      {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.6,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20160",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-77"
+          ],
+          "OSVDB": [
+            "OSVDB-108579"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.661168Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/OSVDB-108579"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Command Execution",
+        "from": [
+          "ruby-app-policy@*",
+          "lynx@0.4.0"
+        ],
+        "upgradePath": [],
+        "version": "0.4.0",
+        "name": "lynx",
+        "isUpgradable": false,
+        "isPatchable": false,
+        "filtered": {
+          "ignored": [
+            {
+              "reason": "will check again in 2100",
+              "expires": "2100-01-01T00:00:00.000Z",
+              "source": "cli",
+              "path": [
+                "*"
+              ]
+            }
+          ]
+        }
+      },
+      {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2018-03-20T04:43:57.565000Z",
+        "credit": [
+          "Shopify Application Security Team"
+        ],
+        "cvssScore": 6.5,
+        "description": "## Overview\n[sanitize](https://rubygems.org/gems/sanitize) is a whitelist-based HTML and CSS sanitizer.\n\nWhen used in combination with libxml2 versions >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.\n\n## Timeline\n* 2018-03-19: Reported by Shopify Application Security Team via email\n* 2018-03-19: Sanitize 4.6.3 released with a fix\n* 2018-03-19: Initial vulnerability report published\n\n## Remediation\nUpgrade `sanitize` to version 4.6.3 or higher.\n\n## References\n- [GitHub Issue](https://github.com/rgrove/sanitize/issues/176)\n",
+        "disclosureTime": "2018-03-19T04:43:57.565000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-SANITIZE-22024",
+        "identifiers": {
+          "CVE": [
+            "CVE-2018-3740"
+          ],
+          "CWE": [
+            "CWE-74"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.461685Z",
+        "moduleName": "sanitize",
+        "packageManager": "rubygems",
+        "packageName": "sanitize",
+        "patches": [],
+        "publicationTime": "2018-03-21T09:26:19.783000Z",
+        "references": [
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/rgrove/sanitize/issues/176"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "<4.6.3"
+          ]
+        },
+        "severity": "medium",
+        "title": "HTML Injection",
+        "from": [
+          "ruby-app-policy@*",
+          "sanitize@4.6.2"
+        ],
+        "upgradePath": [
+          false,
+          "sanitize@4.6.3"
+        ],
+        "version": "4.6.2",
+        "name": "sanitize",
+        "isUpgradable": true,
+        "isPatchable": false,
+        "filtered": {
+          "ignored": [
+            {
+              "reason": "who needs sanitization anyway",
+              "created": "2018-11-23T07:33:16.687Z",
+              "ignoredBy": {
+                "id": "3c2d7dd6-e86e-4842-8124-5766bf55e060",
+                "name": "brian@doogdog.com",
+                "email": "brian@doogdog.com"
+              },
+              "reasonType": "temporary-ignore",
+              "disregardIfFixable": false,
+              "source": "api",
+              "path": [
+                "*"
+              ]
+            }
+          ]
+        }
+      }
+    ],
+    "patch": []
+  },
+  "uniqueCount": 4,
+  "path": "ruby-app-policy"
+}
diff --git a/test/acceptance/workspaces/ruby-app-policy/legacy-res-json.json b/test/acceptance/workspaces/ruby-app-policy/legacy-res-json.json
new file mode 100644
index 0000000000..bb6c495f21
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-policy/legacy-res-json.json
@@ -0,0 +1,412 @@
+{
+  "ok": false,
+  "vulnerabilities": [
+    {
+      "CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2016-09-21T12:36:57Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 4,
+      "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable due to a flaw in `command/basic.rb` that exposes password information in plaintext in the process table. This may allow a local attacker to gain access to password information.\n\n## References\n- http://rubysec.com/advisories/CVE-2014-5002\n",
+      "disclosureTime": "2014-06-29T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-LYNX-20161",
+      "identifiers": {
+        "CVE": [
+          "CVE-2014-5002"
+        ],
+        "CWE": [
+          "CWE-200"
+        ],
+        "OSVDB": [
+          "OSVDB-108580"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:42.664828Z",
+      "moduleName": "lynx",
+      "packageManager": "rubygems",
+      "packageName": "lynx",
+      "patches": [],
+      "publicationTime": "2014-06-29T21:00:00Z",
+      "references": [
+        {
+          "title": "RUBYSEC.COM",
+          "url": "http://rubysec.com/advisories/CVE-2014-5002"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 0"
+        ]
+      },
+      "severity": "medium",
+      "title": "Local Plaintext Password Disclosure",
+      "from": [
+        "ruby-app-policy@*",
+        "lynx@0.4.0"
+      ],
+      "upgradePath": [],
+      "version": "0.4.0",
+      "name": "lynx",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-01-12T12:37:00Z",
+      "credit": [
+        "Snyk Security Research Team"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+      "disclosureTime": "2017-01-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-NOKOGIRI-20299",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-611"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-22T10:10:06.539065Z",
+      "moduleName": "nokogiri",
+      "packageManager": "rubygems",
+      "packageName": "nokogiri",
+      "patches": [],
+      "publicationTime": "2017-01-16T21:00:00Z",
+      "references": [
+        {
+          "title": "CVE-2016-9318",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+        },
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 1.5.4"
+        ]
+      },
+      "severity": "high",
+      "title": "XML External Entity (XXE) Injection",
+      "from": [
+        "ruby-app-policy@*",
+        "sanitize@4.6.2",
+        "nokogiri@1.8.5"
+      ],
+      "upgradePath": [],
+      "version": "1.8.5",
+      "name": "nokogiri",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-01-12T12:37:00Z",
+      "credit": [
+        "Snyk Security Research Team"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+      "disclosureTime": "2017-01-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-NOKOGIRI-20299",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-611"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-22T10:10:06.539065Z",
+      "moduleName": "nokogiri",
+      "packageManager": "rubygems",
+      "packageName": "nokogiri",
+      "patches": [],
+      "publicationTime": "2017-01-16T21:00:00Z",
+      "references": [
+        {
+          "title": "CVE-2016-9318",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+        },
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 1.5.4"
+        ]
+      },
+      "severity": "high",
+      "title": "XML External Entity (XXE) Injection",
+      "from": [
+        "ruby-app-policy@*",
+        "sanitize@4.6.2",
+        "nokogumbo@1.5.0",
+        "nokogiri@1.8.5"
+      ],
+      "upgradePath": [],
+      "version": "1.8.5",
+      "name": "nokogiri",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2018-03-20T04:43:57.565000Z",
+      "credit": [
+        "Shopify Application Security Team"
+      ],
+      "cvssScore": 6.5,
+      "description": "## Overview\n[sanitize](https://rubygems.org/gems/sanitize) is a whitelist-based HTML and CSS sanitizer.\n\nWhen used in combination with libxml2 versions >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.\n\n## Timeline\n* 2018-03-19: Reported by Shopify Application Security Team via email\n* 2018-03-19: Sanitize 4.6.3 released with a fix\n* 2018-03-19: Initial vulnerability report published\n\n## Remediation\nUpgrade `sanitize` to version 4.6.3 or higher.\n\n## References\n- [GitHub Issue](https://github.com/rgrove/sanitize/issues/176)\n",
+      "disclosureTime": "2018-03-19T04:43:57.565000Z",
+      "functions": [],
+      "id": "SNYK-RUBY-SANITIZE-22024",
+      "identifiers": {
+        "CVE": [
+          "CVE-2018-3740"
+        ],
+        "CWE": [
+          "CWE-74"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:43.461685Z",
+      "moduleName": "sanitize",
+      "packageManager": "rubygems",
+      "packageName": "sanitize",
+      "patches": [],
+      "publicationTime": "2018-03-21T09:26:19.783000Z",
+      "references": [
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/rgrove/sanitize/issues/176"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "<4.6.3"
+        ]
+      },
+      "severity": "medium",
+      "title": "HTML Injection",
+      "from": [
+        "ruby-app-policy@*",
+        "sanitize@4.6.2"
+      ],
+      "upgradePath": [
+        false,
+        "sanitize@4.6.3"
+      ],
+      "version": "4.6.2",
+      "name": "sanitize",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-05-04T11:52:51.329000Z",
+      "credit": [
+        "Loren Segal"
+      ],
+      "cvssScore": 3.1,
+      "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of the package are vulnerable to Cross-site Scripting (XSS). Strings parsed from the anchor in the address bar were not sanitized, allowing for arbitrary HTML to be embedded into the page.\n\n## Details\nCross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s browser to execute malicious JavaScript code in the context of a victim’s domain. Such scripts can steal the user’s session cookies for the domain, scrape or modify its content, and perform or modify actions on the user’s behalf, actions typically blocked by the browser’s Same Origin Policy.\n\nThese attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a \"new\" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like `<` `>` `\"` `'` are not escaped properly.\n\nThere are a few types of XSS:\n- **Persistent XSS** is an attack in which the malicious code persists into the web app’s database.\n- **Reflected XSS** is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.\n- **DOM-based XSS** is an that occurs purely in the browser when client-side JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is notoriously hard to detect, as the server never gets a chance to see the attack taking place.\n\n\nYou can read more about `Cross-site Scripting (XSS)` on our [blog](https://snyk.io/blog/xss-attacks-the-next-wave/).\n\n## Remediation\nUpgrade `yard` to version 0.8.7.1 or higher.\n\n## References\n- [Github Commit](https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802)\n",
+      "disclosureTime": "2013-09-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-YARD-20430",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-79"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:43.140701Z",
+      "moduleName": "yard",
+      "packageManager": "rubygems",
+      "packageName": "yard",
+      "patches": [],
+      "publicationTime": "2017-09-14T09:12:31.394000Z",
+      "references": [
+        {
+          "title": "Github Commit",
+          "url": "https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "<0.8.7.1, >=0.8.0"
+        ]
+      },
+      "severity": "low",
+      "title": "Cross-site Scripting (XSS)",
+      "from": [
+        "ruby-app-policy@*",
+        "yard@0.8.0"
+      ],
+      "upgradePath": [
+        false,
+        "yard@0.8.7.1"
+      ],
+      "version": "0.8.0",
+      "name": "yard",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-12-24T17:44:10.116000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 7.5,
+      "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of this package are vulnerable to Directory Traversal via the `lib/yard/core_ext/file.rb` method in the server. It does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [GitHub Commit](https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17042)\n",
+      "disclosureTime": "2017-11-23T17:44:10.116000Z",
+      "functions": [],
+      "id": "SNYK-RUBY-YARD-22004",
+      "identifiers": {
+        "CVE": [
+          "CVE-2017-17042"
+        ],
+        "CWE": [
+          "CWE-22"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:51.823161Z",
+      "moduleName": "yard",
+      "packageManager": "rubygems",
+      "packageName": "yard",
+      "patches": [],
+      "publicationTime": "2017-12-25T15:44:10.116000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17042"
+        },
+        {
+          "title": "GitHub Commit",
+          "url": "https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "< 0.9.11"
+        ]
+      },
+      "severity": "high",
+      "title": "Directory Traversal",
+      "from": [
+        "ruby-app-policy@*",
+        "yard@0.8.0"
+      ],
+      "upgradePath": [
+        false,
+        "yard@0.9.11"
+      ],
+      "version": "0.8.0",
+      "name": "yard",
+      "isUpgradable": true,
+      "isPatchable": false
+    }
+  ],
+  "dependencyCount": 7,
+  "org": "test-org",
+  "licensesPolicy": null,
+  "isPrivate": true,
+  "packageManager": "rubygems",
+  "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\n# ignores vulnerabilities until expiry date; change duration by modifying expiry date\nignore:\n  SNYK-RUBY-LYNX-20160:\n    - '*':\n        reason: will check again in 2100\n        expires: 2100-01-01T00:00:00.000Z\n        source: cli\npatch: {}\n",
+  "ignoreSettings": null,
+  "summary": "7 vulnerable dependency paths",
+  "filesystemPolicy": true,
+  "filtered": {
+    "ignore": [
+      {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.6,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20160",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-77"
+          ],
+          "OSVDB": [
+            "OSVDB-108579"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.661168Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/OSVDB-108579"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Command Execution",
+        "from": [
+          "ruby-app-policy@*",
+          "lynx@0.4.0"
+        ],
+        "upgradePath": [],
+        "version": "0.4.0",
+        "name": "lynx",
+        "isUpgradable": false,
+        "isPatchable": false,
+        "filtered": {
+          "ignored": [
+            {
+              "reason": "will check again in 2100",
+              "expires": "2100-01-01T00:00:00.000Z",
+              "source": "cli",
+              "path": [
+                "*"
+              ]
+            }
+          ]
+        }
+      }
+    ],
+    "patch": []
+  },
+  "uniqueCount": 5,
+  "path": "ruby-app-policy"
+}
diff --git a/test/acceptance/workspaces/ruby-app-policy/test-graph-result-cloud-ignore.json b/test/acceptance/workspaces/ruby-app-policy/test-graph-result-cloud-ignore.json
new file mode 100644
index 0000000000..72451e5d97
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-policy/test-graph-result-cloud-ignore.json
@@ -0,0 +1,393 @@
+{
+  "result": {
+    "affectedPkgs": {
+      "lynx@0.4.0": {
+        "pkg": {
+          "name": "lynx",
+          "version": "0.4.0"
+        },
+        "issues": {
+          "SNYK-RUBY-LYNX-20160": {
+            "issueId": "SNYK-RUBY-LYNX-20160",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          },
+          "SNYK-RUBY-LYNX-20161": {
+            "issueId": "SNYK-RUBY-LYNX-20161",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "nokogiri@1.8.5": {
+        "pkg": {
+          "name": "nokogiri",
+          "version": "1.8.5"
+        },
+        "issues": {
+          "SNYK-RUBY-NOKOGIRI-20299": {
+            "issueId": "SNYK-RUBY-NOKOGIRI-20299",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "sanitize@4.6.2": {
+        "pkg": {
+          "name": "sanitize",
+          "version": "4.6.2"
+        },
+        "issues": {
+          "SNYK-RUBY-SANITIZE-22024": {
+            "issueId": "SNYK-RUBY-SANITIZE-22024",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-policy",
+                      "version": null
+                    },
+                    {
+                      "name": "sanitize",
+                      "version": "4.6.2",
+                      "newVersion": "4.6.3"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "yard@0.8.0": {
+        "pkg": {
+          "name": "yard",
+          "version": "0.8.0"
+        },
+        "issues": {
+          "SNYK-RUBY-YARD-20430": {
+            "issueId": "SNYK-RUBY-YARD-20430",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-policy",
+                      "version": null
+                    },
+                    {
+                      "name": "yard",
+                      "version": "0.8.0",
+                      "newVersion": "0.8.7.1"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-RUBY-YARD-22004": {
+            "issueId": "SNYK-RUBY-YARD-22004",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-policy",
+                      "version": null
+                    },
+                    {
+                      "name": "yard",
+                      "version": "0.8.0",
+                      "newVersion": "0.9.11"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      }
+    },
+    "issuesData": {
+      "SNYK-RUBY-LYNX-20160": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.6,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20160",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-77"
+          ],
+          "OSVDB": [
+            "OSVDB-108579"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.661168Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/OSVDB-108579"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Command Execution"
+      },
+      "SNYK-RUBY-LYNX-20161": {
+        "CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 4,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable due to a flaw in `command/basic.rb` that exposes password information in plaintext in the process table. This may allow a local attacker to gain access to password information.\n\n## References\n- http://rubysec.com/advisories/CVE-2014-5002\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20161",
+        "identifiers": {
+          "CVE": [
+            "CVE-2014-5002"
+          ],
+          "CWE": [
+            "CWE-200"
+          ],
+          "OSVDB": [
+            "OSVDB-108580"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.664828Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/CVE-2014-5002"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "medium",
+        "title": "Local Plaintext Password Disclosure"
+      },
+      "SNYK-RUBY-NOKOGIRI-20299": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-01-12T12:37:00Z",
+        "credit": [
+          "Snyk Security Research Team"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+        "disclosureTime": "2017-01-11T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-NOKOGIRI-20299",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-611"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-22T10:10:06.539065Z",
+        "moduleName": "nokogiri",
+        "packageManager": "rubygems",
+        "packageName": "nokogiri",
+        "patches": [],
+        "publicationTime": "2017-01-16T21:00:00Z",
+        "references": [
+          {
+            "title": "CVE-2016-9318",
+            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+          },
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 1.5.4"
+          ]
+        },
+        "severity": "high",
+        "title": "XML External Entity (XXE) Injection"
+      },
+      "SNYK-RUBY-SANITIZE-22024": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2018-03-20T04:43:57.565000Z",
+        "credit": [
+          "Shopify Application Security Team"
+        ],
+        "cvssScore": 6.5,
+        "description": "## Overview\n[sanitize](https://rubygems.org/gems/sanitize) is a whitelist-based HTML and CSS sanitizer.\n\nWhen used in combination with libxml2 versions >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.\n\n## Timeline\n* 2018-03-19: Reported by Shopify Application Security Team via email\n* 2018-03-19: Sanitize 4.6.3 released with a fix\n* 2018-03-19: Initial vulnerability report published\n\n## Remediation\nUpgrade `sanitize` to version 4.6.3 or higher.\n\n## References\n- [GitHub Issue](https://github.com/rgrove/sanitize/issues/176)\n",
+        "disclosureTime": "2018-03-19T04:43:57.565000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-SANITIZE-22024",
+        "identifiers": {
+          "CVE": [
+            "CVE-2018-3740"
+          ],
+          "CWE": [
+            "CWE-74"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.461685Z",
+        "moduleName": "sanitize",
+        "packageManager": "rubygems",
+        "packageName": "sanitize",
+        "patches": [],
+        "publicationTime": "2018-03-21T09:26:19.783000Z",
+        "references": [
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/rgrove/sanitize/issues/176"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "<4.6.3"
+          ]
+        },
+        "severity": "medium",
+        "title": "HTML Injection"
+      },
+      "SNYK-RUBY-YARD-20430": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-05-04T11:52:51.329000Z",
+        "credit": [
+          "Loren Segal"
+        ],
+        "cvssScore": 3.1,
+        "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of the package are vulnerable to Cross-site Scripting (XSS). Strings parsed from the anchor in the address bar were not sanitized, allowing for arbitrary HTML to be embedded into the page.\n\n## Details\nCross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s browser to execute malicious JavaScript code in the context of a victim’s domain. Such scripts can steal the user’s session cookies for the domain, scrape or modify its content, and perform or modify actions on the user’s behalf, actions typically blocked by the browser’s Same Origin Policy.\n\nThese attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a \"new\" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like `<` `>` `\"` `'` are not escaped properly.\n\nThere are a few types of XSS:\n- **Persistent XSS** is an attack in which the malicious code persists into the web app’s database.\n- **Reflected XSS** is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.\n- **DOM-based XSS** is an that occurs purely in the browser when client-side JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is notoriously hard to detect, as the server never gets a chance to see the attack taking place.\n\n\nYou can read more about `Cross-site Scripting (XSS)` on our [blog](https://snyk.io/blog/xss-attacks-the-next-wave/).\n\n## Remediation\nUpgrade `yard` to version 0.8.7.1 or higher.\n\n## References\n- [Github Commit](https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802)\n",
+        "disclosureTime": "2013-09-11T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-YARD-20430",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-79"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.140701Z",
+        "moduleName": "yard",
+        "packageManager": "rubygems",
+        "packageName": "yard",
+        "patches": [],
+        "publicationTime": "2017-09-14T09:12:31.394000Z",
+        "references": [
+          {
+            "title": "Github Commit",
+            "url": "https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "<0.8.7.1, >=0.8.0"
+          ]
+        },
+        "severity": "low",
+        "title": "Cross-site Scripting (XSS)"
+      },
+      "SNYK-RUBY-YARD-22004": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-12-24T17:44:10.116000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 7.5,
+        "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of this package are vulnerable to Directory Traversal via the `lib/yard/core_ext/file.rb` method in the server. It does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [GitHub Commit](https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17042)\n",
+        "disclosureTime": "2017-11-23T17:44:10.116000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-YARD-22004",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-17042"
+          ],
+          "CWE": [
+            "CWE-22"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:51.823161Z",
+        "moduleName": "yard",
+        "packageManager": "rubygems",
+        "packageName": "yard",
+        "patches": [],
+        "publicationTime": "2017-12-25T15:44:10.116000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17042"
+          },
+          {
+            "title": "GitHub Commit",
+            "url": "https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "< 0.9.11"
+          ]
+        },
+        "severity": "high",
+        "title": "Directory Traversal"
+      }
+    }
+  },
+  "meta": {
+    "isPublic": false,
+    "isLicensesEnabled": false,
+    "licensesPolicy": null,
+    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\n# ignores vulnerabilities until expiry date; change duration by modifying expiry date\nignore:\n  SNYK-RUBY-LYNX-20160:\n    - '*':\n        reason: will check again in 2100\n        expires: 2100-01-01T00:00:00.000Z\n        source: cli\n  SNYK-RUBY-SANITIZE-22024:\n    - '*':\n        reason: who needs sanitization anyway\n        created: '2018-11-23T07:33:16.687Z'\n        ignoredBy:\n          id: 3c2d7dd6-e86e-4842-8124-5766bf55e060\n          name: brian@doogdog.com\n          email: brian@doogdog.com\n        reasonType: temporary-ignore\n        disregardIfFixable: false\n        source: api\npatch: {}\n",
+    "ignoreSettings": null,
+    "org": "test-org"
+  },
+  "filesystemPolicy": true
+}
diff --git a/test/acceptance/workspaces/ruby-app-policy/test-graph-result.json b/test/acceptance/workspaces/ruby-app-policy/test-graph-result.json
new file mode 100644
index 0000000000..36e16d5c92
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-policy/test-graph-result.json
@@ -0,0 +1,393 @@
+{
+  "result": {
+    "affectedPkgs": {
+      "lynx@0.4.0": {
+        "pkg": {
+          "name": "lynx",
+          "version": "0.4.0"
+        },
+        "issues": {
+          "SNYK-RUBY-LYNX-20160": {
+            "issueId": "SNYK-RUBY-LYNX-20160",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          },
+          "SNYK-RUBY-LYNX-20161": {
+            "issueId": "SNYK-RUBY-LYNX-20161",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "nokogiri@1.8.5": {
+        "pkg": {
+          "name": "nokogiri",
+          "version": "1.8.5"
+        },
+        "issues": {
+          "SNYK-RUBY-NOKOGIRI-20299": {
+            "issueId": "SNYK-RUBY-NOKOGIRI-20299",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "sanitize@4.6.2": {
+        "pkg": {
+          "name": "sanitize",
+          "version": "4.6.2"
+        },
+        "issues": {
+          "SNYK-RUBY-SANITIZE-22024": {
+            "issueId": "SNYK-RUBY-SANITIZE-22024",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-policy",
+                      "version": null
+                    },
+                    {
+                      "name": "sanitize",
+                      "version": "4.6.2",
+                      "newVersion": "4.6.3"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "yard@0.8.0": {
+        "pkg": {
+          "name": "yard",
+          "version": "0.8.0"
+        },
+        "issues": {
+          "SNYK-RUBY-YARD-20430": {
+            "issueId": "SNYK-RUBY-YARD-20430",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-policy",
+                      "version": null
+                    },
+                    {
+                      "name": "yard",
+                      "version": "0.8.0",
+                      "newVersion": "0.8.7.1"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-RUBY-YARD-22004": {
+            "issueId": "SNYK-RUBY-YARD-22004",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-policy",
+                      "version": null
+                    },
+                    {
+                      "name": "yard",
+                      "version": "0.8.0",
+                      "newVersion": "0.9.11"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      }
+    },
+    "issuesData": {
+      "SNYK-RUBY-LYNX-20160": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.6,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20160",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-77"
+          ],
+          "OSVDB": [
+            "OSVDB-108579"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.661168Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/OSVDB-108579"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Command Execution"
+      },
+      "SNYK-RUBY-LYNX-20161": {
+        "CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 4,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable due to a flaw in `command/basic.rb` that exposes password information in plaintext in the process table. This may allow a local attacker to gain access to password information.\n\n## References\n- http://rubysec.com/advisories/CVE-2014-5002\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20161",
+        "identifiers": {
+          "CVE": [
+            "CVE-2014-5002"
+          ],
+          "CWE": [
+            "CWE-200"
+          ],
+          "OSVDB": [
+            "OSVDB-108580"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.664828Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/CVE-2014-5002"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "medium",
+        "title": "Local Plaintext Password Disclosure"
+      },
+      "SNYK-RUBY-NOKOGIRI-20299": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-01-12T12:37:00Z",
+        "credit": [
+          "Snyk Security Research Team"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+        "disclosureTime": "2017-01-11T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-NOKOGIRI-20299",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-611"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-22T10:10:06.539065Z",
+        "moduleName": "nokogiri",
+        "packageManager": "rubygems",
+        "packageName": "nokogiri",
+        "patches": [],
+        "publicationTime": "2017-01-16T21:00:00Z",
+        "references": [
+          {
+            "title": "CVE-2016-9318",
+            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+          },
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 1.5.4"
+          ]
+        },
+        "severity": "high",
+        "title": "XML External Entity (XXE) Injection"
+      },
+      "SNYK-RUBY-SANITIZE-22024": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2018-03-20T04:43:57.565000Z",
+        "credit": [
+          "Shopify Application Security Team"
+        ],
+        "cvssScore": 6.5,
+        "description": "## Overview\n[sanitize](https://rubygems.org/gems/sanitize) is a whitelist-based HTML and CSS sanitizer.\n\nWhen used in combination with libxml2 versions >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.\n\n## Timeline\n* 2018-03-19: Reported by Shopify Application Security Team via email\n* 2018-03-19: Sanitize 4.6.3 released with a fix\n* 2018-03-19: Initial vulnerability report published\n\n## Remediation\nUpgrade `sanitize` to version 4.6.3 or higher.\n\n## References\n- [GitHub Issue](https://github.com/rgrove/sanitize/issues/176)\n",
+        "disclosureTime": "2018-03-19T04:43:57.565000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-SANITIZE-22024",
+        "identifiers": {
+          "CVE": [
+            "CVE-2018-3740"
+          ],
+          "CWE": [
+            "CWE-74"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.461685Z",
+        "moduleName": "sanitize",
+        "packageManager": "rubygems",
+        "packageName": "sanitize",
+        "patches": [],
+        "publicationTime": "2018-03-21T09:26:19.783000Z",
+        "references": [
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/rgrove/sanitize/issues/176"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "<4.6.3"
+          ]
+        },
+        "severity": "medium",
+        "title": "HTML Injection"
+      },
+      "SNYK-RUBY-YARD-20430": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-05-04T11:52:51.329000Z",
+        "credit": [
+          "Loren Segal"
+        ],
+        "cvssScore": 3.1,
+        "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of the package are vulnerable to Cross-site Scripting (XSS). Strings parsed from the anchor in the address bar were not sanitized, allowing for arbitrary HTML to be embedded into the page.\n\n## Details\nCross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s browser to execute malicious JavaScript code in the context of a victim’s domain. Such scripts can steal the user’s session cookies for the domain, scrape or modify its content, and perform or modify actions on the user’s behalf, actions typically blocked by the browser’s Same Origin Policy.\n\nThese attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a \"new\" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like `<` `>` `\"` `'` are not escaped properly.\n\nThere are a few types of XSS:\n- **Persistent XSS** is an attack in which the malicious code persists into the web app’s database.\n- **Reflected XSS** is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.\n- **DOM-based XSS** is an that occurs purely in the browser when client-side JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is notoriously hard to detect, as the server never gets a chance to see the attack taking place.\n\n\nYou can read more about `Cross-site Scripting (XSS)` on our [blog](https://snyk.io/blog/xss-attacks-the-next-wave/).\n\n## Remediation\nUpgrade `yard` to version 0.8.7.1 or higher.\n\n## References\n- [Github Commit](https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802)\n",
+        "disclosureTime": "2013-09-11T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-YARD-20430",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-79"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.140701Z",
+        "moduleName": "yard",
+        "packageManager": "rubygems",
+        "packageName": "yard",
+        "patches": [],
+        "publicationTime": "2017-09-14T09:12:31.394000Z",
+        "references": [
+          {
+            "title": "Github Commit",
+            "url": "https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "<0.8.7.1, >=0.8.0"
+          ]
+        },
+        "severity": "low",
+        "title": "Cross-site Scripting (XSS)"
+      },
+      "SNYK-RUBY-YARD-22004": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-12-24T17:44:10.116000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 7.5,
+        "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of this package are vulnerable to Directory Traversal via the `lib/yard/core_ext/file.rb` method in the server. It does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [GitHub Commit](https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17042)\n",
+        "disclosureTime": "2017-11-23T17:44:10.116000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-YARD-22004",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-17042"
+          ],
+          "CWE": [
+            "CWE-22"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:51.823161Z",
+        "moduleName": "yard",
+        "packageManager": "rubygems",
+        "packageName": "yard",
+        "patches": [],
+        "publicationTime": "2017-12-25T15:44:10.116000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17042"
+          },
+          {
+            "title": "GitHub Commit",
+            "url": "https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "< 0.9.11"
+          ]
+        },
+        "severity": "high",
+        "title": "Directory Traversal"
+      }
+    }
+  },
+  "meta": {
+    "isPublic": false,
+    "isLicensesEnabled": false,
+    "licensesPolicy": null,
+    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\n# ignores vulnerabilities until expiry date; change duration by modifying expiry date\nignore:\n  SNYK-RUBY-LYNX-20160:\n    - '*':\n        reason: will check again in 2100\n        expires: 2100-01-01T00:00:00.000Z\n        source: cli\npatch: {}\n",
+    "ignoreSettings": null,
+    "org": "test-org"
+  },
+  "filesystemPolicy": true
+}
diff --git a/test/acceptance/workspaces/ruby-app-thresholds/Gemfile b/test/acceptance/workspaces/ruby-app-thresholds/Gemfile
new file mode 100644
index 0000000000..88d27cc9f0
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-thresholds/Gemfile
@@ -0,0 +1,5 @@
+source :rubygems
+
+gem "sanitize", "4.6.2"
+gem "yard", "0.8.0"
+gem "lynx", "0.4.0"
diff --git a/test/acceptance/workspaces/ruby-app-thresholds/Gemfile.lock b/test/acceptance/workspaces/ruby-app-thresholds/Gemfile.lock
new file mode 100644
index 0000000000..1471006e88
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-thresholds/Gemfile.lock
@@ -0,0 +1,26 @@
+GEM
+  remote: http://rubygems.org/
+  specs:
+    crass (1.0.4)
+    lynx (0.4.0)
+    mini_portile2 (2.3.0)
+    nokogiri (1.8.5)
+      mini_portile2 (~> 2.3.0)
+    nokogumbo (1.5.0)
+      nokogiri
+    sanitize (4.6.2)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.4.4)
+      nokogumbo (~> 1.4)
+    yard (0.8.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  lynx (= 0.4.0)
+  sanitize (= 4.6.2)
+  yard (= 0.8.0)
+
+BUNDLED WITH
+   1.16.5
diff --git a/test/acceptance/workspaces/ruby-app-thresholds/legacy-res-json-high-severity.json b/test/acceptance/workspaces/ruby-app-thresholds/legacy-res-json-high-severity.json
new file mode 100644
index 0000000000..2529d5fdc1
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-thresholds/legacy-res-json-high-severity.json
@@ -0,0 +1,240 @@
+{
+  "ok": false,
+  "vulnerabilities": [
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2016-09-21T12:36:57Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 5.6,
+      "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+      "disclosureTime": "2014-06-29T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-LYNX-20160",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-77"
+        ],
+        "OSVDB": [
+          "OSVDB-108579"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:42.661168Z",
+      "moduleName": "lynx",
+      "packageManager": "rubygems",
+      "packageName": "lynx",
+      "patches": [],
+      "publicationTime": "2014-06-29T21:00:00Z",
+      "references": [
+        {
+          "title": "RUBYSEC.COM",
+          "url": "http://rubysec.com/advisories/OSVDB-108579"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 0"
+        ]
+      },
+      "severity": "high",
+      "title": "Arbitrary Command Execution",
+      "from": [
+        "ruby-app-thresholds@*",
+        "lynx@0.4.0"
+      ],
+      "upgradePath": [],
+      "version": "0.4.0",
+      "name": "lynx",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-01-12T12:37:00Z",
+      "credit": [
+        "Snyk Security Research Team"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+      "disclosureTime": "2017-01-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-NOKOGIRI-20299",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-611"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-21T10:10:04.153595Z",
+      "moduleName": "nokogiri",
+      "packageManager": "rubygems",
+      "packageName": "nokogiri",
+      "patches": [],
+      "publicationTime": "2017-01-16T21:00:00Z",
+      "references": [
+        {
+          "title": "CVE-2016-9318",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+        },
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 1.5.4"
+        ]
+      },
+      "severity": "high",
+      "title": "XML External Entity (XXE) Injection",
+      "from": [
+        "ruby-app-thresholds@*",
+        "sanitize@4.6.2",
+        "nokogiri@1.8.5"
+      ],
+      "upgradePath": [],
+      "version": "1.8.5",
+      "name": "nokogiri",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-01-12T12:37:00Z",
+      "credit": [
+        "Snyk Security Research Team"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+      "disclosureTime": "2017-01-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-NOKOGIRI-20299",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-611"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-21T10:10:04.153595Z",
+      "moduleName": "nokogiri",
+      "packageManager": "rubygems",
+      "packageName": "nokogiri",
+      "patches": [],
+      "publicationTime": "2017-01-16T21:00:00Z",
+      "references": [
+        {
+          "title": "CVE-2016-9318",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+        },
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 1.5.4"
+        ]
+      },
+      "severity": "high",
+      "title": "XML External Entity (XXE) Injection",
+      "from": [
+        "ruby-app-thresholds@*",
+        "sanitize@4.6.2",
+        "nokogumbo@1.5.0",
+        "nokogiri@1.8.5"
+      ],
+      "upgradePath": [],
+      "version": "1.8.5",
+      "name": "nokogiri",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-12-24T17:44:10.116000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 7.5,
+      "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of this package are vulnerable to Directory Traversal via the `lib/yard/core_ext/file.rb` method in the server. It does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [GitHub Commit](https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17042)\n",
+      "disclosureTime": "2017-11-23T17:44:10.116000Z",
+      "functions": [],
+      "id": "SNYK-RUBY-YARD-22004",
+      "identifiers": {
+        "CVE": [
+          "CVE-2017-17042"
+        ],
+        "CWE": [
+          "CWE-22"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:51.823161Z",
+      "moduleName": "yard",
+      "packageManager": "rubygems",
+      "packageName": "yard",
+      "patches": [],
+      "publicationTime": "2017-12-25T15:44:10.116000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17042"
+        },
+        {
+          "title": "GitHub Commit",
+          "url": "https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "< 0.9.11"
+        ]
+      },
+      "severity": "high",
+      "title": "Directory Traversal",
+      "from": [
+        "ruby-app-thresholds@*",
+        "yard@0.8.0"
+      ],
+      "upgradePath": [
+        false,
+        "yard@0.9.11"
+      ],
+      "version": "0.8.0",
+      "name": "yard",
+      "isUpgradable": true,
+      "isPatchable": false
+    }
+  ],
+  "dependencyCount": 7,
+  "org": "test-org",
+  "licensesPolicy": null,
+  "isPrivate": true,
+  "packageManager": "rubygems",
+  "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+  "ignoreSettings": null,
+  "severityThreshold": "high",
+  "summary": "4 high severity vulnerable dependency paths",
+  "filesystemPolicy": false,
+  "filtered": {
+    "ignore": [],
+    "patch": []
+  },
+  "uniqueCount": 3,
+  "path": "ruby-app-thresholds"
+}
diff --git a/test/acceptance/workspaces/ruby-app-thresholds/legacy-res-json-low-severity.json b/test/acceptance/workspaces/ruby-app-thresholds/legacy-res-json-low-severity.json
new file mode 100644
index 0000000000..8231f82176
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-thresholds/legacy-res-json-low-severity.json
@@ -0,0 +1,399 @@
+{
+  "ok": false,
+  "vulnerabilities": [
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2016-09-21T12:36:57Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 5.6,
+      "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+      "disclosureTime": "2014-06-29T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-LYNX-20160",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-77"
+        ],
+        "OSVDB": [
+          "OSVDB-108579"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:42.661168Z",
+      "moduleName": "lynx",
+      "packageManager": "rubygems",
+      "packageName": "lynx",
+      "patches": [],
+      "publicationTime": "2014-06-29T21:00:00Z",
+      "references": [
+        {
+          "title": "RUBYSEC.COM",
+          "url": "http://rubysec.com/advisories/OSVDB-108579"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 0"
+        ]
+      },
+      "severity": "high",
+      "title": "Arbitrary Command Execution",
+      "from": [
+        "ruby-app-thresholds@*",
+        "lynx@0.4.0"
+      ],
+      "upgradePath": [],
+      "version": "0.4.0",
+      "name": "lynx",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2016-09-21T12:36:57Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 4,
+      "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable due to a flaw in `command/basic.rb` that exposes password information in plaintext in the process table. This may allow a local attacker to gain access to password information.\n\n## References\n- http://rubysec.com/advisories/CVE-2014-5002\n",
+      "disclosureTime": "2014-06-29T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-LYNX-20161",
+      "identifiers": {
+        "CVE": [
+          "CVE-2014-5002"
+        ],
+        "CWE": [
+          "CWE-200"
+        ],
+        "OSVDB": [
+          "OSVDB-108580"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:42.664828Z",
+      "moduleName": "lynx",
+      "packageManager": "rubygems",
+      "packageName": "lynx",
+      "patches": [],
+      "publicationTime": "2014-06-29T21:00:00Z",
+      "references": [
+        {
+          "title": "RUBYSEC.COM",
+          "url": "http://rubysec.com/advisories/CVE-2014-5002"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 0"
+        ]
+      },
+      "severity": "medium",
+      "title": "Local Plaintext Password Disclosure",
+      "from": [
+        "ruby-app-thresholds@*",
+        "lynx@0.4.0"
+      ],
+      "upgradePath": [],
+      "version": "0.4.0",
+      "name": "lynx",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-01-12T12:37:00Z",
+      "credit": [
+        "Snyk Security Research Team"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+      "disclosureTime": "2017-01-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-NOKOGIRI-20299",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-611"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-22T10:10:06.539065Z",
+      "moduleName": "nokogiri",
+      "packageManager": "rubygems",
+      "packageName": "nokogiri",
+      "patches": [],
+      "publicationTime": "2017-01-16T21:00:00Z",
+      "references": [
+        {
+          "title": "CVE-2016-9318",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+        },
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 1.5.4"
+        ]
+      },
+      "severity": "high",
+      "title": "XML External Entity (XXE) Injection",
+      "from": [
+        "ruby-app-thresholds@*",
+        "sanitize@4.6.2",
+        "nokogiri@1.8.5"
+      ],
+      "upgradePath": [],
+      "version": "1.8.5",
+      "name": "nokogiri",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-01-12T12:37:00Z",
+      "credit": [
+        "Snyk Security Research Team"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+      "disclosureTime": "2017-01-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-NOKOGIRI-20299",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-611"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-22T10:10:06.539065Z",
+      "moduleName": "nokogiri",
+      "packageManager": "rubygems",
+      "packageName": "nokogiri",
+      "patches": [],
+      "publicationTime": "2017-01-16T21:00:00Z",
+      "references": [
+        {
+          "title": "CVE-2016-9318",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+        },
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 1.5.4"
+        ]
+      },
+      "severity": "high",
+      "title": "XML External Entity (XXE) Injection",
+      "from": [
+        "ruby-app-thresholds@*",
+        "sanitize@4.6.2",
+        "nokogumbo@1.5.0",
+        "nokogiri@1.8.5"
+      ],
+      "upgradePath": [],
+      "version": "1.8.5",
+      "name": "nokogiri",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2018-03-20T04:43:57.565000Z",
+      "credit": [
+        "Shopify Application Security Team"
+      ],
+      "cvssScore": 6.5,
+      "description": "## Overview\n[sanitize](https://rubygems.org/gems/sanitize) is a whitelist-based HTML and CSS sanitizer.\n\nWhen used in combination with libxml2 versions >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.\n\n## Timeline\n* 2018-03-19: Reported by Shopify Application Security Team via email\n* 2018-03-19: Sanitize 4.6.3 released with a fix\n* 2018-03-19: Initial vulnerability report published\n\n## Remediation\nUpgrade `sanitize` to version 4.6.3 or higher.\n\n## References\n- [GitHub Issue](https://github.com/rgrove/sanitize/issues/176)\n",
+      "disclosureTime": "2018-03-19T04:43:57.565000Z",
+      "functions": [],
+      "id": "SNYK-RUBY-SANITIZE-22024",
+      "identifiers": {
+        "CVE": [
+          "CVE-2018-3740"
+        ],
+        "CWE": [
+          "CWE-74"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:43.461685Z",
+      "moduleName": "sanitize",
+      "packageManager": "rubygems",
+      "packageName": "sanitize",
+      "patches": [],
+      "publicationTime": "2018-03-21T09:26:19.783000Z",
+      "references": [
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/rgrove/sanitize/issues/176"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "<4.6.3"
+        ]
+      },
+      "severity": "medium",
+      "title": "HTML Injection",
+      "from": [
+        "ruby-app-thresholds@*",
+        "sanitize@4.6.2"
+      ],
+      "upgradePath": [
+        false,
+        "sanitize@4.6.3"
+      ],
+      "version": "4.6.2",
+      "name": "sanitize",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-05-04T11:52:51.329000Z",
+      "credit": [
+        "Loren Segal"
+      ],
+      "cvssScore": 3.1,
+      "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of the package are vulnerable to Cross-site Scripting (XSS). Strings parsed from the anchor in the address bar were not sanitized, allowing for arbitrary HTML to be embedded into the page.\n\n## Details\nCross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s browser to execute malicious JavaScript code in the context of a victim’s domain. Such scripts can steal the user’s session cookies for the domain, scrape or modify its content, and perform or modify actions on the user’s behalf, actions typically blocked by the browser’s Same Origin Policy.\n\nThese attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a \"new\" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like `<` `>` `\"` `'` are not escaped properly.\n\nThere are a few types of XSS:\n- **Persistent XSS** is an attack in which the malicious code persists into the web app’s database.\n- **Reflected XSS** is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.\n- **DOM-based XSS** is an that occurs purely in the browser when client-side JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is notoriously hard to detect, as the server never gets a chance to see the attack taking place.\n\n\nYou can read more about `Cross-site Scripting (XSS)` on our [blog](https://snyk.io/blog/xss-attacks-the-next-wave/).\n\n## Remediation\nUpgrade `yard` to version 0.8.7.1 or higher.\n\n## References\n- [Github Commit](https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802)\n",
+      "disclosureTime": "2013-09-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-YARD-20430",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-79"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:43.140701Z",
+      "moduleName": "yard",
+      "packageManager": "rubygems",
+      "packageName": "yard",
+      "patches": [],
+      "publicationTime": "2017-09-14T09:12:31.394000Z",
+      "references": [
+        {
+          "title": "Github Commit",
+          "url": "https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "<0.8.7.1, >=0.8.0"
+        ]
+      },
+      "severity": "low",
+      "title": "Cross-site Scripting (XSS)",
+      "from": [
+        "ruby-app-thresholds@*",
+        "yard@0.8.0"
+      ],
+      "upgradePath": [
+        false,
+        "yard@0.8.7.1"
+      ],
+      "version": "0.8.0",
+      "name": "yard",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-12-24T17:44:10.116000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 7.5,
+      "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of this package are vulnerable to Directory Traversal via the `lib/yard/core_ext/file.rb` method in the server. It does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [GitHub Commit](https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17042)\n",
+      "disclosureTime": "2017-11-23T17:44:10.116000Z",
+      "functions": [],
+      "id": "SNYK-RUBY-YARD-22004",
+      "identifiers": {
+        "CVE": [
+          "CVE-2017-17042"
+        ],
+        "CWE": [
+          "CWE-22"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:51.823161Z",
+      "moduleName": "yard",
+      "packageManager": "rubygems",
+      "packageName": "yard",
+      "patches": [],
+      "publicationTime": "2017-12-25T15:44:10.116000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17042"
+        },
+        {
+          "title": "GitHub Commit",
+          "url": "https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "< 0.9.11"
+        ]
+      },
+      "severity": "high",
+      "title": "Directory Traversal",
+      "from": [
+        "ruby-app-thresholds@*",
+        "yard@0.8.0"
+      ],
+      "upgradePath": [
+        false,
+        "yard@0.9.11"
+      ],
+      "version": "0.8.0",
+      "name": "yard",
+      "isUpgradable": true,
+      "isPatchable": false
+    }
+  ],
+  "dependencyCount": 7,
+  "org": "test-org",
+  "licensesPolicy": null,
+  "isPrivate": true,
+  "packageManager": "rubygems",
+  "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+  "ignoreSettings": null,
+  "summary": "7 vulnerable dependency paths",
+  "filesystemPolicy": false,
+  "filtered": {
+    "ignore": [],
+    "patch": []
+  },
+  "uniqueCount": 6,
+  "path": "ruby-app-thresholds"
+}
diff --git a/test/acceptance/workspaces/ruby-app-thresholds/legacy-res-json-medium-severity.json b/test/acceptance/workspaces/ruby-app-thresholds/legacy-res-json-medium-severity.json
new file mode 100644
index 0000000000..2db4950782
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-thresholds/legacy-res-json-medium-severity.json
@@ -0,0 +1,348 @@
+{
+  "ok": false,
+  "vulnerabilities": [
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2016-09-21T12:36:57Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 5.6,
+      "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+      "disclosureTime": "2014-06-29T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-LYNX-20160",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-77"
+        ],
+        "OSVDB": [
+          "OSVDB-108579"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:42.661168Z",
+      "moduleName": "lynx",
+      "packageManager": "rubygems",
+      "packageName": "lynx",
+      "patches": [],
+      "publicationTime": "2014-06-29T21:00:00Z",
+      "references": [
+        {
+          "title": "RUBYSEC.COM",
+          "url": "http://rubysec.com/advisories/OSVDB-108579"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 0"
+        ]
+      },
+      "severity": "high",
+      "title": "Arbitrary Command Execution",
+      "from": [
+        "ruby-app-thresholds@*",
+        "lynx@0.4.0"
+      ],
+      "upgradePath": [],
+      "version": "0.4.0",
+      "name": "lynx",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2016-09-21T12:36:57Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 4,
+      "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable due to a flaw in `command/basic.rb` that exposes password information in plaintext in the process table. This may allow a local attacker to gain access to password information.\n\n## References\n- http://rubysec.com/advisories/CVE-2014-5002\n",
+      "disclosureTime": "2014-06-29T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-LYNX-20161",
+      "identifiers": {
+        "CVE": [
+          "CVE-2014-5002"
+        ],
+        "CWE": [
+          "CWE-200"
+        ],
+        "OSVDB": [
+          "OSVDB-108580"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:42.664828Z",
+      "moduleName": "lynx",
+      "packageManager": "rubygems",
+      "packageName": "lynx",
+      "patches": [],
+      "publicationTime": "2014-06-29T21:00:00Z",
+      "references": [
+        {
+          "title": "RUBYSEC.COM",
+          "url": "http://rubysec.com/advisories/CVE-2014-5002"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 0"
+        ]
+      },
+      "severity": "medium",
+      "title": "Local Plaintext Password Disclosure",
+      "from": [
+        "ruby-app-thresholds@*",
+        "lynx@0.4.0"
+      ],
+      "upgradePath": [],
+      "version": "0.4.0",
+      "name": "lynx",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-01-12T12:37:00Z",
+      "credit": [
+        "Snyk Security Research Team"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+      "disclosureTime": "2017-01-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-NOKOGIRI-20299",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-611"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-22T10:10:06.539065Z",
+      "moduleName": "nokogiri",
+      "packageManager": "rubygems",
+      "packageName": "nokogiri",
+      "patches": [],
+      "publicationTime": "2017-01-16T21:00:00Z",
+      "references": [
+        {
+          "title": "CVE-2016-9318",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+        },
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 1.5.4"
+        ]
+      },
+      "severity": "high",
+      "title": "XML External Entity (XXE) Injection",
+      "from": [
+        "ruby-app-thresholds@*",
+        "sanitize@4.6.2",
+        "nokogiri@1.8.5"
+      ],
+      "upgradePath": [],
+      "version": "1.8.5",
+      "name": "nokogiri",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-01-12T12:37:00Z",
+      "credit": [
+        "Snyk Security Research Team"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+      "disclosureTime": "2017-01-11T21:00:00Z",
+      "functions": [],
+      "id": "SNYK-RUBY-NOKOGIRI-20299",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-611"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-22T10:10:06.539065Z",
+      "moduleName": "nokogiri",
+      "packageManager": "rubygems",
+      "packageName": "nokogiri",
+      "patches": [],
+      "publicationTime": "2017-01-16T21:00:00Z",
+      "references": [
+        {
+          "title": "CVE-2016-9318",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+        },
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          ">= 1.5.4"
+        ]
+      },
+      "severity": "high",
+      "title": "XML External Entity (XXE) Injection",
+      "from": [
+        "ruby-app-thresholds@*",
+        "sanitize@4.6.2",
+        "nokogumbo@1.5.0",
+        "nokogiri@1.8.5"
+      ],
+      "upgradePath": [],
+      "version": "1.8.5",
+      "name": "nokogiri",
+      "isUpgradable": false,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2018-03-20T04:43:57.565000Z",
+      "credit": [
+        "Shopify Application Security Team"
+      ],
+      "cvssScore": 6.5,
+      "description": "## Overview\n[sanitize](https://rubygems.org/gems/sanitize) is a whitelist-based HTML and CSS sanitizer.\n\nWhen used in combination with libxml2 versions >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.\n\n## Timeline\n* 2018-03-19: Reported by Shopify Application Security Team via email\n* 2018-03-19: Sanitize 4.6.3 released with a fix\n* 2018-03-19: Initial vulnerability report published\n\n## Remediation\nUpgrade `sanitize` to version 4.6.3 or higher.\n\n## References\n- [GitHub Issue](https://github.com/rgrove/sanitize/issues/176)\n",
+      "disclosureTime": "2018-03-19T04:43:57.565000Z",
+      "functions": [],
+      "id": "SNYK-RUBY-SANITIZE-22024",
+      "identifiers": {
+        "CVE": [
+          "CVE-2018-3740"
+        ],
+        "CWE": [
+          "CWE-74"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:43.461685Z",
+      "moduleName": "sanitize",
+      "packageManager": "rubygems",
+      "packageName": "sanitize",
+      "patches": [],
+      "publicationTime": "2018-03-21T09:26:19.783000Z",
+      "references": [
+        {
+          "title": "GitHub Issue",
+          "url": "https://github.com/rgrove/sanitize/issues/176"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "<4.6.3"
+        ]
+      },
+      "severity": "medium",
+      "title": "HTML Injection",
+      "from": [
+        "ruby-app-thresholds@*",
+        "sanitize@4.6.2"
+      ],
+      "upgradePath": [
+        false,
+        "sanitize@4.6.3"
+      ],
+      "version": "4.6.2",
+      "name": "sanitize",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-12-24T17:44:10.116000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 7.5,
+      "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of this package are vulnerable to Directory Traversal via the `lib/yard/core_ext/file.rb` method in the server. It does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [GitHub Commit](https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17042)\n",
+      "disclosureTime": "2017-11-23T17:44:10.116000Z",
+      "functions": [],
+      "id": "SNYK-RUBY-YARD-22004",
+      "identifiers": {
+        "CVE": [
+          "CVE-2017-17042"
+        ],
+        "CWE": [
+          "CWE-22"
+        ]
+      },
+      "language": "ruby",
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:51.823161Z",
+      "moduleName": "yard",
+      "packageManager": "rubygems",
+      "packageName": "yard",
+      "patches": [],
+      "publicationTime": "2017-12-25T15:44:10.116000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17042"
+        },
+        {
+          "title": "GitHub Commit",
+          "url": "https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "< 0.9.11"
+        ]
+      },
+      "severity": "high",
+      "title": "Directory Traversal",
+      "from": [
+        "ruby-app-thresholds@*",
+        "yard@0.8.0"
+      ],
+      "upgradePath": [
+        false,
+        "yard@0.9.11"
+      ],
+      "version": "0.8.0",
+      "name": "yard",
+      "isUpgradable": true,
+      "isPatchable": false
+    }
+  ],
+  "dependencyCount": 7,
+  "org": "test-org",
+  "licensesPolicy": null,
+  "isPrivate": true,
+  "packageManager": "rubygems",
+  "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+  "ignoreSettings": null,
+  "severityThreshold": "medium",
+  "summary": "6 medium or high severity vulnerable dependency paths",
+  "filesystemPolicy": false,
+  "filtered": {
+    "ignore": [],
+    "patch": []
+  },
+  "uniqueCount": 5,
+  "path": "ruby-app-thresholds"
+}
diff --git a/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result-high-severity.json b/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result-high-severity.json
new file mode 100644
index 0000000000..b8bd6d9ffc
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result-high-severity.json
@@ -0,0 +1,209 @@
+{
+  "result": {
+    "affectedPkgs": {
+      "lynx@0.4.0": {
+        "pkg": {
+          "name": "lynx",
+          "version": "0.4.0"
+        },
+        "issues": {
+          "SNYK-RUBY-LYNX-20160": {
+            "issueId": "SNYK-RUBY-LYNX-20160",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "nokogiri@1.8.5": {
+        "pkg": {
+          "name": "nokogiri",
+          "version": "1.8.5"
+        },
+        "issues": {
+          "SNYK-RUBY-NOKOGIRI-20299": {
+            "issueId": "SNYK-RUBY-NOKOGIRI-20299",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "yard@0.8.0": {
+        "pkg": {
+          "name": "yard",
+          "version": "0.8.0"
+        },
+        "issues": {
+          "SNYK-RUBY-YARD-22004": {
+            "issueId": "SNYK-RUBY-YARD-22004",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-thresholds",
+                      "version": null
+                    },
+                    {
+                      "name": "yard",
+                      "version": "0.8.0",
+                      "newVersion": "0.9.11"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      }
+    },
+    "issuesData": {
+      "SNYK-RUBY-LYNX-20160": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.6,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20160",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-77"
+          ],
+          "OSVDB": [
+            "OSVDB-108579"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.661168Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/OSVDB-108579"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Command Execution"
+      },
+      "SNYK-RUBY-NOKOGIRI-20299": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-01-12T12:37:00Z",
+        "credit": [
+          "Snyk Security Research Team"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+        "disclosureTime": "2017-01-11T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-NOKOGIRI-20299",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-611"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-21T10:10:04.153595Z",
+        "moduleName": "nokogiri",
+        "packageManager": "rubygems",
+        "packageName": "nokogiri",
+        "patches": [],
+        "publicationTime": "2017-01-16T21:00:00Z",
+        "references": [
+          {
+            "title": "CVE-2016-9318",
+            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+          },
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 1.5.4"
+          ]
+        },
+        "severity": "high",
+        "title": "XML External Entity (XXE) Injection"
+      },
+      "SNYK-RUBY-YARD-22004": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-12-24T17:44:10.116000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 7.5,
+        "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of this package are vulnerable to Directory Traversal via the `lib/yard/core_ext/file.rb` method in the server. It does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [GitHub Commit](https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17042)\n",
+        "disclosureTime": "2017-11-23T17:44:10.116000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-YARD-22004",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-17042"
+          ],
+          "CWE": [
+            "CWE-22"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:51.823161Z",
+        "moduleName": "yard",
+        "packageManager": "rubygems",
+        "packageName": "yard",
+        "patches": [],
+        "publicationTime": "2017-12-25T15:44:10.116000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17042"
+          },
+          {
+            "title": "GitHub Commit",
+            "url": "https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "< 0.9.11"
+          ]
+        },
+        "severity": "high",
+        "title": "Directory Traversal"
+      }
+    }
+  },
+  "meta": {
+    "isPublic": false,
+    "isLicensesEnabled": false,
+    "licensesPolicy": null,
+    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+    "ignoreSettings": null,
+    "org": "test-org"
+  },
+  "filesystemPolicy": false
+}
diff --git a/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result-low-severity.json b/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result-low-severity.json
new file mode 100644
index 0000000000..3201f14154
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result-low-severity.json
@@ -0,0 +1,393 @@
+{
+  "result": {
+    "affectedPkgs": {
+      "lynx@0.4.0": {
+        "pkg": {
+          "name": "lynx",
+          "version": "0.4.0"
+        },
+        "issues": {
+          "SNYK-RUBY-LYNX-20160": {
+            "issueId": "SNYK-RUBY-LYNX-20160",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          },
+          "SNYK-RUBY-LYNX-20161": {
+            "issueId": "SNYK-RUBY-LYNX-20161",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "nokogiri@1.8.5": {
+        "pkg": {
+          "name": "nokogiri",
+          "version": "1.8.5"
+        },
+        "issues": {
+          "SNYK-RUBY-NOKOGIRI-20299": {
+            "issueId": "SNYK-RUBY-NOKOGIRI-20299",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "sanitize@4.6.2": {
+        "pkg": {
+          "name": "sanitize",
+          "version": "4.6.2"
+        },
+        "issues": {
+          "SNYK-RUBY-SANITIZE-22024": {
+            "issueId": "SNYK-RUBY-SANITIZE-22024",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-thresholds",
+                      "version": null
+                    },
+                    {
+                      "name": "sanitize",
+                      "version": "4.6.2",
+                      "newVersion": "4.6.3"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "yard@0.8.0": {
+        "pkg": {
+          "name": "yard",
+          "version": "0.8.0"
+        },
+        "issues": {
+          "SNYK-RUBY-YARD-20430": {
+            "issueId": "SNYK-RUBY-YARD-20430",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-thresholds",
+                      "version": null
+                    },
+                    {
+                      "name": "yard",
+                      "version": "0.8.0",
+                      "newVersion": "0.8.7.1"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-RUBY-YARD-22004": {
+            "issueId": "SNYK-RUBY-YARD-22004",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-thresholds",
+                      "version": null
+                    },
+                    {
+                      "name": "yard",
+                      "version": "0.8.0",
+                      "newVersion": "0.9.11"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      }
+    },
+    "issuesData": {
+      "SNYK-RUBY-LYNX-20160": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.6,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20160",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-77"
+          ],
+          "OSVDB": [
+            "OSVDB-108579"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.661168Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/OSVDB-108579"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Command Execution"
+      },
+      "SNYK-RUBY-LYNX-20161": {
+        "CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 4,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable due to a flaw in `command/basic.rb` that exposes password information in plaintext in the process table. This may allow a local attacker to gain access to password information.\n\n## References\n- http://rubysec.com/advisories/CVE-2014-5002\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20161",
+        "identifiers": {
+          "CVE": [
+            "CVE-2014-5002"
+          ],
+          "CWE": [
+            "CWE-200"
+          ],
+          "OSVDB": [
+            "OSVDB-108580"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.664828Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/CVE-2014-5002"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "medium",
+        "title": "Local Plaintext Password Disclosure"
+      },
+      "SNYK-RUBY-NOKOGIRI-20299": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-01-12T12:37:00Z",
+        "credit": [
+          "Snyk Security Research Team"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+        "disclosureTime": "2017-01-11T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-NOKOGIRI-20299",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-611"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-22T10:10:06.539065Z",
+        "moduleName": "nokogiri",
+        "packageManager": "rubygems",
+        "packageName": "nokogiri",
+        "patches": [],
+        "publicationTime": "2017-01-16T21:00:00Z",
+        "references": [
+          {
+            "title": "CVE-2016-9318",
+            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+          },
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 1.5.4"
+          ]
+        },
+        "severity": "high",
+        "title": "XML External Entity (XXE) Injection"
+      },
+      "SNYK-RUBY-SANITIZE-22024": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2018-03-20T04:43:57.565000Z",
+        "credit": [
+          "Shopify Application Security Team"
+        ],
+        "cvssScore": 6.5,
+        "description": "## Overview\n[sanitize](https://rubygems.org/gems/sanitize) is a whitelist-based HTML and CSS sanitizer.\n\nWhen used in combination with libxml2 versions >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.\n\n## Timeline\n* 2018-03-19: Reported by Shopify Application Security Team via email\n* 2018-03-19: Sanitize 4.6.3 released with a fix\n* 2018-03-19: Initial vulnerability report published\n\n## Remediation\nUpgrade `sanitize` to version 4.6.3 or higher.\n\n## References\n- [GitHub Issue](https://github.com/rgrove/sanitize/issues/176)\n",
+        "disclosureTime": "2018-03-19T04:43:57.565000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-SANITIZE-22024",
+        "identifiers": {
+          "CVE": [
+            "CVE-2018-3740"
+          ],
+          "CWE": [
+            "CWE-74"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.461685Z",
+        "moduleName": "sanitize",
+        "packageManager": "rubygems",
+        "packageName": "sanitize",
+        "patches": [],
+        "publicationTime": "2018-03-21T09:26:19.783000Z",
+        "references": [
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/rgrove/sanitize/issues/176"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "<4.6.3"
+          ]
+        },
+        "severity": "medium",
+        "title": "HTML Injection"
+      },
+      "SNYK-RUBY-YARD-20430": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-05-04T11:52:51.329000Z",
+        "credit": [
+          "Loren Segal"
+        ],
+        "cvssScore": 3.1,
+        "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of the package are vulnerable to Cross-site Scripting (XSS). Strings parsed from the anchor in the address bar were not sanitized, allowing for arbitrary HTML to be embedded into the page.\n\n## Details\nCross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s browser to execute malicious JavaScript code in the context of a victim’s domain. Such scripts can steal the user’s session cookies for the domain, scrape or modify its content, and perform or modify actions on the user’s behalf, actions typically blocked by the browser’s Same Origin Policy.\n\nThese attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a \"new\" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like `<` `>` `\"` `'` are not escaped properly.\n\nThere are a few types of XSS:\n- **Persistent XSS** is an attack in which the malicious code persists into the web app’s database.\n- **Reflected XSS** is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.\n- **DOM-based XSS** is an that occurs purely in the browser when client-side JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is notoriously hard to detect, as the server never gets a chance to see the attack taking place.\n\n\nYou can read more about `Cross-site Scripting (XSS)` on our [blog](https://snyk.io/blog/xss-attacks-the-next-wave/).\n\n## Remediation\nUpgrade `yard` to version 0.8.7.1 or higher.\n\n## References\n- [Github Commit](https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802)\n",
+        "disclosureTime": "2013-09-11T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-YARD-20430",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-79"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.140701Z",
+        "moduleName": "yard",
+        "packageManager": "rubygems",
+        "packageName": "yard",
+        "patches": [],
+        "publicationTime": "2017-09-14T09:12:31.394000Z",
+        "references": [
+          {
+            "title": "Github Commit",
+            "url": "https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "<0.8.7.1, >=0.8.0"
+          ]
+        },
+        "severity": "low",
+        "title": "Cross-site Scripting (XSS)"
+      },
+      "SNYK-RUBY-YARD-22004": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-12-24T17:44:10.116000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 7.5,
+        "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of this package are vulnerable to Directory Traversal via the `lib/yard/core_ext/file.rb` method in the server. It does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [GitHub Commit](https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17042)\n",
+        "disclosureTime": "2017-11-23T17:44:10.116000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-YARD-22004",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-17042"
+          ],
+          "CWE": [
+            "CWE-22"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:51.823161Z",
+        "moduleName": "yard",
+        "packageManager": "rubygems",
+        "packageName": "yard",
+        "patches": [],
+        "publicationTime": "2017-12-25T15:44:10.116000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17042"
+          },
+          {
+            "title": "GitHub Commit",
+            "url": "https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "< 0.9.11"
+          ]
+        },
+        "severity": "high",
+        "title": "Directory Traversal"
+      }
+    }
+  },
+  "meta": {
+    "isPublic": false,
+    "isLicensesEnabled": false,
+    "licensesPolicy": null,
+    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+    "ignoreSettings": null,
+    "org": "test-org"
+  },
+  "filesystemPolicy": false
+}
diff --git a/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result-medium-severity.json b/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result-medium-severity.json
new file mode 100644
index 0000000000..ec58874aa9
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result-medium-severity.json
@@ -0,0 +1,332 @@
+{
+  "result": {
+    "affectedPkgs": {
+      "lynx@0.4.0": {
+        "pkg": {
+          "name": "lynx",
+          "version": "0.4.0"
+        },
+        "issues": {
+          "SNYK-RUBY-LYNX-20160": {
+            "issueId": "SNYK-RUBY-LYNX-20160",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          },
+          "SNYK-RUBY-LYNX-20161": {
+            "issueId": "SNYK-RUBY-LYNX-20161",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "nokogiri@1.8.5": {
+        "pkg": {
+          "name": "nokogiri",
+          "version": "1.8.5"
+        },
+        "issues": {
+          "SNYK-RUBY-NOKOGIRI-20299": {
+            "issueId": "SNYK-RUBY-NOKOGIRI-20299",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "sanitize@4.6.2": {
+        "pkg": {
+          "name": "sanitize",
+          "version": "4.6.2"
+        },
+        "issues": {
+          "SNYK-RUBY-SANITIZE-22024": {
+            "issueId": "SNYK-RUBY-SANITIZE-22024",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-thresholds",
+                      "version": null
+                    },
+                    {
+                      "name": "sanitize",
+                      "version": "4.6.2",
+                      "newVersion": "4.6.3"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "yard@0.8.0": {
+        "pkg": {
+          "name": "yard",
+          "version": "0.8.0"
+        },
+        "issues": {
+          "SNYK-RUBY-YARD-22004": {
+            "issueId": "SNYK-RUBY-YARD-22004",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-thresholds",
+                      "version": null
+                    },
+                    {
+                      "name": "yard",
+                      "version": "0.8.0",
+                      "newVersion": "0.9.11"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      }
+    },
+    "issuesData": {
+      "SNYK-RUBY-LYNX-20160": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.6,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20160",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-77"
+          ],
+          "OSVDB": [
+            "OSVDB-108579"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.661168Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/OSVDB-108579"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Command Execution"
+      },
+      "SNYK-RUBY-LYNX-20161": {
+        "CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 4,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable due to a flaw in `command/basic.rb` that exposes password information in plaintext in the process table. This may allow a local attacker to gain access to password information.\n\n## References\n- http://rubysec.com/advisories/CVE-2014-5002\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20161",
+        "identifiers": {
+          "CVE": [
+            "CVE-2014-5002"
+          ],
+          "CWE": [
+            "CWE-200"
+          ],
+          "OSVDB": [
+            "OSVDB-108580"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.664828Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/CVE-2014-5002"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "medium",
+        "title": "Local Plaintext Password Disclosure"
+      },
+      "SNYK-RUBY-NOKOGIRI-20299": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-01-12T12:37:00Z",
+        "credit": [
+          "Snyk Security Research Team"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+        "disclosureTime": "2017-01-11T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-NOKOGIRI-20299",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-611"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-22T10:10:06.539065Z",
+        "moduleName": "nokogiri",
+        "packageManager": "rubygems",
+        "packageName": "nokogiri",
+        "patches": [],
+        "publicationTime": "2017-01-16T21:00:00Z",
+        "references": [
+          {
+            "title": "CVE-2016-9318",
+            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+          },
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 1.5.4"
+          ]
+        },
+        "severity": "high",
+        "title": "XML External Entity (XXE) Injection"
+      },
+      "SNYK-RUBY-SANITIZE-22024": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2018-03-20T04:43:57.565000Z",
+        "credit": [
+          "Shopify Application Security Team"
+        ],
+        "cvssScore": 6.5,
+        "description": "## Overview\n[sanitize](https://rubygems.org/gems/sanitize) is a whitelist-based HTML and CSS sanitizer.\n\nWhen used in combination with libxml2 versions >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.\n\n## Timeline\n* 2018-03-19: Reported by Shopify Application Security Team via email\n* 2018-03-19: Sanitize 4.6.3 released with a fix\n* 2018-03-19: Initial vulnerability report published\n\n## Remediation\nUpgrade `sanitize` to version 4.6.3 or higher.\n\n## References\n- [GitHub Issue](https://github.com/rgrove/sanitize/issues/176)\n",
+        "disclosureTime": "2018-03-19T04:43:57.565000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-SANITIZE-22024",
+        "identifiers": {
+          "CVE": [
+            "CVE-2018-3740"
+          ],
+          "CWE": [
+            "CWE-74"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.461685Z",
+        "moduleName": "sanitize",
+        "packageManager": "rubygems",
+        "packageName": "sanitize",
+        "patches": [],
+        "publicationTime": "2018-03-21T09:26:19.783000Z",
+        "references": [
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/rgrove/sanitize/issues/176"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "<4.6.3"
+          ]
+        },
+        "severity": "medium",
+        "title": "HTML Injection"
+      },
+      "SNYK-RUBY-YARD-22004": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-12-24T17:44:10.116000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 7.5,
+        "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of this package are vulnerable to Directory Traversal via the `lib/yard/core_ext/file.rb` method in the server. It does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [GitHub Commit](https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17042)\n",
+        "disclosureTime": "2017-11-23T17:44:10.116000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-YARD-22004",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-17042"
+          ],
+          "CWE": [
+            "CWE-22"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:51.823161Z",
+        "moduleName": "yard",
+        "packageManager": "rubygems",
+        "packageName": "yard",
+        "patches": [],
+        "publicationTime": "2017-12-25T15:44:10.116000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17042"
+          },
+          {
+            "title": "GitHub Commit",
+            "url": "https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "< 0.9.11"
+          ]
+        },
+        "severity": "high",
+        "title": "Directory Traversal"
+      }
+    }
+  },
+  "meta": {
+    "isPublic": false,
+    "isLicensesEnabled": true,
+    "licensesPolicy": null,
+    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+    "ignoreSettings": null,
+    "org": "test-org"
+  },
+  "filesystemPolicy": false
+}
diff --git a/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result.json b/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result.json
new file mode 100644
index 0000000000..a5be2868be
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app-thresholds/test-graph-result.json
@@ -0,0 +1,393 @@
+{
+  "result": {
+    "affectedPkgs": {
+      "lynx@0.4.0": {
+        "pkg": {
+          "name": "lynx",
+          "version": "0.4.0"
+        },
+        "issues": {
+          "SNYK-RUBY-LYNX-20160": {
+            "issueId": "SNYK-RUBY-LYNX-20160",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          },
+          "SNYK-RUBY-LYNX-20161": {
+            "issueId": "SNYK-RUBY-LYNX-20161",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "nokogiri@1.8.5": {
+        "pkg": {
+          "name": "nokogiri",
+          "version": "1.8.5"
+        },
+        "issues": {
+          "SNYK-RUBY-NOKOGIRI-20299": {
+            "issueId": "SNYK-RUBY-NOKOGIRI-20299",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      },
+      "sanitize@4.6.2": {
+        "pkg": {
+          "name": "sanitize",
+          "version": "4.6.2"
+        },
+        "issues": {
+          "SNYK-RUBY-SANITIZE-22024": {
+            "issueId": "SNYK-RUBY-SANITIZE-22024",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-thresholds",
+                      "version": null
+                    },
+                    {
+                      "name": "sanitize",
+                      "version": "4.6.2",
+                      "newVersion": "4.6.3"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "yard@0.8.0": {
+        "pkg": {
+          "name": "yard",
+          "version": "0.8.0"
+        },
+        "issues": {
+          "SNYK-RUBY-YARD-20430": {
+            "issueId": "SNYK-RUBY-YARD-20430",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-thresholds",
+                      "version": null
+                    },
+                    {
+                      "name": "yard",
+                      "version": "0.8.0",
+                      "newVersion": "0.8.7.1"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-RUBY-YARD-22004": {
+            "issueId": "SNYK-RUBY-YARD-22004",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "ruby-app-thresholds",
+                      "version": null
+                    },
+                    {
+                      "name": "yard",
+                      "version": "0.8.0",
+                      "newVersion": "0.9.11"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      }
+    },
+    "issuesData": {
+      "SNYK-RUBY-LYNX-20160": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.6,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20160",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-77"
+          ],
+          "OSVDB": [
+            "OSVDB-108579"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.661168Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/OSVDB-108579"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Command Execution"
+      },
+      "SNYK-RUBY-LYNX-20161": {
+        "CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 4,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable due to a flaw in `command/basic.rb` that exposes password information in plaintext in the process table. This may allow a local attacker to gain access to password information.\n\n## References\n- http://rubysec.com/advisories/CVE-2014-5002\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20161",
+        "identifiers": {
+          "CVE": [
+            "CVE-2014-5002"
+          ],
+          "CWE": [
+            "CWE-200"
+          ],
+          "OSVDB": [
+            "OSVDB-108580"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.664828Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/CVE-2014-5002"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "medium",
+        "title": "Local Plaintext Password Disclosure"
+      },
+      "SNYK-RUBY-NOKOGIRI-20299": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-01-12T12:37:00Z",
+        "credit": [
+          "Snyk Security Research Team"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[nokogiri](https://rubygems.org/gems/nokogiri) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.\n\nAffected versions of this Gem are vulnerable to XML External Entity (XXE) attacks when opting into the `DTDLOAD` option and opting out of the `NONET` option.\n`Nokogiri` is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries it depends on. When handling the expansion of XML external entities (XXE) in libxml2, you can specify documents to be read. Opting into the `DTDLOAD` option and opting out of the `NONET` option in `Nokogiri` allows unknown documents to be loaded from the network. This can be used by attackers to load specially crafted XML documents on an internal XML parsing service and may lead to unauthorized disclosure of potentially sensitive information.\n\n**Note:** This vulnerability exists also in versions `< 1.5.4` regardless of the options opted into or out of. See information [here](https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-20298)\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n   <username>John</username>\n</xml>\n```\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n   <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n   <username>&xxe;</username>\n</xml>\n```\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nNokogiri suggests not to opt-out of `NONET` unless only trusted documents are being parsed.\nThere currently is no fix in libxml2 as of September 17th, 2017.\n`Nokogiri` will be waiting for a fix upstream to update.\n\n## Disclosure Timeline\n- January 11th, 2017 - Reported the issue to [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n- January 11th, 2017 - Issue triaged and acknowledged by [Mike Dalessio](https://github.com/flavorjones) of Nokogiri Core.\n\n## References\n- [GitHub Issue](https://github.com/sparklemotion/nokogiri/issues/1582)\n- [CVE-2016-9318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318)\n",
+        "disclosureTime": "2017-01-11T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-NOKOGIRI-20299",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-611"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-21T10:10:04.153595Z",
+        "moduleName": "nokogiri",
+        "packageManager": "rubygems",
+        "packageName": "nokogiri",
+        "patches": [],
+        "publicationTime": "2017-01-16T21:00:00Z",
+        "references": [
+          {
+            "title": "CVE-2016-9318",
+            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318"
+          },
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/sparklemotion/nokogiri/issues/1582"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 1.5.4"
+          ]
+        },
+        "severity": "high",
+        "title": "XML External Entity (XXE) Injection"
+      },
+      "SNYK-RUBY-SANITIZE-22024": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2018-03-20T04:43:57.565000Z",
+        "credit": [
+          "Shopify Application Security Team"
+        ],
+        "cvssScore": 6.5,
+        "description": "## Overview\n[sanitize](https://rubygems.org/gems/sanitize) is a whitelist-based HTML and CSS sanitizer.\n\nWhen used in combination with libxml2 versions >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.\n\n## Timeline\n* 2018-03-19: Reported by Shopify Application Security Team via email\n* 2018-03-19: Sanitize 4.6.3 released with a fix\n* 2018-03-19: Initial vulnerability report published\n\n## Remediation\nUpgrade `sanitize` to version 4.6.3 or higher.\n\n## References\n- [GitHub Issue](https://github.com/rgrove/sanitize/issues/176)\n",
+        "disclosureTime": "2018-03-19T04:43:57.565000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-SANITIZE-22024",
+        "identifiers": {
+          "CVE": [
+            "CVE-2018-3740"
+          ],
+          "CWE": [
+            "CWE-74"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.461685Z",
+        "moduleName": "sanitize",
+        "packageManager": "rubygems",
+        "packageName": "sanitize",
+        "patches": [],
+        "publicationTime": "2018-03-21T09:26:19.783000Z",
+        "references": [
+          {
+            "title": "GitHub Issue",
+            "url": "https://github.com/rgrove/sanitize/issues/176"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "<4.6.3"
+          ]
+        },
+        "severity": "medium",
+        "title": "HTML Injection"
+      },
+      "SNYK-RUBY-YARD-20430": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-05-04T11:52:51.329000Z",
+        "credit": [
+          "Loren Segal"
+        ],
+        "cvssScore": 3.1,
+        "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of the package are vulnerable to Cross-site Scripting (XSS). Strings parsed from the anchor in the address bar were not sanitized, allowing for arbitrary HTML to be embedded into the page.\n\n## Details\nCross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s browser to execute malicious JavaScript code in the context of a victim’s domain. Such scripts can steal the user’s session cookies for the domain, scrape or modify its content, and perform or modify actions on the user’s behalf, actions typically blocked by the browser’s Same Origin Policy.\n\nThese attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a \"new\" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like `<` `>` `\"` `'` are not escaped properly.\n\nThere are a few types of XSS:\n- **Persistent XSS** is an attack in which the malicious code persists into the web app’s database.\n- **Reflected XSS** is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.\n- **DOM-based XSS** is an that occurs purely in the browser when client-side JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is notoriously hard to detect, as the server never gets a chance to see the attack taking place.\n\n\nYou can read more about `Cross-site Scripting (XSS)` on our [blog](https://snyk.io/blog/xss-attacks-the-next-wave/).\n\n## Remediation\nUpgrade `yard` to version 0.8.7.1 or higher.\n\n## References\n- [Github Commit](https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802)\n",
+        "disclosureTime": "2013-09-11T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-YARD-20430",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-79"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.140701Z",
+        "moduleName": "yard",
+        "packageManager": "rubygems",
+        "packageName": "yard",
+        "patches": [],
+        "publicationTime": "2017-09-14T09:12:31.394000Z",
+        "references": [
+          {
+            "title": "Github Commit",
+            "url": "https://github.com/lsegal/yard/commit/715d6cb462392e610ab751fcfee7b622850fa802"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "<0.8.7.1, >=0.8.0"
+          ]
+        },
+        "severity": "low",
+        "title": "Cross-site Scripting (XSS)"
+      },
+      "SNYK-RUBY-YARD-22004": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-12-24T17:44:10.116000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 7.5,
+        "description": "## Overview\n[`yard`](https://rubygems.org/gems/yard) is a documentation generation tool for the Ruby programming language.\n\nAffected versions of this package are vulnerable to Directory Traversal via the `lib/yard/core_ext/file.rb` method in the server. It does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [GitHub Commit](https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17042)\n",
+        "disclosureTime": "2017-11-23T17:44:10.116000Z",
+        "functions": [],
+        "id": "SNYK-RUBY-YARD-22004",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-17042"
+          ],
+          "CWE": [
+            "CWE-22"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:51.823161Z",
+        "moduleName": "yard",
+        "packageManager": "rubygems",
+        "packageName": "yard",
+        "patches": [],
+        "publicationTime": "2017-12-25T15:44:10.116000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17042"
+          },
+          {
+            "title": "GitHub Commit",
+            "url": "https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "< 0.9.11"
+          ]
+        },
+        "severity": "high",
+        "title": "Directory Traversal"
+      }
+    }
+  },
+  "meta": {
+    "isPublic": false,
+    "isLicensesEnabled": false,
+    "licensesPolicy": null,
+    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+    "ignoreSettings": null,
+    "org": "test-org"
+  },
+  "filesystemPolicy": false
+}
diff --git a/test/acceptance/workspaces/ruby-app/test-graph-result.json b/test/acceptance/workspaces/ruby-app/test-graph-result.json
new file mode 100644
index 0000000000..f33a9af595
--- /dev/null
+++ b/test/acceptance/workspaces/ruby-app/test-graph-result.json
@@ -0,0 +1,127 @@
+{
+  "result": {
+    "affectedPkgs": {
+      "lynx@0.4.0": {
+        "pkg": {
+          "name": "lynx",
+          "version": "0.4.0"
+        },
+        "issues": {
+          "SNYK-RUBY-LYNX-20160": {
+            "issueId": "SNYK-RUBY-LYNX-20160",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          },
+          "SNYK-RUBY-LYNX-20161": {
+            "issueId": "SNYK-RUBY-LYNX-20161",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": []
+            }
+          }
+        }
+      }
+    },
+    "issuesData": {
+      "SNYK-RUBY-LYNX-20160": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.6,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable to arbitrary command executions due to a flaw in `lib/lynx/pipe/run.rb`.\n\n## References\n- http://rubysec.com/advisories/OSVDB-108579\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20160",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-77"
+          ],
+          "OSVDB": [
+            "OSVDB-108579"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.661168Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/OSVDB-108579"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Command Execution"
+      },
+      "SNYK-RUBY-LYNX-20161": {
+        "CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+        "alternativeIds": [],
+        "creationTime": "2016-09-21T12:36:57Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 4,
+        "description": "## Overview\n[`lynx`](https://rubygems.org/gems/lynx) is a command line wrapper for MySQL.\nAffected versions of this gem are vulnerable due to a flaw in `command/basic.rb` that exposes password information in plaintext in the process table. This may allow a local attacker to gain access to password information.\n\n## References\n- http://rubysec.com/advisories/CVE-2014-5002\n",
+        "disclosureTime": "2014-06-29T21:00:00Z",
+        "functions": [],
+        "id": "SNYK-RUBY-LYNX-20161",
+        "identifiers": {
+          "CVE": [
+            "CVE-2014-5002"
+          ],
+          "CWE": [
+            "CWE-200"
+          ],
+          "OSVDB": [
+            "OSVDB-108580"
+          ]
+        },
+        "language": "ruby",
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:42.664828Z",
+        "moduleName": "lynx",
+        "packageManager": "rubygems",
+        "packageName": "lynx",
+        "patches": [],
+        "publicationTime": "2014-06-29T21:00:00Z",
+        "references": [
+          {
+            "title": "RUBYSEC.COM",
+            "url": "http://rubysec.com/advisories/CVE-2014-5002"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            ">= 0"
+          ]
+        },
+        "severity": "medium",
+        "title": "Local Plaintext Password Disclosure"
+      }
+    }
+  },
+  "meta": {
+    "isPublic": false,
+    "isLicensesEnabled": true,
+    "licensesPolicy": null,
+    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+    "ignoreSettings": null,
+    "org": "test-org"
+  },
+  "filesystemPolicy": false
+}
diff --git a/test/acceptance/workspaces/sbt-simple-struts/.gitignore b/test/acceptance/workspaces/sbt-simple-struts/.gitignore
new file mode 100644
index 0000000000..569939eae9
--- /dev/null
+++ b/test/acceptance/workspaces/sbt-simple-struts/.gitignore
@@ -0,0 +1,3 @@
+target
+project/target
+project/build.properties
diff --git a/test/acceptance/workspaces/sbt-simple-struts/build.sbt b/test/acceptance/workspaces/sbt-simple-struts/build.sbt
new file mode 100644
index 0000000000..41ac8a4a00
--- /dev/null
+++ b/test/acceptance/workspaces/sbt-simple-struts/build.sbt
@@ -0,0 +1,9 @@
+name := "small-app"
+
+version := "1.0-SNAPSHOT"
+
+scalaVersion := "2.10.4"
+
+libraryDependencies ++= Seq(
+  "org.apache.struts" % "struts2-core" % "2.3.20"
+)
diff --git a/test/acceptance/workspaces/sbt-simple-struts/dep-tree.json b/test/acceptance/workspaces/sbt-simple-struts/dep-tree.json
new file mode 100644
index 0000000000..b3c18fc9ab
--- /dev/null
+++ b/test/acceptance/workspaces/sbt-simple-struts/dep-tree.json
@@ -0,0 +1,89 @@
+{
+  "name": "small-app:small-app_2.10",
+  "version": "1.0-SNAPSHOT",
+  "dependencies": {
+    "org.apache.struts:struts2-core": {
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "dependencies": {
+        "commons-fileupload:commons-fileupload": {
+          "version": "1.3.1",
+          "name": "commons-fileupload:commons-fileupload",
+          "dependencies": {
+            "commons-io:commons-io": {
+              "version": "2.2",
+              "name": "commons-io:commons-io",
+              "dependencies": {}
+            }
+          }
+        },
+        "commons-io:commons-io": {
+          "version": "2.2",
+          "name": "commons-io:commons-io",
+          "dependencies": {}
+        },
+        "ognl:ognl": {
+          "version": "3.0.6",
+          "name": "ognl:ognl",
+          "dependencies": {
+            "javassist:javassist": {
+              "version": "3.11.0.GA",
+              "name": "javassist:javassist",
+              "dependencies": {}
+            }
+          }
+        },
+        "org.apache.struts.xwork:xwork-core": {
+          "version": "2.3.20",
+          "name": "org.apache.struts.xwork:xwork-core",
+          "dependencies": {
+            "ognl:ognl": {
+              "version": "3.0.6",
+              "name": "ognl:ognl",
+              "dependencies": {
+                "javassist:javassist": {
+                  "version": "3.11.0.GA",
+                  "name": "javassist:javassist",
+                  "dependencies": {}
+                }
+              }
+            },
+            "org.apache.commons:commons-lang3": {
+              "version": "3.2",
+              "name": "org.apache.commons:commons-lang3",
+              "dependencies": {}
+            },
+            "org.ow2.asm:asm-commons": {
+              "version": "5.0.2",
+              "name": "org.ow2.asm:asm-commons",
+              "dependencies": {
+                "org.ow2.asm:asm-tree": {
+                  "version": "5.0.2",
+                  "name": "org.ow2.asm:asm-tree",
+                  "dependencies": {
+                    "org.ow2.asm:asm": {
+                      "version": "5.0.2",
+                      "name": "org.ow2.asm:asm",
+                      "dependencies": {}
+                    }
+                  }
+                }
+              }
+            },
+            "org.ow2.asm:asm": {
+              "version": "5.0.2",
+              "name": "org.ow2.asm:asm",
+              "dependencies": {}
+            }
+          }
+        },
+        "org.freemarker:freemarker": {
+          "version": "2.3.19",
+          "name": "org.freemarker:freemarker",
+          "dependencies": {}
+        }
+      }
+    }
+  },
+  "packageFormatVersion": "mvn:0.0.1"
+}
\ No newline at end of file
diff --git a/test/acceptance/workspaces/sbt-simple-struts/legacy-res-json.json b/test/acceptance/workspaces/sbt-simple-struts/legacy-res-json.json
new file mode 100644
index 0000000000..800cbe3aea
--- /dev/null
+++ b/test/acceptance/workspaces/sbt-simple-struts/legacy-res-json.json
@@ -0,0 +1,1973 @@
+{
+  "ok": false,
+  "vulnerabilities": [
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+      "alternativeIds": [],
+      "creationTime": "2016-12-25T16:51:56Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 7.5,
+      "description": "## Overview\n[`commons-fileupload:commons-fileupload`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22commons-fileupload%22) provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) attacks. An attacker can upload a file with a long boundry string in the HTTP header, causing high CPU consumption. The `MultipartStream` class contains a flaw that allows remote attackers to cause a Denial of service (CPU consumption) attacks. This happens by setting the length of the multipart boundary to be just below the size of the buffer (4096 bytes) used to read the uploaded file. Typically, the boundary is tens of bytes long, which caused this case to take much longer than usual.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `commons-fileupload:commons-fileupload` to version 1.3.2 or higher.\n\n## References\n- [Github ChangeLog](https://github.com/apache/commons-fileupload/blob/b1498c9877d751f8bc4635a6f252ebdfcba28518/src/changes/changes.xml#L84)\n- [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1349475)\n- [Apache Mailing Archives](http://mail-archives.us.apache.org/mod_mbox/www-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832@apache.org%3E)\n- [Apache-SVN](http://svn.apache.org/viewvc/commons/proper/fileupload/trunk/RELEASE-NOTES.txt?r1=1745717&r2=1749637&diff_format=h)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092)\n",
+      "disclosureTime": "2016-06-22T16:51:56Z",
+      "id": "SNYK-JAVA-COMMONSFILEUPLOAD-30082",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-3092"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "commons-fileupload",
+        "groupId": "commons-fileupload"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-19T10:10:06.158206Z",
+      "moduleName": "commons-fileupload:commons-fileupload",
+      "packageManager": "maven",
+      "packageName": "commons-fileupload:commons-fileupload",
+      "patches": [],
+      "publicationTime": "2016-06-22T16:51:56Z",
+      "references": [
+        {
+          "title": "CVE",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092"
+        },
+        {
+          "title": "Apache-SVN",
+          "url": "http://svn.apache.org/viewvc/commons/proper/fileupload/trunk/RELEASE-NOTES.txt?r1=1745717&r2=1749637&diff_format=h"
+        },
+        {
+          "title": "Apache Mailing Archives",
+          "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832@apache.org%3E"
+        },
+        {
+          "title": "Redhat Bugzilla",
+          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349475"
+        },
+        {
+          "title": "Github ChangeLog",
+          "url": "https://github.com/apache/commons-fileupload/blob/b1498c9877d751f8bc4635a6f252ebdfcba28518/src/changes/changes.xml#L84"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[1.3,1.3.2)"
+        ]
+      },
+      "severity": "high",
+      "title": "Denial of Service (DoS)",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "commons-fileupload:commons-fileupload@1.3.1"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.30",
+        "commons-fileupload:commons-fileupload@1.3.2"
+      ],
+      "version": "1.3.1",
+      "name": "commons-fileupload:commons-fileupload",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:18.753000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 9.8,
+      "description": "## Overview\n[`commons-fileupload:commons-fileupload`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22commons-fileupload%22)\nThe Apache Commons FileUpload library contains a Java Object that, upon deserialization, can be manipulated to write or copy files in arbitrary locations. If integrated with [`ysoserial`](https://github.com/frohoff/ysoserial), it is possible to upload and execute binaries in a single deserialization call.\n\n# Details\nSerialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.\n\n_Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.\n\nJava deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a [popular library (Apache Commons Collection)](https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.\n\nAn attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.\n\n> Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).\n- Apache Blog\n\n## Remediation\nUpgrade `commons-fileupload` to version 1.3.3 or higher.\n\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000031)\n- [Tenable Security](http://www.tenable.com/security/research/tra-2016-12)\n- [Github ChangeLog](https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml#L65)\n- [Github Commit](https://github.com/apache/commons-fileupload/commit/388e824518697c2c8f9f83fd964621d9c2f8fc4c)\n",
+      "disclosureTime": "2016-10-26T03:04:11.895000Z",
+      "id": "SNYK-JAVA-COMMONSFILEUPLOAD-30401",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-1000031"
+        ],
+        "CWE": [
+          "CWE-284"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "commons-fileupload",
+        "groupId": "commons-fileupload"
+      },
+      "methods": [
+        {
+          "methodId": {
+            "className": "DiskFileItem",
+            "filePath": "org/apache/commons/fileupload/disk/DiskFileItem.java",
+            "methodName": "readObject"
+          },
+          "version": [
+            "[1.1,1.3.3)"
+          ]
+        }
+      ],
+      "modificationTime": "2018-11-19T10:10:05.780180Z",
+      "moduleName": "commons-fileupload:commons-fileupload",
+      "packageManager": "maven",
+      "packageName": "commons-fileupload:commons-fileupload",
+      "patches": [],
+      "publicationTime": "2016-10-26T03:04:11.895000Z",
+      "references": [
+        {
+          "title": "Github Commit",
+          "url": "https://github.com/apache/commons-fileupload/commit/388e824518697c2c8f9f83fd964621d9c2f8fc4c"
+        },
+        {
+          "title": "Github ChangeLog",
+          "url": "https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml#L65"
+        },
+        {
+          "title": "Tenable Security",
+          "url": "http://www.tenable.com/security/research/tra-2016-12"
+        },
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000031"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[1.1,1.3.3)"
+        ]
+      },
+      "severity": "high",
+      "title": "Arbitrary Code Execution",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "commons-fileupload:commons-fileupload@1.3.1"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.5.12",
+        "commons-fileupload:commons-fileupload@1.3.3"
+      ],
+      "version": "1.3.1",
+      "name": "commons-fileupload:commons-fileupload",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-10-01T08:05:48.497000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 6.5,
+      "description": "## Overview\n[`commons-fileupload:commons-fileupload`](https://commons.apache.org/proper/commons-fileupload/) provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.\n\nAffected versions of the package are vulnerable to Information Disclosure because the `InputStream` is not closed on exception.\n\n## Remediation\nUpgrade `commons-fileupload` to version 1.3.2 or higher.\n\n## References\n- [Github ChangeLog](https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml#L56)\n- [Github Commit](https://github.com/apache/commons-fileupload/commit/5b4881d7f75f439326f54fa554a9ca7de6d60814)\n",
+      "disclosureTime": "2014-02-17T22:00:00Z",
+      "id": "SNYK-JAVA-COMMONSFILEUPLOAD-31540",
+      "identifiers": {
+        "CVE": [],
+        "CWE": [
+          "CWE-200"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "commons-fileupload",
+        "groupId": "commons-fileupload"
+      },
+      "methods": [
+        {
+          "methodId": {
+            "className": "FileItemIteratorImpl",
+            "filePath": "org/apache/commons/fileupload/FileUploadBase.java",
+            "methodName": "FileItemIteratorImpl"
+          },
+          "version": [
+            "[,1.3.2)"
+          ]
+        }
+      ],
+      "modificationTime": "2018-11-19T10:10:06.169597Z",
+      "moduleName": "commons-fileupload:commons-fileupload",
+      "packageManager": "maven",
+      "packageName": "commons-fileupload:commons-fileupload",
+      "patches": [],
+      "publicationTime": "2017-02-17T08:05:48.497000Z",
+      "references": [
+        {
+          "title": "Github Commit",
+          "url": "https://github.com/apache/commons-fileupload/commit/5b4881d7f75f439326f54fa554a9ca7de6d60814"
+        },
+        {
+          "title": "Github ChangeLog",
+          "url": "https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml#L56"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[,1.3.2)"
+        ]
+      },
+      "severity": "medium",
+      "title": "Information Disclosure",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "commons-fileupload:commons-fileupload@1.3.1"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.30",
+        "commons-fileupload:commons-fileupload@1.3.2"
+      ],
+      "version": "1.3.1",
+      "name": "commons-fileupload:commons-fileupload",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:19.659000Z",
+      "credit": [
+        "Tao Wang"
+      ],
+      "cvssScore": 5.3,
+      "description": "## Overview\n[`ognl:ognl`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22ognl%22) is a simple Expression Language (EL) for Java.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) attacks.\nApache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `ognl:ognl` to version 3.0.12 or higher.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093)\n- [GitHub Commit](https://github.com/jkuhnert/ognl/commit/ae43073fbf38db8371ff4f8bf2a966ee3b5f7e92)\n",
+      "disclosureTime": "2016-06-02T02:16:48.918000Z",
+      "id": "SNYK-JAVA-OGNL-30474",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-3093"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "ognl",
+        "groupId": "ognl"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:43.976769Z",
+      "moduleName": "ognl:ognl",
+      "packageManager": "maven",
+      "packageName": "ognl:ognl",
+      "patches": [],
+      "publicationTime": "2016-06-02T02:16:48.918000Z",
+      "references": [
+        {
+          "title": "GitHub Commit",
+          "url": "https://github.com/jkuhnert/ognl/commit/ae43073fbf38db8371ff4f8bf2a966ee3b5f7e92"
+        },
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[,3.0.12)"
+        ]
+      },
+      "severity": "medium",
+      "title": "Denial of Service (DoS)",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "ognl:ognl@3.0.6"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.28",
+        "ognl:ognl@3.0.13"
+      ],
+      "version": "3.0.6",
+      "name": "ognl:ognl",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:19.659000Z",
+      "credit": [
+        "Tao Wang"
+      ],
+      "cvssScore": 5.3,
+      "description": "## Overview\n[`ognl:ognl`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22ognl%22) is a simple Expression Language (EL) for Java.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) attacks.\nApache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `ognl:ognl` to version 3.0.12 or higher.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093)\n- [GitHub Commit](https://github.com/jkuhnert/ognl/commit/ae43073fbf38db8371ff4f8bf2a966ee3b5f7e92)\n",
+      "disclosureTime": "2016-06-02T02:16:48.918000Z",
+      "id": "SNYK-JAVA-OGNL-30474",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-3093"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "ognl",
+        "groupId": "ognl"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:43.976769Z",
+      "moduleName": "ognl:ognl",
+      "packageManager": "maven",
+      "packageName": "ognl:ognl",
+      "patches": [],
+      "publicationTime": "2016-06-02T02:16:48.918000Z",
+      "references": [
+        {
+          "title": "GitHub Commit",
+          "url": "https://github.com/jkuhnert/ognl/commit/ae43073fbf38db8371ff4f8bf2a966ee3b5f7e92"
+        },
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[,3.0.12)"
+        ]
+      },
+      "severity": "medium",
+      "title": "Denial of Service (DoS)",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "org.apache.struts.xwork:xwork-core@2.3.20",
+        "ognl:ognl@3.0.6"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.28",
+        "org.apache.struts.xwork:xwork-core@2.3.28",
+        "ognl:ognl@3.0.13"
+      ],
+      "version": "3.0.6",
+      "name": "ognl:ognl",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2016-12-25T16:51:55Z",
+      "credit": [
+        "Jasper Rosenberg"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nThe default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to \"compromise internal state of an application\" via unspecified vectors.\n\n## References\n\n- [Vulnerability Summary](http://struts.apache.org/docs/s2-024.html)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1831)\n",
+      "disclosureTime": "2015-05-11T16:51:55Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30058",
+      "identifiers": {
+        "CVE": [
+          "CVE-2015-1831"
+        ],
+        "CWE": [
+          "CWE-453"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:43.629946Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2015-05-11T16:51:55Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1831"
+        },
+        {
+          "title": "Vulnerability Summary",
+          "url": "http://struts.apache.org/docs/s2-024.html"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.20]"
+        ]
+      },
+      "severity": "high",
+      "title": "Insecure Defaults",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.20.1"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
+      "alternativeIds": [],
+      "creationTime": "2016-12-25T16:51:56Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 9.1,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings.\n\n## References\n\n- [Vulnerability Summary](http://struts.apache.org/docs/s2-026.html)\n",
+      "disclosureTime": "2015-07-01T16:51:56Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30060",
+      "identifiers": {
+        "CVE": [
+          "CVE-2015-5209"
+        ],
+        "CWE": [
+          "CWE-284"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:43.633538Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2015-07-01T16:51:56Z",
+      "references": [
+        {
+          "title": "Vulnerability Summary",
+          "url": "http://struts.apache.org/docs/s2-026.html"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "(,2.3.24]"
+        ]
+      },
+      "severity": "low",
+      "title": "Manipulation of Struts' internals",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.24.1"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H",
+      "alternativeIds": [],
+      "creationTime": "2017-03-19T10:28:21.873000Z",
+      "credit": [
+        "Nike Zheng"
+      ],
+      "cvssScore": 9.8,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](https://cwiki.apache.org/confluence/display/WW/Home) is an elegant, extensible framework for building enterprise-ready Java web applications.\n\nAffected versions of the package are vulnerable to Arbitrary Command Execution while uploading files with the Jakarta Multipart parser. This particular vulnerability can be exploited by an attacker by sending a crafted request to upload a file to the vulnerable server that uses a Jakarta-based plugin to process the upload request.\n\nThe attacker can then send malicious code in the `Content-Type`, `Content-Disposition` or `Content-Length` HTTP headers, which will then be executed by the vulnerable server. [A proof of concept](https://github.com/tengzhangchao/Struts2_045-Poc) that demonstrates the attack scenario is publicly available and the vulnerability is being [actively exploited in the wild](https://www.theregister.co.uk/2017/03/09/apache_under_attack_patch_for_zero_day_available/).\n\nAlthough maintainers of the open source project immediately patched the vulnerability, Struts servers that have yet to install the update remain under attack by hackers who exploit it to inject commands of their choice.\n\nThis attack can be achieved without authentication. To make matters worse, web applications don't necessarily need to successfully upload a malicious file to exploit this vulnerability, as just the presence of the vulnerable Struts library within an application is enough to exploit the vulnerability.\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.32, 2.5.10.1 or higher.\n\n## References\n- [Metasploit GitHub PR](https://github.com/rapid7/metasploit-framework/pull/8072)\n- [Metasploit GitHub Issue](https://github.com/rapid7/metasploit-framework/issues/8064)\n- [Metasploit GitHub Commit](https://github.com/rapid7/metasploit-framework/pull/8072/commits/fc0f63e77471baa40057effaaa8be0f205adc6b7)\n- [PoC](https://github.com/tengzhangchao/Struts2_045-Poc)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638)\n- [Exploit DB](https://www.exploit-db.com/exploits/41570/)\n- [Struts Wiki](https://cwiki.apache.org/confluence/display/WW/S2-045)\n- [Talos Intelligence Blog](http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html)\n",
+      "disclosureTime": "2017-03-05T22:00:00Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30207",
+      "identifiers": {
+        "CVE": [
+          "CVE-2017-5638"
+        ],
+        "CWE": [
+          "CWE-94"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [
+        {
+          "methodId": {
+            "className": "JakartaMultiPartRequest",
+            "filePath": "org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java",
+            "methodName": "buildErrorMessage"
+          },
+          "version": [
+            "[2.5,2.5.10.1)"
+          ]
+        }
+      ],
+      "modificationTime": "2018-11-18T11:50:51.735176Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2017-03-21T15:30:44.863000Z",
+      "references": [
+        {
+          "title": "Talos Intelligence Blog",
+          "url": "http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html"
+        },
+        {
+          "title": "Struts Wiki",
+          "url": "https://cwiki.apache.org/confluence/display/WW/S2-045"
+        },
+        {
+          "title": "Exploit DB",
+          "url": "https://www.exploit-db.com/exploits/41570/"
+        },
+        {
+          "title": "CVE",
+          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638"
+        },
+        {
+          "title": "PoC",
+          "url": "https://github.com/tengzhangchao/Struts2_045-Poc"
+        },
+        {
+          "title": "Metasploit GitHub Commit",
+          "url": "https://github.com/rapid7/metasploit-framework/pull/8072/commits/fc0f63e77471baa40057effaaa8be0f205adc6b7"
+        },
+        {
+          "title": "Metasploit GitHub Issue",
+          "url": "https://github.com/rapid7/metasploit-framework/issues/8064"
+        },
+        {
+          "title": "Metasploit GitHub PR",
+          "url": "https://github.com/rapid7/metasploit-framework/pull/8072"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.5,2.3.32), [2.5,2.5.10.1)"
+        ]
+      },
+      "severity": "high",
+      "title": "Arbitrary Code Execution",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.32"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.315000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 8.8,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nApache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3081)",
+      "disclosureTime": "2016-04-22T04:32:51.243000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30770",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-3081"
+        ],
+        "CWE": [
+          "CWE-77"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.399409Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2016-04-22T04:32:51.243000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3081"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2,2.3.20.2), [2.3.24,2.3.24.2), [2.3.28,2.3.28.1)"
+        ]
+      },
+      "severity": "high",
+      "title": "Command Injection",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.20.3"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.327000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 9.8,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22) is a free open-source solution for creating Java web applications.\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution. It allows remote attackers to execute arbitrary code via the stylesheet location parameter.\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.20.2, 2.3.24.2, 2.3.28.1 or higher.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3082)",
+      "disclosureTime": "2016-04-22T02:36:52.273000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30771",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-3082"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.401329Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2016-04-22T02:36:52.273000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3082"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2,2.3.20.2), [2.3.24,2.3.24.2), [2.3.28,2.3.28.1)"
+        ]
+      },
+      "severity": "high",
+      "title": "Arbitrary Code Execution",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.20.3"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.339000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nApache Struts 2.3.20.x before 2.3.20.3, 2.3.24.x before 2.3.24.3, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3087)",
+      "disclosureTime": "2016-06-02T00:40:36.101000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30772",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-3087"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.403291Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2016-06-02T00:40:36.101000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3087"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2,2.3.20.2), [2.3.24,2.3.24.3), [2.3.28,2.3.28.1)"
+        ]
+      },
+      "severity": "high",
+      "title": "Arbitrary Command Execution",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.20.3"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.353000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 4.3,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nCross-site Scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.\n\n## Details\nCross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s browser to execute malicious JavaScript code in the context of a victim’s domain. Such scripts can steal the user’s session cookies for the domain, scrape or modify its content, and perform or modify actions on the user’s behalf, actions typically blocked by the browser’s Same Origin Policy.\n\nThese attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a \"new\" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like `<` `>` `\"` `'` are not escaped properly.\n\nThere are a few types of XSS:\n- **Persistent XSS** is an attack in which the malicious code persists into the web app’s database.\n- **Reflected XSS** is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.\n- **DOM-based XSS** is an that occurs purely in the browser when client-side JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is notoriously hard to detect, as the server never gets a chance to see the attack taking place.\n\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4003)",
+      "disclosureTime": "2016-03-16T06:52:13.014000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30773",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-4003"
+        ],
+        "CWE": [
+          "CWE-79"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.405310Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2016-03-16T06:52:13.014000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4003"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[,2.3.28)"
+        ]
+      },
+      "severity": "medium",
+      "title": "Cross-site Scripting (XSS)",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.28"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.364000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 6.3,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nApache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4430)",
+      "disclosureTime": "2016-06-20T07:00:37.929000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30774",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-4430"
+        ],
+        "CWE": [
+          "CWE-352"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.407111Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2016-06-20T07:00:37.929000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4430"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.20,2.3.28.1]"
+        ]
+      },
+      "severity": "medium",
+      "title": "Cross-site Request Forgery (CSRF)",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.29"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.377000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 5.3,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nApache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4431)",
+      "disclosureTime": "2016-06-21T04:49:27.674000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30775",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-4431"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.409079Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2016-06-21T04:49:27.674000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4431"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.20,2.3.28.1]"
+        ]
+      },
+      "severity": "medium",
+      "title": "Access Restriction Bypass",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.29"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.390000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 5.3,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nApache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433)",
+      "disclosureTime": "2016-06-21T01:33:07.474000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30776",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-4433"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.411243Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2016-06-21T01:33:07.474000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.20,2.3.28.1]"
+        ]
+      },
+      "severity": "medium",
+      "title": "Access Restriction Bypass",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.29"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.404000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 5.3,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nThe URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465)",
+      "disclosureTime": "2016-06-20T07:45:43.528000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30777",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-4465"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.413209Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2016-06-20T07:45:43.528000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.5,2.5.1), [2.3.20, 2.3.28.1]"
+        ]
+      },
+      "severity": "medium",
+      "title": "Denial of Service (DoS)",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.29"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.415000Z",
+      "credit": [
+        "Takeshi Terada"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nAffected versions of the package are vulnerable to Directory Traversal.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [Apache Security Advisory](http://struts.apache.org/docs/s2-042.html)\n",
+      "disclosureTime": "2016-10-19T01:09:09.263000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-30778",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-6795"
+        ],
+        "CWE": [
+          "CWE-94"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.415113Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2016-10-19T01:09:09.263000Z",
+      "references": [
+        {
+          "title": "Apache Security Advisory",
+          "url": "http://struts.apache.org/docs/s2-042.html"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.20,2.3.31)"
+        ]
+      },
+      "severity": "high",
+      "title": "Directory Traversal",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.31"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+      "alternativeIds": [],
+      "creationTime": "2017-09-06T17:28:23.339000Z",
+      "credit": [
+        "LGTM Security Team"
+      ],
+      "cvssScore": 8.1,
+      "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nThe REST Plugin in affected versions use a `XStreamHandler` with an instance of XStream for deserialization without any type filtering. By design, there are few limits to the type of objects XStream can handle. This flexibility comes at a price. The XML generated or consumed by XStream includes all information required to build Java objects of almost any type. The provided XML data is used by XStream to unmarshal Java objects. An attacker could use this flaw to execute arbitrary code or conduct further attacks.\n\n[A working exploit](https://github.com/rapid7/metasploit-framework/commit/5ea83fee5ee8c23ad95608b7e2022db5b48340ef) is publicly available and [is actively](https://www.imperva.com/blog/2017/09/cve-2017-9805-analysis-of-apache-struts-rce-vulnerability-in-rest-plugin/) exploited in the wild.\n\nYou can read more about this vulnerability [on our blog](https://snyk.io/blog/equifax-breach-vulnerable-open-source-libraries/).\n\n# Details\nSerialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.\n\n_Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker control the state or the flow of the execution. \n\nJava deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a [popular library (Apache Commons Collection)](https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.\n\nAn attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.\n\n> Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).\n- Apache Blog\n\n\n## Remediation\nDevelopers are strongly advised to upgrade their _Apache Struts_ components to version `2.3.34`, `2.5.13` or higher.\n\nIt is possible that some REST actions stop working because of applied default restrictions on available classes. In this case please investigate the new interfaces that were introduced to allow class restrictions per action, those interfaces are:\n* org.apache.struts2.rest.handler.AllowedClasses\n* org.apache.struts2.rest.handler.AllowedClassNames\n* org.apache.struts2.rest.handler.XStreamPermissionProvider\n\nIf for some reason upgrading is not an option, consider the following workarounds:\n1. Disable handling XML pages and requests to such pages\n```xml\n<constant name=\"struts.action.extension\" value=\"xhtml,,json\" />\n```\n\n2. Override getContentType in XStreamHandler\n```java\n public class MyXStreamHandler extends XStreamHandler { \n   public String getContentType() {\n     return \"not-existing-content-type-@;/&%$#@\";\n   }\n }\n```\n\n3. Register the handler by overriding the one provided by the framework in your struts.xml\n```xml\n<bean type=\"org.apache.struts2.rest.handler.ContentTypeHandler\" name=\"myXStreamHandmer\" class=\"com.company.MyXStreamHandler\"/>\n<constant name=\"struts.rest.handlerOverride.xml\" value=\"myXStreamHandler\"/>\n```\n\n## References\n- [LGTM Advisory](https://lgtm.com/blog/apache_struts_CVE-2017-9805_announcement)\n- [LGTM Vulnerability Details](https://lgtm.com/blog/apache_struts_CVE-2017-9805)\n- [Apache Struts Statement on Equifax Security Breach](https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax)\n- [Apache Security Bulletin](https://cwiki.apache.org/confluence/display/WW/S2-052)\n",
+      "disclosureTime": "2017-09-05T17:28:23.339000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-31495",
+      "identifiers": {
+        "CVE": [
+          "CVE-2017-9805"
+        ],
+        "CWE": [
+          "CWE-502",
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:45.524837Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2017-09-06T17:28:23.339000Z",
+      "references": [
+        {
+          "title": "Apache Security Bulletin",
+          "url": "https://cwiki.apache.org/confluence/display/WW/S2-052"
+        },
+        {
+          "title": "Apache Struts Statement on Equifax Security Breach",
+          "url": "https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax"
+        },
+        {
+          "title": "LGTM Vulnerability Details",
+          "url": "https://lgtm.com/blog/apache_struts_CVE-2017-9805"
+        },
+        {
+          "title": "LGTM Advisory",
+          "url": "https://lgtm.com/blog/apache_struts_CVE-2017-9805_announcement"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[,2.3.34), [2.4,2.5.13)"
+        ]
+      },
+      "severity": "high",
+      "title": "Arbitrary Command Execution",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.34"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+      "alternativeIds": [],
+      "creationTime": "2017-09-12T12:47:32.905000Z",
+      "credit": [
+        "Yasser Zamani"
+      ],
+      "cvssScore": 7.5,
+      "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) attacks.\nWhen using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack.\n\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.33, 2.5.12 or higher.\n\n## References\n- [Struts Security Bulletin](http://struts.apache.org/docs/s2-049.html)\n- [Struts Announcements Mailing List](https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d@%3Cannouncements.struts.apache.org%3E)\n",
+      "disclosureTime": "2017-08-23T21:00:00Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-31500",
+      "identifiers": {
+        "CVE": [
+          "CVE-2017-9787"
+        ],
+        "CWE": [
+          "CWE-400"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:45.530953Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2017-09-12T12:47:32.905000Z",
+      "references": [
+        {
+          "title": "Struts Announcements Mailing List",
+          "url": "https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d@%3Cannouncements.struts.apache.org%3E"
+        },
+        {
+          "title": "Struts Security Bulletin",
+          "url": "http://struts.apache.org/docs/s2-049.html"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.7,2.3.33), [2.5,2.5.12)"
+        ]
+      },
+      "severity": "high",
+      "title": "Denial of Service (DoS)",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.33"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+      "alternativeIds": [],
+      "creationTime": "2017-09-12T12:47:32.905000Z",
+      "credit": [
+        "Adam Cazzolla",
+        "Jonathan Bullock"
+      ],
+      "cvssScore": 5.9,
+      "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This is due to an incomplete fix for [CVE-2017-7672](https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-31499). If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.34, 2.5.13 or higher.\n\n## References\n- [Struts Security Bulletin](http://struts.apache.org/docs/s2-050.html)\n",
+      "disclosureTime": "2017-08-23T21:00:00Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-31501",
+      "identifiers": {
+        "CVE": [
+          "CVE-2017-9804"
+        ],
+        "CWE": [
+          "CWE-400"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:51.861942Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2017-09-12T12:47:32.905000Z",
+      "references": [
+        {
+          "title": "Struts Security Bulletin",
+          "url": "http://struts.apache.org/docs/s2-050.html"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.7,2.3.34), [2.5,2.5.13)"
+        ]
+      },
+      "severity": "medium",
+      "title": "Denial of Service (DoS)",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.34"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+      "alternativeIds": [],
+      "creationTime": "2017-09-12T12:47:32.905000Z",
+      "credit": [
+        "Huijun Chen",
+        "Xiaolong Zhu"
+      ],
+      "cvssScore": 5.9,
+      "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Denial of Service (ReDoS) attacks. The REST Plugin is using outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.34, 2.5.13 or higher.\n\n## References\n- [Struts Security Bulletin](http://struts.apache.org/docs/s2-051.html)\n",
+      "disclosureTime": "2017-08-23T21:00:00Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-31502",
+      "identifiers": {
+        "CVE": [
+          "CVE-2017-9793"
+        ],
+        "CWE": [
+          "CWE-400"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:45.532865Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2017-09-12T12:47:32.905000Z",
+      "references": [
+        {
+          "title": "Struts Security Bulletin",
+          "url": "http://struts.apache.org/docs/s2-051.html"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.7,2.3.34), [2.5,2.5.13)"
+        ]
+      },
+      "severity": "medium",
+      "title": "Denial of Service (DoS)",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.34"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-09-06T17:28:23.339000Z",
+      "credit": [
+        "Lupin",
+        "David Greene",
+        "Roland McIntosh"
+      ],
+      "cvssScore": 5.6,
+      "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution. An unauthenticated attack may be able to exploit this \nWhen using expression literals or forcing expression in Freemarker tags (see example below) and using request values can lead to RCE attack.\n\n```xml\n<@s.hidden name=\"redirectUri\" value=redirectUri />\n<@s.hidden name=\"redirectUri\" value=\"${redirectUri}\" />\n<@s.hidden name=\"${redirectUri}\"/>\n```\n\nIn both cases a writable property is used in the value attribute and in both cases this is threatened as an expression by Freemarker. Please be aware that using Struts expression evaluation style is safe:\n\n```\n<@s.hidden name=\"redirectUri\" value=\"%{redirectUri}\" />\n<@s.hidden name=\"%{redirectUri}\"/>\n```\n\n## Remediation\nDevelopers are strongly advised to upgrade their _Apache Struts_ components to version `2.3.34`, `2.5.12` or higher.\n\n## References\n- [Apache Security Bulletin](https://cwiki.apache.org/confluence/display/WW/S2-053)\n",
+      "disclosureTime": "2017-09-05T17:28:23.339000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-31503",
+      "identifiers": {
+        "CVE": [
+          "CVE-2017-12611"
+        ],
+        "CWE": [
+          "CWE-502",
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:45.534767Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2017-09-06T17:28:23.339000Z",
+      "references": [
+        {
+          "title": "Apache Security Bulletin",
+          "url": "https://cwiki.apache.org/confluence/display/WW/S2-053"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[,2.3.34), [2.4,2.5.12)"
+        ]
+      },
+      "severity": "medium",
+      "title": "Arbitrary Code Execution",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.34"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+      "alternativeIds": [],
+      "creationTime": "2018-08-22T00:00:00Z",
+      "credit": [
+        "Man Yue Mo"
+      ],
+      "cvssScore": 9.8,
+      "description": "## Overview\n[org.apache.struts:struts2-core](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Remote Code Execution.\nWhen the namespace value is not set for a result defined in underlying xml configurations, and in same time, its upper action(s) configurations have no or wildcard namespace, an attacker may be able to conduct a remote code execution attack. They could also use the opportunity when using a url tag which does not have a value and action set and in same time, its upper action(s) configurations have no or wildcard namespace.\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to versions 2.3.35, 2.5.17 or higher.\n\n## References\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1620019)\n- [Struts2 Security Bulletin](https://cwiki.apache.org/confluence/display/WW/S2-057)\n- [Lgtm Blog](https://lgtm.com/blog/apache_struts_CVE-2018-11776)\n",
+      "disclosureTime": "2018-08-17T00:00:00Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTS-32477",
+      "identifiers": {
+        "CVE": [
+          "CVE-2018-11776"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "struts2-core",
+        "groupId": "org.apache.struts"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:46.910309Z",
+      "moduleName": "org.apache.struts:struts2-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts:struts2-core",
+      "patches": [],
+      "publicationTime": "2018-08-22T11:53:44.582000Z",
+      "references": [
+        {
+          "title": "Lgtm Blog",
+          "url": "https://lgtm.com/blog/apache_struts_CVE-2018-11776"
+        },
+        {
+          "title": "Struts2 Security Bulletin",
+          "url": "https://cwiki.apache.org/confluence/display/WW/S2-057"
+        },
+        {
+          "title": "RedHat Bugzilla Bug",
+          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1620019"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.0, 2.3.35), [2.5.0, 2.5.17)"
+        ]
+      },
+      "severity": "high",
+      "title": "Remote Code Execution",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.35"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts:struts2-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.661000Z",
+      "credit": [
+        "Jasper Rosenberg"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nThe default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to \"compromise internal state of an application\" via unspecified vectors.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1831)\n- [Struts Security Advisory](https://struts.apache.org/docs/s2-024.html)\n",
+      "disclosureTime": "2015-07-17T17:44:54Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30797",
+      "identifiers": {
+        "CVE": [
+          "CVE-2015-1831"
+        ],
+        "CWE": [
+          "CWE-94"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "xwork-core",
+        "groupId": "org.apache.struts.xwork"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.452635Z",
+      "moduleName": "org.apache.struts.xwork:xwork-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts.xwork:xwork-core",
+      "patches": [],
+      "publicationTime": "2015-07-17T17:44:54Z",
+      "references": [
+        {
+          "title": "Struts Security Advisory",
+          "url": "https://struts.apache.org/docs/s2-024.html"
+        },
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1831"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.20]"
+        ]
+      },
+      "severity": "high",
+      "title": "Arbitrary Code Execution",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "org.apache.struts.xwork:xwork-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.20.1",
+        "org.apache.struts.xwork:xwork-core@2.3.20.1"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts.xwork:xwork-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.673000Z",
+      "credit": [
+        "rskvp93"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nAffected versions of the package are vulnerable to Parameter Alteration. ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings\n\n\n## References\n- [Apache Security Advisory](https://struts.apache.org/docs/s2-026.html)\n",
+      "disclosureTime": "2015-09-28T16:59:30Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798",
+      "identifiers": {
+        "CVE": [
+          "CVE-2015-5209"
+        ],
+        "CWE": [
+          "CWE-235"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "xwork-core",
+        "groupId": "org.apache.struts.xwork"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.454770Z",
+      "moduleName": "org.apache.struts.xwork:xwork-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts.xwork:xwork-core",
+      "patches": [],
+      "publicationTime": "2015-09-28T16:59:30Z",
+      "references": [
+        {
+          "title": "Apache Security Advisory",
+          "url": "https://struts.apache.org/docs/s2-026.html"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2,2.3.24.1)"
+        ]
+      },
+      "severity": "high",
+      "title": "Parameter Alteration",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "org.apache.struts.xwork:xwork-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.24.1",
+        "org.apache.struts.xwork:xwork-core@2.3.24.1"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts.xwork:xwork-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.686000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 9.8,
+      "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nApache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a \"%{}\" sequence in a tag attribute, aka forced double OGNL evaluation.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0785)",
+      "disclosureTime": "2016-03-16T05:58:06.341000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-0785"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "xwork-core",
+        "groupId": "org.apache.struts.xwork"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.457069Z",
+      "moduleName": "org.apache.struts.xwork:xwork-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts.xwork:xwork-core",
+      "patches": [],
+      "publicationTime": "2016-03-16T05:58:06.341000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0785"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2,2.3.28)"
+        ]
+      },
+      "severity": "high",
+      "title": "Improper Input Validation",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "org.apache.struts.xwork:xwork-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.28",
+        "org.apache.struts.xwork:xwork-core@2.3.28"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts.xwork:xwork-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.701000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 4.3,
+      "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nApache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.\n\n## Details\nCross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s browser to execute malicious JavaScript code in the context of a victim’s domain. Such scripts can steal the user’s session cookies for the domain, scrape or modify its content, and perform or modify actions on the user’s behalf, actions typically blocked by the browser’s Same Origin Policy.\n\nThese attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a \"new\" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like `<` `>` `\"` `'` are not escaped properly.\n\nThere are a few types of XSS:\n- **Persistent XSS** is an attack in which the malicious code persists into the web app’s database.\n- **Reflected XSS** is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.\n- **DOM-based XSS** is an that occurs purely in the browser when client-side JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is notoriously hard to detect, as the server never gets a chance to see the attack taking place.\n\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2162)",
+      "disclosureTime": "2016-03-16T07:51:26.242000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-2162"
+        ],
+        "CWE": [
+          "CWE-79"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "xwork-core",
+        "groupId": "org.apache.struts.xwork"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.459569Z",
+      "moduleName": "org.apache.struts.xwork:xwork-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts.xwork:xwork-core",
+      "patches": [],
+      "publicationTime": "2016-03-16T07:51:26.242000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2162"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2,2.3.25)"
+        ]
+      },
+      "severity": "medium",
+      "title": "Cross-site Scripting (XSS)",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "org.apache.struts.xwork:xwork-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.28",
+        "org.apache.struts.xwork:xwork-core@2.3.28"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts.xwork:xwork-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.713000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 5.3,
+      "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nApache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093)",
+      "disclosureTime": "2016-06-02T02:16:48.918000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-3093"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "xwork-core",
+        "groupId": "org.apache.struts.xwork"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.461613Z",
+      "moduleName": "org.apache.struts.xwork:xwork-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts.xwork:xwork-core",
+      "patches": [],
+      "publicationTime": "2016-06-02T02:16:48.918000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2,2.3.24.1]"
+        ]
+      },
+      "severity": "medium",
+      "title": "Improper Input Validation",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "org.apache.struts.xwork:xwork-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.24.3",
+        "org.apache.struts.xwork:xwork-core@2.3.24.3"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts.xwork:xwork-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.724000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 5.3,
+      "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nApache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433)",
+      "disclosureTime": "2016-06-21T01:33:07.474000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-4433"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "xwork-core",
+        "groupId": "org.apache.struts.xwork"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.463554Z",
+      "moduleName": "org.apache.struts.xwork:xwork-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts.xwork:xwork-core",
+      "patches": [],
+      "publicationTime": "2016-06-21T01:33:07.474000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.20,2.3.28.1]"
+        ]
+      },
+      "severity": "medium",
+      "title": "Improper Input Validation",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "org.apache.struts.xwork:xwork-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.29",
+        "org.apache.struts.xwork:xwork-core@2.3.29"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts.xwork:xwork-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.738000Z",
+      "credit": [
+        "Alvaro Munoz"
+      ],
+      "cvssScore": 7.3,
+      "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nAffected versions of the package are vulnerable to Remote code Execution. The Apache Struts frameworks when forced, performs double evaluation of attributes' values assigned to certain tags so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered.\n\n## References\n- [Apache Security Advisory](https://struts.apache.org/docs/s2-036.html)\n",
+      "disclosureTime": "2016-11-14T07:48:03.440000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-4461"
+        ],
+        "CWE": [
+          "CWE-264"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "xwork-core",
+        "groupId": "org.apache.struts.xwork"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.465500Z",
+      "moduleName": "org.apache.struts.xwork:xwork-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts.xwork:xwork-core",
+      "patches": [],
+      "publicationTime": "2016-11-14T07:48:03.440000Z",
+      "references": [
+        {
+          "title": "Apache Security Advisory",
+          "url": "https://struts.apache.org/docs/s2-036.html"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.2.1,2.3.28.1]"
+        ]
+      },
+      "severity": "high",
+      "title": "Arbitrary Code Execution",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "org.apache.struts.xwork:xwork-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.29",
+        "org.apache.struts.xwork:xwork-core@2.3.29"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts.xwork:xwork-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    },
+    {
+      "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+      "alternativeIds": [],
+      "creationTime": "2017-02-22T07:28:23.751000Z",
+      "credit": [
+        "Unknown"
+      ],
+      "cvssScore": 5.3,
+      "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nThe URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465)",
+      "disclosureTime": "2016-06-20T07:45:43.528000Z",
+      "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804",
+      "identifiers": {
+        "CVE": [
+          "CVE-2016-4465"
+        ],
+        "CWE": [
+          "CWE-20"
+        ]
+      },
+      "language": "java",
+      "mavenModuleName": {
+        "artifactId": "xwork-core",
+        "groupId": "org.apache.struts.xwork"
+      },
+      "methods": [],
+      "modificationTime": "2018-11-18T11:50:44.467512Z",
+      "moduleName": "org.apache.struts.xwork:xwork-core",
+      "packageManager": "maven",
+      "packageName": "org.apache.struts.xwork:xwork-core",
+      "patches": [],
+      "publicationTime": "2016-06-20T07:45:43.528000Z",
+      "references": [
+        {
+          "title": "NVD",
+          "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465"
+        }
+      ],
+      "semver": {
+        "vulnerable": [
+          "[2.3.20,2.3.28.1], [2.5,2.5.1)"
+        ]
+      },
+      "severity": "medium",
+      "title": "Improper Input Validation",
+      "from": [
+        "small-app:small-app_2.10@1.0-SNAPSHOT",
+        "org.apache.struts:struts2-core@2.3.20",
+        "org.apache.struts.xwork:xwork-core@2.3.20"
+      ],
+      "upgradePath": [
+        false,
+        "org.apache.struts:struts2-core@2.3.29",
+        "org.apache.struts.xwork:xwork-core@2.3.29"
+      ],
+      "version": "2.3.20",
+      "name": "org.apache.struts.xwork:xwork-core",
+      "isUpgradable": true,
+      "isPatchable": false
+    }
+  ],
+  "dependencyCount": 11,
+  "org": "snyk",
+  "licensesPolicy": {
+    "severities": {
+      "MS-RL": "medium",
+      "EPL-1.0": "medium",
+      "GPL-2.0": "high",
+      "GPL-3.0": "high",
+      "MPL-1.1": "medium",
+      "MPL-2.0": "medium",
+      "AGPL-1.0": "high",
+      "AGPL-3.0": "high",
+      "CDDL-1.0": "medium",
+      "LGPL-2.0": "medium",
+      "LGPL-2.1": "medium",
+      "LGPL-3.0": "medium",
+      "CPOL-1.02": "high",
+      "LGPL-2.1+": "medium",
+      "LGPL-3.0+": "medium",
+      "SimPL-2.0": "high",
+      "Artistic-1.0": "medium",
+      "Artistic-2.0": "medium"
+    }
+  },
+  "isPrivate": true,
+  "packageManager": "maven",
+  "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+  "ignoreSettings": null,
+  "summary": "31 vulnerable dependency paths",
+  "filesystemPolicy": false,
+  "filtered": {
+    "ignore": [],
+    "patch": []
+  },
+  "uniqueCount": 30,
+  "path": "sbt-simple-struts"
+}
diff --git a/test/acceptance/workspaces/sbt-simple-struts/project/plugins.sbt b/test/acceptance/workspaces/sbt-simple-struts/project/plugins.sbt
new file mode 100644
index 0000000000..7233158126
--- /dev/null
+++ b/test/acceptance/workspaces/sbt-simple-struts/project/plugins.sbt
@@ -0,0 +1 @@
+addSbtPlugin("net.virtual-void" % "sbt-dependency-graph" % "0.9.0")
diff --git a/test/acceptance/workspaces/sbt-simple-struts/test-graph-result.json b/test/acceptance/workspaces/sbt-simple-struts/test-graph-result.json
new file mode 100644
index 0000000000..0f0525b275
--- /dev/null
+++ b/test/acceptance/workspaces/sbt-simple-struts/test-graph-result.json
@@ -0,0 +1,2266 @@
+{
+  "result": {
+    "affectedPkgs": {
+      "commons-fileupload:commons-fileupload@1.3.1": {
+        "pkg": {
+          "name": "commons-fileupload:commons-fileupload",
+          "version": "1.3.1"
+        },
+        "issues": {
+          "SNYK-JAVA-COMMONSFILEUPLOAD-30082": {
+            "issueId": "SNYK-JAVA-COMMONSFILEUPLOAD-30082",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.30"
+                    },
+                    {
+                      "name": "commons-fileupload:commons-fileupload",
+                      "version": "1.3.1",
+                      "newVersion": "1.3.2"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-COMMONSFILEUPLOAD-30401": {
+            "issueId": "SNYK-JAVA-COMMONSFILEUPLOAD-30401",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.5.12"
+                    },
+                    {
+                      "name": "commons-fileupload:commons-fileupload",
+                      "version": "1.3.1",
+                      "newVersion": "1.3.3"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-COMMONSFILEUPLOAD-31540": {
+            "issueId": "SNYK-JAVA-COMMONSFILEUPLOAD-31540",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.30"
+                    },
+                    {
+                      "name": "commons-fileupload:commons-fileupload",
+                      "version": "1.3.1",
+                      "newVersion": "1.3.2"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "ognl:ognl@3.0.6": {
+        "pkg": {
+          "name": "ognl:ognl",
+          "version": "3.0.6"
+        },
+        "issues": {
+          "SNYK-JAVA-OGNL-30474": {
+            "issueId": "SNYK-JAVA-OGNL-30474",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.28"
+                    },
+                    {
+                      "name": "ognl:ognl",
+                      "version": "3.0.6",
+                      "newVersion": "3.0.13"
+                    }
+                  ]
+                },
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.28"
+                    },
+                    {
+                      "name": "org.apache.struts.xwork:xwork-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.28"
+                    },
+                    {
+                      "name": "ognl:ognl",
+                      "version": "3.0.6",
+                      "newVersion": "3.0.13"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "org.apache.struts:struts2-core@2.3.20": {
+        "pkg": {
+          "name": "org.apache.struts:struts2-core",
+          "version": "2.3.20"
+        },
+        "issues": {
+          "SNYK-JAVA-ORGAPACHESTRUTS-30058": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30058",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.20.1"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-30060": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30060",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.24.1"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-30207": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30207",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.32"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-30770": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30770",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.20.3"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-30771": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30771",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.20.3"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-30772": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30772",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.20.3"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-30773": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30773",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.28"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-30774": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30774",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.29"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-30775": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30775",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.29"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-30776": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30776",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.29"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-30777": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30777",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.29"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-30778": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-30778",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.31"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-31495": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-31495",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.34"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-31500": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-31500",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.33"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-31501": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-31501",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.34"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-31502": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-31502",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.34"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-31503": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-31503",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.34"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTS-32477": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTS-32477",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.35"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      },
+      "org.apache.struts.xwork:xwork-core@2.3.20": {
+        "pkg": {
+          "name": "org.apache.struts.xwork:xwork-core",
+          "version": "2.3.20"
+        },
+        "issues": {
+          "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30797": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30797",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.20.1"
+                    },
+                    {
+                      "name": "org.apache.struts.xwork:xwork-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.20.1"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.24.1"
+                    },
+                    {
+                      "name": "org.apache.struts.xwork:xwork-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.24.1"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.28"
+                    },
+                    {
+                      "name": "org.apache.struts.xwork:xwork-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.28"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.28"
+                    },
+                    {
+                      "name": "org.apache.struts.xwork:xwork-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.28"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.24.3"
+                    },
+                    {
+                      "name": "org.apache.struts.xwork:xwork-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.24.3"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.29"
+                    },
+                    {
+                      "name": "org.apache.struts.xwork:xwork-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.29"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.29"
+                    },
+                    {
+                      "name": "org.apache.struts.xwork:xwork-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.29"
+                    }
+                  ]
+                }
+              ]
+            }
+          },
+          "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804": {
+            "issueId": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804",
+            "fixInfo": {
+              "isPatchable": false,
+              "upgradePaths": [
+                {
+                  "path": [
+                    {
+                      "name": "small-app:small-app_2.10",
+                      "version": "1.0-SNAPSHOT"
+                    },
+                    {
+                      "name": "org.apache.struts:struts2-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.29"
+                    },
+                    {
+                      "name": "org.apache.struts.xwork:xwork-core",
+                      "version": "2.3.20",
+                      "newVersion": "2.3.29"
+                    }
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      }
+    },
+    "issuesData": {
+      "SNYK-JAVA-COMMONSFILEUPLOAD-30082": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+        "alternativeIds": [],
+        "creationTime": "2016-12-25T16:51:56Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 7.5,
+        "description": "## Overview\n[`commons-fileupload:commons-fileupload`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22commons-fileupload%22) provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) attacks. An attacker can upload a file with a long boundry string in the HTTP header, causing high CPU consumption. The `MultipartStream` class contains a flaw that allows remote attackers to cause a Denial of service (CPU consumption) attacks. This happens by setting the length of the multipart boundary to be just below the size of the buffer (4096 bytes) used to read the uploaded file. Typically, the boundary is tens of bytes long, which caused this case to take much longer than usual.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `commons-fileupload:commons-fileupload` to version 1.3.2 or higher.\n\n## References\n- [Github ChangeLog](https://github.com/apache/commons-fileupload/blob/b1498c9877d751f8bc4635a6f252ebdfcba28518/src/changes/changes.xml#L84)\n- [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1349475)\n- [Apache Mailing Archives](http://mail-archives.us.apache.org/mod_mbox/www-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832@apache.org%3E)\n- [Apache-SVN](http://svn.apache.org/viewvc/commons/proper/fileupload/trunk/RELEASE-NOTES.txt?r1=1745717&r2=1749637&diff_format=h)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092)\n",
+        "disclosureTime": "2016-06-22T16:51:56Z",
+        "id": "SNYK-JAVA-COMMONSFILEUPLOAD-30082",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-3092"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "commons-fileupload",
+          "groupId": "commons-fileupload"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-19T10:10:06.158206Z",
+        "moduleName": "commons-fileupload:commons-fileupload",
+        "packageManager": "maven",
+        "packageName": "commons-fileupload:commons-fileupload",
+        "patches": [],
+        "publicationTime": "2016-06-22T16:51:56Z",
+        "references": [
+          {
+            "title": "CVE",
+            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092"
+          },
+          {
+            "title": "Apache-SVN",
+            "url": "http://svn.apache.org/viewvc/commons/proper/fileupload/trunk/RELEASE-NOTES.txt?r1=1745717&r2=1749637&diff_format=h"
+          },
+          {
+            "title": "Apache Mailing Archives",
+            "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832@apache.org%3E"
+          },
+          {
+            "title": "Redhat Bugzilla",
+            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349475"
+          },
+          {
+            "title": "Github ChangeLog",
+            "url": "https://github.com/apache/commons-fileupload/blob/b1498c9877d751f8bc4635a6f252ebdfcba28518/src/changes/changes.xml#L84"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[1.3,1.3.2)"
+          ]
+        },
+        "severity": "high",
+        "title": "Denial of Service (DoS)"
+      },
+      "SNYK-JAVA-COMMONSFILEUPLOAD-30401": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:18.753000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 9.8,
+        "description": "## Overview\n[`commons-fileupload:commons-fileupload`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22commons-fileupload%22)\nThe Apache Commons FileUpload library contains a Java Object that, upon deserialization, can be manipulated to write or copy files in arbitrary locations. If integrated with [`ysoserial`](https://github.com/frohoff/ysoserial), it is possible to upload and execute binaries in a single deserialization call.\n\n# Details\nSerialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.\n\n_Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.\n\nJava deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a [popular library (Apache Commons Collection)](https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.\n\nAn attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.\n\n> Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).\n- Apache Blog\n\n## Remediation\nUpgrade `commons-fileupload` to version 1.3.3 or higher.\n\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000031)\n- [Tenable Security](http://www.tenable.com/security/research/tra-2016-12)\n- [Github ChangeLog](https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml#L65)\n- [Github Commit](https://github.com/apache/commons-fileupload/commit/388e824518697c2c8f9f83fd964621d9c2f8fc4c)\n",
+        "disclosureTime": "2016-10-26T03:04:11.895000Z",
+        "id": "SNYK-JAVA-COMMONSFILEUPLOAD-30401",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-1000031"
+          ],
+          "CWE": [
+            "CWE-284"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "commons-fileupload",
+          "groupId": "commons-fileupload"
+        },
+        "methods": [
+          {
+            "methodId": {
+              "className": "DiskFileItem",
+              "filePath": "org/apache/commons/fileupload/disk/DiskFileItem.java",
+              "methodName": "readObject"
+            },
+            "version": [
+              "[1.1,1.3.3)"
+            ]
+          }
+        ],
+        "modificationTime": "2018-11-19T10:10:05.780180Z",
+        "moduleName": "commons-fileupload:commons-fileupload",
+        "packageManager": "maven",
+        "packageName": "commons-fileupload:commons-fileupload",
+        "patches": [],
+        "publicationTime": "2016-10-26T03:04:11.895000Z",
+        "references": [
+          {
+            "title": "Github Commit",
+            "url": "https://github.com/apache/commons-fileupload/commit/388e824518697c2c8f9f83fd964621d9c2f8fc4c"
+          },
+          {
+            "title": "Github ChangeLog",
+            "url": "https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml#L65"
+          },
+          {
+            "title": "Tenable Security",
+            "url": "http://www.tenable.com/security/research/tra-2016-12"
+          },
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000031"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[1.1,1.3.3)"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Code Execution"
+      },
+      "SNYK-JAVA-COMMONSFILEUPLOAD-31540": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-10-01T08:05:48.497000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 6.5,
+        "description": "## Overview\n[`commons-fileupload:commons-fileupload`](https://commons.apache.org/proper/commons-fileupload/) provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.\n\nAffected versions of the package are vulnerable to Information Disclosure because the `InputStream` is not closed on exception.\n\n## Remediation\nUpgrade `commons-fileupload` to version 1.3.2 or higher.\n\n## References\n- [Github ChangeLog](https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml#L56)\n- [Github Commit](https://github.com/apache/commons-fileupload/commit/5b4881d7f75f439326f54fa554a9ca7de6d60814)\n",
+        "disclosureTime": "2014-02-17T22:00:00Z",
+        "id": "SNYK-JAVA-COMMONSFILEUPLOAD-31540",
+        "identifiers": {
+          "CVE": [],
+          "CWE": [
+            "CWE-200"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "commons-fileupload",
+          "groupId": "commons-fileupload"
+        },
+        "methods": [
+          {
+            "methodId": {
+              "className": "FileItemIteratorImpl",
+              "filePath": "org/apache/commons/fileupload/FileUploadBase.java",
+              "methodName": "FileItemIteratorImpl"
+            },
+            "version": [
+              "[,1.3.2)"
+            ]
+          }
+        ],
+        "modificationTime": "2018-11-19T10:10:06.169597Z",
+        "moduleName": "commons-fileupload:commons-fileupload",
+        "packageManager": "maven",
+        "packageName": "commons-fileupload:commons-fileupload",
+        "patches": [],
+        "publicationTime": "2017-02-17T08:05:48.497000Z",
+        "references": [
+          {
+            "title": "Github Commit",
+            "url": "https://github.com/apache/commons-fileupload/commit/5b4881d7f75f439326f54fa554a9ca7de6d60814"
+          },
+          {
+            "title": "Github ChangeLog",
+            "url": "https://github.com/apache/commons-fileupload/blob/master/src/changes/changes.xml#L56"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[,1.3.2)"
+          ]
+        },
+        "severity": "medium",
+        "title": "Information Disclosure"
+      },
+      "SNYK-JAVA-OGNL-30474": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:19.659000Z",
+        "credit": [
+          "Tao Wang"
+        ],
+        "cvssScore": 5.3,
+        "description": "## Overview\n[`ognl:ognl`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22ognl%22) is a simple Expression Language (EL) for Java.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) attacks.\nApache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `ognl:ognl` to version 3.0.12 or higher.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093)\n- [GitHub Commit](https://github.com/jkuhnert/ognl/commit/ae43073fbf38db8371ff4f8bf2a966ee3b5f7e92)\n",
+        "disclosureTime": "2016-06-02T02:16:48.918000Z",
+        "id": "SNYK-JAVA-OGNL-30474",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-3093"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "ognl",
+          "groupId": "ognl"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.976769Z",
+        "moduleName": "ognl:ognl",
+        "packageManager": "maven",
+        "packageName": "ognl:ognl",
+        "patches": [],
+        "publicationTime": "2016-06-02T02:16:48.918000Z",
+        "references": [
+          {
+            "title": "GitHub Commit",
+            "url": "https://github.com/jkuhnert/ognl/commit/ae43073fbf38db8371ff4f8bf2a966ee3b5f7e92"
+          },
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[,3.0.12)"
+          ]
+        },
+        "severity": "medium",
+        "title": "Denial of Service (DoS)"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30058": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2016-12-25T16:51:55Z",
+        "credit": [
+          "Jasper Rosenberg"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nThe default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to \"compromise internal state of an application\" via unspecified vectors.\n\n## References\n\n- [Vulnerability Summary](http://struts.apache.org/docs/s2-024.html)\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1831)\n",
+        "disclosureTime": "2015-05-11T16:51:55Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30058",
+        "identifiers": {
+          "CVE": [
+            "CVE-2015-1831"
+          ],
+          "CWE": [
+            "CWE-453"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.629946Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2015-05-11T16:51:55Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1831"
+          },
+          {
+            "title": "Vulnerability Summary",
+            "url": "http://struts.apache.org/docs/s2-024.html"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.20]"
+          ]
+        },
+        "severity": "high",
+        "title": "Insecure Defaults"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30060": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
+        "alternativeIds": [],
+        "creationTime": "2016-12-25T16:51:56Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 9.1,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings.\n\n## References\n\n- [Vulnerability Summary](http://struts.apache.org/docs/s2-026.html)\n",
+        "disclosureTime": "2015-07-01T16:51:56Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30060",
+        "identifiers": {
+          "CVE": [
+            "CVE-2015-5209"
+          ],
+          "CWE": [
+            "CWE-284"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:43.633538Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2015-07-01T16:51:56Z",
+        "references": [
+          {
+            "title": "Vulnerability Summary",
+            "url": "http://struts.apache.org/docs/s2-026.html"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "(,2.3.24]"
+          ]
+        },
+        "severity": "low",
+        "title": "Manipulation of Struts' internals"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30207": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H",
+        "alternativeIds": [],
+        "creationTime": "2017-03-19T10:28:21.873000Z",
+        "credit": [
+          "Nike Zheng"
+        ],
+        "cvssScore": 9.8,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](https://cwiki.apache.org/confluence/display/WW/Home) is an elegant, extensible framework for building enterprise-ready Java web applications.\n\nAffected versions of the package are vulnerable to Arbitrary Command Execution while uploading files with the Jakarta Multipart parser. This particular vulnerability can be exploited by an attacker by sending a crafted request to upload a file to the vulnerable server that uses a Jakarta-based plugin to process the upload request.\n\nThe attacker can then send malicious code in the `Content-Type`, `Content-Disposition` or `Content-Length` HTTP headers, which will then be executed by the vulnerable server. [A proof of concept](https://github.com/tengzhangchao/Struts2_045-Poc) that demonstrates the attack scenario is publicly available and the vulnerability is being [actively exploited in the wild](https://www.theregister.co.uk/2017/03/09/apache_under_attack_patch_for_zero_day_available/).\n\nAlthough maintainers of the open source project immediately patched the vulnerability, Struts servers that have yet to install the update remain under attack by hackers who exploit it to inject commands of their choice.\n\nThis attack can be achieved without authentication. To make matters worse, web applications don't necessarily need to successfully upload a malicious file to exploit this vulnerability, as just the presence of the vulnerable Struts library within an application is enough to exploit the vulnerability.\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.32, 2.5.10.1 or higher.\n\n## References\n- [Metasploit GitHub PR](https://github.com/rapid7/metasploit-framework/pull/8072)\n- [Metasploit GitHub Issue](https://github.com/rapid7/metasploit-framework/issues/8064)\n- [Metasploit GitHub Commit](https://github.com/rapid7/metasploit-framework/pull/8072/commits/fc0f63e77471baa40057effaaa8be0f205adc6b7)\n- [PoC](https://github.com/tengzhangchao/Struts2_045-Poc)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638)\n- [Exploit DB](https://www.exploit-db.com/exploits/41570/)\n- [Struts Wiki](https://cwiki.apache.org/confluence/display/WW/S2-045)\n- [Talos Intelligence Blog](http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html)\n",
+        "disclosureTime": "2017-03-05T22:00:00Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30207",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-5638"
+          ],
+          "CWE": [
+            "CWE-94"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [
+          {
+            "methodId": {
+              "className": "JakartaMultiPartRequest",
+              "filePath": "org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java",
+              "methodName": "buildErrorMessage"
+            },
+            "version": [
+              "[2.5,2.5.10.1)"
+            ]
+          }
+        ],
+        "modificationTime": "2018-11-18T11:50:51.735176Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2017-03-21T15:30:44.863000Z",
+        "references": [
+          {
+            "title": "Talos Intelligence Blog",
+            "url": "http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html"
+          },
+          {
+            "title": "Struts Wiki",
+            "url": "https://cwiki.apache.org/confluence/display/WW/S2-045"
+          },
+          {
+            "title": "Exploit DB",
+            "url": "https://www.exploit-db.com/exploits/41570/"
+          },
+          {
+            "title": "CVE",
+            "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638"
+          },
+          {
+            "title": "PoC",
+            "url": "https://github.com/tengzhangchao/Struts2_045-Poc"
+          },
+          {
+            "title": "Metasploit GitHub Commit",
+            "url": "https://github.com/rapid7/metasploit-framework/pull/8072/commits/fc0f63e77471baa40057effaaa8be0f205adc6b7"
+          },
+          {
+            "title": "Metasploit GitHub Issue",
+            "url": "https://github.com/rapid7/metasploit-framework/issues/8064"
+          },
+          {
+            "title": "Metasploit GitHub PR",
+            "url": "https://github.com/rapid7/metasploit-framework/pull/8072"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.5,2.3.32), [2.5,2.5.10.1)"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Code Execution"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30770": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.315000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 8.8,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nApache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3081)",
+        "disclosureTime": "2016-04-22T04:32:51.243000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30770",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-3081"
+          ],
+          "CWE": [
+            "CWE-77"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.399409Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2016-04-22T04:32:51.243000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3081"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2,2.3.20.2), [2.3.24,2.3.24.2), [2.3.28,2.3.28.1)"
+          ]
+        },
+        "severity": "high",
+        "title": "Command Injection"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30771": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.327000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 9.8,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22) is a free open-source solution for creating Java web applications.\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution. It allows remote attackers to execute arbitrary code via the stylesheet location parameter.\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.20.2, 2.3.24.2, 2.3.28.1 or higher.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3082)",
+        "disclosureTime": "2016-04-22T02:36:52.273000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30771",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-3082"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.401329Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2016-04-22T02:36:52.273000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3082"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2,2.3.20.2), [2.3.24,2.3.24.2), [2.3.28,2.3.28.1)"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Code Execution"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30772": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.339000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nApache Struts 2.3.20.x before 2.3.20.3, 2.3.24.x before 2.3.24.3, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3087)",
+        "disclosureTime": "2016-06-02T00:40:36.101000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30772",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-3087"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.403291Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2016-06-02T00:40:36.101000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3087"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2,2.3.20.2), [2.3.24,2.3.24.3), [2.3.28,2.3.28.1)"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Command Execution"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30773": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.353000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 4.3,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nCross-site Scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.\n\n## Details\nCross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s browser to execute malicious JavaScript code in the context of a victim’s domain. Such scripts can steal the user’s session cookies for the domain, scrape or modify its content, and perform or modify actions on the user’s behalf, actions typically blocked by the browser’s Same Origin Policy.\n\nThese attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a \"new\" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like `<` `>` `\"` `'` are not escaped properly.\n\nThere are a few types of XSS:\n- **Persistent XSS** is an attack in which the malicious code persists into the web app’s database.\n- **Reflected XSS** is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.\n- **DOM-based XSS** is an that occurs purely in the browser when client-side JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is notoriously hard to detect, as the server never gets a chance to see the attack taking place.\n\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4003)",
+        "disclosureTime": "2016-03-16T06:52:13.014000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30773",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-4003"
+          ],
+          "CWE": [
+            "CWE-79"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.405310Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2016-03-16T06:52:13.014000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4003"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[,2.3.28)"
+          ]
+        },
+        "severity": "medium",
+        "title": "Cross-site Scripting (XSS)"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30774": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.364000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 6.3,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nApache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4430)",
+        "disclosureTime": "2016-06-20T07:00:37.929000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30774",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-4430"
+          ],
+          "CWE": [
+            "CWE-352"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.407111Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2016-06-20T07:00:37.929000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4430"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.20,2.3.28.1]"
+          ]
+        },
+        "severity": "medium",
+        "title": "Cross-site Request Forgery (CSRF)"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30775": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.377000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.3,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nApache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4431)",
+        "disclosureTime": "2016-06-21T04:49:27.674000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30775",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-4431"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.409079Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2016-06-21T04:49:27.674000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4431"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.20,2.3.28.1]"
+          ]
+        },
+        "severity": "medium",
+        "title": "Access Restriction Bypass"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30776": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.390000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.3,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nApache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433)",
+        "disclosureTime": "2016-06-21T01:33:07.474000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30776",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-4433"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.411243Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2016-06-21T01:33:07.474000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.20,2.3.28.1]"
+          ]
+        },
+        "severity": "medium",
+        "title": "Access Restriction Bypass"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30777": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.404000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.3,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nThe URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465)",
+        "disclosureTime": "2016-06-20T07:45:43.528000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30777",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-4465"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.413209Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2016-06-20T07:45:43.528000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.5,2.5.1), [2.3.20, 2.3.28.1]"
+          ]
+        },
+        "severity": "medium",
+        "title": "Denial of Service (DoS)"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-30778": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.415000Z",
+        "credit": [
+          "Takeshi Terada"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[`org.apache.struts:struts2-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22struts2-core%22)\nAffected versions of the package are vulnerable to Directory Traversal.\n\n## Details\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n\n## References\n- [Apache Security Advisory](http://struts.apache.org/docs/s2-042.html)\n",
+        "disclosureTime": "2016-10-19T01:09:09.263000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-30778",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-6795"
+          ],
+          "CWE": [
+            "CWE-94"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.415113Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2016-10-19T01:09:09.263000Z",
+        "references": [
+          {
+            "title": "Apache Security Advisory",
+            "url": "http://struts.apache.org/docs/s2-042.html"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.20,2.3.31)"
+          ]
+        },
+        "severity": "high",
+        "title": "Directory Traversal"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-31495": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+        "alternativeIds": [],
+        "creationTime": "2017-09-06T17:28:23.339000Z",
+        "credit": [
+          "LGTM Security Team"
+        ],
+        "cvssScore": 8.1,
+        "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nThe REST Plugin in affected versions use a `XStreamHandler` with an instance of XStream for deserialization without any type filtering. By design, there are few limits to the type of objects XStream can handle. This flexibility comes at a price. The XML generated or consumed by XStream includes all information required to build Java objects of almost any type. The provided XML data is used by XStream to unmarshal Java objects. An attacker could use this flaw to execute arbitrary code or conduct further attacks.\n\n[A working exploit](https://github.com/rapid7/metasploit-framework/commit/5ea83fee5ee8c23ad95608b7e2022db5b48340ef) is publicly available and [is actively](https://www.imperva.com/blog/2017/09/cve-2017-9805-analysis-of-apache-struts-rce-vulnerability-in-rest-plugin/) exploited in the wild.\n\nYou can read more about this vulnerability [on our blog](https://snyk.io/blog/equifax-breach-vulnerable-open-source-libraries/).\n\n# Details\nSerialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.\n\n_Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker control the state or the flow of the execution. \n\nJava deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a [popular library (Apache Commons Collection)](https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.\n\nAn attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.\n\n> Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).\n- Apache Blog\n\n\n## Remediation\nDevelopers are strongly advised to upgrade their _Apache Struts_ components to version `2.3.34`, `2.5.13` or higher.\n\nIt is possible that some REST actions stop working because of applied default restrictions on available classes. In this case please investigate the new interfaces that were introduced to allow class restrictions per action, those interfaces are:\n* org.apache.struts2.rest.handler.AllowedClasses\n* org.apache.struts2.rest.handler.AllowedClassNames\n* org.apache.struts2.rest.handler.XStreamPermissionProvider\n\nIf for some reason upgrading is not an option, consider the following workarounds:\n1. Disable handling XML pages and requests to such pages\n```xml\n<constant name=\"struts.action.extension\" value=\"xhtml,,json\" />\n```\n\n2. Override getContentType in XStreamHandler\n```java\n public class MyXStreamHandler extends XStreamHandler { \n   public String getContentType() {\n     return \"not-existing-content-type-@;/&%$#@\";\n   }\n }\n```\n\n3. Register the handler by overriding the one provided by the framework in your struts.xml\n```xml\n<bean type=\"org.apache.struts2.rest.handler.ContentTypeHandler\" name=\"myXStreamHandmer\" class=\"com.company.MyXStreamHandler\"/>\n<constant name=\"struts.rest.handlerOverride.xml\" value=\"myXStreamHandler\"/>\n```\n\n## References\n- [LGTM Advisory](https://lgtm.com/blog/apache_struts_CVE-2017-9805_announcement)\n- [LGTM Vulnerability Details](https://lgtm.com/blog/apache_struts_CVE-2017-9805)\n- [Apache Struts Statement on Equifax Security Breach](https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax)\n- [Apache Security Bulletin](https://cwiki.apache.org/confluence/display/WW/S2-052)\n",
+        "disclosureTime": "2017-09-05T17:28:23.339000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-31495",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-9805"
+          ],
+          "CWE": [
+            "CWE-502",
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:45.524837Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2017-09-06T17:28:23.339000Z",
+        "references": [
+          {
+            "title": "Apache Security Bulletin",
+            "url": "https://cwiki.apache.org/confluence/display/WW/S2-052"
+          },
+          {
+            "title": "Apache Struts Statement on Equifax Security Breach",
+            "url": "https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax"
+          },
+          {
+            "title": "LGTM Vulnerability Details",
+            "url": "https://lgtm.com/blog/apache_struts_CVE-2017-9805"
+          },
+          {
+            "title": "LGTM Advisory",
+            "url": "https://lgtm.com/blog/apache_struts_CVE-2017-9805_announcement"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[,2.3.34), [2.4,2.5.13)"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Command Execution"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-31500": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+        "alternativeIds": [],
+        "creationTime": "2017-09-12T12:47:32.905000Z",
+        "credit": [
+          "Yasser Zamani"
+        ],
+        "cvssScore": 7.5,
+        "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) attacks.\nWhen using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack.\n\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.33, 2.5.12 or higher.\n\n## References\n- [Struts Security Bulletin](http://struts.apache.org/docs/s2-049.html)\n- [Struts Announcements Mailing List](https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d@%3Cannouncements.struts.apache.org%3E)\n",
+        "disclosureTime": "2017-08-23T21:00:00Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-31500",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-9787"
+          ],
+          "CWE": [
+            "CWE-400"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:45.530953Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2017-09-12T12:47:32.905000Z",
+        "references": [
+          {
+            "title": "Struts Announcements Mailing List",
+            "url": "https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d@%3Cannouncements.struts.apache.org%3E"
+          },
+          {
+            "title": "Struts Security Bulletin",
+            "url": "http://struts.apache.org/docs/s2-049.html"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.7,2.3.33), [2.5,2.5.12)"
+          ]
+        },
+        "severity": "high",
+        "title": "Denial of Service (DoS)"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-31501": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+        "alternativeIds": [],
+        "creationTime": "2017-09-12T12:47:32.905000Z",
+        "credit": [
+          "Adam Cazzolla",
+          "Jonathan Bullock"
+        ],
+        "cvssScore": 5.9,
+        "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This is due to an incomplete fix for [CVE-2017-7672](https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-31499). If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.34, 2.5.13 or higher.\n\n## References\n- [Struts Security Bulletin](http://struts.apache.org/docs/s2-050.html)\n",
+        "disclosureTime": "2017-08-23T21:00:00Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-31501",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-9804"
+          ],
+          "CWE": [
+            "CWE-400"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:51.861942Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2017-09-12T12:47:32.905000Z",
+        "references": [
+          {
+            "title": "Struts Security Bulletin",
+            "url": "http://struts.apache.org/docs/s2-050.html"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.7,2.3.34), [2.5,2.5.13)"
+          ]
+        },
+        "severity": "medium",
+        "title": "Denial of Service (DoS)"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-31502": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+        "alternativeIds": [],
+        "creationTime": "2017-09-12T12:47:32.905000Z",
+        "credit": [
+          "Huijun Chen",
+          "Xiaolong Zhu"
+        ],
+        "cvssScore": 5.9,
+        "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Denial of Service (ReDoS) attacks. The REST Plugin is using outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to version 2.3.34, 2.5.13 or higher.\n\n## References\n- [Struts Security Bulletin](http://struts.apache.org/docs/s2-051.html)\n",
+        "disclosureTime": "2017-08-23T21:00:00Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-31502",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-9793"
+          ],
+          "CWE": [
+            "CWE-400"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:45.532865Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2017-09-12T12:47:32.905000Z",
+        "references": [
+          {
+            "title": "Struts Security Bulletin",
+            "url": "http://struts.apache.org/docs/s2-051.html"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.7,2.3.34), [2.5,2.5.13)"
+          ]
+        },
+        "severity": "medium",
+        "title": "Denial of Service (DoS)"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-31503": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-09-06T17:28:23.339000Z",
+        "credit": [
+          "Lupin",
+          "David Greene",
+          "Roland McIntosh"
+        ],
+        "cvssScore": 5.6,
+        "description": "## Overview\n[Apache Struts2](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution. An unauthenticated attack may be able to exploit this \nWhen using expression literals or forcing expression in Freemarker tags (see example below) and using request values can lead to RCE attack.\n\n```xml\n<@s.hidden name=\"redirectUri\" value=redirectUri />\n<@s.hidden name=\"redirectUri\" value=\"${redirectUri}\" />\n<@s.hidden name=\"${redirectUri}\"/>\n```\n\nIn both cases a writable property is used in the value attribute and in both cases this is threatened as an expression by Freemarker. Please be aware that using Struts expression evaluation style is safe:\n\n```\n<@s.hidden name=\"redirectUri\" value=\"%{redirectUri}\" />\n<@s.hidden name=\"%{redirectUri}\"/>\n```\n\n## Remediation\nDevelopers are strongly advised to upgrade their _Apache Struts_ components to version `2.3.34`, `2.5.12` or higher.\n\n## References\n- [Apache Security Bulletin](https://cwiki.apache.org/confluence/display/WW/S2-053)\n",
+        "disclosureTime": "2017-09-05T17:28:23.339000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-31503",
+        "identifiers": {
+          "CVE": [
+            "CVE-2017-12611"
+          ],
+          "CWE": [
+            "CWE-502",
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:45.534767Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2017-09-06T17:28:23.339000Z",
+        "references": [
+          {
+            "title": "Apache Security Bulletin",
+            "url": "https://cwiki.apache.org/confluence/display/WW/S2-053"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[,2.3.34), [2.4,2.5.12)"
+          ]
+        },
+        "severity": "medium",
+        "title": "Arbitrary Code Execution"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTS-32477": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+        "alternativeIds": [],
+        "creationTime": "2018-08-22T00:00:00Z",
+        "credit": [
+          "Man Yue Mo"
+        ],
+        "cvssScore": 9.8,
+        "description": "## Overview\n[org.apache.struts:struts2-core](http://struts.apache.org/) is a popular open-source framework for developing web applications in the Java programming language.\n\nAffected versions of this package are vulnerable to Remote Code Execution.\nWhen the namespace value is not set for a result defined in underlying xml configurations, and in same time, its upper action(s) configurations have no or wildcard namespace, an attacker may be able to conduct a remote code execution attack. They could also use the opportunity when using a url tag which does not have a value and action set and in same time, its upper action(s) configurations have no or wildcard namespace.\n\n## Remediation\nUpgrade `org.apache.struts:struts2-core` to versions 2.3.35, 2.5.17 or higher.\n\n## References\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1620019)\n- [Struts2 Security Bulletin](https://cwiki.apache.org/confluence/display/WW/S2-057)\n- [Lgtm Blog](https://lgtm.com/blog/apache_struts_CVE-2018-11776)\n",
+        "disclosureTime": "2018-08-17T00:00:00Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTS-32477",
+        "identifiers": {
+          "CVE": [
+            "CVE-2018-11776"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "struts2-core",
+          "groupId": "org.apache.struts"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:46.910309Z",
+        "moduleName": "org.apache.struts:struts2-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts:struts2-core",
+        "patches": [],
+        "publicationTime": "2018-08-22T11:53:44.582000Z",
+        "references": [
+          {
+            "title": "Lgtm Blog",
+            "url": "https://lgtm.com/blog/apache_struts_CVE-2018-11776"
+          },
+          {
+            "title": "Struts2 Security Bulletin",
+            "url": "https://cwiki.apache.org/confluence/display/WW/S2-057"
+          },
+          {
+            "title": "RedHat Bugzilla Bug",
+            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1620019"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.0, 2.3.35), [2.5.0, 2.5.17)"
+          ]
+        },
+        "severity": "high",
+        "title": "Remote Code Execution"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30797": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.661000Z",
+        "credit": [
+          "Jasper Rosenberg"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nThe default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to \"compromise internal state of an application\" via unspecified vectors.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1831)\n- [Struts Security Advisory](https://struts.apache.org/docs/s2-024.html)\n",
+        "disclosureTime": "2015-07-17T17:44:54Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30797",
+        "identifiers": {
+          "CVE": [
+            "CVE-2015-1831"
+          ],
+          "CWE": [
+            "CWE-94"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "xwork-core",
+          "groupId": "org.apache.struts.xwork"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.452635Z",
+        "moduleName": "org.apache.struts.xwork:xwork-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts.xwork:xwork-core",
+        "patches": [],
+        "publicationTime": "2015-07-17T17:44:54Z",
+        "references": [
+          {
+            "title": "Struts Security Advisory",
+            "url": "https://struts.apache.org/docs/s2-024.html"
+          },
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1831"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.20]"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Code Execution"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.673000Z",
+        "credit": [
+          "rskvp93"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nAffected versions of the package are vulnerable to Parameter Alteration. ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings\n\n\n## References\n- [Apache Security Advisory](https://struts.apache.org/docs/s2-026.html)\n",
+        "disclosureTime": "2015-09-28T16:59:30Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798",
+        "identifiers": {
+          "CVE": [
+            "CVE-2015-5209"
+          ],
+          "CWE": [
+            "CWE-235"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "xwork-core",
+          "groupId": "org.apache.struts.xwork"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.454770Z",
+        "moduleName": "org.apache.struts.xwork:xwork-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts.xwork:xwork-core",
+        "patches": [],
+        "publicationTime": "2015-09-28T16:59:30Z",
+        "references": [
+          {
+            "title": "Apache Security Advisory",
+            "url": "https://struts.apache.org/docs/s2-026.html"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2,2.3.24.1)"
+          ]
+        },
+        "severity": "high",
+        "title": "Parameter Alteration"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.686000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 9.8,
+        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nApache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a \"%{}\" sequence in a tag attribute, aka forced double OGNL evaluation.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0785)",
+        "disclosureTime": "2016-03-16T05:58:06.341000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-0785"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "xwork-core",
+          "groupId": "org.apache.struts.xwork"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.457069Z",
+        "moduleName": "org.apache.struts.xwork:xwork-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts.xwork:xwork-core",
+        "patches": [],
+        "publicationTime": "2016-03-16T05:58:06.341000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0785"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2,2.3.28)"
+          ]
+        },
+        "severity": "high",
+        "title": "Improper Input Validation"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.701000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 4.3,
+        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nApache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.\n\n## Details\nCross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s browser to execute malicious JavaScript code in the context of a victim’s domain. Such scripts can steal the user’s session cookies for the domain, scrape or modify its content, and perform or modify actions on the user’s behalf, actions typically blocked by the browser’s Same Origin Policy.\n\nThese attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a \"new\" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like `<` `>` `\"` `'` are not escaped properly.\n\nThere are a few types of XSS:\n- **Persistent XSS** is an attack in which the malicious code persists into the web app’s database.\n- **Reflected XSS** is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.\n- **DOM-based XSS** is an that occurs purely in the browser when client-side JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is notoriously hard to detect, as the server never gets a chance to see the attack taking place.\n\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2162)",
+        "disclosureTime": "2016-03-16T07:51:26.242000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-2162"
+          ],
+          "CWE": [
+            "CWE-79"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "xwork-core",
+          "groupId": "org.apache.struts.xwork"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.459569Z",
+        "moduleName": "org.apache.struts.xwork:xwork-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts.xwork:xwork-core",
+        "patches": [],
+        "publicationTime": "2016-03-16T07:51:26.242000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2162"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2,2.3.25)"
+          ]
+        },
+        "severity": "medium",
+        "title": "Cross-site Scripting (XSS)"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.713000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.3,
+        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nApache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093)",
+        "disclosureTime": "2016-06-02T02:16:48.918000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-3093"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "xwork-core",
+          "groupId": "org.apache.struts.xwork"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.461613Z",
+        "moduleName": "org.apache.struts.xwork:xwork-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts.xwork:xwork-core",
+        "patches": [],
+        "publicationTime": "2016-06-02T02:16:48.918000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3093"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2,2.3.24.1]"
+          ]
+        },
+        "severity": "medium",
+        "title": "Improper Input Validation"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.724000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.3,
+        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nApache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433)",
+        "disclosureTime": "2016-06-21T01:33:07.474000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-4433"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "xwork-core",
+          "groupId": "org.apache.struts.xwork"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.463554Z",
+        "moduleName": "org.apache.struts.xwork:xwork-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts.xwork:xwork-core",
+        "patches": [],
+        "publicationTime": "2016-06-21T01:33:07.474000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4433"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.20,2.3.28.1]"
+          ]
+        },
+        "severity": "medium",
+        "title": "Improper Input Validation"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.738000Z",
+        "credit": [
+          "Alvaro Munoz"
+        ],
+        "cvssScore": 7.3,
+        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nAffected versions of the package are vulnerable to Remote code Execution. The Apache Struts frameworks when forced, performs double evaluation of attributes' values assigned to certain tags so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered.\n\n## References\n- [Apache Security Advisory](https://struts.apache.org/docs/s2-036.html)\n",
+        "disclosureTime": "2016-11-14T07:48:03.440000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-4461"
+          ],
+          "CWE": [
+            "CWE-264"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "xwork-core",
+          "groupId": "org.apache.struts.xwork"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.465500Z",
+        "moduleName": "org.apache.struts.xwork:xwork-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts.xwork:xwork-core",
+        "patches": [],
+        "publicationTime": "2016-11-14T07:48:03.440000Z",
+        "references": [
+          {
+            "title": "Apache Security Advisory",
+            "url": "https://struts.apache.org/docs/s2-036.html"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.2.1,2.3.28.1]"
+          ]
+        },
+        "severity": "high",
+        "title": "Arbitrary Code Execution"
+      },
+      "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804": {
+        "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+        "alternativeIds": [],
+        "creationTime": "2017-02-22T07:28:23.751000Z",
+        "credit": [
+          "Unknown"
+        ],
+        "cvssScore": 5.3,
+        "description": "## Overview\n[`org.apache.struts.xwork:xwork-core`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22xwork-core%22)\nThe URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465)",
+        "disclosureTime": "2016-06-20T07:45:43.528000Z",
+        "id": "SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804",
+        "identifiers": {
+          "CVE": [
+            "CVE-2016-4465"
+          ],
+          "CWE": [
+            "CWE-20"
+          ]
+        },
+        "language": "java",
+        "mavenModuleName": {
+          "artifactId": "xwork-core",
+          "groupId": "org.apache.struts.xwork"
+        },
+        "methods": [],
+        "modificationTime": "2018-11-18T11:50:44.467512Z",
+        "moduleName": "org.apache.struts.xwork:xwork-core",
+        "packageManager": "maven",
+        "packageName": "org.apache.struts.xwork:xwork-core",
+        "patches": [],
+        "publicationTime": "2016-06-20T07:45:43.528000Z",
+        "references": [
+          {
+            "title": "NVD",
+            "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4465"
+          }
+        ],
+        "semver": {
+          "vulnerable": [
+            "[2.3.20,2.3.28.1], [2.5,2.5.1)"
+          ]
+        },
+        "severity": "medium",
+        "title": "Improper Input Validation"
+      }
+    }
+  },
+  "meta": {
+    "isPublic": false,
+    "isLicensesEnabled": true,
+    "licensesPolicy": {
+      "severities": {
+        "MS-RL": "medium",
+        "EPL-1.0": "medium",
+        "GPL-2.0": "high",
+        "GPL-3.0": "high",
+        "MPL-1.1": "medium",
+        "MPL-2.0": "medium",
+        "AGPL-1.0": "high",
+        "AGPL-3.0": "high",
+        "CDDL-1.0": "medium",
+        "LGPL-2.0": "medium",
+        "LGPL-2.1": "medium",
+        "LGPL-3.0": "medium",
+        "CPOL-1.02": "high",
+        "LGPL-2.1+": "medium",
+        "LGPL-3.0+": "medium",
+        "SimPL-2.0": "high",
+        "Artistic-1.0": "medium",
+        "Artistic-2.0": "medium"
+      }
+    },
+    "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.13.1\nignore: {}\npatch: {}\n",
+    "ignoreSettings": null,
+    "org": "snyk"
+  },
+  "filesystemPolicy": false
+}