<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
    <metadata>
        <component type="application" bom-ref="acme">
            <publisher>DependencyTrack</publisher>
            <name>Acme example</name>
            <externalReferences>
                <reference type="build-system">
                    <url>https://acme.example</url>
                </reference>
                <reference type="distribution">
                    <url>https://acme.example</url>
                </reference>
                <reference type="issue-tracker">
                    <url>https://acme.example</url>
                </reference>
                <reference type="vcs">
                    <url>https://acme.example</url>
                </reference>
            </externalReferences>
        </component>
    </metadata>
    <components>
        <component type="application" bom-ref="comp">
            <author>Sometimes this field is long because it is composed of a list of authors......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................</author>
            <publisher>Example Incorporated</publisher>
            <group>com.example</group>
            <name>xmlutil</name>
            <version>1.0.0</version>
            <description>A makebelieve XML utility library</description>
            <hashes>
                <hash alg="MD5">2b67669c925048d1a5c7f124d9ba1d2a</hash>
                <hash alg="SHA-1">72ca79908c814022905e86f8bbecd9b829352139</hash>
                <hash alg="SHA-256">1389877662864d2bb0488b4b1e417ce5647a1687084341178a203b243dfe90e7</hash>
            </hashes>
            <licenses>
                <license>
                    <id>Apache-2.0</id>
                    <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
                </license>
            </licenses>
            <copyright>Copyright Example Inc. All rights reserved.</copyright>
            <cpe>cpe:/a:example:xmlutil:1.0.0</cpe>
            <purl>pkg:maven/com.example/xmlutil@1.0.0?packaging=jar</purl>
            <modified>false</modified>
        </component>
    </components>
    <vulnerabilities>
        <vulnerability bom-ref="comp-vuln">
            <id>BOMVULN-01</id>
            <ratings>
                <rating>
                    <score>10.0</score>
                    <severity>critical</severity>
                    <method>CVSSv3</method>
                </rating>
            </ratings>
            <affects>
                <target>
                    <ref>comp</ref>
                </target>
            </affects>
        </vulnerability>
    </vulnerabilities>
</bom>