Sunshine - SBOM visualization tool

Analyzed CycloneDX JSON file: bom.json

No. of Components	Vulnerabilities	Main Component	Spec Version	Serial Number	Version	Tool
75	Critical: 0,  High: 0,  Medium: 0,  Low: 0,  Information: 0, Max EPSS → 0.0, Vulnerabilities in CISA KEV → 0	Type → application, Group → de.infoteam, Name → profile-assist, Version → 0.0.1-SNAPSHOT, Description → infoteam profile assist, PURL → pkg:maven/de.infoteam/profile-assist@0.0.1-SNAPSHOT?type=jar	1.6	urn:uuid:7f08611a-fc65-3b1d-891f-8dc090811d60	1	Component Type → library, Component Group → org.cyclonedx, Component Name → cyclonedx-maven-plugin, Component Version → 2.9.1

This chart visualizes components and their dependencies, with each segment representing a single component. The chart provides a hierarchical view of the dependency structure, with relationships radiating outward from the core components.

• Innermost circle: represents components that are independent and not dependencies for any other components.
• Outer circles: each segment represents a dependency of the corresponding segment in the circle immediately inside it. The farther a segment is from the center, the deeper the dependency level.

Note: If there is only one circle, it means that no dependency relationships are defined in the input file.

The colors of the segments indicate the vulnerability status of the components:

• Dark red: affected by at least one critical severity vulnerability.
• Red: affected by at least one high severity vulnerability.
• Orange: affected by at least one medium severity vulnerability.
• Yellow: affected by at least one low severity vulnerability.
• Green: affected by at least one informational severity vulnerability.
• Light blue: not directly affected by vulnerabilities but has at least one vulnerable dependency.
• Grey: neither the component nor its dependencies are affected by any vulnerabilities.

The chart is interactive:

• Hovering: displays details about a component, including its name, version, and list of vulnerabilities.
• Clicking: refocuses the chart. The clicked segment becomes the center (second innermost circle), showing only that component and its dependencies. In this view, the innermost circle is always blue. Clicking the blue circle navigates back up one level in the dependency hierarchy.

---

---

This table visualizes components, their dependencies, vulnerabilities and licenses.
The colors of the elements in columns "Component", "Depends on" and "Dependency of" indicate the vulnerability status of the components:

• Dark red: affected by at least one critical severity vulnerability.
• Red: affected by at least one high severity vulnerability.
• Orange: affected by at least one medium severity vulnerability.
• Yellow: affected by at least one low severity vulnerability.
• Green: affected by at least one informational severity vulnerability.
• Light blue: not directly affected by vulnerabilities but has at least one vulnerable dependency.
• Grey: neither the component nor its dependencies are affected by any vulnerabilities.

The colors of the elements in columns "Direct vulnerabilities" and "Transitive vulnerabilities" indicate the severity of the vulnerabilities:

• Dark red: critical.
• Red: high.
• Orange: medium.
• Yellow:low.
• Green:informational.

The "Depth" column indicates a component's position in the dependency graph:

• A "root" value means it is a root component, meaning it resides in the innermost circle of the chart.
• An integer value represents the component's depth level within the dependency chain.

Note: since a single component may be a dependency for multiple components in different places in the dependency graph, it may be associated with multiple depths.

---

This table focuses on vulnerabilities and shows the components that are affected either directly or transitively.
The colors of the elements in column "Vulnerability" indicate the severity of the vulnerabilities:

• Dark red: critical.
• Red: high.
• Orange: medium.
• Yellow:low.
• Green:informational.

The colors of the elements in columns "Directly vulnerable components" and "Transitively vulnerable components" indicate the vulnerability status of the components:

• Dark red: affected by at least one critical severity vulnerability.
• Red: affected by at least one high severity vulnerability.
• Orange: affected by at least one medium severity vulnerability.
• Yellow: affected by at least one low severity vulnerability.
• Green: affected by at least one informational severity vulnerability.
• Light blue: not directly affected by vulnerabilities but has at least one vulnerable dependency.

---

Vulnerability	Severity	Score	Vector	EPSS	CISA KEV Date	Directly vulnerable components	Transitively vulnerable components

Sunshine - SBOM visualization tool | Made by Luca Capacci | Contributor Mattia Fierro | GitHub repository | License