fix(scanoss): Also take EPSS scores as references

Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.io>

Author: sschuberth

plugins/advisors/scanoss/src/funTest/kotlin/ScanOssFunTest.kt

@@ -97,10 +97,10 @@ class ScanOssFunTest : WordSpec({
                 vulnerability.references.find {
                     it.url.toString() == "https://nvd.nist.gov/vuln/detail/CVE-2023-2976"
                 } shouldNotBeNull {
-                    scoringSystem should beNull()
-                    severity shouldBe "MEDIUM"
-                    score should beNull()
-                    vector should beNull()
+                    scoringSystem shouldBe "EPSS"
+                    severity should beNull()
+                    score shouldBe 6.5E-4f
+                    vector shouldBe "0.20002"
                 }
             }
         }
@@ -124,10 +124,10 @@ class ScanOssFunTest : WordSpec({
                 vulnerability.references.find {
                     it.url.toString() == "https://nvd.nist.gov/vuln/detail/CVE-2024-48948"
                 } shouldNotBeNull {
-                    scoringSystem should beNull()
-                    severity shouldBe "MEDIUM"
-                    score should beNull()
-                    vector should beNull()
+                    scoringSystem shouldBe "EPSS"
+                    severity should beNull()
+                    score shouldBe 0.00162f
+                    vector shouldBe "0.3665"
                 }
             }
         }

plugins/advisors/scanoss/src/main/kotlin/ScanOss.kt

@@ -121,19 +121,31 @@ private fun V2Vulnerability.toOrtVulnerability(): Vulnerability? {
     val vulnId = id ?: cve ?: return null
     val infoUrl = url?.let { URI(it) } ?: return null
 
+    val references = cvss.mapTo(mutableListOf()) { info ->
+        VulnerabilityReference(
+            url = infoUrl,
+            scoringSystem = info.cvss?.substringBefore('/', "")?.ifEmpty { null },
+            severity = info.cvss_severity,
+            score = info.cvss_score,
+            vector = info.cvss
+        )
+    }
+
+    epss?.also {
+        references += VulnerabilityReference(
+            url = infoUrl,
+            scoringSystem = "EPSS",
+            severity = null,
+            score = it.probability,
+            vector = it.percentile?.toString()
+        )
+    }
+
     return Vulnerability(
         id = vulnId,
         summary = summary,
         // TODO: Get a more detailed description.
-        references = cvss.map { info ->
-            VulnerabilityReference(
-                url = infoUrl,
-                scoringSystem = info.cvss?.substringBefore('/', "")?.ifEmpty { null },
-                severity = info.cvss_severity,
-                score = info.cvss_score,
-                vector = info.cvss
-            )
-        }.ifEmpty {
+        references = references.ifEmpty {
             listOf(
                 VulnerabilityReference(
                     url = infoUrl,