Option to handle incomplete NVD version information

I'm using Dependency Track "for real", monitoring several products and hundreds of components.

Sometimes DTrack does not report a vulnerability I know is applicable. The reason is that the "affected version" information in NVD XML sources is incomplete. A frequent example is that only the version in which the vulnerability is found is reported, nothing being said about earlier versions. When the set of the affected versions is nontrivial (happens regularly with e.g. `OpenSSL`), it is seldom fully correct in the NVD XML.

I see this as a showstopper for many users: the purpose of DTrack is to not miss the vulnerabilities.

But obviously the report cannot be better than the source data it is based upon.

One idea might be to give an option to "report vulnerabilities for **all** versions" for a given component when the user selects a component version in the application. This way the user will get also non-applicable vulnerabilities, but will never miss the relevant ones (if only the product name is correct).

I do not know how such "feature request" fits in the present vision of DTrack. But otherwise I found that I'm reading the XML diff to be sure that I have not missed something critical, which kind of defeats the purpose of using DTrack.

The issue proposes an option to report vulnerabilities for all versions of a selected component when NVD affected-version data is incomplete, but names no implementation files, entry points, or tests. Start by locating the component-version vulnerability matching flow and its NVD data handling; done means the option is defined, implemented, and verified without hiding applicable vulnerabilities.

Written by the indexing model from the issue text.