False Positive due to missing "AND/OR" capabilities defined in the NVD data feed

Hello community.

- Dependencies (gradle with mavenCentral):
- `org.springframework.security:spring-security-config:5.1.4.RELEASE`
- `org.springframework.security:spring-security-web:5.1.4.RELEASE`
- `org.springframework.security:spring-security-core:5.1.4.RELEASE`

- `cpe:2.3:a:pivotal_software:spring_security:5.1.4:*:*:*:*:*:*:*` [NVD link](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Apivotal_software&cpe_product=cpe%3A%2F%3Apivotal_software%3Aspring_security)
- `CVE-2018-1258` [NVD link](https://nvd.nist.gov/vuln/detail/CVE-2018-1258)

According with [https://pivotal.io/security/cve-2018-1258](https://pivotal.io/security/cve-2018-1258) this was fixed in the 5.0.6.RELEASE version.

Original dependency check output:

```
spring-security-web-5.1.4.RELEASE.jar (pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE, cpe:2.3:a:pivotal_s
oftware:spring_security:5.1.4:*:*:*:*:*:*:*) : CVE-2018-1258
spring-security-config-5.1.4.RELEASE.jar (pkg:maven/org.springframework.security/spring-security-config@5.1.4.RELEASE, cpe:2.3:a:piv
otal_software:spring_security:5.1.4:*:*:*:*:*:*:*) : CVE-2018-1258
spring-security-core-5.1.4.RELEASE.jar (pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE, cpe:2.3:a:pivotal
_software:spring_security:5.1.4:*:*:*:*:*:*:*) : CVE-2018-1258
```

Actual spring frameworks version for this project (gradle output):
```
+--- org.springframework.boot:spring-boot-starter-web -> 2.1.3.RELEASE
| +--- org.springframework.boot:spring-boot-starter:2.1.3.RELEASE
| | +--- org.springframework.boot:spring-boot:2.1.3.RELEASE
| | | +--- org.springframework:spring-core:5.1.5.RELEASE
| | | | \--- org.springframework:spring-jcl:5.1.5.RELEASE
| | | \--- org.springframework:spring-context:5.1.5.RELEASE
| | | +--- org.springframework:spring-aop:5.1.5.RELEASE
| | | | +--- org.springframework:spring-beans:5.1.5.RELEASE
| | | | | \--- org.springframework:spring-core:5.1.5.RELEASE (*)
| | | | \--- org.springframework:spring-core:5.1.5.RELEASE (*)
| | | +--- org.springframework:spring-beans:5.1.5.RELEASE (*)
| | | +--- org.springframework:spring-core:5.1.5.RELEASE (*)
| | | \--- org.springframework:spring-expression:5.1.5.RELEASE
| | | \--- org.springframework:spring-core:5.1.5.RELEASE (*)
+--- org.springframework.boot:spring-boot-starter-security -> 2.1.3.RELEASE
| +--- org.springframework.boot:spring-boot-starter:2.1.3.RELEASE (*)
| +--- org.springframework:spring-aop:5.1.5.RELEASE (*)
| +--- org.springframework.security:spring-security-config:5.1.4.RELEASE
| | +--- org.springframework.security:spring-security-core:5.1.4.RELEASE
| | | +--- org.springframework:spring-aop:5.1.5.RELEASE (*)
| | | +--- org.springframework:spring-beans:5.1.5.RELEASE (*)
| | | +--- org.springframework:spring-context:5.1.5.RELEASE (*)
| | | +--- org.springframework:spring-core:5.1.5.RELEASE (*)
| | | \--- org.springframework:spring-expression:5.1.5.RELEASE (*)
| | +--- org.springframework:spring-aop:5.1.5.RELEASE (*)
| | +--- org.springframework:spring-beans:5.1.5.RELEASE (*)
| | +--- org.springframework:spring-context:5.1.5.RELEASE (*)
| | \--- org.springframework:spring-core:5.1.5.RELEASE (*)
| \--- org.springframework.security:spring-security-web:5.1.4.RELEASE
| +--- org.springframework.security:spring-security-core:5.1.4.RELEASE (*)
| +--- org.springframework:spring-aop:5.1.5.RELEASE (*)
| +--- org.springframework:spring-beans:5.1.5.RELEASE (*)
| +--- org.springframework:spring-context:5.1.5.RELEASE (*)
| +--- org.springframework:spring-core:5.1.5.RELEASE (*)
| +--- org.springframework:spring-expression:5.1.5.RELEASE (*)
| \--- org.springframework:spring-web:5.1.5.RELEASE (*)

```