Excluded transitive dependencies of WAR overlays are still scanned

Transitive dependencies of a WAR overlay that are excluded within the WAR plugin are still showing up in the scan, despite not being in the resulting WAR file.

Eg the following POM snippets:

provided
org.jasig.cas
cas-server-webapp
3.5.3
war

commons-beanutilscommons-beanutils1.9.3
commons-codeccommons-codec1.10
commons-collectionscommons-collections3.2.2
commons-fileuploadcommons-fileupload1.3.2
commons-httpclientcommons-httpclient3.1
commons-iocommons-io2.5
commons-langcommons-lang2.6
commons-loggingcommons-logging1.2
joda-timejoda-time2.9.4
org.apache.httpcomponentshttpclient4.5.2
org.apache.santuarioxmlsec1.5.8
org.apache.xmlgraphicsbatik-css1.8
org.opensamlopensaml2.6.6
org.owasp.esapiesapi2.1.0.1

commons-beanutilscommons-beanutils-core
log4jlog4j
org.owasp.antisamyantisamy


org.slf4jjcl-over-slf4j1.7.23
org.slf4jlog4j-over-slf4j1.7.23
org.slf4jslf4j-api1.7.23
org.springframeworkspring-aop3.1.4.RELEASE
org.springframeworkspring-asm3.1.4.RELEASE
org.springframeworkspring-beans3.1.4.RELEASE
org.springframeworkspring-context3.1.4.RELEASE
org.springframeworkspring-context-support3.1.4.RELEASE
org.springframeworkspring-core3.1.4.RELEASE
org.springframeworkspring-expression3.1.4.RELEASE
org.springframeworkspring-jdbc3.1.4.RELEASE
org.springframeworkspring-orm3.1.4.RELEASE
org.springframeworkspring-tx3.1.4.RELEASE
org.springframeworkspring-web3.1.4.RELEASE
org.springframeworkspring-webmvc3.1.4.RELEASE
org.springframework.securityspring-security-cas3.1.7.RELEASE
org.springframework.securityspring-security-config3.1.7.RELEASE
org.springframework.securityspring-security-core3.1.7.RELEASE
org.springframework.securityspring-security-crypto3.1.7.RELEASE
org.springframework.securityspring-security-web3.1.7.RELEASE
xalanxalan2.7.2
xercesxercesImpl2.11.0.SP3
xml-apisxml-apis1.4.01

...

org.apache.maven.plugins
2.6
maven-war-plugin

**/default/ui/includes/*.jsp


org.jasig.cascas-server-webapp

WEB-INF/lib/bcprov-jdk15-*.jar
WEB-INF/lib/cas-client-*.jar
WEB-INF/lib/commons-beanutils-*.jar
WEB-INF/lib/commons-codec-*.jar
WEB-INF/lib/commons-collections-*.jar
WEB-INF/lib/commons-lang-*.jar
WEB-INF/lib/commons-logging-*.jar
WEB-INF/lib/esapi-*.jar
WEB-INF/lib/javassist-*.jar
WEB-INF/lib/jcl-over-slf4j-*.jar
WEB-INF/lib/joda-time-*.jar
WEB-INF/lib/jul-to-slf4j-*.jar
WEB-INF/lib/log4j-1*.jar
WEB-INF/lib/opensaml-*.jar
WEB-INF/lib/openws-*.jar
WEB-INF/lib/serializer-*.jar
WEB-INF/lib/slf4j-log4j12-*.jar
WEB-INF/lib/slf4j-api-*.jar
WEB-INF/lib/spring-*-3.1.1.RELEASE.jar
WEB-INF/lib/spring-security-*-3.1.0.RELEASE.jar
WEB-INF/lib/velocity-*.jar
WEB-INF/lib/xalan-*.jar
WEB-INF/lib/xercesImpl-*.jar
WEB-INF/lib/xmlsec-*.jar
WEB-INF/lib/xmltooling-*.jar
WEB-INF/lib/xml-apis-*.jar
WEB-INF/lib/stax-api-1.0.1.jar
WEB-INF/cas.properties
WEB-INF/classes/log4j.properties
WEB-INF/web.xml
WEB-INF/view/jsp/default/ui/includes/*.jsp

will result in:

cas-server-webapp-3.5.3.war: bcprov-jdk15-1.45.jar (cpe:/a:bouncycastle:bouncy-castle-crypto-package:1.45, cpe:/a:bouncycastle:bouncy_castle_crypto_package:1.45, org.bouncycastle:bcprov-jdk15:1.45) : CVE-2015-7940
cas-server-webapp-3.5.3.war: commons-beanutils-1.7.0.jar (commons-beanutils:commons-beanutils:1.7.0, cpe:/a:apache:commons_beanutils:1.7.0) : CVE-2014-0114
cas-server-webapp-3.5.3.war: commons-collections-3.2.jar (commons-collections:commons-collections:3.2, cpe:/a:apache:commons_collections:3.2.1) : CVE-2015-6420
cas-server-webapp-3.5.3.war: hibernate-validator-4.2.0.Final.jar (cpe:/a:hibernate:hibernate_validator:4.2.0, org.hibernate:hibernate-validator:4.2.0.Final) : CVE-2014-3558
cas-server-webapp-3.5.3.war: serializer-2.7.1.jar (cpe:/a:apache:xalan-java:2.7.1, xalan:serializer:2.7.1) : CVE-2014-0107
cas-server-webapp-3.5.3.war: spring-core-3.1.1.RELEASE.jar (cpe:/a:pivotal:spring_framework:3.1.1, cpe:/a:pivotal_software:spring_framework:3.1.1, cpe:/a:springsource:spring_framework:3.1.1, cpe:/a:vmware:springsource_spring_framework:3.1.1, org.springframework:spring-core:3.1.1.RELEASE) : CVE-2016-9878, CVE-2014-3625, CVE-2014-3578, CVE-2014-1904, CVE-2014-0054, CVE-2013-7315, CVE-2013-6429, CVE-2013-4152
cas-server-webapp-3.5.3.war: standard-1.1.2.jar (cpe:/a:apache:standard_taglibs:1.1.2, taglibs:standard:1.1.2) : CVE-2015-0254
cas-server-webapp-3.5.3.war: xalan-2.7.1.jar (cpe:/a:apache:xalan-java:2.7.1, xalan:xalan:2.7.1) : CVE-2014-0107
cas-server-webapp-3.5.3.war: xstream-1.3.jar (com.thoughtworks.xstream:xstream:1.3, cpe:/a:x-stream:xstream:1.3) : CVE-2016-3674