OWASP Dependency Check is a tool for checking the Java libraries you use have no security issues. Since it often reports false positives or issues not really needing attention, you need to maintain a suppression file.
First I must say, it's a very tedious work to use OWASP Dependency Check to identify and possibly fix dependencies vulnerabilities. Not only there are many false positives or issues not really needing our attention, but some issues are also hidding others. So you need to check issues one by one and put the possible suppress information in the suppression file and run again the check, etc. Unfortunately it's the best solution we have so far. Because it's not enough to blindly update libraries we use by using the last version.
Here is the suppress file, I (Jacques Le Roux) created in early December 2015 while updating the vulnerable libraries when possible. It's commented inside to help having a clearer vision of the situation (which fortunately is not bad 
)
I though must say Dependency Check was not able to detect a major issue: OFBIZ-6905 - Getting issue details... STATUS I reported to them http://markmail.org/message/ucs34et4a3h7gun4
The idea is that you can use it as a basis on your project and (if possible) help to keep it up to date. This can be done by sharing your experience here as a comment, or by updating this page as a Confluence contributor (as explained in the top banner you can ask on the OFBiz user ML else).
Here is the command line I use on Windows to start the check (I used the OWASP Dependency Check command line option on Windows):
>dependency-check -project OFBiz -scan C:\projectASF-Mars\ofbiz --suppression C:\tools\dependency-check\suppress.xml
You can remove the "--suppression C:\tools\dependency-check\suppress.xml" part if you want to see the initial state
Here an example of a report:
There is also the tools\security folder whith some information in OFBiz trunk repo...