vrt 0.13.3 → 0.13.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (23) hide show
  1. checksums.yaml +4 -4
  2. data/lib/data/1.15.1/deprecated-node-mapping.json +317 -0
  3. data/lib/data/1.15.1/mappings/cvss_v3/cvss_v3.json +1465 -0
  4. data/lib/data/1.15.1/mappings/cvss_v3/cvss_v3.schema.json +59 -0
  5. data/lib/data/1.15.1/mappings/cwe/cwe.json +1161 -0
  6. data/lib/data/1.15.1/mappings/cwe/cwe.schema.json +63 -0
  7. data/lib/data/1.15.1/mappings/remediation_advice/remediation_advice.json +2122 -0
  8. data/lib/data/1.15.1/mappings/remediation_advice/remediation_advice.schema.json +75 -0
  9. data/lib/data/1.15.1/third-party-mappings/remediation_training/secure-code-warrior-links.json +491 -0
  10. data/lib/data/1.15.1/vrt.schema.json +63 -0
  11. data/lib/data/1.15.1/vulnerability-rating-taxonomy.json +3058 -0
  12. data/lib/data/1.16/deprecated-node-mapping.json +332 -0
  13. data/lib/data/1.16/mappings/cvss_v3/cvss_v3.json +1335 -0
  14. data/lib/data/1.16/mappings/cvss_v3/cvss_v3.schema.json +59 -0
  15. data/lib/data/1.16/mappings/cwe/cwe.json +1167 -0
  16. data/lib/data/1.16/mappings/cwe/cwe.schema.json +63 -0
  17. data/lib/data/1.16/mappings/remediation_advice/remediation_advice.json +2101 -0
  18. data/lib/data/1.16/mappings/remediation_advice/remediation_advice.schema.json +75 -0
  19. data/lib/data/1.16/third-party-mappings/remediation_training/secure-code-warrior-links.json +520 -0
  20. data/lib/data/1.16/vrt.schema.json +63 -0
  21. data/lib/data/1.16/vulnerability-rating-taxonomy.json +3244 -0
  22. data/lib/vrt/version.rb +1 -1
  23. metadata +23 -3
data/lib/data/1.16/mappings/cvss_v3/cvss_v3.json ADDED
@@ -0,0 +1,1335 @@
1
+ {
2
+ "metadata": {
3
+ "default": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
4
+ },
5
+ "content": [
6
+ {
7
+ "id": "ai_application_security",
8
+ "children": [
9
+ {
10
+ "id": "adversarial_example_injection",
11
+ "children": [
12
+ {
13
+ "id": "ai_misclassification_attacks",
14
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"
15
+ }
16
+ ]
17
+ },
18
+ {
19
+ "id": "ai_safety",
20
+ "children": [
21
+ {
22
+ "id": "misinformation_wrong_factual_data",
23
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
24
+ }
25
+ ]
26
+ },
27
+ {
28
+ "id": "denial_of_service_dos",
29
+ "children": [
30
+ {
31
+ "id": "application_wide",
32
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
33
+ },
34
+ {
35
+ "id": "tenant_scoped",
36
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L"
37
+ }
38
+ ]
39
+ },
40
+ {
41
+ "id": "improper_input_handling",
42
+ "children": [
43
+ {
44
+ "id": "ansi_escape_codes",
45
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
46
+ },
47
+ {
48
+ "id": "rtl_overrides",
49
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
50
+ },
51
+ {
52
+ "id": "unicode_confusables",
53
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
54
+ }
55
+ ]
56
+ },
57
+ {
58
+ "id": "improper_output_handling",
59
+ "children": [
60
+ {
61
+ "id": "cross_site_scripting_xss",
62
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
63
+ },
64
+ {
65
+ "id": "markdown_html_injection",
66
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
67
+ }
68
+ ]
69
+ },
70
+ {
71
+ "id": "insufficient_rate_limiting",
72
+ "children": [
73
+ {
74
+ "id": "query_flooding_api_token_abuse",
75
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
76
+ }
77
+ ]
78
+ },
79
+ {
80
+ "id": "model_extraction",
81
+ "children": [
82
+ {
83
+ "id": "api_query_based_model_reconstruction",
84
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
85
+ }
86
+ ]
87
+ },
88
+ {
89
+ "id": "prompt_injection",
90
+ "children": [
91
+ {
92
+ "id": "system_prompt_leakage",
93
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
94
+ }
95
+ ]
96
+ },
97
+ {
98
+ "id": "remote_code_execution",
99
+ "children": [
100
+ {
101
+ "id": "full_system_compromise",
102
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
103
+ },
104
+ {
105
+ "id": "sandboxed_container_code_execution",
106
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H"
107
+ }
108
+ ]
109
+ },
110
+ {
111
+ "id": "sensitive_information_disclosure",
112
+ "children": [
113
+ {
114
+ "id": "cross_tenant_pii_leakage_exposure",
115
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
116
+ },
117
+ {
118
+ "id": "key_leak",
119
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
120
+ }
121
+ ]
122
+ },
123
+ {
124
+ "id": "training_data_poisoning",
125
+ "children": [
126
+ {
127
+ "id": "backdoor_injection_bias_manipulation",
128
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
129
+ }
130
+ ]
131
+ },
132
+ {
133
+ "id": "vector_and_embedding_weaknesses",
134
+ "children": [
135
+ {
136
+ "id": "embedding_exfiltration_model_extraction",
137
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
138
+ },
139
+ {
140
+ "id": "semantic_indexing",
141
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
142
+ }
143
+ ]
144
+ }
145
+ ]
146
+ },
147
+ {
148
+ "id": "algorithmic_biases",
149
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
150
+ },
151
+ {
152
+ "id": "application_level_denial_of_service_dos",
153
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
154
+ "children": [
155
+ {
156
+ "id": "critical_impact_and_or_easy_difficulty",
157
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
158
+ },
159
+ {
160
+ "id": "excessive_resource_consumption",
161
+ "children": [
162
+ {
163
+ "id": "injection_prompt",
164
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
165
+ }
166
+ ],
167
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H"
168
+ },
169
+ {
170
+ "id": "high_impact_and_or_medium_difficulty",
171
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
172
+ }
173
+ ]
174
+ },
175
+ {
176
+ "id": "automotive_security_misconfiguration",
177
+ "children": [
178
+ {
179
+ "id": "abs",
180
+ "children": [
181
+ {
182
+ "id": "unintended_acceleration_brake",
183
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
184
+ }
185
+ ]
186
+ },
187
+ {
188
+ "id": "battery_management_system",
189
+ "children": [
190
+ {
191
+ "id": "firmware_dump",
192
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
193
+ },
194
+ {
195
+ "id": "fraudulent_interface",
196
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H"
197
+ }
198
+ ]
199
+ },
200
+ {
201
+ "id": "can",
202
+ "children": [
203
+ {
204
+ "id": "injection_basic_safety_message",
205
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
206
+ },
207
+ {
208
+ "id": "injection_battery_management_system",
209
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
210
+ },
211
+ {
212
+ "id": "injection_disallowed_messages",
213
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
214
+ },
215
+ {
216
+ "id": "injection_dos",
217
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
218
+ },
219
+ {
220
+ "id": "injection_headlights",
221
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
222
+ },
223
+ {
224
+ "id": "injection_powertrain",
225
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
226
+ },
227
+ {
228
+ "id": "injection_pyrotechnical_device_deployment_tool",
229
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
230
+ },
231
+ {
232
+ "id": "injection_sensors",
233
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
234
+ },
235
+ {
236
+ "id": "injection_steering_control",
237
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
238
+ },
239
+ {
240
+ "id": "injection_vehicle_anti_theft_systems",
241
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
242
+ }
243
+ ]
244
+ },
245
+ {
246
+ "id": "gnss_gps",
247
+ "children": [
248
+ {
249
+ "id": "spoofing",
250
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
251
+ }
252
+ ]
253
+ },
254
+ {
255
+ "id": "immobilizer",
256
+ "children": [
257
+ {
258
+ "id": "engine_start",
259
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
260
+ }
261
+ ]
262
+ },
263
+ {
264
+ "id": "infotainment_radio_head_unit",
265
+ "children": [
266
+ {
267
+ "id": "code_execution_can_bus_pivot",
268
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
269
+ },
270
+ {
271
+ "id": "code_execution_no_can_bus_pivot",
272
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
273
+ },
274
+ {
275
+ "id": "default_credentials",
276
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
277
+ },
278
+ {
279
+ "id": "dos_brick",
280
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
281
+ },
282
+ {
283
+ "id": "ota_firmware_manipulation",
284
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
285
+ },
286
+ {
287
+ "id": "sensitive_data_leakage_exposure",
288
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
289
+ },
290
+ {
291
+ "id": "source_code_dump",
292
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
293
+ },
294
+ {
295
+ "id": "unauthorized_access_to_services",
296
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
297
+ }
298
+ ]
299
+ },
300
+ {
301
+ "id": "rf_hub",
302
+ "children": [
303
+ {
304
+ "id": "can_injection_interaction",
305
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
306
+ },
307
+ {
308
+ "id": "data_leakage_pull_encryption_mechanism",
309
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
310
+ },
311
+ {
312
+ "id": "key_fob_cloning",
313
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
314
+ },
315
+ {
316
+ "id": "relay",
317
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
318
+ },
319
+ {
320
+ "id": "replay",
321
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
322
+ },
323
+ {
324
+ "id": "roll_jam",
325
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
326
+ },
327
+ {
328
+ "id": "unauthorized_access_turn_on",
329
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"
330
+ }
331
+ ]
332
+ },
333
+ {
334
+ "id": "rsu",
335
+ "children": [
336
+ {
337
+ "id": "sybil_attack",
338
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
339
+ }
340
+ ]
341
+ }
342
+ ]
343
+ },
344
+ {
345
+ "id": "blockchain_infrastructure_misconfiguration",
346
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
347
+ },
348
+ {
349
+ "id": "broken_access_control",
350
+ "children": [
351
+ {
352
+ "id": "bypass_of_password_confirmation",
353
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
354
+ },
355
+ {
356
+ "id": "exposed_sensitive_android_intent",
357
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
358
+ },
359
+ {
360
+ "id": "exposed_sensitive_ios_url_scheme",
361
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
362
+ },
363
+ {
364
+ "id": "privilege_escalation",
365
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
366
+ },
367
+ {
368
+ "id": "username_enumeration",
369
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
370
+ }
371
+ ],
372
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
373
+ },
374
+ {
375
+ "id": "broken_authentication_and_session_management",
376
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
377
+ "children": [
378
+ {
379
+ "id": "authentication_bypass",
380
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
381
+ },
382
+ {
383
+ "id": "cleartext_transmission_of_session_token",
384
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
385
+ },
386
+ {
387
+ "id": "concurrent_logins",
388
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
389
+ },
390
+ {
391
+ "id": "failure_to_invalidate_session",
392
+ "children": [
393
+ {
394
+ "id": "all_sessions",
395
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
396
+ },
397
+ {
398
+ "id": "long_timeout",
399
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
400
+ },
401
+ {
402
+ "id": "on_email_change",
403
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
404
+ },
405
+ {
406
+ "id": "on_logout",
407
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
408
+ },
409
+ {
410
+ "id": "on_logout_server_side_only",
411
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
412
+ },
413
+ {
414
+ "id": "on_password_change",
415
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
416
+ },
417
+ {
418
+ "id": "on_two_fa_activation_change",
419
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
420
+ }
421
+ ]
422
+ },
423
+ {
424
+ "id": "saml_replay",
425
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
426
+ },
427
+ {
428
+ "id": "session_fixation",
429
+ "children": [
430
+ {
431
+ "id": "local_attack_vector",
432
+ "cvss_v3": "AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N"
433
+ },
434
+ {
435
+ "id": "remote_attack_vector",
436
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
437
+ }
438
+ ]
439
+ },
440
+ {
441
+ "id": "two_fa_bypass",
442
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
443
+ },
444
+ {
445
+ "id": "weak_login_function",
446
+ "children": [
447
+ {
448
+ "id": "other_plaintext_protocol_no_secure_alternative",
449
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
450
+ },
451
+ {
452
+ "id": "over_http",
453
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
454
+ }
455
+ ]
456
+ },
457
+ {
458
+ "id": "weak_registration_implementation",
459
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
460
+ }
461
+ ]
462
+ },
463
+ {
464
+ "id": "client_side_injection",
465
+ "children": [
466
+ {
467
+ "id": "binary_planting",
468
+ "children": [
469
+ {
470
+ "id": "no_privilege_escalation",
471
+ "cvss_v3": "AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
472
+ },
473
+ {
474
+ "id": "non_default_folder_privilege_escalation",
475
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
476
+ },
477
+ {
478
+ "id": "privilege_escalation",
479
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
480
+ }
481
+ ]
482
+ }
483
+ ]
484
+ },
485
+ {
486
+ "id": "cross_site_request_forgery_csrf",
487
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
488
+ "children": [
489
+ {
490
+ "id": "action_specific",
491
+ "children": [
492
+ {
493
+ "id": "logout",
494
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
495
+ }
496
+ ]
497
+ },
498
+ {
499
+ "id": "application_wide",
500
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
501
+ },
502
+ {
503
+ "id": "csrf_token_not_unique_per_request",
504
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
505
+ },
506
+ {
507
+ "id": "flash_based",
508
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
509
+ }
510
+ ]
511
+ },
512
+ {
513
+ "id": "cross_site_scripting_xss",
514
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
515
+ "children": [
516
+ {
517
+ "id": "cookie_based",
518
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
519
+ },
520
+ {
521
+ "id": "flash_based",
522
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
523
+ },
524
+ {
525
+ "id": "ie_only",
526
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
527
+ },
528
+ {
529
+ "id": "off_domain",
530
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
531
+ },
532
+ {
533
+ "id": "referer",
534
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
535
+ },
536
+ {
537
+ "id": "reflected",
538
+ "children": [
539
+ {
540
+ "id": "non_self",
541
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
542
+ }
543
+ ]
544
+ },
545
+ {
546
+ "id": "stored",
547
+ "children": [
548
+ {
549
+ "id": "non_admin_to_anyone",
550
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
551
+ },
552
+ {
553
+ "id": "privileged_user_to_no_privilege_elevation",
554
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
555
+ },
556
+ {
557
+ "id": "privileged_user_to_privilege_elevation",
558
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"
559
+ },
560
+ {
561
+ "id": "url_based",
562
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
563
+ }
564
+ ]
565
+ },
566
+ {
567
+ "id": "universal_uxss",
568
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
569
+ }
570
+ ]
571
+ },
572
+ {
573
+ "id": "cryptographic_weakness",
574
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
575
+ "children": [
576
+ {
577
+ "id": "broken_cryptography",
578
+ "children": [
579
+ {
580
+ "id": "use_of_broken_cryptographic_primitive",
581
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
582
+ },
583
+ {
584
+ "id": "use_of_vulnerable_cryptographic_library",
585
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
586
+ }
587
+ ]
588
+ },
589
+ {
590
+ "id": "incomplete_cleanup_of_keying_material",
591
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L"
592
+ },
593
+ {
594
+ "id": "insecure_key_generation",
595
+ "children": [
596
+ {
597
+ "id": "insufficient_key_space",
598
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
599
+ },
600
+ {
601
+ "id": "key_exchange_without_entity_authentication",
602
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
603
+ }
604
+ ]
605
+ },
606
+ {
607
+ "id": "insufficient_entropy",
608
+ "children": [
609
+ {
610
+ "id": "initialization_vector_reuse",
611
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
612
+ },
613
+ {
614
+ "id": "limited_rng_entropy_source",
615
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
616
+ },
617
+ {
618
+ "id": "predictable_initialization_vector",
619
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
620
+ },
621
+ {
622
+ "id": "predictable_prng_seed",
623
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
624
+ },
625
+ {
626
+ "id": "prng_seed_reuse",
627
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
628
+ },
629
+ {
630
+ "id": "small_seed_space_in_prng",
631
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
632
+ },
633
+ {
634
+ "id": "use_of_trng_for_nonsecurity_purpose",
635
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
636
+ }
637
+ ]
638
+ },
639
+ {
640
+ "id": "insufficient_verification_of_data_authenticity",
641
+ "children": [
642
+ {
643
+ "id": "identity_check_value",
644
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
645
+ }
646
+ ]
647
+ },
648
+ {
649
+ "id": "key_reuse",
650
+ "children": [
651
+ {
652
+ "id": "inter_environment",
653
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
654
+ },
655
+ {
656
+ "id": "intra_environment",
657
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
658
+ },
659
+ {
660
+ "id": "lack_of_perfect_forward_secrecy",
661
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
662
+ }
663
+ ]
664
+ },
665
+ {
666
+ "id": "side_channel_attack",
667
+ "children": [
668
+ {
669
+ "id": "emanations_attack",
670
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
671
+ },
672
+ {
673
+ "id": "padding_oracle_attack",
674
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
675
+ },
676
+ {
677
+ "id": "power_analysis_attack",
678
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
679
+ },
680
+ {
681
+ "id": "timing_attack",
682
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
683
+ }
684
+ ]
685
+ },
686
+ {
687
+ "id": "use_of_expired_cryptographic_key_or_cert",
688
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
689
+ },
690
+ {
691
+ "id": "weak_hash",
692
+ "children": [
693
+ {
694
+ "id": "use_of_predictable_salt",
695
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
696
+ }
697
+ ]
698
+ }
699
+ ]
700
+ },
701
+ {
702
+ "id": "data_biases",
703
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
704
+ },
705
+ {
706
+ "id": "decentralized_application_misconfiguration",
707
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
708
+ },
709
+ {
710
+ "id": "developer_biases",
711
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
712
+ },
713
+ {
714
+ "id": "external_behavior",
715
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
716
+ },
717
+ {
718
+ "id": "indicators_of_compromise",
719
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
720
+ },
721
+ {
722
+ "id": "insecure_data_storage",
723
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
724
+ "children": [
725
+ {
726
+ "id": "sensitive_application_data_stored_unencrypted",
727
+ "children": [
728
+ {
729
+ "id": "on_external_storage",
730
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
731
+ }
732
+ ]
733
+ },
734
+ {
735
+ "id": "server_side_credentials_storage",
736
+ "children": [
737
+ {
738
+ "id": "plaintext",
739
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N"
740
+ }
741
+ ]
742
+ }
743
+ ]
744
+ },
745
+ {
746
+ "id": "insecure_data_transport",
747
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
748
+ "children": [
749
+ {
750
+ "id": "executable_download",
751
+ "children": [
752
+ {
753
+ "id": "no_secure_integrity_check",
754
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
755
+ },
756
+ {
757
+ "id": "secure_integrity_check",
758
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
759
+ }
760
+ ]
761
+ }
762
+ ]
763
+ },
764
+ {
765
+ "id": "insecure_os_firmware",
766
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
767
+ "children": [
768
+ {
769
+ "id": "command_injection",
770
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
771
+ },
772
+ {
773
+ "id": "data_not_encrypted_at_rest",
774
+ "children": [
775
+ {
776
+ "id": "non_sensitive",
777
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
778
+ }
779
+ ]
780
+ },
781
+ {
782
+ "id": "hardcoded_password",
783
+ "children": [
784
+ {
785
+ "id": "non_privileged_user",
786
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
787
+ },
788
+ {
789
+ "id": "privileged_user",
790
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
791
+ }
792
+ ]
793
+ },
794
+ {
795
+ "id": "local_administrator_on_default_environment",
796
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
797
+ },
798
+ {
799
+ "id": "over_permissioned_credentials_on_storage",
800
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
801
+ },
802
+ {
803
+ "id": "shared_credentials_on_storage",
804
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
805
+ },
806
+ {
807
+ "id": "weakness_in_firmware_updates",
808
+ "children": [
809
+ {
810
+ "id": "firmware_does_not_validate_update_integrity",
811
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"
812
+ },
813
+ {
814
+ "id": "firmware_is_not_encrypted",
815
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
816
+ }
817
+ ]
818
+ }
819
+ ]
820
+ },
821
+ {
822
+ "id": "insufficient_security_configurability",
823
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
824
+ "children": [
825
+ {
826
+ "id": "no_password_policy",
827
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
828
+ },
829
+ {
830
+ "id": "weak_password_reset_implementation",
831
+ "children": [
832
+ {
833
+ "id": "token_is_not_invalidated_after_use",
834
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
835
+ }
836
+ ]
837
+ },
838
+ {
839
+ "id": "weak_two_fa_implementation",
840
+ "children": [
841
+ {
842
+ "id": "two_fa_secret_cannot_be_rotated",
843
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
844
+ },
845
+ {
846
+ "id": "two_fa_secret_remains_obtainable_after_two_fa_is_enabled",
847
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
848
+ }
849
+ ]
850
+ }
851
+ ]
852
+ },
853
+ {
854
+ "id": "lack_of_binary_hardening",
855
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
856
+ },
857
+ {
858
+ "id": "misinterpretation_biases",
859
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
860
+ },
861
+ {
862
+ "id": "mobile_security_misconfiguration",
863
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
864
+ "children": [
865
+ {
866
+ "id": "auto_backup_allowed_by_default",
867
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
868
+ },
869
+ {
870
+ "id": "clipboard_enabled",
871
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
872
+ }
873
+ ]
874
+ },
875
+ {
876
+ "id": "network_security_misconfiguration",
877
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
878
+ },
879
+ {
880
+ "id": "physical_security_issues",
881
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
882
+ "children": [
883
+ {
884
+ "id": "weakness_in_physical_access_control",
885
+ "children": [
886
+ {
887
+ "id": "commonly_keyed_system",
888
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
889
+ }
890
+ ]
891
+ }
892
+ ]
893
+ },
894
+ {
895
+ "id": "privacy_concerns",
896
+ "children": [
897
+ {
898
+ "id": "unnecessary_data_collection",
899
+ "children": [
900
+ {
901
+ "id": "wifi_ssid_password",
902
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
903
+ }
904
+ ]
905
+ }
906
+ ]
907
+ },
908
+ {
909
+ "id": "protocol_specific_misconfiguration",
910
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
911
+ },
912
+ {
913
+ "id": "sensitive_data_exposure",
914
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
915
+ "children": [
916
+ {
917
+ "id": "disclosure_of_secrets",
918
+ "children": [
919
+ {
920
+ "id": "for_internal_asset",
921
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
922
+ },
923
+ {
924
+ "id": "for_publicly_accessible_asset",
925
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
926
+ },
927
+ {
928
+ "id": "pay_per_use_abuse",
929
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
930
+ }
931
+ ]
932
+ },
933
+ {
934
+ "id": "exif_geolocation_data_not_stripped_from_uploaded_images",
935
+ "children": [
936
+ {
937
+ "id": "automatic_user_enumeration",
938
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
939
+ },
940
+ {
941
+ "id": "manual_user_enumeration",
942
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
943
+ }
944
+ ]
945
+ },
946
+ {
947
+ "id": "graphql_introspection_enabled",
948
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
949
+ },
950
+ {
951
+ "id": "json_hijacking",
952
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
953
+ },
954
+ {
955
+ "id": "mixed_content",
956
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
957
+ },
958
+ {
959
+ "id": "non_sensitive_token_in_url",
960
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
961
+ },
962
+ {
963
+ "id": "sensitive_token_in_url",
964
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
965
+ },
966
+ {
967
+ "id": "token_leakage_via_referer",
968
+ "children": [
969
+ {
970
+ "id": "over_http",
971
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
972
+ },
973
+ {
974
+ "id": "password_reset_token",
975
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
976
+ },
977
+ {
978
+ "id": "trusted_third_party",
979
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
980
+ },
981
+ {
982
+ "id": "untrusted_third_party",
983
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"
984
+ }
985
+ ]
986
+ },
987
+ {
988
+ "id": "via_localstorage_sessionstorage",
989
+ "children": [
990
+ {
991
+ "id": "non_sensitive_token",
992
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
993
+ },
994
+ {
995
+ "id": "sensitive_token",
996
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
997
+ }
998
+ ]
999
+ },
1000
+ {
1001
+ "id": "visible_detailed_error_page",
1002
+ "children": [
1003
+ {
1004
+ "id": "detailed_server_configuration",
1005
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1006
+ }
1007
+ ]
1008
+ },
1009
+ {
1010
+ "id": "weak_password_reset_implementation",
1011
+ "children": [
1012
+ {
1013
+ "id": "token_leakage_via_host_header_poisoning",
1014
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
1015
+ }
1016
+ ],
1017
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
1018
+ }
1019
+ ]
1020
+ },
1021
+ {
1022
+ "id": "server_security_misconfiguration",
1023
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1024
+ "children": [
1025
+ {
1026
+ "id": "bitsquatting",
1027
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1028
+ },
1029
+ {
1030
+ "id": "captcha",
1031
+ "children": [
1032
+ {
1033
+ "id": "brute_force",
1034
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1035
+ },
1036
+ {
1037
+ "id": "implementation_vulnerability",
1038
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1039
+ }
1040
+ ]
1041
+ },
1042
+ {
1043
+ "id": "clickjacking",
1044
+ "children": [
1045
+ {
1046
+ "id": "form_input",
1047
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1048
+ },
1049
+ {
1050
+ "id": "non_sensitive_action",
1051
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
1052
+ },
1053
+ {
1054
+ "id": "sensitive_action",
1055
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
1056
+ }
1057
+ ]
1058
+ },
1059
+ {
1060
+ "id": "dbms_misconfiguration",
1061
+ "children": [
1062
+ {
1063
+ "id": "excessively_privileged_user_dba",
1064
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
1065
+ }
1066
+ ]
1067
+ },
1068
+ {
1069
+ "id": "email_verification_bypass",
1070
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1071
+ },
1072
+ {
1073
+ "id": "insecure_ssl",
1074
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1075
+ },
1076
+ {
1077
+ "id": "lack_of_password_confirmation",
1078
+ "children": [
1079
+ {
1080
+ "id": "manage_two_fa",
1081
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
1082
+ }
1083
+ ],
1084
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"
1085
+ },
1086
+ {
1087
+ "id": "lack_of_security_headers",
1088
+ "children": [
1089
+ {
1090
+ "id": "cache_control_for_a_sensitive_page",
1091
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1092
+ }
1093
+ ],
1094
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1095
+ },
1096
+ {
1097
+ "id": "mail_server_misconfiguration",
1098
+ "children": [
1099
+ {
1100
+ "id": "email_spoofing_to_inbox_due_to_missing_or_misconfigured_dmarc_on_email_domain",
1101
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1102
+ },
1103
+ {
1104
+ "id": "no_spoofing_protection_on_email_domain",
1105
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
1106
+ }
1107
+ ]
1108
+ },
1109
+ {
1110
+ "id": "misconfigured_dns",
1111
+ "children": [
1112
+ {
1113
+ "id": "missing_caa_record",
1114
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1115
+ },
1116
+ {
1117
+ "id": "subdomain_takeover",
1118
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
1119
+ },
1120
+ {
1121
+ "id": "zone_transfer",
1122
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1123
+ }
1124
+ ]
1125
+ },
1126
+ {
1127
+ "id": "missing_dnssec",
1128
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1129
+ },
1130
+ {
1131
+ "id": "missing_secure_or_httponly_cookie_flag",
1132
+ "children": [
1133
+ {
1134
+ "id": "session_token",
1135
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1136
+ }
1137
+ ]
1138
+ },
1139
+ {
1140
+ "id": "missing_subresource_integrity",
1141
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1142
+ },
1143
+ {
1144
+ "id": "no_rate_limiting_on_form",
1145
+ "children": [
1146
+ {
1147
+ "id": "change_password",
1148
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"
1149
+ },
1150
+ {
1151
+ "id": "login",
1152
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
1153
+ }
1154
+ ],
1155
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
1156
+ },
1157
+ {
1158
+ "id": "oauth_misconfiguration",
1159
+ "children": [
1160
+ {
1161
+ "id": "account_squatting",
1162
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
1163
+ },
1164
+ {
1165
+ "id": "account_takeover",
1166
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
1167
+ },
1168
+ {
1169
+ "id": "insecure_redirect_uri",
1170
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1171
+ },
1172
+ {
1173
+ "id": "missing_state_parameter",
1174
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1175
+ }
1176
+ ],
1177
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
1178
+ },
1179
+ {
1180
+ "id": "rfd",
1181
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
1182
+ },
1183
+ {
1184
+ "id": "same_site_scripting",
1185
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
1186
+ },
1187
+ {
1188
+ "id": "server_side_request_forgery_ssrf",
1189
+ "children": [
1190
+ {
1191
+ "id": "external_dns_query_only",
1192
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
1193
+ },
1194
+ {
1195
+ "id": "external_low_impact",
1196
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
1197
+ },
1198
+ {
1199
+ "id": "internal_high_impact",
1200
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
1201
+ },
1202
+ {
1203
+ "id": "internal_scan_and_or_medium_impact",
1204
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
1205
+ }
1206
+ ]
1207
+ },
1208
+ {
1209
+ "id": "unsafe_file_upload",
1210
+ "children": [
1211
+ {
1212
+ "id": "no_antivirus",
1213
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
1214
+ },
1215
+ {
1216
+ "id": "no_size_limit",
1217
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1218
+ }
1219
+ ]
1220
+ },
1221
+ {
1222
+ "id": "using_default_credentials",
1223
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
1224
+ },
1225
+ {
1226
+ "id": "waf_bypass",
1227
+ "children": [
1228
+ {
1229
+ "id": "direct_server_access",
1230
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1231
+ }
1232
+ ]
1233
+ }
1234
+ ]
1235
+ },
1236
+ {
1237
+ "id": "server_side_injection",
1238
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1239
+ "children": [
1240
+ {
1241
+ "id": "content_spoofing",
1242
+ "children": [
1243
+ {
1244
+ "id": "email_html_injection",
1245
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1246
+ },
1247
+ {
1248
+ "id": "external_authentication_injection",
1249
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1250
+ },
1251
+ {
1252
+ "id": "html_content_injection",
1253
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1254
+ },
1255
+ {
1256
+ "id": "iframe_injection",
1257
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
1258
+ },
1259
+ {
1260
+ "id": "impersonation_via_broken_link_hijacking",
1261
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
1262
+ }
1263
+ ],
1264
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1265
+ },
1266
+ {
1267
+ "id": "file_inclusion",
1268
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
1269
+ },
1270
+ {
1271
+ "id": "http_response_manipulation",
1272
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
1273
+ },
1274
+ {
1275
+ "id": "remote_code_execution_rce",
1276
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1277
+ },
1278
+ {
1279
+ "id": "sql_injection",
1280
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
1281
+ },
1282
+ {
1283
+ "id": "ssti",
1284
+ "children": [
1285
+ {
1286
+ "id": "basic",
1287
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1288
+ }
1289
+ ]
1290
+ },
1291
+ {
1292
+ "id": "xml_external_entity_injection_xxe",
1293
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
1294
+ }
1295
+ ]
1296
+ },
1297
+ {
1298
+ "id": "smart_contract_misconfiguration",
1299
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1300
+ },
1301
+ {
1302
+ "id": "societal_biases",
1303
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1304
+ },
1305
+ {
1306
+ "id": "unvalidated_redirects_and_forwards",
1307
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1308
+ "children": [
1309
+ {
1310
+ "id": "open_redirect",
1311
+ "children": [
1312
+ {
1313
+ "id": "get_based",
1314
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
1315
+ }
1316
+ ]
1317
+ }
1318
+ ]
1319
+ },
1320
+ {
1321
+ "id": "using_components_with_known_vulnerabilities",
1322
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1323
+ "children": [
1324
+ {
1325
+ "id": "rosetta_flash",
1326
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1327
+ }
1328
+ ]
1329
+ },
1330
+ {
1331
+ "id": "zero_knowledge_security_misconfiguration",
1332
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1333
+ }
1334
+ ]
1335
+ }