vrt 0.13.6 → 0.13.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (41) hide show
  1. checksums.yaml +4 -4
  2. data/lib/data/1.18/deprecated-node-mapping.json +335 -0
  3. data/lib/data/1.18/mappings/cvss_v3/cvss_v3.json +1418 -0
  4. data/lib/data/1.18/mappings/cvss_v3/cvss_v3.schema.json +59 -0
  5. data/lib/data/1.18/mappings/cvss_v4/cvss_v4.json +2340 -0
  6. data/lib/data/1.18/mappings/cvss_v4/cvss_v4.schema.json +62 -0
  7. data/lib/data/1.18/mappings/cwe/cwe.json +1167 -0
  8. data/lib/data/1.18/mappings/cwe/cwe.schema.json +63 -0
  9. data/lib/data/1.18/mappings/remediation_advice/remediation_advice.json +2107 -0
  10. data/lib/data/1.18/mappings/remediation_advice/remediation_advice.schema.json +75 -0
  11. data/lib/data/1.18/third-party-mappings/remediation_training/secure-code-warrior-links.json +540 -0
  12. data/lib/data/1.18/vrt.schema.json +63 -0
  13. data/lib/data/1.18/vulnerability-rating-taxonomy.json +3371 -0
  14. data/lib/data/1.18.1/deprecated-node-mapping.json +341 -0
  15. data/lib/data/1.18.1/mappings/cvss_v3/cvss_v3.json +1602 -0
  16. data/lib/data/1.18.1/mappings/cvss_v3/cvss_v3.schema.json +59 -0
  17. data/lib/data/1.18.1/mappings/cvss_v4/cvss_v4.json +2521 -0
  18. data/lib/data/1.18.1/mappings/cvss_v4/cvss_v4.schema.json +62 -0
  19. data/lib/data/1.18.1/mappings/cwe/cwe.json +1363 -0
  20. data/lib/data/1.18.1/mappings/cwe/cwe.schema.json +63 -0
  21. data/lib/data/1.18.1/mappings/remediation_advice/remediation_advice.json +2300 -0
  22. data/lib/data/1.18.1/mappings/remediation_advice/remediation_advice.schema.json +75 -0
  23. data/lib/data/1.18.1/scw_links.json +583 -0
  24. data/lib/data/1.18.1/third-party-mappings/remediation_training/secure-code-warrior-links.json +583 -0
  25. data/lib/data/1.18.1/vrt.schema.json +63 -0
  26. data/lib/data/1.18.1/vulnerability-rating-taxonomy.json +3638 -0
  27. data/lib/data/1.19/deprecated-node-mapping.json +341 -0
  28. data/lib/data/1.19/mappings/cvss_v3/cvss_v3.json +1602 -0
  29. data/lib/data/1.19/mappings/cvss_v3/cvss_v3.schema.json +59 -0
  30. data/lib/data/1.19/mappings/cvss_v4/cvss_v4.json +2521 -0
  31. data/lib/data/1.19/mappings/cvss_v4/cvss_v4.schema.json +62 -0
  32. data/lib/data/1.19/mappings/cwe/cwe.json +1363 -0
  33. data/lib/data/1.19/mappings/cwe/cwe.schema.json +63 -0
  34. data/lib/data/1.19/mappings/remediation_advice/remediation_advice.json +2300 -0
  35. data/lib/data/1.19/mappings/remediation_advice/remediation_advice.schema.json +75 -0
  36. data/lib/data/1.19/third-party-mappings/remediation_training/secure-code-warrior-links.json +583 -0
  37. data/lib/data/1.19/vrt.schema.json +63 -0
  38. data/lib/data/1.19/vulnerability-rating-taxonomy.json +3638 -0
  39. data/lib/vrt/version.rb +1 -1
  40. data/lib/vrt.rb +1 -1
  41. metadata +40 -7
data/lib/data/1.18.1/mappings/cvss_v3/cvss_v3.json ADDED
@@ -0,0 +1,1602 @@
1
+ {
2
+ "metadata": {
3
+ "default": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
4
+ },
5
+ "content": [
6
+ {
7
+ "id": "ai_application_security",
8
+ "children": [
9
+ {
10
+ "id": "adversarial_example_injection",
11
+ "children": [
12
+ {
13
+ "id": "ai_misclassification_attacks",
14
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"
15
+ }
16
+ ]
17
+ },
18
+ {
19
+ "id": "ai_safety",
20
+ "children": [
21
+ {
22
+ "id": "misinformation_wrong_factual_data",
23
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
24
+ }
25
+ ]
26
+ },
27
+ {
28
+ "id": "denial_of_service_dos",
29
+ "children": [
30
+ {
31
+ "id": "application_wide",
32
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
33
+ },
34
+ {
35
+ "id": "tenant_scoped",
36
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L"
37
+ }
38
+ ]
39
+ },
40
+ {
41
+ "id": "improper_input_handling",
42
+ "children": [
43
+ {
44
+ "id": "ansi_escape_codes",
45
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
46
+ },
47
+ {
48
+ "id": "rtl_overrides",
49
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
50
+ },
51
+ {
52
+ "id": "unicode_confusables",
53
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
54
+ }
55
+ ]
56
+ },
57
+ {
58
+ "id": "improper_output_handling",
59
+ "children": [
60
+ {
61
+ "id": "cross_site_scripting_xss",
62
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
63
+ },
64
+ {
65
+ "id": "markdown_html_injection",
66
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
67
+ }
68
+ ]
69
+ },
70
+ {
71
+ "id": "insufficient_rate_limiting",
72
+ "children": [
73
+ {
74
+ "id": "query_flooding_api_token_abuse",
75
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
76
+ }
77
+ ]
78
+ },
79
+ {
80
+ "id": "model_extraction",
81
+ "children": [
82
+ {
83
+ "id": "api_query_based_model_reconstruction",
84
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
85
+ }
86
+ ]
87
+ },
88
+ {
89
+ "id": "prompt_injection",
90
+ "children": [
91
+ {
92
+ "id": "system_prompt_leakage",
93
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
94
+ }
95
+ ]
96
+ },
97
+ {
98
+ "id": "remote_code_execution",
99
+ "children": [
100
+ {
101
+ "id": "full_system_compromise",
102
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
103
+ },
104
+ {
105
+ "id": "sandboxed_container_code_execution",
106
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H"
107
+ }
108
+ ]
109
+ },
110
+ {
111
+ "id": "sensitive_information_disclosure",
112
+ "children": [
113
+ {
114
+ "id": "cross_tenant_pii_leakage_exposure",
115
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
116
+ },
117
+ {
118
+ "id": "key_leak",
119
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
120
+ }
121
+ ]
122
+ },
123
+ {
124
+ "id": "training_data_poisoning",
125
+ "children": [
126
+ {
127
+ "id": "backdoor_injection_bias_manipulation",
128
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
129
+ }
130
+ ]
131
+ },
132
+ {
133
+ "id": "vector_and_embedding_weaknesses",
134
+ "children": [
135
+ {
136
+ "id": "embedding_exfiltration_model_extraction",
137
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
138
+ },
139
+ {
140
+ "id": "semantic_indexing",
141
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
142
+ }
143
+ ]
144
+ }
145
+ ]
146
+ },
147
+ {
148
+ "id": "algorithmic_biases",
149
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
150
+ },
151
+ {
152
+ "id": "application_level_denial_of_service_dos",
153
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
154
+ "children": [
155
+ {
156
+ "id": "critical_impact_and_or_easy_difficulty",
157
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
158
+ },
159
+ {
160
+ "id": "excessive_resource_consumption",
161
+ "children": [
162
+ {
163
+ "id": "injection_prompt",
164
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
165
+ }
166
+ ],
167
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H"
168
+ },
169
+ {
170
+ "id": "high_impact_and_or_medium_difficulty",
171
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
172
+ }
173
+ ]
174
+ },
175
+ {
176
+ "id": "automotive_security_misconfiguration",
177
+ "children": [
178
+ {
179
+ "id": "abs",
180
+ "children": [
181
+ {
182
+ "id": "unintended_acceleration_brake",
183
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
184
+ }
185
+ ]
186
+ },
187
+ {
188
+ "id": "battery_management_system",
189
+ "children": [
190
+ {
191
+ "id": "firmware_dump",
192
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
193
+ },
194
+ {
195
+ "id": "fraudulent_interface",
196
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H"
197
+ }
198
+ ]
199
+ },
200
+ {
201
+ "id": "can",
202
+ "children": [
203
+ {
204
+ "id": "injection_basic_safety_message",
205
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
206
+ },
207
+ {
208
+ "id": "injection_battery_management_system",
209
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
210
+ },
211
+ {
212
+ "id": "injection_disallowed_messages",
213
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
214
+ },
215
+ {
216
+ "id": "injection_dos",
217
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
218
+ },
219
+ {
220
+ "id": "injection_headlights",
221
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
222
+ },
223
+ {
224
+ "id": "injection_powertrain",
225
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
226
+ },
227
+ {
228
+ "id": "injection_pyrotechnical_device_deployment_tool",
229
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
230
+ },
231
+ {
232
+ "id": "injection_sensors",
233
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
234
+ },
235
+ {
236
+ "id": "injection_steering_control",
237
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
238
+ },
239
+ {
240
+ "id": "injection_vehicle_anti_theft_systems",
241
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
242
+ }
243
+ ]
244
+ },
245
+ {
246
+ "id": "gnss_gps",
247
+ "children": [
248
+ {
249
+ "id": "spoofing",
250
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
251
+ }
252
+ ]
253
+ },
254
+ {
255
+ "id": "immobilizer",
256
+ "children": [
257
+ {
258
+ "id": "engine_start",
259
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
260
+ }
261
+ ]
262
+ },
263
+ {
264
+ "id": "infotainment_radio_head_unit",
265
+ "children": [
266
+ {
267
+ "id": "code_execution_can_bus_pivot",
268
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
269
+ },
270
+ {
271
+ "id": "code_execution_no_can_bus_pivot",
272
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
273
+ },
274
+ {
275
+ "id": "default_credentials",
276
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
277
+ },
278
+ {
279
+ "id": "dos_brick",
280
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
281
+ },
282
+ {
283
+ "id": "ota_firmware_manipulation",
284
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
285
+ },
286
+ {
287
+ "id": "sensitive_data_leakage_exposure",
288
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
289
+ },
290
+ {
291
+ "id": "source_code_dump",
292
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
293
+ },
294
+ {
295
+ "id": "unauthorized_access_to_services",
296
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
297
+ }
298
+ ]
299
+ },
300
+ {
301
+ "id": "rf_hub",
302
+ "children": [
303
+ {
304
+ "id": "can_injection_interaction",
305
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
306
+ },
307
+ {
308
+ "id": "data_leakage_pull_encryption_mechanism",
309
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
310
+ },
311
+ {
312
+ "id": "key_fob_cloning",
313
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
314
+ },
315
+ {
316
+ "id": "relay",
317
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
318
+ },
319
+ {
320
+ "id": "replay",
321
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
322
+ },
323
+ {
324
+ "id": "roll_jam",
325
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
326
+ },
327
+ {
328
+ "id": "unauthorized_access_turn_on",
329
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"
330
+ }
331
+ ]
332
+ },
333
+ {
334
+ "id": "rsu",
335
+ "children": [
336
+ {
337
+ "id": "sybil_attack",
338
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
339
+ }
340
+ ]
341
+ }
342
+ ]
343
+ },
344
+ {
345
+ "id": "blockchain_infrastructure_misconfiguration",
346
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
347
+ },
348
+ {
349
+ "id": "broken_access_control",
350
+ "children": [
351
+ {
352
+ "id": "bypass_of_password_confirmation",
353
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
354
+ },
355
+ {
356
+ "id": "exposed_sensitive_android_intent",
357
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
358
+ },
359
+ {
360
+ "id": "exposed_sensitive_ios_url_scheme",
361
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
362
+ },
363
+ {
364
+ "id": "privilege_escalation",
365
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
366
+ },
367
+ {
368
+ "id": "username_enumeration",
369
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
370
+ }
371
+ ],
372
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
373
+ },
374
+ {
375
+ "id": "broken_authentication_and_session_management",
376
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
377
+ "children": [
378
+ {
379
+ "id": "authentication_bypass",
380
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
381
+ },
382
+ {
383
+ "id": "cleartext_transmission_of_session_token",
384
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
385
+ },
386
+ {
387
+ "id": "concurrent_logins",
388
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
389
+ },
390
+ {
391
+ "id": "failure_to_invalidate_session",
392
+ "children": [
393
+ {
394
+ "id": "all_sessions",
395
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
396
+ },
397
+ {
398
+ "id": "long_timeout",
399
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
400
+ },
401
+ {
402
+ "id": "on_email_change",
403
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
404
+ },
405
+ {
406
+ "id": "on_logout",
407
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
408
+ },
409
+ {
410
+ "id": "on_logout_server_side_only",
411
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
412
+ },
413
+ {
414
+ "id": "on_password_change",
415
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
416
+ },
417
+ {
418
+ "id": "on_two_fa_activation_change",
419
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N"
420
+ }
421
+ ]
422
+ },
423
+ {
424
+ "id": "saml_replay",
425
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
426
+ },
427
+ {
428
+ "id": "session_fixation",
429
+ "children": [
430
+ {
431
+ "id": "local_attack_vector",
432
+ "cvss_v3": "AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N"
433
+ },
434
+ {
435
+ "id": "remote_attack_vector",
436
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
437
+ }
438
+ ]
439
+ },
440
+ {
441
+ "id": "two_fa_bypass",
442
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
443
+ },
444
+ {
445
+ "id": "weak_login_function",
446
+ "children": [
447
+ {
448
+ "id": "other_plaintext_protocol_no_secure_alternative",
449
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
450
+ },
451
+ {
452
+ "id": "over_http",
453
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
454
+ }
455
+ ]
456
+ },
457
+ {
458
+ "id": "weak_registration_implementation",
459
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
460
+ },
461
+ {
462
+ "id": "excessive_jwt_lifetime",
463
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
464
+ },
465
+ {
466
+ "id": "secret_questions_account_verification",
467
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
468
+ }
469
+ ]
470
+ },
471
+ {
472
+ "id": "client_side_injection",
473
+ "children": [
474
+ {
475
+ "id": "binary_planting",
476
+ "children": [
477
+ {
478
+ "id": "no_privilege_escalation",
479
+ "cvss_v3": "AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
480
+ },
481
+ {
482
+ "id": "non_default_folder_privilege_escalation",
483
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
484
+ },
485
+ {
486
+ "id": "privilege_escalation",
487
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
488
+ }
489
+ ]
490
+ }
491
+ ]
492
+ },
493
+ {
494
+ "id": "cloud_security",
495
+ "children": [
496
+ {
497
+ "id": "identity_and_access_management_iam_misconfigurations",
498
+ "children": [
499
+ {
500
+ "id": "overly_permissive_iam_roles",
501
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
502
+ },
503
+ {
504
+ "id": "publicly_accessible_iam_credentials",
505
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
506
+ }
507
+ ]
508
+ },
509
+ {
510
+ "id": "logging_and_monitoring_issues",
511
+ "children": [
512
+ {
513
+ "id": "disabled_or_insufficient_logging",
514
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
515
+ }
516
+ ]
517
+ },
518
+ {
519
+ "id": "misconfigured_services_and_apis",
520
+ "children": [
521
+ {
522
+ "id": "exposed_debug_or_admin_interfaces",
523
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
524
+ },
525
+ {
526
+ "id": "insecure_api_endpoints",
527
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
528
+ }
529
+ ]
530
+ },
531
+ {
532
+ "id": "network_configuration_issues",
533
+ "children": [
534
+ {
535
+ "id": "lack_of_network_segmentation",
536
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L"
537
+ },
538
+ {
539
+ "id": "open_management_ports_to_the_internet",
540
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
541
+ }
542
+ ]
543
+ },
544
+ {
545
+ "id": "storage_misconfigurations",
546
+ "children": [
547
+ {
548
+ "id": "publicly_accessible_cloud_storage",
549
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
550
+ },
551
+ {
552
+ "id": "unencrypted_sensitive_data_at_rest",
553
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
554
+ }
555
+ ]
556
+ }
557
+ ]
558
+ },
559
+ {
560
+ "id": "cross_site_request_forgery_csrf",
561
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
562
+ "children": [
563
+ {
564
+ "id": "action_specific",
565
+ "children": [
566
+ {
567
+ "id": "logout",
568
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
569
+ }
570
+ ]
571
+ },
572
+ {
573
+ "id": "application_wide",
574
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
575
+ },
576
+ {
577
+ "id": "csrf_token_not_unique_per_request",
578
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
579
+ },
580
+ {
581
+ "id": "flash_based",
582
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
583
+ }
584
+ ]
585
+ },
586
+ {
587
+ "id": "cross_site_scripting_xss",
588
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
589
+ "children": [
590
+ {
591
+ "id": "cookie_based",
592
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
593
+ },
594
+ {
595
+ "id": "flash_based",
596
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N"
597
+ },
598
+ {
599
+ "id": "ie_only",
600
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
601
+ },
602
+ {
603
+ "id": "off_domain",
604
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
605
+ },
606
+ {
607
+ "id": "referer",
608
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
609
+ },
610
+ {
611
+ "id": "reflected",
612
+ "children": [
613
+ {
614
+ "id": "non_self",
615
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
616
+ }
617
+ ]
618
+ },
619
+ {
620
+ "id": "stored",
621
+ "children": [
622
+ {
623
+ "id": "non_admin_to_anyone",
624
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
625
+ },
626
+ {
627
+ "id": "privileged_user_to_no_privilege_elevation",
628
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
629
+ },
630
+ {
631
+ "id": "privileged_user_to_privilege_elevation",
632
+ "cvss_v3": "AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"
633
+ },
634
+ {
635
+ "id": "url_based",
636
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
637
+ }
638
+ ]
639
+ },
640
+ {
641
+ "id": "universal_uxss",
642
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
643
+ }
644
+ ]
645
+ },
646
+ {
647
+ "id": "cryptographic_weakness",
648
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
649
+ "children": [
650
+ {
651
+ "id": "broken_cryptography",
652
+ "children": [
653
+ {
654
+ "id": "use_of_broken_cryptographic_primitive",
655
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
656
+ },
657
+ {
658
+ "id": "use_of_vulnerable_cryptographic_library",
659
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
660
+ }
661
+ ]
662
+ },
663
+ {
664
+ "id": "incomplete_cleanup_of_keying_material",
665
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L"
666
+ },
667
+ {
668
+ "id": "insecure_key_generation",
669
+ "children": [
670
+ {
671
+ "id": "insufficient_key_space",
672
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
673
+ },
674
+ {
675
+ "id": "key_exchange_without_entity_authentication",
676
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
677
+ }
678
+ ]
679
+ },
680
+ {
681
+ "id": "insufficient_entropy",
682
+ "children": [
683
+ {
684
+ "id": "initialization_vector_reuse",
685
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
686
+ },
687
+ {
688
+ "id": "limited_rng_entropy_source",
689
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
690
+ },
691
+ {
692
+ "id": "predictable_initialization_vector",
693
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
694
+ },
695
+ {
696
+ "id": "predictable_prng_seed",
697
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
698
+ },
699
+ {
700
+ "id": "prng_seed_reuse",
701
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
702
+ },
703
+ {
704
+ "id": "small_seed_space_in_prng",
705
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
706
+ },
707
+ {
708
+ "id": "use_of_trng_for_nonsecurity_purpose",
709
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
710
+ }
711
+ ]
712
+ },
713
+ {
714
+ "id": "insufficient_verification_of_data_authenticity",
715
+ "children": [
716
+ {
717
+ "id": "identity_check_value",
718
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
719
+ }
720
+ ]
721
+ },
722
+ {
723
+ "id": "key_reuse",
724
+ "children": [
725
+ {
726
+ "id": "inter_environment",
727
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
728
+ },
729
+ {
730
+ "id": "intra_environment",
731
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
732
+ },
733
+ {
734
+ "id": "lack_of_perfect_forward_secrecy",
735
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
736
+ }
737
+ ]
738
+ },
739
+ {
740
+ "id": "side_channel_attack",
741
+ "children": [
742
+ {
743
+ "id": "emanations_attack",
744
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
745
+ },
746
+ {
747
+ "id": "padding_oracle_attack",
748
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
749
+ },
750
+ {
751
+ "id": "power_analysis_attack",
752
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
753
+ },
754
+ {
755
+ "id": "timing_attack",
756
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
757
+ }
758
+ ]
759
+ },
760
+ {
761
+ "id": "use_of_expired_cryptographic_key_or_cert",
762
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
763
+ },
764
+ {
765
+ "id": "weak_hash",
766
+ "children": [
767
+ {
768
+ "id": "use_of_predictable_salt",
769
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
770
+ }
771
+ ]
772
+ }
773
+ ]
774
+ },
775
+ {
776
+ "id": "data_biases",
777
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
778
+ },
779
+ {
780
+ "id": "decentralized_application_misconfiguration",
781
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
782
+ },
783
+ {
784
+ "id": "developer_biases",
785
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
786
+ },
787
+ {
788
+ "id": "external_behavior",
789
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
790
+ },
791
+ {
792
+ "id": "indicators_of_compromise",
793
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
794
+ },
795
+ {
796
+ "id": "insecure_data_storage",
797
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
798
+ "children": [
799
+ {
800
+ "id": "sensitive_application_data_stored_unencrypted",
801
+ "children": [
802
+ {
803
+ "id": "on_external_storage",
804
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
805
+ }
806
+ ]
807
+ },
808
+ {
809
+ "id": "server_side_credentials_storage",
810
+ "children": [
811
+ {
812
+ "id": "plaintext",
813
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N"
814
+ }
815
+ ]
816
+ }
817
+ ]
818
+ },
819
+ {
820
+ "id": "insecure_data_transport",
821
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
822
+ "children": [
823
+ {
824
+ "id": "executable_download",
825
+ "children": [
826
+ {
827
+ "id": "no_secure_integrity_check",
828
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
829
+ },
830
+ {
831
+ "id": "secure_integrity_check",
832
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
833
+ }
834
+ ]
835
+ }
836
+ ]
837
+ },
838
+ {
839
+ "id": "insecure_os_firmware",
840
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
841
+ "children": [
842
+ {
843
+ "id": "command_injection",
844
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
845
+ },
846
+ {
847
+ "id": "data_not_encrypted_at_rest",
848
+ "children": [
849
+ {
850
+ "id": "non_sensitive",
851
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
852
+ }
853
+ ]
854
+ },
855
+ {
856
+ "id": "hardcoded_password",
857
+ "children": [
858
+ {
859
+ "id": "non_privileged_user",
860
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
861
+ },
862
+ {
863
+ "id": "privileged_user",
864
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
865
+ }
866
+ ]
867
+ },
868
+ {
869
+ "id": "local_administrator_on_default_environment",
870
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
871
+ },
872
+ {
873
+ "id": "over_permissioned_credentials_on_storage",
874
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
875
+ },
876
+ {
877
+ "id": "shared_credentials_on_storage",
878
+ "cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
879
+ },
880
+ {
881
+ "id": "weakness_in_firmware_updates",
882
+ "children": [
883
+ {
884
+ "id": "firmware_does_not_validate_update_integrity",
885
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"
886
+ },
887
+ {
888
+ "id": "firmware_is_not_encrypted",
889
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
890
+ }
891
+ ]
892
+ }
893
+ ]
894
+ },
895
+ {
896
+ "id": "insufficient_security_configurability",
897
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
898
+ "children": [
899
+ {
900
+ "id": "no_password_policy",
901
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
902
+ },
903
+ {
904
+ "id": "weak_password_reset_implementation",
905
+ "children": [
906
+ {
907
+ "id": "token_is_not_invalidated_after_use",
908
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
909
+ }
910
+ ]
911
+ },
912
+ {
913
+ "id": "weak_two_fa_implementation",
914
+ "children": [
915
+ {
916
+ "id": "two_fa_secret_cannot_be_rotated",
917
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
918
+ },
919
+ {
920
+ "id": "two_fa_secret_remains_obtainable_after_two_fa_is_enabled",
921
+ "cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
922
+ }
923
+ ]
924
+ },
925
+ {
926
+ "id": "no_two_fa_implementation",
927
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
928
+ },
929
+ {
930
+ "id": "no_account_lockout",
931
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
932
+ },
933
+ {
934
+ "id": "weak_jwt_hashing_algorithm",
935
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
936
+ }
937
+ ]
938
+ },
939
+ {
940
+ "id": "lack_of_binary_hardening",
941
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
942
+ },
943
+ {
944
+ "id": "misinterpretation_biases",
945
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
946
+ },
947
+ {
948
+ "id": "mobile_security_misconfiguration",
949
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
950
+ "children": [
951
+ {
952
+ "id": "auto_backup_allowed_by_default",
953
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
954
+ },
955
+ {
956
+ "id": "clipboard_enabled",
957
+ "cvss_v3": "AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
958
+ }
959
+ ]
960
+ },
961
+ {
962
+ "id": "network_security_misconfiguration",
963
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
964
+ },
965
+ {
966
+ "id": "physical_security_issues",
967
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
968
+ "children": [
969
+ {
970
+ "id": "weakness_in_physical_access_control",
971
+ "children": [
972
+ {
973
+ "id": "commonly_keyed_system",
974
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
975
+ }
976
+ ]
977
+ }
978
+ ]
979
+ },
980
+ {
981
+ "id": "privacy_concerns",
982
+ "children": [
983
+ {
984
+ "id": "unnecessary_data_collection",
985
+ "children": [
986
+ {
987
+ "id": "wifi_ssid_password",
988
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
989
+ }
990
+ ]
991
+ }
992
+ ]
993
+ },
994
+ {
995
+ "id": "protocol_specific_misconfiguration",
996
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
997
+ },
998
+ {
999
+ "id": "sensitive_data_exposure",
1000
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1001
+ "children": [
1002
+ {
1003
+ "id": "disclosure_of_secrets",
1004
+ "children": [
1005
+ {
1006
+ "id": "for_internal_asset",
1007
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
1008
+ },
1009
+ {
1010
+ "id": "for_publicly_accessible_asset",
1011
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
1012
+ },
1013
+ {
1014
+ "id": "pay_per_use_abuse",
1015
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
1016
+ },
1017
+ {
1018
+ "id": "sensitive_information_disclosed_jwt",
1019
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1020
+ },
1021
+ {
1022
+ "id": "publicly_accessible_robots",
1023
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1024
+ }
1025
+ ]
1026
+ },
1027
+ {
1028
+ "id": "exif_geolocation_data_not_stripped_from_uploaded_images",
1029
+ "children": [
1030
+ {
1031
+ "id": "automatic_user_enumeration",
1032
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1033
+ },
1034
+ {
1035
+ "id": "manual_user_enumeration",
1036
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1037
+ }
1038
+ ]
1039
+ },
1040
+ {
1041
+ "id": "graphql_introspection_enabled",
1042
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1043
+ },
1044
+ {
1045
+ "id": "json_hijacking",
1046
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
1047
+ },
1048
+ {
1049
+ "id": "mixed_content",
1050
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N"
1051
+ },
1052
+ {
1053
+ "id": "non_sensitive_token_in_url",
1054
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1055
+ },
1056
+ {
1057
+ "id": "sensitive_token_in_url",
1058
+ "cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
1059
+ },
1060
+ {
1061
+ "id": "token_leakage_via_referer",
1062
+ "children": [
1063
+ {
1064
+ "id": "over_http",
1065
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
1066
+ },
1067
+ {
1068
+ "id": "password_reset_token",
1069
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1070
+ },
1071
+ {
1072
+ "id": "trusted_third_party",
1073
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N"
1074
+ },
1075
+ {
1076
+ "id": "untrusted_third_party",
1077
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"
1078
+ }
1079
+ ]
1080
+ },
1081
+ {
1082
+ "id": "via_localstorage_sessionstorage",
1083
+ "children": [
1084
+ {
1085
+ "id": "non_sensitive_token",
1086
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1087
+ },
1088
+ {
1089
+ "id": "sensitive_token",
1090
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1091
+ }
1092
+ ]
1093
+ },
1094
+ {
1095
+ "id": "visible_detailed_error_page",
1096
+ "children": [
1097
+ {
1098
+ "id": "detailed_server_configuration",
1099
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1100
+ }
1101
+ ]
1102
+ },
1103
+ {
1104
+ "id": "weak_password_reset_implementation",
1105
+ "children": [
1106
+ {
1107
+ "id": "token_leakage_via_host_header_poisoning",
1108
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
1109
+ }
1110
+ ],
1111
+ "cvss_v3": "AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
1112
+ }
1113
+ ]
1114
+ },
1115
+ {
1116
+ "id": "server_security_misconfiguration",
1117
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1118
+ "children": [
1119
+ {
1120
+ "id": "bitsquatting",
1121
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1122
+ },
1123
+ {
1124
+ "id": "captcha",
1125
+ "children": [
1126
+ {
1127
+ "id": "brute_force",
1128
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1129
+ },
1130
+ {
1131
+ "id": "implementation_vulnerability",
1132
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1133
+ }
1134
+ ]
1135
+ },
1136
+ {
1137
+ "id": "clickjacking",
1138
+ "children": [
1139
+ {
1140
+ "id": "form_input",
1141
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1142
+ },
1143
+ {
1144
+ "id": "non_sensitive_action",
1145
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N"
1146
+ },
1147
+ {
1148
+ "id": "sensitive_action",
1149
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
1150
+ }
1151
+ ]
1152
+ },
1153
+ {
1154
+ "id": "dbms_misconfiguration",
1155
+ "children": [
1156
+ {
1157
+ "id": "excessively_privileged_user_dba",
1158
+ "cvss_v3": "AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
1159
+ }
1160
+ ]
1161
+ },
1162
+ {
1163
+ "id": "email_verification_bypass",
1164
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1165
+ },
1166
+ {
1167
+ "id": "exposed_portal",
1168
+ "children": [
1169
+ {
1170
+ "id": "admin_portal",
1171
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1172
+ },
1173
+ {
1174
+ "id": "non_admin_portal",
1175
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
1176
+ },
1177
+ {
1178
+ "id": "protected",
1179
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1180
+ }
1181
+ ]
1182
+ },
1183
+ {
1184
+ "id": "insecure_ssl",
1185
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1186
+ },
1187
+ {
1188
+ "id": "lack_of_password_confirmation",
1189
+ "children": [
1190
+ {
1191
+ "id": "manage_two_fa",
1192
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
1193
+ }
1194
+ ],
1195
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"
1196
+ },
1197
+ {
1198
+ "id": "lack_of_security_headers",
1199
+ "children": [
1200
+ {
1201
+ "id": "cache_control_for_a_sensitive_page",
1202
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1203
+ }
1204
+ ],
1205
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1206
+ },
1207
+ {
1208
+ "id": "mail_server_misconfiguration",
1209
+ "children": [
1210
+ {
1211
+ "id": "email_spoofing_to_inbox_due_to_missing_or_misconfigured_dmarc_on_email_domain",
1212
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1213
+ },
1214
+ {
1215
+ "id": "no_spoofing_protection_on_email_domain",
1216
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
1217
+ }
1218
+ ]
1219
+ },
1220
+ {
1221
+ "id": "misconfigured_dns",
1222
+ "children": [
1223
+ {
1224
+ "id": "missing_caa_record",
1225
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1226
+ },
1227
+ {
1228
+ "id": "subdomain_takeover",
1229
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
1230
+ },
1231
+ {
1232
+ "id": "zone_transfer",
1233
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1234
+ }
1235
+ ]
1236
+ },
1237
+ {
1238
+ "id": "missing_dnssec",
1239
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1240
+ },
1241
+ {
1242
+ "id": "missing_secure_or_httponly_cookie_flag",
1243
+ "children": [
1244
+ {
1245
+ "id": "session_token",
1246
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1247
+ }
1248
+ ]
1249
+ },
1250
+ {
1251
+ "id": "missing_subresource_integrity",
1252
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
1253
+ },
1254
+ {
1255
+ "id": "no_rate_limiting_on_form",
1256
+ "children": [
1257
+ {
1258
+ "id": "change_password",
1259
+ "cvss_v3": "AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"
1260
+ },
1261
+ {
1262
+ "id": "login",
1263
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
1264
+ }
1265
+ ],
1266
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
1267
+ },
1268
+ {
1269
+ "id": "oauth_misconfiguration",
1270
+ "children": [
1271
+ {
1272
+ "id": "account_squatting",
1273
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
1274
+ },
1275
+ {
1276
+ "id": "account_takeover",
1277
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
1278
+ },
1279
+ {
1280
+ "id": "insecure_redirect_uri",
1281
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1282
+ },
1283
+ {
1284
+ "id": "missing_state_parameter",
1285
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1286
+ }
1287
+ ],
1288
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
1289
+ },
1290
+ {
1291
+ "id": "rfd",
1292
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
1293
+ },
1294
+ {
1295
+ "id": "same_site_scripting",
1296
+ "cvss_v3": "AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
1297
+ },
1298
+ {
1299
+ "id": "server_side_request_forgery_ssrf",
1300
+ "children": [
1301
+ {
1302
+ "id": "external_dns_query_only",
1303
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
1304
+ },
1305
+ {
1306
+ "id": "external_low_impact",
1307
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
1308
+ },
1309
+ {
1310
+ "id": "internal_secrets_exposure",
1311
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"
1312
+ },
1313
+ {
1314
+ "id": "internal_data_exposure",
1315
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
1316
+ },
1317
+ {
1318
+ "id": "internal_port_service_scan",
1319
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
1320
+ },
1321
+ {
1322
+ "id": "internal_exposure_presence_data_secrets",
1323
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
1324
+ },
1325
+ {
1326
+ "id": "internal_port_scan_only",
1327
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
1328
+ }
1329
+ ]
1330
+ },
1331
+ {
1332
+ "id": "unsafe_file_upload",
1333
+ "children": [
1334
+ {
1335
+ "id": "no_antivirus",
1336
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
1337
+ },
1338
+ {
1339
+ "id": "no_size_limit",
1340
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1341
+ }
1342
+ ]
1343
+ },
1344
+ {
1345
+ "id": "using_default_credentials",
1346
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
1347
+ },
1348
+ {
1349
+ "id": "waf_bypass",
1350
+ "children": [
1351
+ {
1352
+ "id": "direct_server_access",
1353
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
1354
+ }
1355
+ ]
1356
+ },
1357
+ {
1358
+ "id": "misconfigured_file_share",
1359
+ "children": [
1360
+ {
1361
+ "id": "anonymous_ftp_enabled",
1362
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
1363
+ },
1364
+ {
1365
+ "id": "anonymous_smb_enabled",
1366
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
1367
+ },
1368
+ {
1369
+ "id": "non_sensitive_data_exposure_ftp_smb",
1370
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1371
+ }
1372
+ ]
1373
+ },
1374
+ {
1375
+ "id": "fingerprinting_banner_disclosure",
1376
+ "children": [
1377
+ {
1378
+ "id": "software_version_in_response_headers",
1379
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1380
+ }
1381
+ ]
1382
+ },
1383
+ {
1384
+ "id": "misconfigured_security_headers",
1385
+ "children": [
1386
+ {
1387
+ "id": "insecure_csp",
1388
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1389
+ }
1390
+ ]
1391
+ }
1392
+ ]
1393
+ },
1394
+ {
1395
+ "id": "server_side_injection",
1396
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1397
+ "children": [
1398
+ {
1399
+ "id": "content_spoofing",
1400
+ "children": [
1401
+ {
1402
+ "id": "email_html_injection",
1403
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1404
+ },
1405
+ {
1406
+ "id": "external_authentication_injection",
1407
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
1408
+ },
1409
+ {
1410
+ "id": "html_content_injection",
1411
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1412
+ },
1413
+ {
1414
+ "id": "iframe_injection",
1415
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
1416
+ },
1417
+ {
1418
+ "id": "impersonation_via_broken_link_hijacking",
1419
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
1420
+ },
1421
+ {
1422
+ "id": "self_email_html_injection",
1423
+ "cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:N"
1424
+ }
1425
+ ],
1426
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1427
+ },
1428
+ {
1429
+ "id": "file_inclusion",
1430
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
1431
+ },
1432
+ {
1433
+ "id": "http_response_manipulation",
1434
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
1435
+ },
1436
+ {
1437
+ "id": "remote_code_execution_rce",
1438
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1439
+ },
1440
+ {
1441
+ "id": "sql_injection",
1442
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
1443
+ },
1444
+ {
1445
+ "id": "ssti",
1446
+ "children": [
1447
+ {
1448
+ "id": "basic",
1449
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1450
+ }
1451
+ ]
1452
+ },
1453
+ {
1454
+ "id": "xml_external_entity_injection_xxe",
1455
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
1456
+ }
1457
+ ]
1458
+ },
1459
+ {
1460
+ "id": "smart_contract_misconfiguration",
1461
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1462
+ },
1463
+ {
1464
+ "id": "societal_biases",
1465
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1466
+ },
1467
+ {
1468
+ "id": "unvalidated_redirects_and_forwards",
1469
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1470
+ "children": [
1471
+ {
1472
+ "id": "open_redirect",
1473
+ "children": [
1474
+ {
1475
+ "id": "get_based",
1476
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
1477
+ }
1478
+ ]
1479
+ }
1480
+ ]
1481
+ },
1482
+ {
1483
+ "id": "using_components_with_known_vulnerabilities",
1484
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
1485
+ "children": [
1486
+ {
1487
+ "id": "rosetta_flash",
1488
+ "cvss_v3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"
1489
+ },
1490
+ {
1491
+ "id": "unpatched_javascript_libraries",
1492
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1493
+ }
1494
+ ]
1495
+ },
1496
+ {
1497
+ "id": "zero_knowledge_security_misconfiguration",
1498
+ "cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
1499
+ },
1500
+ {
1501
+ "id": "active_directory",
1502
+ "children": [
1503
+ {
1504
+ "id": "sscm_abuse",
1505
+ "children": [
1506
+ {
1507
+ "id": "pxe_boot_media_theft",
1508
+ "cvss_v3": "AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
1509
+ },
1510
+ {
1511
+ "id": "distribution_point_anonymous_access",
1512
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
1513
+ },
1514
+ {
1515
+ "id": "automatic_device_approval",
1516
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N"
1517
+ },
1518
+ {
1519
+ "id": "ntlm_management_point_site_database",
1520
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
1521
+ },
1522
+ {
1523
+ "id": "ntlm_site_server_site_systems",
1524
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
1525
+ },
1526
+ {
1527
+ "id": "ntlm_automatic_push_installation",
1528
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
1529
+ },
1530
+ {
1531
+ "id": "privileged_credentials_exposed",
1532
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
1533
+ }
1534
+ ]
1535
+ },
1536
+ {
1537
+ "id": "kerberos_abuse",
1538
+ "children": [
1539
+ {
1540
+ "id": "domain_compromise_unconstrained_delegated",
1541
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
1542
+ },
1543
+ {
1544
+ "id": "insecure_service_account_management",
1545
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
1546
+ },
1547
+ {
1548
+ "id": "no_pre_authentication",
1549
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
1550
+ }
1551
+ ]
1552
+ },
1553
+ {
1554
+ "id": "misconfigured_active_directory_certificate_services",
1555
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
1556
+ },
1557
+ {
1558
+ "id": "configuration_weaknesses",
1559
+ "children": [
1560
+ {
1561
+ "id": "passwords_found_domain_description",
1562
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
1563
+ },
1564
+ {
1565
+ "id": "weak_domain_password_policy",
1566
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
1567
+ },
1568
+ {
1569
+ "id": "shared_administrator_passwords",
1570
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
1571
+ },
1572
+ {
1573
+ "id": "excessive_domain_admin_membership",
1574
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
1575
+ },
1576
+ {
1577
+ "id": "dormant_enabled_user_accounts",
1578
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
1579
+ }
1580
+ ]
1581
+ },
1582
+ {
1583
+ "id": "sensitive_data_exposure",
1584
+ "children": [
1585
+ {
1586
+ "id": "ldap_anonymous_bind_enabled",
1587
+ "cvss_v3": "AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
1588
+ },
1589
+ {
1590
+ "id": "sensitive_data_in_open_file_shares",
1591
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
1592
+ }
1593
+ ]
1594
+ },
1595
+ {
1596
+ "id": "dacl_abuse",
1597
+ "cvss_v3": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
1598
+ }
1599
+ ]
1600
+ }
1601
+ ]
1602
+ }