@blamejs/exceptd-skills 0.15.11 → 0.15.13

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.15.13 — 2026-05-29
+
+Draft-curation pass 11 — Citrix. Six CISA KEV-listed Citrix CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: four NetScaler ADC/Gateway appliance flaws (CVE-2026-3055 and CVE-2025-5777 — the CitrixBleed-class out-of-bounds reads that disclose authenticated session material; CVE-2025-7775 and CVE-2025-6543 memory-corruption buffer flaws) and two Session Recording flaws (CVE-2024-8069 deserialization RCE and CVE-2024-8068 privilege escalation). The CitrixBleed entries map T1552 alongside T1190 to surface session-token theft, and the lessons stress session termination + secret rotation (memory-disclosure class) and appliance rebuild (RCE class) as required steps beyond the patch.
+
+## 0.15.12 — 2026-05-29
+
+Draft-curation pass 10 — Zimbra mail server. Seven CISA KEV-listed Synacor Zimbra Collaboration Suite (ZCS) CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: the cross-site scripting cluster (CVE-2025-48700, CVE-2025-66376, CVE-2025-27915, CVE-2024-27443), the server-side request forgery pair (CVE-2020-7796, CVE-2019-9621), and the PHP remote-file-inclusion RCE (CVE-2025-68645). The lessons note ZCS is a recurring mass-exploited mail-server target where web-shell hunting and session-secret rotation are needed beyond the patch.
+
 ## 0.15.11 — 2026-05-29
 
 Draft-curation pass 9 — Apple client-side zero-days. Nine CISA KEV-listed Apple memory-corruption CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons. They map T1203 (Exploitation for Client Execution) — and T1068 for the sandbox-escape steps that act as privilege links in a multi-stage chain — rather than the network-service T1190: improper locking (CVE-2025-43510), buffer overflows (CVE-2025-43520, CVE-2025-31277, CVE-2026-20700), use-after-frees (CVE-2023-43000, CVE-2023-41974), an integer overflow (CVE-2021-30952), and two code-execution flaws (CVE-2022-48503, CVE-2025-43200). The lessons frame these as targeted-spyware-chain components and stress same-day OS update vs. MDM change windows, with Lockdown Mode for high-risk users.

package/data/_indexes/_meta.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-29T19:51:04.683Z",
+  "generated_at": "2026-05-29T20:35:07.738Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "690cb7c701080f97144ae7df49c0fb2b2b017f6699859f6cfe1a2d07c2a1d32c",
+    "manifest.json": "8fe3f27879a535ce7242433d0a93dc71146f6a9f7fddc1fd9869c9f8270e1ea6",
     "data/atlas-ttps.json": "878b4a08bb73c8d20396d85cf433a88f2bc5e7a8cbf7f6ab773ce7ede0a11251",
-    "data/attack-techniques.json": "874c1693aa263ff5161cc96bd28efa6056c0e018847e2b55f575502b47a45fc5",
-    "data/cve-catalog.json": "6787e2aea49819872301629954f5a5d3ce9c27d984ffd45835eb097cab95e98c",
+    "data/attack-techniques.json": "d139db4dc4cb4ec2be0ba517bbfa541215053aa6fa3aa1544dd061711d1acd8e",
+    "data/cve-catalog.json": "b24fe940b9752fd8ec37ec03954b0b99c8de523b1a5b6a7b79e2f55e3327baea",
     "data/cwe-catalog.json": "0fd275c2a61754958d68cea03a92794a67cf1c1d4d609f81a5728334df013ee3",
     "data/d3fend-catalog.json": "9a54bccb9f24f84b32024216cc3f53819a053721ac8ab43c326859e68fc0ffaf",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
@@ -15,7 +15,7 @@
     "data/framework-control-gaps.json": "29e7b6aa841ddf2530ca5971bdb60d7a715684b2f6264141ad49f0de9a039d78",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
     "data/rfc-references.json": "b21d03b948c41bc8a854e2f057948ecf844bd8c105848aeb141d1eadf8192c31",
-    "data/zeroday-lessons.json": "775bcd4734117ccfc4d191f0a3ae337b43da6611a612c1e0074c3bb8e285bbbc",
+    "data/zeroday-lessons.json": "a127b709dee1473f21804a85150aabfe1072e95443292d853b1fc6de554b4825",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "2880499993e0e69e3897a9d02b5e83aa0462c86a4dd2c1988b9968e375704a1f",
     "skills/mcp-agent-trust/skill.md": "0752834acde0303d6d1e36be4b320eac3d34fde715bb8d71f3ad9e801d701482",

package/data/attack-techniques.json

@@ -298,6 +298,7 @@
       "CVE-2024-4889",
       "CVE-2024-50050",
       "CVE-2024-5565",
+      "CVE-2024-8069",
       "CVE-2025-10164",
       "CVE-2025-1094",
       "CVE-2025-11837",
@@ -325,6 +326,7 @@
       "CVE-2025-58034",
       "CVE-2025-60455",
       "CVE-2025-64496",
+      "CVE-2025-68645",
       "CVE-2025-68664",
       "CVE-2025-68665",
       "CVE-2025-68668",
@@ -912,9 +914,11 @@
       "CVE-2017-1000353",
       "CVE-2018-4063",
       "CVE-2019-6693",
+      "CVE-2019-9621",
       "CVE-2020-10148",
       "CVE-2020-25078",
       "CVE-2020-25079",
+      "CVE-2020-7796",
       "CVE-2021-22681",
       "CVE-2021-26828",
       "CVE-2022-1471",
@@ -947,6 +951,7 @@
       "CVE-2024-21575",
       "CVE-2024-21576",
       "CVE-2024-21762",
+      "CVE-2024-27443",
       "CVE-2024-2912",
       "CVE-2024-31462",
       "CVE-2024-37032",
@@ -961,6 +966,7 @@
       "CVE-2024-57726",
       "CVE-2024-6587",
       "CVE-2024-7694",
+      "CVE-2024-8068",
       "CVE-2024-8069",
       "CVE-2025-0282",
       "CVE-2025-10035",
@@ -992,6 +998,7 @@
       "CVE-2025-27520",
       "CVE-2025-2775",
       "CVE-2025-2776",
+      "CVE-2025-27915",
       "CVE-2025-29635",
       "CVE-2025-30165",
       "CVE-2025-30202",
@@ -1023,6 +1030,7 @@
       "CVE-2025-47812",
       "CVE-2025-47827",
       "CVE-2025-48384",
+      "CVE-2025-48700",
       "CVE-2025-48703",
       "CVE-2025-48927",
       "CVE-2025-48928",
@@ -1047,6 +1055,7 @@
       "CVE-2025-55177",
       "CVE-2025-55182",
       "CVE-2025-56520",
+      "CVE-2025-5777",
       "CVE-2025-57819",
       "CVE-2025-58034",
       "CVE-2025-58360",
@@ -1067,8 +1076,10 @@
       "CVE-2025-64446",
       "CVE-2025-64496",
       "CVE-2025-64513",
+      "CVE-2025-6543",
       "CVE-2025-6554",
       "CVE-2025-6558",
+      "CVE-2025-66376",
       "CVE-2025-66644",
       "CVE-2025-67818",
       "CVE-2025-68613",
@@ -1123,6 +1134,7 @@
       "CVE-2026-25108",
       "CVE-2026-26015",
       "CVE-2026-26190",
+      "CVE-2026-3055",
       "CVE-2026-3059",
       "CVE-2026-3060",
       "CVE-2026-30616",
@@ -1649,10 +1661,12 @@
       "CVE-2024-12450",
       "CVE-2025-30066",
       "CVE-2025-30154",
+      "CVE-2025-5777",
       "CVE-2025-68664",
       "CVE-2025-68665",
       "CVE-2026-20128",
       "CVE-2026-22219",
+      "CVE-2026-3055",
       "CVE-2026-48027",
       "MAL-2025-PYPI-COLORAMA-SOLANA-STEALER",
       "MAL-2026-RUBYGEMS-BUFFERZONECORP-SLEEPER"