@blamejs/exceptd-skills 0.15.32 → 0.15.34

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.15.34 — 2026-05-29
+
+Draft-curation pass 31 — authentication bypass and missing authentication. Seven CISA KEV-listed CVEs that grant access without valid credentials are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: the Juniper ScreenOS hardcoded-backdoor credential (CVE-2015-7755), Sangoma FreePBX (CVE-2019-19006) and SKYSEA Client View (CVE-2016-7836) improper authentication, AMI MegaRAC SPx baseboard-management-controller authentication bypass by spoofing (CVE-2024-54085), the Erlang/OTP SSH server pre-authentication remote code execution (CVE-2025-32433), Oracle Fusion Middleware missing authentication (CVE-2025-61757), and the TP-Link TL-WA855RE extender missing authentication (CVE-2020-24363). All map T1190 and T1078; the Erlang flaw also maps T1059. The lessons make the load-bearing point that multi-factor authentication and password policy are irrelevant once authentication is bypassed — the compensating control is restricting the management plane to a trusted network — and that below-the-OS targets (the BMC) and planted backdoors require device rebuild, because firmware-level persistence survives an OS reinstall.
+
+## 0.15.33 — 2026-05-29
+
+Draft-curation pass 30 — unauthenticated command/code-injection RCE. Eight CISA KEV-listed CVEs where attacker input reaches a shell or interpreter are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: Array Networks ArrayOS AG (CVE-2025-66644), CWP Control Web Panel (CVE-2025-48703), Libraesva Email Security Gateway (CVE-2025-59689), Trend Micro Apex One console (CVE-2025-54948), GNU Bash Shellshock-family parsing (CVE-2014-6278), PHPMailer sender-address injection (CVE-2016-10033), Jenkins CLI Java deserialization (CVE-2017-1000353), and Fortra GoAnywhere MFT license-servlet deserialization (CVE-2025-10035). All map T1190 and T1059. The lessons highlight a high-fidelity detection signal — a shell or interpreter spawned from a web/daemon process — and stress that bundled-library flaws (Bash, PHPMailer) require updating every consumer, while CI, MFT, and EDR-console compromise carries downstream supply-chain and data reach beyond the patched host.
+
 ## 0.15.32 — 2026-05-29
 
 Draft-curation pass 29 — network devices and edge appliances. Seven CISA KEV-listed unauthenticated CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons, spanning enterprise appliances — F5 BIG-IP stack overflow (CVE-2025-53521), HPE OneView code injection (CVE-2025-37164), Versa Concerto SD-WAN orchestrator authentication bypass (CVE-2025-34026) — and SOHO/embedded devices: ASUS router OS command injection (CVE-2023-39780) and authentication bypass (CVE-2021-32030), Digiever DVR missing authorization (CVE-2023-52163), and Sierra Wireless AirLink ALEOS unrestricted upload (CVE-2018-4063). All map T1190, with per-class T1059, T1078, or T1505.003. The lessons split remediation by device class: enterprise appliances must be rebuilt and re-keyed after compromise, while embedded/SOHO devices — often end-of-life and recruited into botnets — require firmware re-flash or replacement rather than patch-in-place.

package/data/_indexes/_meta.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-30T02:46:03.958Z",
+  "generated_at": "2026-05-30T03:26:11.638Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "bfb12203bc94fbd39b4c1343556482b87f365f89b77c0df1970ecc3f3f29a5e4",
+    "manifest.json": "74458ac0665d22cbe1d574a3b5cf3eb22b51968b93208deb0832911156160355",
     "data/atlas-ttps.json": "878b4a08bb73c8d20396d85cf433a88f2bc5e7a8cbf7f6ab773ce7ede0a11251",
-    "data/attack-techniques.json": "287890d9363989eae37cc65cc32d2c7daeb9393c7c213c3acd0aa12bc5de6bc7",
-    "data/cve-catalog.json": "da1abcc2d3878253bf38e6bb1924b702e89ca2681aeb586100a85ec39e33ce3f",
+    "data/attack-techniques.json": "17bcc2da0674c811c9b31fc4c0870adf6e019c90d18852d6f564a656c39eb13d",
+    "data/cve-catalog.json": "71ced4e5637b5e6be30fe65d0f6370a2f32e851a066837eaab8d8523499291ae",
     "data/cwe-catalog.json": "0fd275c2a61754958d68cea03a92794a67cf1c1d4d609f81a5728334df013ee3",
     "data/d3fend-catalog.json": "9a54bccb9f24f84b32024216cc3f53819a053721ac8ab43c326859e68fc0ffaf",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
@@ -15,7 +15,7 @@
     "data/framework-control-gaps.json": "29e7b6aa841ddf2530ca5971bdb60d7a715684b2f6264141ad49f0de9a039d78",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
     "data/rfc-references.json": "b21d03b948c41bc8a854e2f057948ecf844bd8c105848aeb141d1eadf8192c31",
-    "data/zeroday-lessons.json": "78c717b5c3c9dab103447cac53fdacf966449f9e5450bff323967eaefdd4dbca",
+    "data/zeroday-lessons.json": "83eb8a65889305f4fed33a453b1e693e43e929f4ea6d06646eecf0ec4f7caa96",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "2880499993e0e69e3897a9d02b5e83aa0462c86a4dd2c1988b9968e375704a1f",
     "skills/mcp-agent-trust/skill.md": "0752834acde0303d6d1e36be4b320eac3d34fde715bb8d71f3ad9e801d701482",

package/data/attack-techniques.json

@@ -272,6 +272,9 @@
       "DS0017"
     ],
     "cve_refs": [
+      "CVE-2014-6278",
+      "CVE-2016-10033",
+      "CVE-2017-1000353",
       "CVE-2020-25078",
       "CVE-2020-25079",
       "CVE-2022-1471",
@@ -303,6 +306,7 @@
       "CVE-2024-5565",
       "CVE-2024-56145",
       "CVE-2024-8069",
+      "CVE-2025-10035",
       "CVE-2025-10164",
       "CVE-2025-1094",
       "CVE-2025-11837",
@@ -316,6 +320,7 @@
       "CVE-2025-29635",
       "CVE-2025-30165",
       "CVE-2025-32432",
+      "CVE-2025-32433",
       "CVE-2025-32434",
       "CVE-2025-32444",
       "CVE-2025-3248",
@@ -326,6 +331,7 @@
       "CVE-2025-40551",
       "CVE-2025-4428",
       "CVE-2025-47812",
+      "CVE-2025-48703",
       "CVE-2025-49113",
       "CVE-2025-49596",
       "CVE-2025-49704",
@@ -336,13 +342,16 @@
       "CVE-2025-54068",
       "CVE-2025-54136",
       "CVE-2025-54253",
+      "CVE-2025-54948",
       "CVE-2025-55319",
       "CVE-2025-58034",
+      "CVE-2025-59689",
       "CVE-2025-60455",
       "CVE-2025-61882",
       "CVE-2025-6204",
       "CVE-2025-64328",
       "CVE-2025-64496",
+      "CVE-2025-66644",
       "CVE-2025-68613",
       "CVE-2025-68645",
       "CVE-2025-68664",
@@ -590,6 +599,7 @@
     "cve_refs": [
       "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY",
       "CVE-2015-7755",
+      "CVE-2016-7836",
       "CVE-2017-7921",
       "CVE-2019-19006",
       "CVE-2019-6693",
@@ -611,6 +621,7 @@
       "CVE-2025-2746",
       "CVE-2025-2747",
       "CVE-2025-31161",
+      "CVE-2025-32433",
       "CVE-2025-32975",
       "CVE-2025-34026",
       "CVE-2025-3935",
@@ -946,14 +957,17 @@
       "CVE-2008-0015",
       "CVE-2008-4250",
       "CVE-2014-6278",
+      "CVE-2015-7755",
       "CVE-2016-10033",
       "CVE-2016-7836",
       "CVE-2017-1000353",
       "CVE-2017-7921",
       "CVE-2018-4063",
+      "CVE-2019-19006",
       "CVE-2019-6693",
       "CVE-2019-9621",
       "CVE-2020-10148",
+      "CVE-2020-24363",
       "CVE-2020-25078",
       "CVE-2020-25079",
       "CVE-2020-7796",
@@ -1009,6 +1023,7 @@
       "CVE-2024-43468",
       "CVE-2024-4889",
       "CVE-2024-50050",
+      "CVE-2024-54085",
       "CVE-2024-56145",
       "CVE-2024-57726",
       "CVE-2024-57728",
@@ -1113,6 +1128,7 @@
       "CVE-2025-59389",
       "CVE-2025-59689",
       "CVE-2025-59718",
+      "CVE-2025-61757",
       "CVE-2025-61882",
       "CVE-2025-61932",
       "CVE-2025-6204",