@blamejs/exceptd-skills 0.15.33 → 0.15.35

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.15.35 — 2026-05-29
+
+Draft-curation pass 32 — server-side processing of untrusted data. Seven CISA KEV-listed unauthenticated CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons. The remote-code-execution set — SAP NetWeaver deserialization (CVE-2025-42999), Wazuh server deserialization (CVE-2025-24016), Meta React Server Components (CVE-2025-55182), and XWiki eval injection (CVE-2025-24893) — maps T1190 and T1059; the forgery/disclosure set — OSGeo GeoServer XXE (CVE-2025-58360), Adminer SSRF (CVE-2021-21311), and Oracle E-Business Suite SSRF (CVE-2025-61884) — maps T1190. The lessons separate the RCE response (web-shell hunting and secret rotation) from the SSRF/XXE response (egress filtering, cloud-metadata blocking, disabling external entities), and flag two amplifiers: a compromised Wazuh monitoring server blinds detection across the estate, and SAP/Oracle E-Business Suite sit adjacent to financial data in PCI scope.
+
+## 0.15.34 — 2026-05-29
+
+Draft-curation pass 31 — authentication bypass and missing authentication. Seven CISA KEV-listed CVEs that grant access without valid credentials are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: the Juniper ScreenOS hardcoded-backdoor credential (CVE-2015-7755), Sangoma FreePBX (CVE-2019-19006) and SKYSEA Client View (CVE-2016-7836) improper authentication, AMI MegaRAC SPx baseboard-management-controller authentication bypass by spoofing (CVE-2024-54085), the Erlang/OTP SSH server pre-authentication remote code execution (CVE-2025-32433), Oracle Fusion Middleware missing authentication (CVE-2025-61757), and the TP-Link TL-WA855RE extender missing authentication (CVE-2020-24363). All map T1190 and T1078; the Erlang flaw also maps T1059. The lessons make the load-bearing point that multi-factor authentication and password policy are irrelevant once authentication is bypassed — the compensating control is restricting the management plane to a trusted network — and that below-the-OS targets (the BMC) and planted backdoors require device rebuild, because firmware-level persistence survives an OS reinstall.
+
 ## 0.15.33 — 2026-05-29
 
 Draft-curation pass 30 — unauthenticated command/code-injection RCE. Eight CISA KEV-listed CVEs where attacker input reaches a shell or interpreter are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: Array Networks ArrayOS AG (CVE-2025-66644), CWP Control Web Panel (CVE-2025-48703), Libraesva Email Security Gateway (CVE-2025-59689), Trend Micro Apex One console (CVE-2025-54948), GNU Bash Shellshock-family parsing (CVE-2014-6278), PHPMailer sender-address injection (CVE-2016-10033), Jenkins CLI Java deserialization (CVE-2017-1000353), and Fortra GoAnywhere MFT license-servlet deserialization (CVE-2025-10035). All map T1190 and T1059. The lessons highlight a high-fidelity detection signal — a shell or interpreter spawned from a web/daemon process — and stress that bundled-library flaws (Bash, PHPMailer) require updating every consumer, while CI, MFT, and EDR-console compromise carries downstream supply-chain and data reach beyond the patched host.

package/data/_indexes/_meta.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-30T03:05:30.785Z",
+  "generated_at": "2026-05-30T03:45:52.260Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "9045d51286721985592156db17c8cb917201b948715597901238bda99b99f792",
+    "manifest.json": "1883386c234d1c94350e6ecbdbf4decb6b0bf7c280355a2977c89056c3b40f2d",
     "data/atlas-ttps.json": "878b4a08bb73c8d20396d85cf433a88f2bc5e7a8cbf7f6ab773ce7ede0a11251",
-    "data/attack-techniques.json": "6849ebc7b44fe562f1e2728d1e881d2e9148d8c89b8d6b050b580c5338d3dd23",
-    "data/cve-catalog.json": "b18466211fdd24ed61766573c402cc38324d7fd90ec55a147e7c98a5f6a6444f",
+    "data/attack-techniques.json": "14746c8acf8019d2340a93912393c0d5986d9df509ca551d2dae25d199c223de",
+    "data/cve-catalog.json": "31c934e524a16a103651ed8f3a76e175dac934886999f9add2ca0633168a9139",
     "data/cwe-catalog.json": "0fd275c2a61754958d68cea03a92794a67cf1c1d4d609f81a5728334df013ee3",
     "data/d3fend-catalog.json": "9a54bccb9f24f84b32024216cc3f53819a053721ac8ab43c326859e68fc0ffaf",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
@@ -15,7 +15,7 @@
     "data/framework-control-gaps.json": "29e7b6aa841ddf2530ca5971bdb60d7a715684b2f6264141ad49f0de9a039d78",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
     "data/rfc-references.json": "b21d03b948c41bc8a854e2f057948ecf844bd8c105848aeb141d1eadf8192c31",
-    "data/zeroday-lessons.json": "4c41089a5a095fc4be5898833a4f83c0cebe06e5b13f959a022241acb1164dc4",
+    "data/zeroday-lessons.json": "73fd27ed2806eddbd690f58e21c7a8a6d7554283c2a7f9b41ac09b6c3a129da9",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "2880499993e0e69e3897a9d02b5e83aa0462c86a4dd2c1988b9968e375704a1f",
     "skills/mcp-agent-trust/skill.md": "0752834acde0303d6d1e36be4b320eac3d34fde715bb8d71f3ad9e801d701482",

package/data/attack-techniques.json

@@ -315,11 +315,14 @@
       "CVE-2025-20281",
       "CVE-2025-20337",
       "CVE-2025-23254",
+      "CVE-2025-24016",
+      "CVE-2025-24893",
       "CVE-2025-26399",
       "CVE-2025-27520",
       "CVE-2025-29635",
       "CVE-2025-30165",
       "CVE-2025-32432",
+      "CVE-2025-32433",
       "CVE-2025-32434",
       "CVE-2025-32444",
       "CVE-2025-3248",
@@ -328,6 +331,7 @@
       "CVE-2025-3466",
       "CVE-2025-37164",
       "CVE-2025-40551",
+      "CVE-2025-42999",
       "CVE-2025-4428",
       "CVE-2025-47812",
       "CVE-2025-48703",
@@ -342,6 +346,7 @@
       "CVE-2025-54136",
       "CVE-2025-54253",
       "CVE-2025-54948",
+      "CVE-2025-55182",
       "CVE-2025-55319",
       "CVE-2025-58034",
       "CVE-2025-59689",
@@ -598,6 +603,7 @@
     "cve_refs": [
       "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY",
       "CVE-2015-7755",
+      "CVE-2016-7836",
       "CVE-2017-7921",
       "CVE-2019-19006",
       "CVE-2019-6693",
@@ -619,6 +625,7 @@
       "CVE-2025-2746",
       "CVE-2025-2747",
       "CVE-2025-31161",
+      "CVE-2025-32433",
       "CVE-2025-32975",
       "CVE-2025-34026",
       "CVE-2025-3935",
@@ -954,17 +961,21 @@
       "CVE-2008-0015",
       "CVE-2008-4250",
       "CVE-2014-6278",
+      "CVE-2015-7755",
       "CVE-2016-10033",
       "CVE-2016-7836",
       "CVE-2017-1000353",
       "CVE-2017-7921",
       "CVE-2018-4063",
+      "CVE-2019-19006",
       "CVE-2019-6693",
       "CVE-2019-9621",
       "CVE-2020-10148",
+      "CVE-2020-24363",
       "CVE-2020-25078",
       "CVE-2020-25079",
       "CVE-2020-7796",
+      "CVE-2021-21311",
       "CVE-2021-22054",
       "CVE-2021-22175",
       "CVE-2021-22681",
@@ -1017,6 +1028,7 @@
       "CVE-2024-43468",
       "CVE-2024-4889",
       "CVE-2024-50050",
+      "CVE-2024-54085",
       "CVE-2024-56145",
       "CVE-2024-57726",
       "CVE-2024-57728",
@@ -1121,7 +1133,9 @@
       "CVE-2025-59389",
       "CVE-2025-59689",
       "CVE-2025-59718",
+      "CVE-2025-61757",
       "CVE-2025-61882",
+      "CVE-2025-61884",
       "CVE-2025-61932",
       "CVE-2025-6204",
       "CVE-2025-6205",