@blamejs/exceptd-skills 0.15.8 → 0.15.10

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.15.10 — 2026-05-29
+
+Draft-curation pass 8 — Microsoft server-side RCE. Six CISA KEV-listed CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: Exchange Server deserialization (CVE-2023-21529), Configuration Manager SQL injection (CVE-2024-43468), Windows Server Update Services deserialization (CVE-2025-59287), and the SharePoint Server "ToolShell" chain — improper authentication (CVE-2025-49706), code injection (CVE-2025-49704), and deserialization (CVE-2025-53770). The lessons stress that for these deserialization RCEs patching alone is insufficient: stolen machine keys and dropped web shells survive the patch and require explicit key rotation and web-shell hunting.
+
+## 0.15.9 — 2026-05-29
+
+Draft-curation pass 7 — network devices and the Ivanti EPMM chain. Seven CISA KEV-listed unauthenticated CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: D-Link DIR-823X command injection (CVE-2025-29635), router buffer overflow (CVE-2022-37055), DCS-2530L/2670L camera code execution (CVE-2020-25078) and command injection (CVE-2020-25079), DNR-322L download-without-integrity (CVE-2022-40799), and the Ivanti EPMM authentication-bypass + code-injection preauth chain (CVE-2025-4427, CVE-2025-4428). The device lessons note that end-of-life consumer hardware is unpatchable, making network isolation the load-bearing control, and that firmware implants survive a reboot without a reflash.
+
 ## 0.15.8 — 2026-05-29
 
 Draft-curation pass 6 — Cisco network devices. Seven CISA KEV-listed Cisco CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: SD-WAN path traversal (CVE-2022-20775), multi-product improper input validation (CVE-2025-20393), IOS/IOS XE SNMP DoS+RCE (CVE-2025-20352), the Secure Firewall ASA/FTD missing-authorization (CVE-2025-20362) and buffer-overflow (CVE-2025-20333) chain, and the Identity Services Engine injection pair (CVE-2025-20337, CVE-2025-20281). The ASA and device lessons note that network-device implants survive patching without explicit recovery steps.

package/data/_indexes/_meta.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-29T18:43:29.131Z",
+  "generated_at": "2026-05-29T19:28:44.044Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "a122252b090e0f606e64537278dd5998f3a9d73274badd8f3a8c65145dd0d377",
+    "manifest.json": "1bd5c8e6489d1a1b7ef67889b6fa5afbfb3d0780d0a5bf2699b1a5ca22164ec9",
     "data/atlas-ttps.json": "878b4a08bb73c8d20396d85cf433a88f2bc5e7a8cbf7f6ab773ce7ede0a11251",
-    "data/attack-techniques.json": "2644a3fa8dd40586085126f3fc9ca120d6155da083f70d4208f57ccb0b8884ee",
-    "data/cve-catalog.json": "878f54c4589360a765dbc41173ce48b12beef73c13a04037e2bb036e828c7165",
+    "data/attack-techniques.json": "96e21dd277fe24598e8ae74b40009785757a71ed4fc98e456504cd04f441bc90",
+    "data/cve-catalog.json": "365fd70e7f02daff7ca5b2b4eeeeb4579621937b167ad2fc07914d1c36a36bc9",
     "data/cwe-catalog.json": "0fd275c2a61754958d68cea03a92794a67cf1c1d4d609f81a5728334df013ee3",
     "data/d3fend-catalog.json": "9a54bccb9f24f84b32024216cc3f53819a053721ac8ab43c326859e68fc0ffaf",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
@@ -15,7 +15,7 @@
     "data/framework-control-gaps.json": "29e7b6aa841ddf2530ca5971bdb60d7a715684b2f6264141ad49f0de9a039d78",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
     "data/rfc-references.json": "b21d03b948c41bc8a854e2f057948ecf844bd8c105848aeb141d1eadf8192c31",
-    "data/zeroday-lessons.json": "56cf66af139d604ba955fa1b0f3d42b4baf7043bd664e20f90855fe4f1db0989",
+    "data/zeroday-lessons.json": "eecfcd270e8c6063511122374cfc2d5b56bdf5be769ad8e2a1556949ec682f0b",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "2880499993e0e69e3897a9d02b5e83aa0462c86a4dd2c1988b9968e375704a1f",
     "skills/mcp-agent-trust/skill.md": "0752834acde0303d6d1e36be4b320eac3d34fde715bb8d71f3ad9e801d701482",

package/data/attack-techniques.json

@@ -272,6 +272,8 @@
       "DS0017"
     ],
     "cve_refs": [
+      "CVE-2020-25078",
+      "CVE-2020-25079",
       "CVE-2022-1471",
       "CVE-2023-43654",
       "CVE-2023-44467",
@@ -305,6 +307,7 @@
       "CVE-2025-20337",
       "CVE-2025-23254",
       "CVE-2025-27520",
+      "CVE-2025-29635",
       "CVE-2025-30165",
       "CVE-2025-32434",
       "CVE-2025-32444",
@@ -312,7 +315,9 @@
       "CVE-2025-33236",
       "CVE-2025-34291",
       "CVE-2025-3466",
+      "CVE-2025-4428",
       "CVE-2025-49596",
+      "CVE-2025-49704",
       "CVE-2025-51480",
       "CVE-2025-53773",
       "CVE-2025-54136",
@@ -561,6 +566,7 @@
       "CVE-2025-31161",
       "CVE-2025-32975",
       "CVE-2025-34026",
+      "CVE-2025-4427",
       "CVE-2025-49706",
       "CVE-2025-61757",
       "CVE-2025-64513",
@@ -1023,6 +1029,7 @@
       "CVE-2025-49113",
       "CVE-2025-49596",
       "CVE-2025-49704",
+      "CVE-2025-49706",
       "CVE-2025-49844",
       "CVE-2025-5086",
       "CVE-2025-52691",
@@ -12044,7 +12051,9 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
-      "CVE-2025-31324"
+      "CVE-2025-31324",
+      "CVE-2025-49704",
+      "CVE-2025-53770"
     ]
   },
   "T1505.004": {