@blamejs/exceptd-skills 0.18.19 → 0.18.21

package/data/cwe-catalog.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "last_updated": "2026-06-01",
+    "last_updated": "2026-07-03",
     "cwe_version": "4.20",
     "cwe_version_release_date": "2026-04-30",
     "source": "https://cwe.mitre.org",
@@ -96,6 +96,7 @@
       "webapp-security"
     ],
     "evidence_cves": [
+      "CVE-2017-12637",
       "CVE-2019-5418",
       "CVE-2021-43798",
       "CVE-2023-38950",
@@ -111,6 +112,7 @@
       "CVE-2024-31462",
       "CVE-2024-37032",
       "CVE-2024-39722",
+      "CVE-2024-4885",
       "CVE-2024-57728",
       "CVE-2024-7399",
       "CVE-2025-2749",
@@ -164,6 +166,7 @@
       "CVE-2016-10033",
       "CVE-2020-25079",
       "CVE-2021-33515",
+      "CVE-2023-20118",
       "CVE-2023-33538",
       "CVE-2024-12450",
       "CVE-2024-5565",
@@ -215,6 +218,7 @@
     ],
     "evidence_cves": [
       "CVE-2014-6278",
+      "CVE-2021-20035",
       "CVE-2023-39780",
       "CVE-2023-44221",
       "CVE-2023-6019",
@@ -223,6 +227,7 @@
       "CVE-2024-6047",
       "CVE-2025-11953",
       "CVE-2025-12686",
+      "CVE-2025-1316",
       "CVE-2025-1753",
       "CVE-2025-1976",
       "CVE-2025-48703",
@@ -283,6 +288,7 @@
     ],
     "evidence_cves": [
       "CVE-2021-26829",
+      "CVE-2023-34192",
       "CVE-2023-6571",
       "CVE-2024-11182",
       "CVE-2024-27132",
@@ -359,6 +365,7 @@
     ],
     "evidence_cves": [
       "CVE-2024-43468",
+      "CVE-2025-25181",
       "CVE-2025-25257",
       "CVE-2025-57819",
       "CVE-2026-21643",
@@ -407,6 +414,7 @@
       "CVE-2013-3918",
       "CVE-2017-1000353",
       "CVE-2020-25078",
+      "CVE-2022-43769",
       "CVE-2022-48503",
       "CVE-2023-44467",
       "CVE-2023-6016",
@@ -513,6 +521,8 @@
     "evidence_cves": [
       "CVE-2023-36424",
       "CVE-2024-42478",
+      "CVE-2024-53150",
+      "CVE-2025-24991",
       "CVE-2025-48633",
       "CVE-2025-5419",
       "CVE-2025-5777",
@@ -661,6 +671,7 @@
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "CVE-2021-43226",
       "CVE-2024-21626",
+      "CVE-2024-49035",
       "CVE-2024-8068",
       "CVE-2025-48543",
       "CVE-2025-48572",
@@ -697,6 +708,7 @@
     ],
     "evidence_cves": [
       "CVE-2025-12480",
+      "CVE-2025-24989",
       "CVE-2025-31125",
       "CVE-2025-33073",
       "CVE-2025-59230",
@@ -1247,7 +1259,9 @@
       "CVE-2020-9715",
       "CVE-2023-41974",
       "CVE-2023-43000",
+      "CVE-2025-24983",
       "CVE-2025-27038",
+      "CVE-2025-29824",
       "CVE-2025-30400",
       "CVE-2025-32701",
       "CVE-2025-32709",
@@ -1322,6 +1336,7 @@
     "evidence_cves": [
       "CVE-2018-4063",
       "CVE-2021-26828",
+      "CVE-2024-57968",
       "CVE-2024-7399",
       "CVE-2024-7694",
       "CVE-2025-2749",
@@ -1395,11 +1410,15 @@
       "webapp-security"
     ],
     "evidence_cves": [
+      "CVE-2017-3066",
+      "CVE-2019-9874",
+      "CVE-2019-9875",
       "CVE-2022-1471",
       "CVE-2023-21529",
       "CVE-2024-11392",
       "CVE-2024-11393",
       "CVE-2024-11394",
+      "CVE-2024-20953",
       "CVE-2024-24590",
       "CVE-2024-37052",
       "CVE-2024-37060",
@@ -1409,6 +1428,7 @@
       "CVE-2025-10164",
       "CVE-2025-23254",
       "CVE-2025-24016",
+      "CVE-2025-24813",
       "CVE-2025-26399",
       "CVE-2025-27520",
       "CVE-2025-30165",
@@ -1431,7 +1451,8 @@
       "CVE-2026-3059",
       "CVE-2026-3060",
       "CVE-2026-31229",
-      "CVE-2026-45247"
+      "CVE-2026-45247",
+      "CVE-2026-45659"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
@@ -1710,6 +1731,7 @@
       "CVE-2024-21762",
       "CVE-2024-37079",
       "CVE-2024-42479",
+      "CVE-2024-53197",
       "CVE-2025-0282",
       "CVE-2025-14174",
       "CVE-2025-14733",
@@ -1765,7 +1787,9 @@
     ],
     "evidence_cves": [
       "CVE-2019-6693",
+      "CVE-2024-20439",
       "CVE-2025-14611",
+      "CVE-2025-30406",
       "CVE-2026-22769"
     ],
     "framework_controls_partially_addressing": [
@@ -2473,6 +2497,7 @@
     "evidence_cves": [
       "CVE-2018-14634",
       "CVE-2021-30952",
+      "CVE-2025-24985",
       "CVE-2025-48595",
       "CVE-2026-21385",
       "CVE-2026-24214"
@@ -2572,6 +2597,7 @@
     "related_weaknesses": [],
     "evidence_cves": [
       "CVE-2024-1709",
+      "CVE-2025-24472",
       "CVE-2025-2746",
       "CVE-2025-2747",
       "CVE-2025-34026",
@@ -2619,7 +2645,8 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
-      "CVE-2025-59718"
+      "CVE-2025-59718",
+      "CVE-2026-48558"
     ],
     "last_verified": "2026-05-18",
     "notes": "Added v0.13.17 KEV bulk-import.",
@@ -2888,6 +2915,7 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2025-0111",
       "CVE-2025-24054",
       "CVE-2025-33053"
     ],
@@ -2909,6 +2937,7 @@
     "related_weaknesses": [],
     "evidence_cves": [
       "CVE-2021-38371",
+      "CVE-2022-43769",
       "CVE-2025-20281",
       "CVE-2025-20337"
     ],
@@ -2930,6 +2959,8 @@
     "related_weaknesses": [],
     "evidence_cves": [
       "CVE-2009-3459",
+      "CVE-2025-24985",
+      "CVE-2025-24993",
       "CVE-2025-32706",
       "CVE-2026-22778"
     ],
@@ -3372,6 +3403,7 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2025-2783",
       "CVE-2025-64496"
     ],
     "last_verified": "2026-05-19",
@@ -3430,7 +3462,9 @@
       "CWE-2000"
     ],
     "related_weaknesses": [],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2025-24984"
+    ],
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
@@ -3974,7 +4008,9 @@
       "CWE-2000"
     ],
     "related_weaknesses": [],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2024-50302"
+    ],
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
@@ -4733,6 +4769,7 @@
     ],
     "skills_referencing": [],
     "evidence_cves": [
+      "CVE-2024-20439",
       "CVE-2025-47729"
     ],
     "framework_controls_partially_addressing": [],
@@ -4843,5 +4880,212 @@
     "real_requirement": "Enumerate and apply the same authorization and input-validation checks to every code path that reaches a protected resource, including framework-internal alternate routes; deny-by-default for any path not explicitly modeled.",
     "lag_notes": "An access-control audit typically tests the documented path; CWE-424 is about the undocumented alternate path that the same audit never exercises.",
     "last_verified": "2026-06-26"
+  },
+  "CWE-321": {
+    "id": "CWE-321",
+    "name": "Use of Hard-coded Cryptographic Key",
+    "abstraction": "Variant",
+    "category": "Cryptographic Issues",
+    "description": "The product uses a hard-coded cryptographic key, so anyone with access to the product (or its source/binaries) can derive the key and forge or decrypt protected data. Cited by NVD for the Gladinet CentreStack/Triofox flaw (CVE-2025-30406) where a hard-coded ASP.NET machineKey let attackers forge ViewState payloads into RCE.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-20",
+      "CAPEC-97"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2025-30406"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-53-SC-12",
+      "ISO-27001-2022-A.8.24",
+      "PCI-DSS-4.0-3.5"
+    ],
+    "real_requirement": "Cryptographic keys are generated per-deployment from a secure source, never shipped in code or default config; key material is stored in a secrets manager/HSM and rotated on a defined schedule.",
+    "lag_notes": "A crypto-policy audit confirms that encryption is used; CWE-321 is about the key being shared across every install, which the policy's existence does not detect.",
+    "last_verified": "2026-06-28"
+  },
+  "CWE-706": {
+    "id": "CWE-706",
+    "name": "Use of Incorrectly-Resolved Name or Reference",
+    "abstraction": "Class",
+    "category": "Path Resolution",
+    "description": "The product uses a name or reference to access a resource, but does not resolve it to the intended target, so an attacker-influenced name reaches a different resource than the access checks assumed. Parent of path-equivalence weaknesses; cited by NVD for the Apache Tomcat partial-PUT path-equivalence flaw (CVE-2025-24813).",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-3",
+      "CAPEC-165"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2025-24813"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-53-SI-10",
+      "ISO-27001-2022-A.8.28"
+    ],
+    "real_requirement": "Canonicalize every name/path to its absolute resolved form before any authorization or existence check, and re-check after resolution; reject names whose resolved target differs from the requested one.",
+    "lag_notes": "Input-validation controls test the requested name; CWE-706 is about the gap between the requested name and what it actually resolves to, which the same control does not exercise.",
+    "last_verified": "2026-06-28"
+  },
+  "CWE-44": {
+    "id": "CWE-44",
+    "name": "Path Equivalence: 'file.name' (Internal Dot)",
+    "abstraction": "Base",
+    "category": "Path Resolution",
+    "description": "The product treats two distinct path spellings (e.g. with internal dots, trailing dots, or alternate separators) as the same or different targets inconsistently, so an attacker reaches a protected resource via an equivalent spelling the access check did not anticipate. A child of CWE-706; cited by NVD for the Tomcat partial-PUT chain (CVE-2025-24813).",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-3"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2025-24813"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-53-SI-10",
+      "ISO-27001-2022-A.8.28"
+    ],
+    "real_requirement": "Normalize path spellings (dots, separators, case, encoding) to a single canonical form before mapping a request to a file or servlet, and apply the same normalization the runtime uses to dispatch the request.",
+    "lag_notes": "A path-traversal test that only tries `../` misses equivalence spellings; CWE-44 is the class of equivalent names the dispatcher and the access check disagree on.",
+    "last_verified": "2026-06-28"
+  },
+  "CWE-36": {
+    "id": "CWE-36",
+    "name": "Absolute Path Traversal",
+    "abstraction": "Base",
+    "category": "Path Resolution",
+    "description": "The product uses an attacker-controlled path that begins with an absolute root (e.g. /etc/passwd or C:\\), reaching a file outside the intended directory without needing `../` sequences. A child of CWE-22; cited by NVD for the NAKIVO Backup & Replication arbitrary-file-read flaw (CVE-2024-48248).",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-597"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2024-13159",
+      "CVE-2024-13160",
+      "CVE-2024-13161",
+      "CVE-2024-48248"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-53-AC-3",
+      "ISO-27001-2022-A.8.3"
+    ],
+    "real_requirement": "Reject absolute paths outright for user-supplied file references; resolve against a fixed base directory and confirm the canonical result stays within it before opening.",
+    "lag_notes": "A relative-traversal filter that strips `../` does nothing against an absolute path; CWE-36 is the absolute-root variant the same filter ignores.",
+    "last_verified": "2026-06-28"
+  },
+  "CWE-653": {
+    "id": "CWE-653",
+    "name": "Improper Isolation or Compartmentalization",
+    "abstraction": "Class",
+    "category": "Access Control",
+    "description": "The product does not properly separate components with different trust or privilege, so a compromise of one reaches another that should have been isolated. Cited by NVD for the Juniper Junos OS flaw (CVE-2025-21590) used by the UNC3886 espionage actor to run code outside the intended sandbox.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-233"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2025-21590"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-53-SC-3",
+      "NIST-800-53-AC-6",
+      "ISO-27001-2022-A.8.22"
+    ],
+    "real_requirement": "Enforce strong boundaries between trust domains (process/container/VM/privilege separation), deny cross-domain primitives by default, and audit the actual reachability between compartments rather than the documented design.",
+    "lag_notes": "An architecture review attests that compartments exist; CWE-653 is about a real primitive that crosses them, which a design review on paper does not test.",
+    "last_verified": "2026-06-28"
+  },
+  "CWE-707": {
+    "id": "CWE-707",
+    "name": "Improper Neutralization",
+    "abstraction": "Pillar",
+    "category": "Injection",
+    "description": "The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component. Parent class of the injection weaknesses; CVE-2025-26633's MMC/MSC 'EvilTwin' console-file substitution bypasses the Microsoft Management Console security boundary by improperly neutralizing a crafted .msc file loaded from an en-US MUIPath directory.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2025-26633"
+    ]
+  },
+  "CWE-404": {
+    "id": "CWE-404",
+    "name": "Improper Resource Shutdown or Release",
+    "abstraction": "Class",
+    "category": "Resource Management",
+    "description": "The product does not release or incorrectly releases a resource before it is made available for re-use, enabling use-after-free and related memory-safety failures. CVE-2018-8639 is a Win32k kernel use-after-free (improper resource release) that a local low-privileged user leverages for arbitrary kernel-mode code execution and SYSTEM elevation.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000",
+      "CWE-1003"
+    ],
+    "related_attack_patterns_capec": [],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2018-8639"
+    ]
+  },
+  "CWE-647": {
+    "id": "CWE-647",
+    "name": "Use of Non-Canonical URL Paths for Authorization Decisions",
+    "abstraction": "Base",
+    "category": "Authorization",
+    "description": "The product makes authorization decisions based on the assumption that a requested URL is canonical, so a crafted non-canonical URL can bypass the authorization check. CVE-2022-43939's Pentaho BA Server authorization bypass accepts non-canonical URLs (a permissive suffix match) to reach protected endpoints unauthenticated, and is chained with the special-element-injection CVE-2022-43769 for pre-auth RCE.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000",
+      "CWE-1003"
+    ],
+    "related_attack_patterns_capec": [],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2022-43939"
+    ]
+  },
+  "CWE-610": {
+    "id": "CWE-610",
+    "name": "Externally Controlled Reference to a Resource in Another Sphere",
+    "abstraction": "Class",
+    "category": "Resource Control",
+    "description": "The product uses an externally controlled name or reference that resolves to a resource outside the intended control sphere — the parent class of server-side request forgery and external control of a filename or path. CVE-2025-0111's PAN-OS authenticated arbitrary file read lets a management-interface request reference filesystem paths readable by the 'nobody' user that sit outside the intended web-interface sphere, and is chained with the CVE-2025-0108 auth bypass to read config and credential material unauthenticated.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2025-0111"
+    ]
   }
 }