@blamejs/exceptd-skills 0.18.21 → 0.18.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. package/ARCHITECTURE.md +1 -1
  2. package/CHANGELOG.md +6 -0
  3. package/bin/exceptd.js +4 -1
  4. package/data/_indexes/_meta.json +9 -9
  5. package/data/_indexes/activity-feed.json +3 -3
  6. package/data/_indexes/catalog-summaries.json +8 -8
  7. package/data/_indexes/chains.json +56413 -604
  8. package/data/_indexes/frequency.json +6 -0
  9. package/data/attack-techniques.json +244 -6
  10. package/data/cve-catalog.json +9315 -1
  11. package/data/cwe-catalog.json +273 -7
  12. package/data/framework-control-gaps.json +519 -12
  13. package/data/zeroday-lessons.json +3916 -1
  14. package/lib/auto-discovery.js +54 -67
  15. package/lib/cve-batch.js +216 -0
  16. package/lib/cve-curation.js +4 -0
  17. package/lib/cve-enrich.js +172 -0
  18. package/lib/prefetch.js +189 -110
  19. package/lib/scoring.js +24 -0
  20. package/manifest.json +53 -53
  21. package/package.json +2 -2
  22. package/sbom.cdx.json +65 -35
package/data/_indexes/frequency.json CHANGED
@@ -3142,6 +3142,7 @@
3142
3142
  "CWE-1004",
3143
3143
  "CWE-1021",
3144
3144
  "CWE-1023",
3145
+ "CWE-114",
3145
3146
  "CWE-116",
3146
3147
  "CWE-119",
3147
3148
  "CWE-120",
@@ -3166,12 +3167,14 @@
3166
3167
  "CWE-1299",
3167
3168
  "CWE-1305",
3168
3169
  "CWE-1321",
3170
+ "CWE-134",
3169
3171
  "CWE-1390",
3170
3172
  "CWE-1391",
3171
3173
  "CWE-1392",
3172
3174
  "CWE-1393",
3173
3175
  "CWE-1394",
3174
3176
  "CWE-158",
3177
+ "CWE-176",
3175
3178
  "CWE-190",
3176
3179
  "CWE-209",
3177
3180
  "CWE-23",
@@ -3182,9 +3185,11 @@
3182
3185
  "CWE-264",
3183
3186
  "CWE-266",
3184
3187
  "CWE-267",
3188
+ "CWE-273",
3185
3189
  "CWE-282",
3186
3190
  "CWE-285",
3187
3191
  "CWE-288",
3192
+ "CWE-303",
3188
3193
  "CWE-305",
3189
3194
  "CWE-310",
3190
3195
  "CWE-312",
@@ -3210,6 +3215,7 @@
3210
3215
  "CWE-404",
3211
3216
  "CWE-420",
3212
3217
  "CWE-424",
3218
+ "CWE-425",
3213
3219
  "CWE-426",
3214
3220
  "CWE-427",
3215
3221
  "CWE-428",
package/data/attack-techniques.json CHANGED
@@ -162,6 +162,7 @@
162
162
  "DS0009"
163
163
  ],
164
164
  "cve_refs": [
165
+ "CVE-2024-43572",
165
166
  "CVE-2026-32202"
166
167
  ],
167
168
  "description_full": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016) Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.(Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.(Citation: Carbon Black Obfuscation Sept 2016) Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)",
@@ -263,6 +264,9 @@
263
264
  "tactic": [
264
265
  "Stealth",
265
266
  "Privilege Escalation"
267
+ ],
268
+ "cve_refs": [
269
+ "CVE-2024-35250"
266
270
  ]
267
271
  },
268
272
  "T1059": {
@@ -279,14 +283,24 @@
279
283
  "CVE-2016-10033",
280
284
  "CVE-2017-1000353",
281
285
  "CVE-2017-3066",
286
+ "CVE-2018-14933",
287
+ "CVE-2018-9276",
288
+ "CVE-2019-0344",
289
+ "CVE-2019-11001",
290
+ "CVE-2019-16278",
282
291
  "CVE-2019-9874",
283
292
  "CVE-2019-9875",
293
+ "CVE-2020-15069",
294
+ "CVE-2020-15415",
284
295
  "CVE-2020-25078",
285
296
  "CVE-2020-25079",
297
+ "CVE-2020-2883",
286
298
  "CVE-2021-20035",
299
+ "CVE-2021-40407",
287
300
  "CVE-2022-1471",
288
301
  "CVE-2022-43769",
289
302
  "CVE-2023-20118",
303
+ "CVE-2023-25280",
290
304
  "CVE-2023-33538",
291
305
  "CVE-2023-39780",
292
306
  "CVE-2023-43654",
@@ -300,27 +314,47 @@
300
314
  "CVE-2024-11392",
301
315
  "CVE-2024-11393",
302
316
  "CVE-2024-11394",
317
+ "CVE-2024-1212",
318
+ "CVE-2024-12356",
303
319
  "CVE-2024-12366",
320
+ "CVE-2024-12686",
304
321
  "CVE-2024-12987",
305
322
  "CVE-2024-13059",
306
323
  "CVE-2024-20953",
307
324
  "CVE-2024-21513",
308
325
  "CVE-2024-21575",
309
326
  "CVE-2024-21576",
327
+ "CVE-2024-23113",
310
328
  "CVE-2024-24590",
329
+ "CVE-2024-29059",
311
330
  "CVE-2024-2912",
331
+ "CVE-2024-29824",
312
332
  "CVE-2024-37032",
313
333
  "CVE-2024-37052",
314
334
  "CVE-2024-37060",
335
+ "CVE-2024-40890",
336
+ "CVE-2024-40891",
337
+ "CVE-2024-41710",
315
338
  "CVE-2024-42479",
339
+ "CVE-2024-45195",
340
+ "CVE-2024-45519",
316
341
  "CVE-2024-4885",
317
342
  "CVE-2024-4889",
318
343
  "CVE-2024-50050",
344
+ "CVE-2024-50603",
345
+ "CVE-2024-51378",
346
+ "CVE-2024-51567",
319
347
  "CVE-2024-5565",
348
+ "CVE-2024-55956",
320
349
  "CVE-2024-56145",
321
350
  "CVE-2024-58136",
322
351
  "CVE-2024-6047",
323
352
  "CVE-2024-8069",
353
+ "CVE-2024-8957",
354
+ "CVE-2024-9380",
355
+ "CVE-2024-9463",
356
+ "CVE-2024-9474",
357
+ "CVE-2025-0994",
324
358
  "CVE-2025-10035",
325
359
  "CVE-2025-10164",
326
360
  "CVE-2025-1094",
@@ -333,6 +367,8 @@
333
367
  "CVE-2025-20281",
334
368
  "CVE-2025-20337",
335
369
  "CVE-2025-21590",
370
+ "CVE-2025-23006",
371
+ "CVE-2025-23209",
336
372
  "CVE-2025-23254",
337
373
  "CVE-2025-24016",
338
374
  "CVE-2025-24813",
@@ -433,6 +469,7 @@
433
469
  "CVE-2026-45659",
434
470
  "CVE-2026-45829",
435
471
  "CVE-2026-48172",
472
+ "CVE-2026-48282",
436
473
  "CVE-2026-5760",
437
474
  "CVE-2026-6973"
438
475
  ],
@@ -554,20 +591,36 @@
554
591
  "CVE-2021-43226",
555
592
  "CVE-2022-0492",
556
593
  "CVE-2023-0386",
594
+ "CVE-2023-25280",
557
595
  "CVE-2023-36424",
558
596
  "CVE-2023-41974",
559
597
  "CVE-2023-43000",
560
598
  "CVE-2024-0769",
599
+ "CVE-2024-1212",
600
+ "CVE-2024-30088",
601
+ "CVE-2024-35250",
602
+ "CVE-2024-38813",
603
+ "CVE-2024-43047",
604
+ "CVE-2024-43093",
561
605
  "CVE-2024-49035",
606
+ "CVE-2024-49039",
607
+ "CVE-2024-49138",
562
608
  "CVE-2024-50302",
609
+ "CVE-2024-53104",
563
610
  "CVE-2024-53197",
564
611
  "CVE-2024-8068",
565
612
  "CVE-2025-10725",
566
613
  "CVE-2025-1976",
614
+ "CVE-2025-21333",
615
+ "CVE-2025-21334",
616
+ "CVE-2025-21335",
617
+ "CVE-2025-21391",
618
+ "CVE-2025-21418",
567
619
  "CVE-2025-21479",
568
620
  "CVE-2025-21480",
569
621
  "CVE-2025-22224",
570
622
  "CVE-2025-22225",
623
+ "CVE-2025-24085",
571
624
  "CVE-2025-24201",
572
625
  "CVE-2025-24983",
573
626
  "CVE-2025-24990",
@@ -646,6 +699,10 @@
646
699
  "description": "Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.",
647
700
  "tactic": [
648
701
  "Command and Control"
702
+ ],
703
+ "cve_refs": [
704
+ "CVE-2024-50603",
705
+ "CVE-2024-9680"
649
706
  ]
650
707
  },
651
708
  "T1078": {
@@ -656,24 +713,47 @@
656
713
  "CVE-2015-7755",
657
714
  "CVE-2016-7836",
658
715
  "CVE-2017-7921",
716
+ "CVE-2018-9276",
717
+ "CVE-2019-11001",
659
718
  "CVE-2019-19006",
660
719
  "CVE-2019-6693",
661
720
  "CVE-2020-10148",
662
721
  "CVE-2020-24363",
722
+ "CVE-2020-29574",
663
723
  "CVE-2021-20035",
664
724
  "CVE-2021-32030",
725
+ "CVE-2021-40407",
726
+ "CVE-2021-44207",
727
+ "CVE-2022-23227",
665
728
  "CVE-2022-43939",
666
729
  "CVE-2023-27351",
667
730
  "CVE-2023-43791",
731
+ "CVE-2023-48365",
668
732
  "CVE-2023-50224",
669
733
  "CVE-2023-52163",
734
+ "CVE-2024-0012",
735
+ "CVE-2024-12686",
670
736
  "CVE-2024-12776",
671
737
  "CVE-2024-1709",
672
738
  "CVE-2024-20439",
673
739
  "CVE-2024-27199",
740
+ "CVE-2024-28987",
741
+ "CVE-2024-38094",
742
+ "CVE-2024-40711",
743
+ "CVE-2024-41710",
744
+ "CVE-2024-43451",
745
+ "CVE-2024-47575",
674
746
  "CVE-2024-49035",
747
+ "CVE-2024-51378",
748
+ "CVE-2024-53704",
675
749
  "CVE-2024-54085",
750
+ "CVE-2024-55550",
751
+ "CVE-2024-55591",
676
752
  "CVE-2024-57726",
753
+ "CVE-2024-5910",
754
+ "CVE-2024-7593",
755
+ "CVE-2024-9474",
756
+ "CVE-2025-0108",
677
757
  "CVE-2025-12480",
678
758
  "CVE-2025-1796",
679
759
  "CVE-2025-21085",
@@ -948,7 +1028,9 @@
948
1028
  "tactic": [
949
1029
  "Credential Access"
950
1030
  ],
951
- "cve_refs": []
1031
+ "cve_refs": [
1032
+ "CVE-2024-20481"
1033
+ ]
952
1034
  },
953
1035
  "T1110.001": {
954
1036
  "name": "Brute Force: Password Guessing",
@@ -1031,6 +1113,7 @@
1031
1113
  "version": "v19",
1032
1114
  "cve_refs": [
1033
1115
  "CVE-2008-4250",
1116
+ "CVE-2014-2120",
1034
1117
  "CVE-2014-3931",
1035
1118
  "CVE-2014-6278",
1036
1119
  "CVE-2015-7755",
@@ -1040,7 +1123,13 @@
1040
1123
  "CVE-2017-12637",
1041
1124
  "CVE-2017-3066",
1042
1125
  "CVE-2017-7921",
1126
+ "CVE-2018-14933",
1127
+ "CVE-2018-19410",
1043
1128
  "CVE-2018-4063",
1129
+ "CVE-2018-9276",
1130
+ "CVE-2019-0344",
1131
+ "CVE-2019-11001",
1132
+ "CVE-2019-16278",
1044
1133
  "CVE-2019-19006",
1045
1134
  "CVE-2019-5418",
1046
1135
  "CVE-2019-6693",
@@ -1048,22 +1137,32 @@
1048
1137
  "CVE-2019-9874",
1049
1138
  "CVE-2019-9875",
1050
1139
  "CVE-2020-10148",
1140
+ "CVE-2020-11023",
1141
+ "CVE-2020-15069",
1142
+ "CVE-2020-15415",
1051
1143
  "CVE-2020-24363",
1052
1144
  "CVE-2020-25078",
1053
1145
  "CVE-2020-25079",
1146
+ "CVE-2020-2883",
1147
+ "CVE-2020-29574",
1054
1148
  "CVE-2020-7796",
1055
1149
  "CVE-2021-20035",
1056
1150
  "CVE-2021-21311",
1057
1151
  "CVE-2021-22054",
1058
1152
  "CVE-2021-22175",
1059
1153
  "CVE-2021-22681",
1154
+ "CVE-2021-26086",
1060
1155
  "CVE-2021-26828",
1061
1156
  "CVE-2021-26829",
1062
1157
  "CVE-2021-32030",
1063
1158
  "CVE-2021-39935",
1159
+ "CVE-2021-40407",
1160
+ "CVE-2021-41277",
1064
1161
  "CVE-2021-43798",
1162
+ "CVE-2021-44207",
1065
1163
  "CVE-2022-1471",
1066
1164
  "CVE-2022-20775",
1165
+ "CVE-2022-23227",
1067
1166
  "CVE-2022-36551",
1068
1167
  "CVE-2022-37055",
1069
1168
  "CVE-2022-40799",
@@ -1071,8 +1170,10 @@
1071
1170
  "CVE-2022-43939",
1072
1171
  "CVE-2023-20118",
1073
1172
  "CVE-2023-21529",
1173
+ "CVE-2023-25280",
1074
1174
  "CVE-2023-2533",
1075
1175
  "CVE-2023-27351",
1176
+ "CVE-2023-28461",
1076
1177
  "CVE-2023-33538",
1077
1178
  "CVE-2023-3519",
1078
1179
  "CVE-2023-38950",
@@ -1080,8 +1181,10 @@
1080
1181
  "CVE-2023-43654",
1081
1182
  "CVE-2023-43791",
1082
1183
  "CVE-2023-44221",
1184
+ "CVE-2023-45727",
1083
1185
  "CVE-2023-47117",
1084
1186
  "CVE-2023-48022",
1187
+ "CVE-2023-48365",
1085
1188
  "CVE-2023-50224",
1086
1189
  "CVE-2023-51449",
1087
1190
  "CVE-2023-51764",
@@ -1092,10 +1195,16 @@
1092
1195
  "CVE-2023-6019",
1093
1196
  "CVE-2023-6021",
1094
1197
  "CVE-2023-6038",
1198
+ "CVE-2024-0012",
1095
1199
  "CVE-2024-0769",
1096
1200
  "CVE-2024-11120",
1097
1201
  "CVE-2024-11182",
1202
+ "CVE-2024-11667",
1203
+ "CVE-2024-11680",
1204
+ "CVE-2024-1212",
1205
+ "CVE-2024-12356",
1098
1206
  "CVE-2024-12450",
1207
+ "CVE-2024-12686",
1099
1208
  "CVE-2024-12776",
1100
1209
  "CVE-2024-12987",
1101
1210
  "CVE-2024-13059",
@@ -1103,41 +1212,80 @@
1103
1212
  "CVE-2024-1708",
1104
1213
  "CVE-2024-1709",
1105
1214
  "CVE-2024-20439",
1215
+ "CVE-2024-20767",
1106
1216
  "CVE-2024-20953",
1107
1217
  "CVE-2024-21182",
1218
+ "CVE-2024-21287",
1108
1219
  "CVE-2024-21575",
1109
1220
  "CVE-2024-21576",
1110
1221
  "CVE-2024-21762",
1222
+ "CVE-2024-23113",
1111
1223
  "CVE-2024-27199",
1112
1224
  "CVE-2024-27443",
1225
+ "CVE-2024-28987",
1226
+ "CVE-2024-29059",
1113
1227
  "CVE-2024-2912",
1228
+ "CVE-2024-29824",
1114
1229
  "CVE-2024-31462",
1115
1230
  "CVE-2024-37032",
1116
1231
  "CVE-2024-37079",
1232
+ "CVE-2024-37383",
1233
+ "CVE-2024-38094",
1117
1234
  "CVE-2024-38475",
1235
+ "CVE-2024-38812",
1118
1236
  "CVE-2024-39722",
1237
+ "CVE-2024-40711",
1238
+ "CVE-2024-40890",
1239
+ "CVE-2024-40891",
1240
+ "CVE-2024-41713",
1119
1241
  "CVE-2024-42009",
1120
1242
  "CVE-2024-42478",
1121
1243
  "CVE-2024-42479",
1122
1244
  "CVE-2024-43468",
1245
+ "CVE-2024-45195",
1246
+ "CVE-2024-45519",
1247
+ "CVE-2024-47575",
1123
1248
  "CVE-2024-48248",
1124
1249
  "CVE-2024-4885",
1125
1250
  "CVE-2024-4889",
1126
1251
  "CVE-2024-50050",
1252
+ "CVE-2024-50603",
1253
+ "CVE-2024-50623",
1254
+ "CVE-2024-51378",
1255
+ "CVE-2024-51567",
1256
+ "CVE-2024-53704",
1127
1257
  "CVE-2024-54085",
1258
+ "CVE-2024-55550",
1259
+ "CVE-2024-55591",
1260
+ "CVE-2024-55956",
1128
1261
  "CVE-2024-56145",
1129
1262
  "CVE-2024-57726",
1263
+ "CVE-2024-57727",
1130
1264
  "CVE-2024-57728",
1131
1265
  "CVE-2024-57968",
1132
1266
  "CVE-2024-58136",
1267
+ "CVE-2024-5910",
1133
1268
  "CVE-2024-6047",
1134
1269
  "CVE-2024-6587",
1135
1270
  "CVE-2024-7399",
1271
+ "CVE-2024-7593",
1136
1272
  "CVE-2024-7694",
1137
1273
  "CVE-2024-8068",
1138
1274
  "CVE-2024-8069",
1275
+ "CVE-2024-8956",
1276
+ "CVE-2024-8957",
1277
+ "CVE-2024-8963",
1278
+ "CVE-2024-9379",
1279
+ "CVE-2024-9380",
1280
+ "CVE-2024-9463",
1281
+ "CVE-2024-9465",
1282
+ "CVE-2024-9474",
1283
+ "CVE-2024-9537",
1284
+ "CVE-2024-9680",
1285
+ "CVE-2025-0108",
1139
1286
  "CVE-2025-0111",
1140
1287
  "CVE-2025-0282",
1288
+ "CVE-2025-0994",
1141
1289
  "CVE-2025-10035",
1142
1290
  "CVE-2025-1094",
1143
1291
  "CVE-2025-11371",
@@ -1156,6 +1304,8 @@
1156
1304
  "CVE-2025-20362",
1157
1305
  "CVE-2025-20393",
1158
1306
  "CVE-2025-22457",
1307
+ "CVE-2025-23006",
1308
+ "CVE-2025-23209",
1159
1309
  "CVE-2025-24016",
1160
1310
  "CVE-2025-24472",
1161
1311
  "CVE-2025-24813",
@@ -1338,9 +1488,15 @@
1338
1488
  "CVE-2026-45247",
1339
1489
  "CVE-2026-45659",
1340
1490
  "CVE-2026-45829",
1491
+ "CVE-2026-48282",
1341
1492
  "CVE-2026-48558",
1342
1493
  "CVE-2026-48907",
1494
+ "CVE-2026-48908",
1495
+ "CVE-2026-48939",
1343
1496
  "CVE-2026-50751",
1497
+ "CVE-2026-55255",
1498
+ "CVE-2026-56290",
1499
+ "CVE-2026-56291",
1344
1500
  "CVE-2026-5760",
1345
1501
  "CVE-2026-6973",
1346
1502
  "CVE-2026-7473",
@@ -1518,12 +1674,23 @@
1518
1674
  "CVE-2022-48503",
1519
1675
  "CVE-2023-41974",
1520
1676
  "CVE-2023-43000",
1677
+ "CVE-2024-21413",
1678
+ "CVE-2024-37383",
1679
+ "CVE-2024-43093",
1680
+ "CVE-2024-43572",
1681
+ "CVE-2024-43573",
1682
+ "CVE-2024-44308",
1683
+ "CVE-2024-44309",
1684
+ "CVE-2024-49039",
1521
1685
  "CVE-2024-53150",
1686
+ "CVE-2024-9680",
1687
+ "CVE-2025-0411",
1522
1688
  "CVE-2025-10585",
1523
1689
  "CVE-2025-13223",
1524
1690
  "CVE-2025-14174",
1525
1691
  "CVE-2025-21042",
1526
1692
  "CVE-2025-21043",
1693
+ "CVE-2025-24085",
1527
1694
  "CVE-2025-24201",
1528
1695
  "CVE-2025-24983",
1529
1696
  "CVE-2025-24985",
@@ -1892,12 +2059,22 @@
1892
2059
  "CVE-2019-5418",
1893
2060
  "CVE-2021-22681",
1894
2061
  "CVE-2021-43798",
2062
+ "CVE-2021-44207",
1895
2063
  "CVE-2023-38950",
1896
2064
  "CVE-2023-47117",
1897
2065
  "CVE-2024-0769",
1898
2066
  "CVE-2024-12450",
2067
+ "CVE-2024-21413",
2068
+ "CVE-2024-28987",
2069
+ "CVE-2024-43451",
2070
+ "CVE-2024-57727",
2071
+ "CVE-2024-5910",
2072
+ "CVE-2024-8956",
2073
+ "CVE-2024-9463",
2074
+ "CVE-2024-9465",
1899
2075
  "CVE-2025-11371",
1900
2076
  "CVE-2025-14611",
2077
+ "CVE-2025-23209",
1901
2078
  "CVE-2025-30066",
1902
2079
  "CVE-2025-30154",
1903
2080
  "CVE-2025-31125",
@@ -1911,6 +2088,7 @@
1911
2088
  "CVE-2026-22219",
1912
2089
  "CVE-2026-3055",
1913
2090
  "CVE-2026-48027",
2091
+ "CVE-2026-55255",
1914
2092
  "MAL-2025-PYPI-COLORAMA-SOLANA-STEALER",
1915
2093
  "MAL-2026-RUBYGEMS-BUFFERZONECORP-SLEEPER"
1916
2094
  ],
@@ -2061,6 +2239,9 @@
2061
2239
  "description": "Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.",
2062
2240
  "tactic": [
2063
2241
  "Credential Access"
2242
+ ],
2243
+ "cve_refs": [
2244
+ "CVE-2024-9379"
2064
2245
  ]
2065
2246
  },
2066
2247
  "T1556": {
@@ -2360,6 +2541,7 @@
2360
2541
  "version": "v19",
2361
2542
  "cve_refs": [
2362
2543
  "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
2544
+ "CVE-2022-23748",
2363
2545
  "CVE-2026-45321"
2364
2546
  ],
2365
2547
  "description_full": "Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.",
@@ -2892,10 +3074,14 @@
2892
3074
  "name": "Data from Local System",
2893
3075
  "version": "v19",
2894
3076
  "cve_refs": [
3077
+ "CVE-2021-41277",
2895
3078
  "CVE-2023-36424",
3079
+ "CVE-2023-45727",
2896
3080
  "CVE-2023-51449",
2897
3081
  "CVE-2023-6038",
2898
3082
  "CVE-2024-1561",
3083
+ "CVE-2024-43047",
3084
+ "CVE-2024-9537",
2899
3085
  "CVE-2025-14847",
2900
3086
  "CVE-2025-22226",
2901
3087
  "CVE-2025-47813",
@@ -3214,6 +3400,8 @@
3214
3400
  "cve_refs": [
3215
3401
  "CVE-2023-50387",
3216
3402
  "CVE-2023-50868",
3403
+ "CVE-2024-20481",
3404
+ "CVE-2024-3393",
3217
3405
  "CVE-2025-1316",
3218
3406
  "CVE-2025-20352",
3219
3407
  "CVE-2025-30202",
@@ -4013,19 +4201,30 @@
4013
4201
  "is_subtechnique": false,
4014
4202
  "cve_refs": [
4015
4203
  "CVE-2017-12637",
4204
+ "CVE-2021-26086",
4205
+ "CVE-2021-41277",
4206
+ "CVE-2023-28461",
4016
4207
  "CVE-2023-51449",
4017
4208
  "CVE-2023-6021",
4018
4209
  "CVE-2023-6038",
4210
+ "CVE-2024-11667",
4019
4211
  "CVE-2024-1561",
4212
+ "CVE-2024-20767",
4213
+ "CVE-2024-21287",
4020
4214
  "CVE-2024-24591",
4021
4215
  "CVE-2024-38475",
4022
4216
  "CVE-2024-39722",
4217
+ "CVE-2024-41713",
4023
4218
  "CVE-2024-48248",
4219
+ "CVE-2024-55550",
4220
+ "CVE-2024-57727",
4221
+ "CVE-2024-8963",
4024
4222
  "CVE-2025-0111",
4025
4223
  "CVE-2025-24984",
4026
4224
  "CVE-2026-20262",
4027
4225
  "CVE-2026-34909",
4028
4226
  "CVE-2026-34926",
4227
+ "CVE-2026-48282",
4029
4228
  "CVE-2026-54420"
4030
4229
  ]
4031
4230
  },
@@ -4190,7 +4389,16 @@
4190
4389
  "Windows"
4191
4390
  ],
4192
4391
  "stix_id": "attack-pattern--e6919abc-99f9-4c6c-95a5-14761e7b2add",
4193
- "is_subtechnique": false
4392
+ "is_subtechnique": false,
4393
+ "cve_refs": [
4394
+ "CVE-2023-48365",
4395
+ "CVE-2024-43572",
4396
+ "CVE-2024-43573",
4397
+ "CVE-2024-50603",
4398
+ "CVE-2024-50623",
4399
+ "CVE-2024-55956",
4400
+ "CVE-2024-9680"
4401
+ ]
4194
4402
  },
4195
4403
  "T1106": {
4196
4404
  "id": "T1106",
@@ -4558,7 +4766,15 @@
4558
4766
  "ESXi"
4559
4767
  ],
4560
4768
  "stix_id": "attack-pattern--e01be9c5-e763-4caf-aeb7-000b416aef67",
4561
- "is_subtechnique": false
4769
+ "is_subtechnique": false,
4770
+ "cve_refs": [
4771
+ "CVE-2018-19410",
4772
+ "CVE-2022-23227",
4773
+ "CVE-2024-11680",
4774
+ "CVE-2024-40711",
4775
+ "CVE-2024-55591",
4776
+ "CVE-2024-7593"
4777
+ ]
4562
4778
  },
4563
4779
  "T1137": {
4564
4780
  "id": "T1137",
@@ -4667,6 +4883,7 @@
4667
4883
  "CVE-2024-13159",
4668
4884
  "CVE-2024-13160",
4669
4885
  "CVE-2024-13161",
4886
+ "CVE-2024-43451",
4670
4887
  "CVE-2025-24054"
4671
4888
  ]
4672
4889
  },
@@ -4712,7 +4929,8 @@
4712
4929
  "stix_id": "attack-pattern--d40239b3-05ff-46d8-9bdd-b46d13463ef9",
4713
4930
  "is_subtechnique": false,
4714
4931
  "cve_refs": [
4715
- "CVE-2024-50302"
4932
+ "CVE-2024-50302",
4933
+ "CVE-2025-24200"
4716
4934
  ]
4717
4935
  },
4718
4936
  "T1201": {
@@ -4865,7 +5083,10 @@
4865
5083
  "stix_id": "attack-pattern--9db0cf3a-a3c9-4012-8268-123b9db6fd82",
4866
5084
  "is_subtechnique": false,
4867
5085
  "cve_refs": [
4868
- "CVE-2008-4250"
5086
+ "CVE-2008-4250",
5087
+ "CVE-2024-12356",
5088
+ "CVE-2024-38812",
5089
+ "CVE-2024-38813"
4869
5090
  ]
4870
5091
  },
4871
5092
  "T1211": {
@@ -4892,6 +5113,7 @@
4892
5113
  "is_subtechnique": false,
4893
5114
  "cve_refs": [
4894
5115
  "CVE-2025-21590",
5116
+ "CVE-2025-24200",
4895
5117
  "CVE-2025-2783",
4896
5118
  "CVE-2025-31201",
4897
5119
  "CVE-2026-21509",
@@ -11032,6 +11254,8 @@
11032
11254
  "_auto_imported": true,
11033
11255
  "_intake_method": "mitre-attack-stix",
11034
11256
  "cve_refs": [
11257
+ "CVE-2022-23748",
11258
+ "CVE-2025-0411",
11035
11259
  "CVE-2025-24985",
11036
11260
  "CVE-2025-24991",
11037
11261
  "CVE-2025-24993",
@@ -12414,12 +12638,22 @@
12414
12638
  "_auto_imported": true,
12415
12639
  "_intake_method": "mitre-attack-stix",
12416
12640
  "cve_refs": [
12641
+ "CVE-2014-2120",
12417
12642
  "CVE-2018-4063",
12418
12643
  "CVE-2021-26828",
12644
+ "CVE-2023-28461",
12645
+ "CVE-2024-0012",
12646
+ "CVE-2024-11680",
12419
12647
  "CVE-2024-1708",
12648
+ "CVE-2024-38094",
12649
+ "CVE-2024-45195",
12650
+ "CVE-2024-45519",
12651
+ "CVE-2024-50623",
12420
12652
  "CVE-2024-57968",
12421
12653
  "CVE-2024-7399",
12422
12654
  "CVE-2024-7694",
12655
+ "CVE-2024-8963",
12656
+ "CVE-2024-9380",
12423
12657
  "CVE-2025-24813",
12424
12658
  "CVE-2025-2749",
12425
12659
  "CVE-2025-30406",
@@ -12431,7 +12665,11 @@
12431
12665
  "CVE-2025-52691",
12432
12666
  "CVE-2025-53770",
12433
12667
  "CVE-2026-12569",
12434
- "CVE-2026-48907"
12668
+ "CVE-2026-48907",
12669
+ "CVE-2026-48908",
12670
+ "CVE-2026-48939",
12671
+ "CVE-2026-56290",
12672
+ "CVE-2026-56291"
12435
12673
  ]
12436
12674
  },
12437
12675
  "T1505.004": {