@blamejs/exceptd-skills 0.18.21 → 0.18.22

package/data/cwe-catalog.json

@@ -49,6 +49,7 @@
     ],
     "evidence_cves": [
       "CVE-2022-1471",
+      "CVE-2024-21413",
       "CVE-2024-3154",
       "CVE-2025-10164",
       "CVE-2025-20393",
@@ -97,7 +98,10 @@
     ],
     "evidence_cves": [
       "CVE-2017-12637",
+      "CVE-2019-16278",
       "CVE-2019-5418",
+      "CVE-2021-26086",
+      "CVE-2021-41277",
       "CVE-2021-43798",
       "CVE-2023-38950",
       "CVE-2023-43472",
@@ -105,6 +109,7 @@
       "CVE-2023-6021",
       "CVE-2024-0129",
       "CVE-2024-0769",
+      "CVE-2024-11667",
       "CVE-2024-13059",
       "CVE-2024-1561",
       "CVE-2024-1708",
@@ -112,9 +117,13 @@
       "CVE-2024-31462",
       "CVE-2024-37032",
       "CVE-2024-39722",
+      "CVE-2024-41713",
       "CVE-2024-4885",
+      "CVE-2024-55550",
+      "CVE-2024-57727",
       "CVE-2024-57728",
       "CVE-2024-7399",
+      "CVE-2024-8963",
       "CVE-2025-2749",
       "CVE-2025-27920",
       "CVE-2025-34028",
@@ -127,7 +136,8 @@
       "CVE-2026-22218",
       "CVE-2026-25592",
       "CVE-2026-34909",
-      "CVE-2026-34926"
+      "CVE-2026-34926",
+      "CVE-2026-48282"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-AC-3",
@@ -168,8 +178,11 @@
       "CVE-2021-33515",
       "CVE-2023-20118",
       "CVE-2023-33538",
+      "CVE-2024-12356",
       "CVE-2024-12450",
       "CVE-2024-5565",
+      "CVE-2024-55956",
+      "CVE-2024-9380",
       "CVE-2025-10035",
       "CVE-2025-29635",
       "CVE-2025-4008",
@@ -218,13 +231,30 @@
     ],
     "evidence_cves": [
       "CVE-2014-6278",
+      "CVE-2018-14933",
+      "CVE-2018-9276",
+      "CVE-2019-11001",
+      "CVE-2020-15415",
       "CVE-2021-20035",
+      "CVE-2021-40407",
+      "CVE-2023-25280",
       "CVE-2023-39780",
       "CVE-2023-44221",
       "CVE-2023-6019",
       "CVE-2024-11120",
+      "CVE-2024-1212",
+      "CVE-2024-12686",
       "CVE-2024-12987",
+      "CVE-2024-40890",
+      "CVE-2024-40891",
+      "CVE-2024-45519",
+      "CVE-2024-50603",
+      "CVE-2024-51378",
       "CVE-2024-6047",
+      "CVE-2024-8957",
+      "CVE-2024-9380",
+      "CVE-2024-9463",
+      "CVE-2024-9474",
       "CVE-2025-11953",
       "CVE-2025-12686",
       "CVE-2025-1316",
@@ -287,13 +317,18 @@
       "webapp-security"
     ],
     "evidence_cves": [
+      "CVE-2014-2120",
+      "CVE-2020-11023",
       "CVE-2021-26829",
       "CVE-2023-34192",
       "CVE-2023-6571",
       "CVE-2024-11182",
       "CVE-2024-27132",
       "CVE-2024-27443",
+      "CVE-2024-37383",
       "CVE-2024-42009",
+      "CVE-2024-43573",
+      "CVE-2024-44309",
       "CVE-2024-9526",
       "CVE-2025-27915",
       "CVE-2025-48700",
@@ -329,6 +364,7 @@
     "skills_referencing": [],
     "evidence_cves": [
       "CVE-2016-10033",
+      "CVE-2024-41710",
       "CVE-2026-24061",
       "CVE-2026-30623",
       "CVE-2026-31230",
@@ -364,7 +400,11 @@
       "webapp-security"
     ],
     "evidence_cves": [
+      "CVE-2020-29574",
+      "CVE-2024-29824",
       "CVE-2024-43468",
+      "CVE-2024-9379",
+      "CVE-2024-9465",
       "CVE-2025-25181",
       "CVE-2025-25257",
       "CVE-2025-57819",
@@ -425,9 +465,11 @@
       "CVE-2024-4889",
       "CVE-2024-5565",
       "CVE-2024-56145",
+      "CVE-2024-9537",
       "CVE-2025-11837",
       "CVE-2025-1550",
       "CVE-2025-1976",
+      "CVE-2025-23209",
       "CVE-2025-32432",
       "CVE-2025-3248",
       "CVE-2025-33236",
@@ -567,6 +609,7 @@
       "webapp-security"
     ],
     "evidence_cves": [
+      "CVE-2021-41277",
       "CVE-2023-43791",
       "CVE-2023-47117",
       "CVE-2024-21182",
@@ -601,6 +644,7 @@
     ],
     "skills_referencing": [],
     "evidence_cves": [
+      "CVE-2024-38813",
       "CVE-2025-40602"
     ],
     "framework_controls_partially_addressing": [
@@ -707,6 +751,7 @@
       "idp-incident-response"
     ],
     "evidence_cves": [
+      "CVE-2024-20767",
       "CVE-2025-12480",
       "CVE-2025-24989",
       "CVE-2025-31125",
@@ -766,8 +811,13 @@
       "CVE-2021-32030",
       "CVE-2022-0492",
       "CVE-2023-27351",
+      "CVE-2023-28461",
       "CVE-2024-12776",
       "CVE-2024-1709",
+      "CVE-2024-49039",
+      "CVE-2024-53704",
+      "CVE-2024-7593",
+      "CVE-2024-8956",
       "CVE-2025-32975",
       "CVE-2025-3935",
       "CVE-2025-49706",
@@ -808,7 +858,17 @@
       "sector-telecom"
     ],
     "evidence_cves": [
+      "CVE-2018-19410",
       "CVE-2020-24363",
+      "CVE-2022-23227",
+      "CVE-2023-28461",
+      "CVE-2024-0012",
+      "CVE-2024-11680",
+      "CVE-2024-47575",
+      "CVE-2024-51567",
+      "CVE-2024-5910",
+      "CVE-2024-8956",
+      "CVE-2025-0108",
       "CVE-2025-32433",
       "CVE-2025-3248",
       "CVE-2025-34028",
@@ -1259,6 +1319,11 @@
       "CVE-2020-9715",
       "CVE-2023-41974",
       "CVE-2023-43000",
+      "CVE-2024-43047",
+      "CVE-2024-9680",
+      "CVE-2025-21334",
+      "CVE-2025-21335",
+      "CVE-2025-24085",
       "CVE-2025-24983",
       "CVE-2025-27038",
       "CVE-2025-29824",
@@ -1298,6 +1363,7 @@
     "skills_referencing": [],
     "evidence_cves": [
       "CVE-2012-1854",
+      "CVE-2022-23748",
       "CVE-2025-23266"
     ],
     "framework_controls_partially_addressing": [
@@ -1336,6 +1402,7 @@
     "evidence_cves": [
       "CVE-2018-4063",
       "CVE-2021-26828",
+      "CVE-2024-50623",
       "CVE-2024-57968",
       "CVE-2024-7399",
       "CVE-2024-7694",
@@ -1343,7 +1410,11 @@
       "CVE-2025-31324",
       "CVE-2025-3928",
       "CVE-2025-52691",
-      "CVE-2026-21877"
+      "CVE-2026-21877",
+      "CVE-2026-48908",
+      "CVE-2026-48939",
+      "CVE-2026-56290",
+      "CVE-2026-56291"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-3",
@@ -1411,8 +1482,10 @@
     ],
     "evidence_cves": [
       "CVE-2017-3066",
+      "CVE-2019-0344",
       "CVE-2019-9874",
       "CVE-2019-9875",
+      "CVE-2020-2883",
       "CVE-2022-1471",
       "CVE-2023-21529",
       "CVE-2024-11392",
@@ -1422,10 +1495,14 @@
       "CVE-2024-24590",
       "CVE-2024-37052",
       "CVE-2024-37060",
+      "CVE-2024-38094",
+      "CVE-2024-40711",
       "CVE-2024-50050",
       "CVE-2024-8069",
+      "CVE-2025-0994",
       "CVE-2025-10035",
       "CVE-2025-10164",
+      "CVE-2025-23006",
       "CVE-2025-23254",
       "CVE-2025-24016",
       "CVE-2025-24813",
@@ -1730,7 +1807,10 @@
       "CVE-2023-3519",
       "CVE-2024-21762",
       "CVE-2024-37079",
+      "CVE-2024-38812",
       "CVE-2024-42479",
+      "CVE-2024-44308",
+      "CVE-2024-53104",
       "CVE-2024-53197",
       "CVE-2025-0282",
       "CVE-2025-14174",
@@ -1787,7 +1867,9 @@
     ],
     "evidence_cves": [
       "CVE-2019-6693",
+      "CVE-2021-44207",
       "CVE-2024-20439",
+      "CVE-2024-28987",
       "CVE-2025-14611",
       "CVE-2025-30406",
       "CVE-2026-22769"
@@ -1910,8 +1992,10 @@
       "webapp-security"
     ],
     "evidence_cves": [
+      "CVE-2024-21287",
       "CVE-2025-21479",
       "CVE-2025-21480",
+      "CVE-2025-24200",
       "CVE-2025-55177"
     ],
     "framework_controls_partially_addressing": [
@@ -2251,7 +2335,8 @@
     ],
     "evidence_cves": [
       "CVE-2020-17103-REREGRESSION-2026",
-      "CVE-2024-0132"
+      "CVE-2024-0132",
+      "CVE-2024-30088"
     ],
     "last_verified": "2026-05-18",
     "notes": "Added v0.13.17 to back the MiniPlasma cldflt.sys re-regression entry. CWE-367 is the standard MITRE classification for TOCTOU races; the cldflt.sys HsmOsBlockPlaceholderAccess primitive validates a placeholder file's accessibility once, then is racing against a junction / symlink swap before the kernel acts on the cached decision."
@@ -2298,6 +2383,7 @@
     ],
     "evidence_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
+      "CVE-2025-0411",
       "CVE-2025-3466",
       "CVE-2025-40536",
       "CVE-2025-68668",
@@ -2361,6 +2447,7 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2025-21391",
       "CVE-2025-48384",
       "CVE-2025-60710",
       "CVE-2026-41091"
@@ -2451,6 +2538,7 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2020-15069",
       "CVE-2022-37055",
       "CVE-2025-20333",
       "CVE-2025-43520"
@@ -2519,6 +2607,7 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2024-29059",
       "CVE-2025-47813"
     ],
     "last_verified": "2026-05-18",
@@ -2597,6 +2686,7 @@
     "related_weaknesses": [],
     "evidence_cves": [
       "CVE-2024-1709",
+      "CVE-2024-55591",
       "CVE-2025-24472",
       "CVE-2025-2746",
       "CVE-2025-2747",
@@ -2709,6 +2799,7 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2023-45727",
       "CVE-2025-2775",
       "CVE-2025-2776",
       "CVE-2025-58360"
@@ -2795,6 +2886,7 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2024-35250",
       "CVE-2025-24990"
     ],
     "last_verified": "2026-05-18",
@@ -2915,6 +3007,7 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2024-43451",
       "CVE-2025-0111",
       "CVE-2025-24054",
       "CVE-2025-33053"
@@ -2959,6 +3052,10 @@
     "related_weaknesses": [],
     "evidence_cves": [
       "CVE-2009-3459",
+      "CVE-2024-38812",
+      "CVE-2024-49138",
+      "CVE-2025-21333",
+      "CVE-2025-21418",
       "CVE-2025-24985",
       "CVE-2025-24993",
       "CVE-2025-32706",
@@ -3345,7 +3442,9 @@
       "CWE-2000"
     ],
     "related_weaknesses": [],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2023-48365"
+    ],
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
@@ -3661,7 +3760,8 @@
     "related_weaknesses": [],
     "evidence_cves": [
       "CVE-2026-41947",
-      "CVE-2026-41950"
+      "CVE-2026-41950",
+      "CVE-2026-55255"
     ],
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
@@ -3820,7 +3920,9 @@
       "CWE-2000"
     ],
     "related_weaknesses": [],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2024-3393"
+    ],
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
@@ -3884,7 +3986,9 @@
       "CWE-2000"
     ],
     "related_weaknesses": [],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2024-20481"
+    ],
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
@@ -5032,6 +5136,7 @@
     "related_attack_patterns_capec": [],
     "skills_referencing": [],
     "evidence_cves": [
+      "CVE-2024-43572",
       "CVE-2025-26633"
     ]
   },
@@ -5087,5 +5192,166 @@
     "evidence_cves": [
       "CVE-2025-0111"
     ]
+  },
+  "CWE-114": {
+    "id": "CWE-114",
+    "name": "Process Control",
+    "abstraction": "Base",
+    "category": "Code",
+    "description": "Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-108",
+      "CAPEC-640"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2022-23748"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-53-SI-7",
+      "ISO-27001-2022-A.8.28"
+    ],
+    "real_requirement": "Load libraries/plugins only from trusted, integrity-verified paths; pin absolute paths for DLL/shared-object loading; sign and verify loadable modules; disable search-order/relative loading for privileged processes.",
+    "lag_notes": "Software-integrity controls rarely mandate load-path pinning against DLL search-order hijacking in vendor-shipped services.",
+    "last_verified": "2026-07-11"
+  },
+  "CWE-134": {
+    "id": "CWE-134",
+    "name": "Use of Externally-Controlled Format String",
+    "abstraction": "Base",
+    "category": "Injection",
+    "description": "The product uses a function that accepts a format string as an argument, but the format string originates from an external source.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000",
+      "CWE-1003"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-135",
+      "CAPEC-67"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2024-23113"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-53-SI-10",
+      "OWASP-Top-10-2021-A03"
+    ],
+    "real_requirement": "Never pass externally-controlled data as the format string argument; use constant format strings with the untrusted value as a parameter; enable compiler format-string warnings (-Wformat-security) and treat them as errors.",
+    "lag_notes": "Input-validation controls target injection classes generically and seldom call out format-string sinks in C/C++ network daemons.",
+    "last_verified": "2026-07-11"
+  },
+  "CWE-176": {
+    "id": "CWE-176",
+    "name": "Improper Handling of Unicode Encoding",
+    "abstraction": "Base",
+    "category": "Encoding",
+    "description": "The product does not properly handle when an input contains Unicode encoding.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-80"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2024-43093"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-53-SI-10",
+      "OWASP-ASVS-v5.0-V14"
+    ],
+    "real_requirement": "Canonicalize all input to a single Unicode normalization form before validation and authorization checks; reject overlong/ambiguous encodings; apply the same normalization on every trust boundary to prevent normalization-mismatch bypasses.",
+    "lag_notes": "Validation controls assume post-canonicalization input and do not require normalization-before-check ordering.",
+    "last_verified": "2026-07-11"
+  },
+  "CWE-273": {
+    "id": "CWE-273",
+    "name": "Improper Check for Dropped Privileges",
+    "abstraction": "Base",
+    "category": "Privilege",
+    "description": "The product attempts to drop privileges but does not check or incorrectly checks to see if the privilege-dropping operation succeeded.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-234"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2024-38813"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-53-AC-6",
+      "ISO-27001-2022-A.8.2"
+    ],
+    "real_requirement": "Check the return value of every setuid/setgid/token-adjustment call and fail closed if the drop did not take effect; re-verify the effective privilege set after dropping; never continue a privileged operation on an unverified drop.",
+    "lag_notes": "Least-privilege controls mandate dropping privileges but do not require verifying the drop succeeded.",
+    "last_verified": "2026-07-11"
+  },
+  "CWE-303": {
+    "id": "CWE-303",
+    "name": "Incorrect Implementation of Authentication Algorithm",
+    "abstraction": "Base",
+    "category": "Authentication",
+    "description": "The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-90"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2024-7593"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-63B-rev4",
+      "ISO-27001-2022-A.8.5"
+    ],
+    "real_requirement": "Implement authentication algorithms per their specification with constant-time comparisons and complete state validation; test negative/edge auth paths; independently review any custom auth handshake against the reference algorithm before shipping.",
+    "lag_notes": "AuthN controls assume a correct algorithm implementation and do not require conformance testing of the handshake itself.",
+    "last_verified": "2026-07-11"
+  },
+  "CWE-425": {
+    "id": "CWE-425",
+    "name": "Direct Request (Forced Browsing)",
+    "abstraction": "Base",
+    "category": "Access Control",
+    "description": "The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000",
+      "CWE-1003"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-87",
+      "CAPEC-127"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2024-45195"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-53-AC-3",
+      "OWASP-Top-10-2021-A01"
+    ],
+    "real_requirement": "Enforce authorization server-side on every restricted resource (not just linked entry points); default-deny unmapped routes; do not rely on the absence of a UI link or on client-side gating to protect admin/internal endpoints.",
+    "lag_notes": "Access-control controls check linked paths; forced-browsing to unlinked-but-reachable endpoints is a common blind spot.",
+    "last_verified": "2026-07-11"
   }
 }