@blamejs/exceptd-skills 0.19.13 → 0.19.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/data/_indexes/_meta.json +3 -3
- package/data/zeroday-lessons.json +967 -38
- package/manifest.json +53 -53
- package/package.json +1 -1
- package/sbom.cdx.json +15 -15
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.19.14 — 2026-08-10
|
|
4
|
+
|
|
5
|
+
Another 36 CVEs report the controls they require, taking coverage to 678 of 1025. The set includes Citrix Session Recording, Erlang/OTP SSH, FreePBX, Zimbra, Ubiquiti UniFi OS, Power Pages, Android Runtime, and the PowerPoint record-parser entry.
|
|
6
|
+
|
|
7
|
+
Two entries state why a network-shaped defence does nothing for them. The Citrix Session Recording deserialization is reached by an authenticated user already on the same intranet as the server, so the payload arrives as ordinary internal traffic from an ordinary internal account — restricting reachability bounds which hosts can present it and repairs nothing, and any account inside the permitted segment still holds the path.
|
|
8
|
+
|
|
9
|
+
Where a decade-old defect returns to the exploited list, the requirement is not "apply the update" but "find the installs that never received it". The re-listed PowerPoint entry measures completion by the build each install reports rather than by a management console showing no updates pending — the hosts keeping a defect of that vintage reachable are the ones that fell out of managed updating, so the console's silence is missing visibility rather than evidence. Copies no inventory can see are remediated by removal, never by being recorded as compliant.
|
|
10
|
+
|
|
3
11
|
## 0.19.13 — 2026-08-10
|
|
4
12
|
|
|
5
13
|
Another 34 CVEs report the controls they require, taking coverage to 642 of 1025. The set includes BeyondTrust Remote Support and Privileged Remote Access, Cisco Unified Communications and Catalyst SD-WAN, Sitecore, TP-Link, and Windows and Linux kernel entries.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-08-
|
|
3
|
+
"generated_at": "2026-08-10T18:19:35.848Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "b9c723df435ce05a1b79873766234f4643c6d413b839ab0d2cec760e8065aef6",
|
|
8
8
|
"README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
|
|
9
9
|
"data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
|
|
10
10
|
"data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
"data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
|
|
17
17
|
"data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "7a74e6b829ee4c07927b3261ecb3d0ac39b2a46364c3785a3294561fbde3a2fa",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
|