@blamejs/exceptd-skills 0.19.17 → 0.19.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/data/_indexes/_meta.json +3 -3
- package/data/zeroday-lessons.json +1161 -40
- package/manifest.json +53 -53
- package/package.json +1 -1
- package/sbom.cdx.json +15 -15
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,15 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.19.18 — 2026-08-11
|
|
4
|
+
|
|
5
|
+
Another 40 CVEs report the controls they require, taking coverage to 833 of 1025. The set includes Ivanti Connect Secure, PAN-OS, Confluence, VMware vCenter, Adobe ColdFusion, Firefox, Chromium, Windows Hyper-V, Oracle E-Business Suite, SonicWall's SSL-VPN, and the Realtek SDK.
|
|
6
|
+
|
|
7
|
+
Where the vendor hosts the software, the patch obligations complete themselves. The Microsoft Partner Center fix was applied server-side, with nothing for an operator to install, schedule or attest — so all five patch-cadence controls citing the CVE can be marked satisfied by someone who did nothing and could have done nothing, while exploitation ran against the service. What the operator does hold is the relationship: Partner Center brokers access into downstream customer tenants, so the escalation lands on the delegated grant rather than on any one organisation's server. The requirement is validation and logging of the cross-tenant calls a partner identity makes, plus an incident path for a control plane whose remediation was never the operator's to perform.
|
|
8
|
+
|
|
9
|
+
Whether a patch exists is a per-model question when the defect sits in a component other vendors embed. The Realtek SDK entry records an available fix alongside affected devices that are end-of-life with no fixed firmware, and the flaw is in a UPnP service shipped inside OEM router and IoT builds — so the answer comes from each OEM rather than being assumed either way across an estate. The requirement splits that estate into three states rather than the usual two: patched, mitigation-active with the WAN-side path blocked and a dated review, and no verdict — which is a device to retire, not a row to leave open.
|
|
10
|
+
|
|
11
|
+
An appliance cannot be isolated out of doing its job. The FortiWeb command injection is reachable over crafted HTTP requests as well as the CLI, and serving HTTP is the entire reason the appliance is deployed, so restricting reachability narrows the management path for the duration and closes nothing. That entry also counts a unit carrying the new image but not yet restarted as still exposed, because the recorded fix requires the restart to take effect.
|
|
12
|
+
|
|
3
13
|
## 0.19.17 — 2026-08-11
|
|
4
14
|
|
|
5
15
|
Another 41 CVEs report the controls they require, taking coverage to 793 of 1025. The set includes Chromium V8, Apple WebKit and CoreMedia, PAN-OS, MOVEit Transfer, SharePoint, Cisco ASA and Catalyst SD-WAN, Ivanti's Cloud Services Appliance, D-Link NAS devices, jQuery, and GNU Bash.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-08-
|
|
3
|
+
"generated_at": "2026-08-11T10:42:37.172Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "5176b0cfd4246b7c3f169abd1d4782f81340a35ff434a821119ba817faa751e6",
|
|
8
8
|
"README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
|
|
9
9
|
"data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
|
|
10
10
|
"data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
"data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
|
|
17
17
|
"data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "7130ebec316e0c26ea166b9536da985e65f74c6152d1fb567046b18f2f5c778d",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
|