@blamejs/exceptd-skills 0.19.18 → 0.19.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/data/_indexes/_meta.json +3 -3
- package/data/zeroday-lessons.json +1321 -43
- package/manifest.json +53 -53
- package/package.json +1 -1
- package/sbom.cdx.json +15 -15
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,15 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.19.19 — 2026-08-11
|
|
4
|
+
|
|
5
|
+
Another 43 CVEs report the controls they require, taking coverage to 876 of 1025. The set includes Jenkins, Oracle WebLogic and Java SE, FortiManager, SonicWall's SMA appliances, Veeam Backup and Replication, Veritas Backup Exec, the Barracuda Email Security Gateway, PaperCut, Roundcube, and IP cameras from Dahua, Edimax and PTZOptics.
|
|
6
|
+
|
|
7
|
+
An applied patch is not always the end state, and one entry says so in the vendor's own terms. Barracuda auto-applied the fix to every customer Email Security Gateway without the operator doing anything — and still advised replacing compromised units, because nothing restores the integrity of an appliance that was already backdoored. The operator's question on that product is therefore not whether the fix landed but whether the unit was held during the exposure window, which on an appliance the attacker controlled cannot be answered from the appliance's own logs. The requirement pairs the replacement default with off-box telemetry, so the record of what the appliance did outlives the appliance.
|
|
8
|
+
|
|
9
|
+
Backup infrastructure is rated by what it protects, not by what it is. Three entries in this set put unauthenticated code execution on backup servers and agents, and each records the same gap between a fix existing and it being applied — a Backup Exec flaw was exploited for over a year against a fix already shipped, and Veeam servers were still unpatched when ransomware affiliates arrived roughly six weeks after the release. The requirement moves those hosts off the maintenance window their tier normally gets and onto the listing clock, and it names what an upgrade does not undo: the accounts created and the staging left behind on a server that was already reached.
|
|
10
|
+
|
|
11
|
+
Where a vulnerability's scope is recorded as "per vendor advisory", the sweep is built from that advisory rather than from the models the description happens to name. The DrayTek entry names three Vigor models in its description while the affected-product record scopes it to the product line, so an inventory built from the description reports clean across an estate standardised on another model. The same entry declines to guess at end-of-support: a fix existing for this CVE says nothing about whether a given model can still receive one, so that is written as something to obtain per model — and the units driving this class of exploitation are the home-office and small-branch routers that were never in the patch inventory to begin with.
|
|
12
|
+
|
|
3
13
|
## 0.19.18 — 2026-08-11
|
|
4
14
|
|
|
5
15
|
Another 40 CVEs report the controls they require, taking coverage to 833 of 1025. The set includes Ivanti Connect Secure, PAN-OS, Confluence, VMware vCenter, Adobe ColdFusion, Firefox, Chromium, Windows Hyper-V, Oracle E-Business Suite, SonicWall's SSL-VPN, and the Realtek SDK.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-08-
|
|
3
|
+
"generated_at": "2026-08-11T12:32:23.810Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "9c1408c795f3718ce9ddeb8c249b7d18e3168443d7ea530bf5375d699b977799",
|
|
8
8
|
"README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
|
|
9
9
|
"data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
|
|
10
10
|
"data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
"data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
|
|
17
17
|
"data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "b71fb59c9acb3c9ca9a2e4881b45aa959c23f0bc49264f5c26d18980ea2afe30",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
|