@blamejs/exceptd-skills 0.19.18 → 0.19.20

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.19.20 — 2026-08-11
+
+Another 38 CVEs report the controls they require, taking coverage to 914 of 1025. The set includes Ivanti Connect Secure and EPMM, VMware ESXi, Exchange, SharePoint, Adobe ColdFusion and Acrobat, Juniper's J-Web interface, Zimbra, Roundcube, libwebp, the Linux netfilter entries, and Outlook's credential-leak defect.
+
+An ordinary directory operation can be equivalent to hypervisor root. On an AD-integrated ESXi host, full administrative access is granted to members of a group matched by name, so whoever can create a group with that name holds hypervisor administration — which is what the named ransomware actors did, deleting and re-creating it. The requirement classifies that group-creation permission at the tier the access it confers actually is, and the entry carries the consequence: backup copies for VMs on those hosts must not live on datastores the hosts present, because the failure mode on record is backups encrypted alongside the machines they were meant to restore.
+
+Where the vulnerable code is vendored beneath products, the inventory has to reach the depth it actually sits at. The libwebp entry refuses to be scoped to a browser: everything embedding the codec is reachable through a crafted image, and the record names Chromium-based browsers, Electron applications and native software that bundles its own copy. Each install is held to its own fixed build rather than to the browser's, and the entry states why an application list cannot produce that population — a component vendored beneath a product is not something an operator installs, so it appears in no software inventory built from what was installed.
+
+One entry is reclassified. The D-Link DCS-2530L and DCS-2670L camera flaw (CVE-2020-25078) was carried as remote code execution with a CWE-94 assignment and an estimated CVSS of 8.8; the verified primitive is administrator-password disclosure from an unauthenticated endpoint, scored 7.5 for confidentiality impact alone. The score, the weakness class, the attack class and the ATT&CK mapping now follow the verified reading, and the indicators changed with them: what an operator hunts is unauthenticated requests to the disclosing endpoint and reuse of that password elsewhere, not command execution, implanted firmware or outbound command-and-control from the camera. The response changes too — rotate the credential and everywhere it was reused, and replace units that cannot reach a fixed build, rather than treating reachability as evidence that something ran on the device.
+
+For entries where the fix and the listing arrive together, the alternatives are what the clock needs. The Outlook credential-leak entry pairs the vendor update with three named mitigations, so a client that cannot take the update inside the window still has a deployable answer. It also records what remediation cannot reach: roughly eleven months of exploitation preceded the listing, and the defect's output is the user's authentication material delivered to an attacker with no interaction — so credentials exposed before the update are not repaired by it.
+
+## 0.19.19 — 2026-08-11
+
+Another 43 CVEs report the controls they require, taking coverage to 876 of 1025. The set includes Jenkins, Oracle WebLogic and Java SE, FortiManager, SonicWall's SMA appliances, Veeam Backup and Replication, Veritas Backup Exec, the Barracuda Email Security Gateway, PaperCut, Roundcube, and IP cameras from Dahua, Edimax and PTZOptics.
+
+An applied patch is not always the end state, and one entry says so in the vendor's own terms. Barracuda auto-applied the fix to every customer Email Security Gateway without the operator doing anything — and still advised replacing compromised units, because nothing restores the integrity of an appliance that was already backdoored. The operator's question on that product is therefore not whether the fix landed but whether the unit was held during the exposure window, which on an appliance the attacker controlled cannot be answered from the appliance's own logs. The requirement pairs the replacement default with off-box telemetry, so the record of what the appliance did outlives the appliance.
+
+Backup infrastructure is rated by what it protects, not by what it is. Three entries in this set put unauthenticated code execution on backup servers and agents, and each records the same gap between a fix existing and it being applied — a Backup Exec flaw was exploited for over a year against a fix already shipped, and Veeam servers were still unpatched when ransomware affiliates arrived roughly six weeks after the release. The requirement moves those hosts off the maintenance window their tier normally gets and onto the listing clock, and it names what an upgrade does not undo: the accounts created and the staging left behind on a server that was already reached.
+
+Where a vulnerability's scope is recorded as "per vendor advisory", the sweep is built from that advisory rather than from the models the description happens to name. The DrayTek entry names three Vigor models in its description while the affected-product record scopes it to the product line, so an inventory built from the description reports clean across an estate standardised on another model. The same entry declines to guess at end-of-support: a fix existing for this CVE says nothing about whether a given model can still receive one, so that is written as something to obtain per model — and the units driving this class of exploitation are the home-office and small-branch routers that were never in the patch inventory to begin with.
+
 ## 0.19.18 — 2026-08-11
 
 Another 40 CVEs report the controls they require, taking coverage to 833 of 1025. The set includes Ivanti Connect Secure, PAN-OS, Confluence, VMware vCenter, Adobe ColdFusion, Firefox, Chromium, Windows Hyper-V, Oracle E-Business Suite, SonicWall's SSL-VPN, and the Realtek SDK.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-11T10:42:37.172Z",
+  "generated_at": "2026-08-11T16:42:47.287Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "5176b0cfd4246b7c3f169abd1d4782f81340a35ff434a821119ba817faa751e6",
+    "manifest.json": "fa1f1accfae4a723ac46ab5f9b7d5310b98fa5cca7f6d8a1ffd105731b274b5c",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
-    "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
-    "data/cve-catalog.json": "0f440663a16dfffa241e173eb8ba8613c790015e2eb5f81a5a33ea88975ca1d5",
-    "data/cwe-catalog.json": "27b244f6e82528ddef7923d0ddaca9942db3c49411ff8184c471d9195179803f",
+    "data/attack-techniques.json": "e6b9bae2be71e9b73848c1c2ca7175ac4ab0c8e153565f3c0fda3824e668c3a1",
+    "data/cve-catalog.json": "13cf279a8ea22fdcc2c1485689a4dbea2dadfa65171bd7a3df1950e998d81b23",
+    "data/cwe-catalog.json": "7b2223f0773d2f033d72fdcbf00cba9cdfdc2dff6bfb1366c9b30144396945f6",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "7130ebec316e0c26ea166b9536da985e65f74c6152d1fb567046b18f2f5c778d",
+    "data/zeroday-lessons.json": "b5335059c25d0ab4e77a8b88dc7c3eb3445be4e9ef8bcd51ebddd8a9511d1d64",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",

package/data/_indexes/chains.json

@@ -463209,8 +463209,8 @@
   },
   "CVE-2020-25078": {
     "name": "D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability",
-    "rwep": 77,
-    "cvss": 8.8,
+    "rwep": 67,
+    "cvss": 7.5,
     "cisa_kev": true,
     "epss_score": null,
     "referencing_skills": [

package/data/attack-techniques.json

@@ -247,7 +247,6 @@
       "CVE-2020-14644",
       "CVE-2020-15069",
       "CVE-2020-15415",
-      "CVE-2020-25078",
       "CVE-2020-25079",
       "CVE-2020-2551",
       "CVE-2020-2883",

package/data/cve-catalog.json

@@ -79930,10 +79930,10 @@
   },
   "CVE-2020-25078": {
     "name": "D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability",
-    "type": "RCE",
-    "cvss_score": 8.8,
-    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
-    "cvss_note": "Operator estimate inferred from KEV vulnerabilityName + shortDescription classification (no per-CVE NVD lookup at bulk-import time). Refine via `exceptd refresh --advisory <CVE-ID> --apply` for NVD/GHSA/OSV enrichment.",
+    "type": "info-disclosure",
+    "cvss_score": 7.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+    "cvss_note": "CVSS 3.1 base score and vector taken from the NVD record (nvd@nist.gov), which scores the flaw confidentiality-only (C:H/I:N/A:N) for administrator-password disclosure. Replaces an earlier operator estimate of 8.8 (C:H/I:H/A:H) that had been inferred from the KEV vulnerabilityName without a per-CVE NVD lookup.",
     "cisa_kev": true,
     "cisa_kev_date": "2025-08-05",
     "cisa_kev_due_date": "2025-08-26",
@@ -79971,34 +79971,34 @@
     },
     "atlas_refs": [],
     "attack_refs": [
-      "T1190",
-      "T1059"
+      "T1190"
     ],
-    "rwep_score": 77,
+    "rwep_score": 67,
     "rwep_factors": {
       "cisa_kev": 25,
       "poc_available": 20,
       "ai_factor": 0,
       "active_exploitation": 20,
-      "blast_radius": 22,
+      "blast_radius": 12,
       "patch_available": -15,
       "live_patch_available": 0,
       "reboot_required": 5
     },
-    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22 (standard vendor-product scope). Bulk-imported via v0.13.17 KEV intake — score reflects KEV+PoC+active_exploitation contributions; refine factors when per-CVE research publishes.",
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=12: the verified primitive is administrator-password disclosure on a two-model consumer camera line, not execution on the device, so the earlier 22 (assigned as standard vendor-product scope under a code-execution reading) overstated it. Score is the sum of the factors below.",
     "epss_score": null,
     "epss_date": "2026-05-18",
     "epss_note": "EPSS not refreshed at bulk-import. Pull via FIRST EPSS API per-CVE in a future refresh.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-25078",
     "cwe_refs": [
-      "CWE-94"
+      "CWE-200"
     ],
     "source_verified": "2026-05-29",
     "verification_sources": [
       "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
       "https://support.dlink.com/productinfo.aspx?m=DCS-2530L",
       "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180",
-      "https://nvd.nist.gov/vuln/detail/CVE-2020-25078"
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-25078",
+      "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25078.yaml"
     ],
     "vendor_advisories": [
       {
@@ -80031,13 +80031,14 @@
     "iocs": {
       "behavioral": [
         "D-Link DCS-2530L / DCS-2670L cameras reachable on the network at a release below the fixed firmware/version (or end-of-life with no fix).",
-        "Unauthenticated requests to the IP camera web interface consistent with an unauthenticated code-execution flaw (CWE-94) on the D-Link DCS-2530L/2670L network cameras.",
-        "Indicators of the exploited weakness on the IP camera web interface — unexpected command execution, new accounts, malicious firmware, or botnet/C2 traffic from the device — with no corresponding legitimate administrative action (KEV-confirmed in-the-wild exploitation)."
+        "Unauthenticated HTTP GET to /config/getuser on a DCS-2530L or DCS-2670L — the published reproducer requests /config/getuser?index=0 and matches on a name= field in the response body — from any source that is not a known administration host. The endpoint answers without authentication and returns the administrator password, so a single successful request is the whole exploit.",
+        "Administrative logins to the camera, or to any system sharing that password, from sources or at times inconsistent with sanctioned administration — the credential is what this flaw yields, so reuse of the disclosed password elsewhere is the consequence to hunt, not execution on the camera itself."
       ],
-      "_ioc_source_note": "Anchored to NVD CVE-2020-25078, CISA KEV (added 2025-08-05), and the vendor advisory recorded in vendor_advisories."
+      "_ioc_source_note": "Request path, parameter and response matcher extracted from the published Nuclei detection template for this CVE (projectdiscovery/nuclei-templates, http/cves/2020/CVE-2020-25078.yaml: method GET, path {{BaseURL}}/config/getuser?index=0, word matcher \"name=\"), which is the primary reproducer for poc_available:true on this entry. Classification cross-checked against NVD CVE-2020-25078 (unauthenticated /config/getuser endpoint disclosing the administrator password; CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — the same vector the template records) and CISA KEV (added 2025-08-05). Indicators describe credential disclosure and its downstream reuse; execution-side indicators were removed because the verified primitive does not run code on the device."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. KEV/vendor_advisories retained from the verified import. The CVSS score/vector and the CWE assignment were later corrected against NVD — the import had estimated 8.8 (C:H/I:H/A:H) and CWE-94 from the KEV vulnerabilityName, while the verified primitive is administrator-password disclosure from an unauthenticated endpoint; see cvss_note and cwe_note. The ATT&CK refs, IoCs and attack class were re-derived from that corrected reading.",
+    "cwe_note": "NVD assigns NVD-CWE-noinfo; classified as CWE-200 (Exposure of Sensitive Information) per the confidentiality-only impact (C:H/I:N/A:N) and the NVD description, which records an unauthenticated /config/getuser endpoint disclosing the administrator password. Supersedes an earlier CWE-94 (Code Injection) assignment that the primitive does not support."
   },
   "CVE-2020-25079": {
     "name": "D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability",

package/data/cwe-catalog.json

@@ -544,7 +544,6 @@
       "CVE-2017-1000353",
       "CVE-2017-7494",
       "CVE-2018-14667",
-      "CVE-2020-25078",
       "CVE-2021-3129",
       "CVE-2021-39144",
       "CVE-2021-44529",
@@ -730,6 +729,7 @@
       "CVE-2016-6415",
       "CVE-2017-5521",
       "CVE-2018-5430",
+      "CVE-2020-25078",
       "CVE-2020-3259",
       "CVE-2021-25369",
       "CVE-2021-41277",