@blamejs/exceptd-skills 0.19.19 → 0.19.21

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.19.21 — 2026-08-11
+
+Another 39 CVEs report the controls they require, taking coverage to 953 of 1025. The set includes Jenkins, PAN-OS, Ivanti EPMM and the Cloud Services Appliance, Juniper's J-Web, Veeam Cloud Connect, Veritas Backup Exec, SolarWinds Web Help Desk, Apache OFBiz, Adobe Acrobat, and IP cameras from Reolink and NUUO.
+
+A patch that has been superseded is not a patch. The Cobalt Strike teamserver entry records that the first fix was incomplete, so a server upgraded off the vulnerable line — and even one upgraded to that first fix — can still be exploitable. The requirement refuses to close on "upgraded", and names the running version against the release that carries the complete fix, because a remediation record keyed to the first advisory reads as done while the flaw is reachable.
+
+Where the vulnerable component is unnamed, the inventory gap is the finding. One entry describes a flaw in an unspecified third-party component packaged inside a vendor's product — so the asset record says the product name and stops, and the component that actually carried the code execution was never tracked, scanned or held to a patch SLA by anyone. The requirement is that component inventory reach the depth at which the vulnerability actually sits, and the entry is explicit that the exploitation preceded any vendor fix: no remediation clock has force in a window where no fix exists, and pretending otherwise is how that window gets recorded as compliant.
+
+Two release tracks moving independently are two populations. The Jenkins entry names an affected weekly-line build and an affected long-term-support build, so an estate that upgrades one line and leaves a controller on the other has not finished — completion is counted per controller, not per track. The entry also separates what the upgrade does from what it cannot: the primitive is file disclosure, an unauthenticated caller obtains at least the first lines of any file on the controller, and the upgrade closes the read without unreading what was already taken.
+
+## 0.19.20 — 2026-08-11
+
+Another 38 CVEs report the controls they require, taking coverage to 914 of 1025. The set includes Ivanti Connect Secure and EPMM, VMware ESXi, Exchange, SharePoint, Adobe ColdFusion and Acrobat, Juniper's J-Web interface, Zimbra, Roundcube, libwebp, the Linux netfilter entries, and Outlook's credential-leak defect.
+
+An ordinary directory operation can be equivalent to hypervisor root. On an AD-integrated ESXi host, full administrative access is granted to members of a group matched by name, so whoever can create a group with that name holds hypervisor administration — which is what the named ransomware actors did, deleting and re-creating it. The requirement classifies that group-creation permission at the tier the access it confers actually is, and the entry carries the consequence: backup copies for VMs on those hosts must not live on datastores the hosts present, because the failure mode on record is backups encrypted alongside the machines they were meant to restore.
+
+Where the vulnerable code is vendored beneath products, the inventory has to reach the depth it actually sits at. The libwebp entry refuses to be scoped to a browser: everything embedding the codec is reachable through a crafted image, and the record names Chromium-based browsers, Electron applications and native software that bundles its own copy. Each install is held to its own fixed build rather than to the browser's, and the entry states why an application list cannot produce that population — a component vendored beneath a product is not something an operator installs, so it appears in no software inventory built from what was installed.
+
+One entry is reclassified. The D-Link DCS-2530L and DCS-2670L camera flaw (CVE-2020-25078) was carried as remote code execution with a CWE-94 assignment and an estimated CVSS of 8.8; the verified primitive is administrator-password disclosure from an unauthenticated endpoint, scored 7.5 for confidentiality impact alone. The score, the weakness class, the attack class and the ATT&CK mapping now follow the verified reading, and the indicators changed with them: what an operator hunts is unauthenticated requests to the disclosing endpoint and reuse of that password elsewhere, not command execution, implanted firmware or outbound command-and-control from the camera. The response changes too — rotate the credential and everywhere it was reused, and replace units that cannot reach a fixed build, rather than treating reachability as evidence that something ran on the device.
+
+For entries where the fix and the listing arrive together, the alternatives are what the clock needs. The Outlook credential-leak entry pairs the vendor update with three named mitigations, so a client that cannot take the update inside the window still has a deployable answer. It also records what remediation cannot reach: roughly eleven months of exploitation preceded the listing, and the defect's output is the user's authentication material delivered to an attacker with no interaction — so credentials exposed before the update are not repaired by it.
+
 ## 0.19.19 — 2026-08-11
 
 Another 43 CVEs report the controls they require, taking coverage to 876 of 1025. The set includes Jenkins, Oracle WebLogic and Java SE, FortiManager, SonicWall's SMA appliances, Veeam Backup and Replication, Veritas Backup Exec, the Barracuda Email Security Gateway, PaperCut, Roundcube, and IP cameras from Dahua, Edimax and PTZOptics.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-11T12:32:23.810Z",
+  "generated_at": "2026-08-11T17:45:39.617Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "9c1408c795f3718ce9ddeb8c249b7d18e3168443d7ea530bf5375d699b977799",
+    "manifest.json": "675104078ee6e6848b997894d2c38100c5ef55e98cbc70a1b2acbb35bd06244b",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
-    "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
-    "data/cve-catalog.json": "0f440663a16dfffa241e173eb8ba8613c790015e2eb5f81a5a33ea88975ca1d5",
-    "data/cwe-catalog.json": "27b244f6e82528ddef7923d0ddaca9942db3c49411ff8184c471d9195179803f",
+    "data/attack-techniques.json": "e6b9bae2be71e9b73848c1c2ca7175ac4ab0c8e153565f3c0fda3824e668c3a1",
+    "data/cve-catalog.json": "13cf279a8ea22fdcc2c1485689a4dbea2dadfa65171bd7a3df1950e998d81b23",
+    "data/cwe-catalog.json": "7b2223f0773d2f033d72fdcbf00cba9cdfdc2dff6bfb1366c9b30144396945f6",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "b71fb59c9acb3c9ca9a2e4881b45aa959c23f0bc49264f5c26d18980ea2afe30",
+    "data/zeroday-lessons.json": "2ad6f59b641c83e65c4050db106ed22e8f4b87bdbe5947470b71d342b3cdbd60",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",

package/data/_indexes/chains.json

@@ -463209,8 +463209,8 @@
   },
   "CVE-2020-25078": {
     "name": "D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability",
-    "rwep": 77,
-    "cvss": 8.8,
+    "rwep": 67,
+    "cvss": 7.5,
     "cisa_kev": true,
     "epss_score": null,
     "referencing_skills": [

package/data/attack-techniques.json

@@ -247,7 +247,6 @@
       "CVE-2020-14644",
       "CVE-2020-15069",
       "CVE-2020-15415",
-      "CVE-2020-25078",
       "CVE-2020-25079",
       "CVE-2020-2551",
       "CVE-2020-2883",

package/data/cve-catalog.json

@@ -79930,10 +79930,10 @@
   },
   "CVE-2020-25078": {
     "name": "D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability",
-    "type": "RCE",
-    "cvss_score": 8.8,
-    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
-    "cvss_note": "Operator estimate inferred from KEV vulnerabilityName + shortDescription classification (no per-CVE NVD lookup at bulk-import time). Refine via `exceptd refresh --advisory <CVE-ID> --apply` for NVD/GHSA/OSV enrichment.",
+    "type": "info-disclosure",
+    "cvss_score": 7.5,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+    "cvss_note": "CVSS 3.1 base score and vector taken from the NVD record (nvd@nist.gov), which scores the flaw confidentiality-only (C:H/I:N/A:N) for administrator-password disclosure. Replaces an earlier operator estimate of 8.8 (C:H/I:H/A:H) that had been inferred from the KEV vulnerabilityName without a per-CVE NVD lookup.",
     "cisa_kev": true,
     "cisa_kev_date": "2025-08-05",
     "cisa_kev_due_date": "2025-08-26",
@@ -79971,34 +79971,34 @@
     },
     "atlas_refs": [],
     "attack_refs": [
-      "T1190",
-      "T1059"
+      "T1190"
     ],
-    "rwep_score": 77,
+    "rwep_score": 67,
     "rwep_factors": {
       "cisa_kev": 25,
       "poc_available": 20,
       "ai_factor": 0,
       "active_exploitation": 20,
-      "blast_radius": 22,
+      "blast_radius": 12,
       "patch_available": -15,
       "live_patch_available": 0,
       "reboot_required": 5
     },
-    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22 (standard vendor-product scope). Bulk-imported via v0.13.17 KEV intake — score reflects KEV+PoC+active_exploitation contributions; refine factors when per-CVE research publishes.",
+    "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=12: the verified primitive is administrator-password disclosure on a two-model consumer camera line, not execution on the device, so the earlier 22 (assigned as standard vendor-product scope under a code-execution reading) overstated it. Score is the sum of the factors below.",
     "epss_score": null,
     "epss_date": "2026-05-18",
     "epss_note": "EPSS not refreshed at bulk-import. Pull via FIRST EPSS API per-CVE in a future refresh.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-25078",
     "cwe_refs": [
-      "CWE-94"
+      "CWE-200"
     ],
     "source_verified": "2026-05-29",
     "verification_sources": [
       "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
       "https://support.dlink.com/productinfo.aspx?m=DCS-2530L",
       "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180",
-      "https://nvd.nist.gov/vuln/detail/CVE-2020-25078"
+      "https://nvd.nist.gov/vuln/detail/CVE-2020-25078",
+      "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25078.yaml"
     ],
     "vendor_advisories": [
       {
@@ -80031,13 +80031,14 @@
     "iocs": {
       "behavioral": [
         "D-Link DCS-2530L / DCS-2670L cameras reachable on the network at a release below the fixed firmware/version (or end-of-life with no fix).",
-        "Unauthenticated requests to the IP camera web interface consistent with an unauthenticated code-execution flaw (CWE-94) on the D-Link DCS-2530L/2670L network cameras.",
-        "Indicators of the exploited weakness on the IP camera web interface — unexpected command execution, new accounts, malicious firmware, or botnet/C2 traffic from the device — with no corresponding legitimate administrative action (KEV-confirmed in-the-wild exploitation)."
+        "Unauthenticated HTTP GET to /config/getuser on a DCS-2530L or DCS-2670L — the published reproducer requests /config/getuser?index=0 and matches on a name= field in the response body — from any source that is not a known administration host. The endpoint answers without authentication and returns the administrator password, so a single successful request is the whole exploit.",
+        "Administrative logins to the camera, or to any system sharing that password, from sources or at times inconsistent with sanctioned administration — the credential is what this flaw yields, so reuse of the disclosed password elsewhere is the consequence to hunt, not execution on the camera itself."
       ],
-      "_ioc_source_note": "Anchored to NVD CVE-2020-25078, CISA KEV (added 2025-08-05), and the vendor advisory recorded in vendor_advisories."
+      "_ioc_source_note": "Request path, parameter and response matcher extracted from the published Nuclei detection template for this CVE (projectdiscovery/nuclei-templates, http/cves/2020/CVE-2020-25078.yaml: method GET, path {{BaseURL}}/config/getuser?index=0, word matcher \"name=\"), which is the primary reproducer for poc_available:true on this entry. Classification cross-checked against NVD CVE-2020-25078 (unauthenticated /config/getuser endpoint disclosing the administrator password; CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — the same vector the template records) and CISA KEV (added 2025-08-05). Indicators describe credential disclosure and its downstream reuse; execution-side indicators were removed because the verified primitive does not run code on the device."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. KEV/vendor_advisories retained from the verified import. The CVSS score/vector and the CWE assignment were later corrected against NVD — the import had estimated 8.8 (C:H/I:H/A:H) and CWE-94 from the KEV vulnerabilityName, while the verified primitive is administrator-password disclosure from an unauthenticated endpoint; see cvss_note and cwe_note. The ATT&CK refs, IoCs and attack class were re-derived from that corrected reading.",
+    "cwe_note": "NVD assigns NVD-CWE-noinfo; classified as CWE-200 (Exposure of Sensitive Information) per the confidentiality-only impact (C:H/I:N/A:N) and the NVD description, which records an unauthenticated /config/getuser endpoint disclosing the administrator password. Supersedes an earlier CWE-94 (Code Injection) assignment that the primitive does not support."
   },
   "CVE-2020-25079": {
     "name": "D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability",

package/data/cwe-catalog.json

@@ -544,7 +544,6 @@
       "CVE-2017-1000353",
       "CVE-2017-7494",
       "CVE-2018-14667",
-      "CVE-2020-25078",
       "CVE-2021-3129",
       "CVE-2021-39144",
       "CVE-2021-44529",
@@ -730,6 +729,7 @@
       "CVE-2016-6415",
       "CVE-2017-5521",
       "CVE-2018-5430",
+      "CVE-2020-25078",
       "CVE-2020-3259",
       "CVE-2021-25369",
       "CVE-2021-41277",