@blamejs/exceptd-skills 0.19.20 → 0.19.21
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/data/_indexes/_meta.json +3 -3
- package/data/zeroday-lessons.json +1148 -65
- package/lib/validate-package.js +6 -3
- package/manifest.json +53 -53
- package/package.json +1 -1
- package/sbom.cdx.json +17 -17
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,15 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.19.21 — 2026-08-11
|
|
4
|
+
|
|
5
|
+
Another 39 CVEs report the controls they require, taking coverage to 953 of 1025. The set includes Jenkins, PAN-OS, Ivanti EPMM and the Cloud Services Appliance, Juniper's J-Web, Veeam Cloud Connect, Veritas Backup Exec, SolarWinds Web Help Desk, Apache OFBiz, Adobe Acrobat, and IP cameras from Reolink and NUUO.
|
|
6
|
+
|
|
7
|
+
A patch that has been superseded is not a patch. The Cobalt Strike teamserver entry records that the first fix was incomplete, so a server upgraded off the vulnerable line — and even one upgraded to that first fix — can still be exploitable. The requirement refuses to close on "upgraded", and names the running version against the release that carries the complete fix, because a remediation record keyed to the first advisory reads as done while the flaw is reachable.
|
|
8
|
+
|
|
9
|
+
Where the vulnerable component is unnamed, the inventory gap is the finding. One entry describes a flaw in an unspecified third-party component packaged inside a vendor's product — so the asset record says the product name and stops, and the component that actually carried the code execution was never tracked, scanned or held to a patch SLA by anyone. The requirement is that component inventory reach the depth at which the vulnerability actually sits, and the entry is explicit that the exploitation preceded any vendor fix: no remediation clock has force in a window where no fix exists, and pretending otherwise is how that window gets recorded as compliant.
|
|
10
|
+
|
|
11
|
+
Two release tracks moving independently are two populations. The Jenkins entry names an affected weekly-line build and an affected long-term-support build, so an estate that upgrades one line and leaves a controller on the other has not finished — completion is counted per controller, not per track. The entry also separates what the upgrade does from what it cannot: the primitive is file disclosure, an unauthenticated caller obtains at least the first lines of any file on the controller, and the upgrade closes the read without unreading what was already taken.
|
|
12
|
+
|
|
3
13
|
## 0.19.20 — 2026-08-11
|
|
4
14
|
|
|
5
15
|
Another 38 CVEs report the controls they require, taking coverage to 914 of 1025. The set includes Ivanti Connect Secure and EPMM, VMware ESXi, Exchange, SharePoint, Adobe ColdFusion and Acrobat, Juniper's J-Web interface, Zimbra, Roundcube, libwebp, the Linux netfilter entries, and Outlook's credential-leak defect.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-08-
|
|
3
|
+
"generated_at": "2026-08-11T17:45:39.617Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "675104078ee6e6848b997894d2c38100c5ef55e98cbc70a1b2acbb35bd06244b",
|
|
8
8
|
"README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
|
|
9
9
|
"data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
|
|
10
10
|
"data/attack-techniques.json": "e6b9bae2be71e9b73848c1c2ca7175ac4ab0c8e153565f3c0fda3824e668c3a1",
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
"data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
|
|
17
17
|
"data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "2ad6f59b641c83e65c4050db106ed22e8f4b87bdbe5947470b71d342b3cdbd60",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
|