@blamejs/exceptd-skills 0.19.20 → 0.19.22

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.19.22 — 2026-08-11
+
+Another 38 CVEs report the controls they require, taking coverage to 991 of 1025. The set includes Citrix NetScaler, Apache ActiveMQ and RocketMQ, Adobe ColdFusion, Oracle Fusion Middleware, Zimbra, Ivanti's Cloud Services Appliance, Qlik Sense, Cisco NX-OS, and the Fortinet FortiSandbox and Trend Micro Apex One entries.
+
+Three entries put the flaw inside the security product itself. A sandbox appliance exists so hostile content detonates somewhere other than production; an endpoint-protection console exists to control the fleet; a migration tool exists to move firewall configurations. Each is carried as tooling rather than as an asset, which is how each stays outside the inventory that would have clocked it — and the migration tool holds, in its own record, the usernames, cleartext passwords, configurations and device API keys of every firewall it has handled. The requirement puts these on the tier their contents justify rather than the tier their role suggests, and states what the upgrade does not undo: credentials that passed through the tool stay valid until they are re-issued on the devices themselves.
+
+Where an exploit's precondition is administrative access, the administrator population is the attack surface. The endpoint-protection entry needs console access before its uninstaller module can be driven into executing commands — so the requirement raises those accounts above ordinary application administrators, reachable through a privileged-access path rather than from any workstation on the corporate segment. Recording the flaw as needing a patch and stopping there leaves the prerequisite untouched.
+
+A second-order injection is not visible at the point it is submitted. The sandbox appliance stores a value from one feature and executes it as an operating-system command later, so a check that validates input on submission sees nothing wrong. The requirement is that the configuration-accepting endpoint neutralises the value before it can reach a command sink, and the distinguishing test exercises the stored path rather than the submission path.
+
+## 0.19.21 — 2026-08-11
+
+Another 39 CVEs report the controls they require, taking coverage to 953 of 1025. The set includes Jenkins, PAN-OS, Ivanti EPMM and the Cloud Services Appliance, Juniper's J-Web, Veeam Cloud Connect, Veritas Backup Exec, SolarWinds Web Help Desk, Apache OFBiz, Adobe Acrobat, and IP cameras from Reolink and NUUO.
+
+A patch that has been superseded is not a patch. The Cobalt Strike teamserver entry records that the first fix was incomplete, so a server upgraded off the vulnerable line — and even one upgraded to that first fix — can still be exploitable. The requirement refuses to close on "upgraded", and names the running version against the release that carries the complete fix, because a remediation record keyed to the first advisory reads as done while the flaw is reachable.
+
+Where the vulnerable component is unnamed, the inventory gap is the finding. One entry describes a flaw in an unspecified third-party component packaged inside a vendor's product — so the asset record says the product name and stops, and the component that actually carried the code execution was never tracked, scanned or held to a patch SLA by anyone. The requirement is that component inventory reach the depth at which the vulnerability actually sits, and the entry is explicit that the exploitation preceded any vendor fix: no remediation clock has force in a window where no fix exists, and pretending otherwise is how that window gets recorded as compliant.
+
+Two release tracks moving independently are two populations. The Jenkins entry names an affected weekly-line build and an affected long-term-support build, so an estate that upgrades one line and leaves a controller on the other has not finished — completion is counted per controller, not per track. The entry also separates what the upgrade does from what it cannot: the primitive is file disclosure, an unauthenticated caller obtains at least the first lines of any file on the controller, and the upgrade closes the read without unreading what was already taken.
+
 ## 0.19.20 — 2026-08-11
 
 Another 38 CVEs report the controls they require, taking coverage to 914 of 1025. The set includes Ivanti Connect Secure and EPMM, VMware ESXi, Exchange, SharePoint, Adobe ColdFusion and Acrobat, Juniper's J-Web interface, Zimbra, Roundcube, libwebp, the Linux netfilter entries, and Outlook's credential-leak defect.

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-11T16:42:47.287Z",
+  "generated_at": "2026-08-11T19:32:39.070Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "fa1f1accfae4a723ac46ab5f9b7d5310b98fa5cca7f6d8a1ffd105731b274b5c",
+    "manifest.json": "8a272417326889968145ebc4e93c57b0db3ecaa44186188769cda934e6369763",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "e6b9bae2be71e9b73848c1c2ca7175ac4ab0c8e153565f3c0fda3824e668c3a1",
-    "data/cve-catalog.json": "13cf279a8ea22fdcc2c1485689a4dbea2dadfa65171bd7a3df1950e998d81b23",
+    "data/cve-catalog.json": "3c1089b065f070984c997a601a6abd541706dbf50b3901f2ae32d0fd4542e0c2",
     "data/cwe-catalog.json": "7b2223f0773d2f033d72fdcbf00cba9cdfdc2dff6bfb1366c9b30144396945f6",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "b5335059c25d0ab4e77a8b88dc7c3eb3445be4e9ef8bcd51ebddd8a9511d1d64",
+    "data/zeroday-lessons.json": "a4f86106ba3b5a75646a923ce2fc3f09bdc17aeff8357e8513a1052c5168014e",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",

package/data/cve-catalog.json

@@ -30757,12 +30757,12 @@
     ],
     "atlas_refs": [],
     "framework_control_gaps": {
-      "NIST-800-53-SI-2": "Patch alone (4.13.8 / 5.5.8) doesn't remediate an already-compromised security key from before the update — rotation is a separate required action the patch cannot force.",
-      "NIS2-Art21-vulnerability-management": "Vulnerability management processes typically close once a patch is applied; this flaw needs an additional secret-rotation step that standard patch-tracking doesn't capture.",
+      "NIST-800-53-SI-2": "Flaw remediation closes on the fixed release (4.13.8 / 5.5.8), which is what remediates this CVE — but the exploit precondition is a security key compromised before the update, and SI-2 has no trigger for rotating a secret whose exposure the vulnerability reveals. The upgrade closes the injection path and leaves a key the attacker may hold still in service for everything else it protects.",
+      "NIS2-Art21-vulnerability-management": "Vulnerability management records a CVE as open or closed, with no state for the interim measure the vendor names for installs that cannot update promptly — rotating the security key. A site running that measure is neither exposed as reported nor remediated, and standard patch-tracking cannot express the difference or carry the dated upgrade item it still owes.",
       "UK-CAF-B4": "Secure-by-default secrets handling should prevent the security key from being derivable/leakable via any other vector in the first place, since this CVE is only exploitable after that precondition is met.",
       "GDPR-Art32": "Security-of-processing is directly undermined when a leaked application security key enables remote code execution against a system that may process personal data.",
-      "AU-Essential-8-Patch": "Patch-application guidance doesn't address the compensating action (key rotation) required when the precondition for exploitation is a secret compromised before the patch existed.",
-      "ISO-27001-2022-A.8.24": "A.8.24 use-of-cryptography and key-management is the operative control here: the RCE is only reachable when the Craft security key is already compromised, so patching does not remediate it — key-management lifecycle (rotation on suspected exposure, non-derivable storage) is required, which technical-vulnerability tracking does not trigger."
+      "AU-Essential-8-Patch": "Patch-application guidance measures whether the fixed release landed inside the window. It has no expression for the vendor-provided interim mitigation available to installs that cannot meet it, so a site that rotated its key while remaining below the fixed release is reported identically to one that did nothing.",
+      "ISO-27001-2022-A.8.24": "A.8.24 use-of-cryptography and key-management governs both ends of this CVE that patching does not: the precondition, a security key derivable or leakable through some other vector, and the rotation a key suspected of exposure warrants once the fixed release is in place. The upgrade remediates the code-injection path; it does not un-disclose the key, and technical-vulnerability tracking never triggers that rotation."
     },
     "patch_available": true,
     "patch_required_reboot": false,