@zerothreatai/vulnerability-registry 1.0.0 → 2.0.0

package/src/categories/configuration.ts

@@ -33,10 +33,10 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         remediation: 'Implement Content-Security-Policy header with strict directives. Start with default-src self and progressively add required sources. Use nonce-based CSP for inline scripts.',
     },
 
-    [VulnerabilityCode.HEADER_MISSING_HSTS]: {
-        id: 70,
-        code: VulnerabilityCode.HEADER_MISSING_HSTS,
-        title: 'Missing Security Header - Strict-Transport-Security',
+    [VulnerabilityCode.HEADER_MISSING_HSTS]: {
+        id: 70,
+        code: VulnerabilityCode.HEADER_MISSING_HSTS,
+        title: 'Missing Security Header - Strict-Transport-Security',
         description: 'The application does not implement HSTS (HTTP Strict Transport Security) header, leaving users vulnerable to SSL stripping attacks and man-in-the-middle downgrades from HTTPS to HTTP connections on initial visits or after cookie expiration.',
         severity: 'medium',
         category: 'configuration',
@@ -52,8 +52,96 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Add Strict-Transport-Security header with max-age of at least 31536000 (1 year). Include includeSubDomains directive. Consider HSTS preloading for maximum protection.',
-    },
+        remediation: 'Add Strict-Transport-Security header with max-age of at least 31536000 (1 year). Include includeSubDomains directive. Consider HSTS preloading for maximum protection.',
+    },
+
+    [VulnerabilityCode.HEADER_HSTS_BAD_MAX_AGE]: {
+        id: 1011,
+        code: VulnerabilityCode.HEADER_HSTS_BAD_MAX_AGE,
+        title: 'HSTS Misconfiguration - Invalid Max-Age',
+        description: 'The Strict-Transport-Security header uses an invalid or malformed max-age value, preventing reliable HTTPS enforcement.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Set a valid numeric max-age on Strict-Transport-Security (at least 31536000).',
+    },
+
+    [VulnerabilityCode.HEADER_HSTS_SHORT_MAX_AGE]: {
+        id: 1012,
+        code: VulnerabilityCode.HEADER_HSTS_SHORT_MAX_AGE,
+        title: 'HSTS Misconfiguration - Max-Age Too Short',
+        description: 'The Strict-Transport-Security header uses a short max-age value that weakens HTTPS enforcement and allows downgrade risk to return quickly.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Increase max-age to at least 31536000 (1 year) to provide durable HTTPS enforcement.',
+    },
+
+    [VulnerabilityCode.HEADER_HSTS_NO_INCLUDESUBDOMAINS]: {
+        id: 1013,
+        code: VulnerabilityCode.HEADER_HSTS_NO_INCLUDESUBDOMAINS,
+        title: 'HSTS Misconfiguration - Missing includeSubDomains',
+        description: 'The Strict-Transport-Security header is missing includeSubDomains, leaving subdomains unprotected from downgrade and stripping attacks.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Add includeSubDomains to the HSTS header to protect all subdomains.',
+    },
+
+    [VulnerabilityCode.HEADER_HSTS_PRELOAD_LOW_MAX_AGE]: {
+        id: 1018,
+        code: VulnerabilityCode.HEADER_HSTS_PRELOAD_LOW_MAX_AGE,
+        title: 'HSTS Preload Requirements Not Met',
+        description: 'The HSTS header indicates preload intent but does not meet preload requirements, such as a sufficiently long max-age or includeSubDomains, reducing preload effectiveness.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Ensure HSTS max-age is at least 31536000, include includeSubDomains, and add preload before submitting to the preload list.',
+    },
 
     [VulnerabilityCode.HEADER_MISSING_XFRAME]: {
         id: 71,
@@ -77,11 +165,11 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         remediation: 'Set X-Frame-Options header to DENY or SAMEORIGIN. Use Content-Security-Policy frame-ancestors directive for more granular control. Both headers can be used together for compatibility.',
     },
 
-    [VulnerabilityCode.HEADER_WEAK_CSP]: {
-        id: 72,
-        code: VulnerabilityCode.HEADER_WEAK_CSP,
-        title: 'Weak Content-Security-Policy Configuration',
-        description: 'The Content-Security-Policy header contains unsafe directives like unsafe-inline, unsafe-eval, or overly permissive source allowlists that significantly reduce its effectiveness as an XSS mitigation and may create false sense of security.',
+    [VulnerabilityCode.HEADER_WEAK_CSP]: {
+        id: 72,
+        code: VulnerabilityCode.HEADER_WEAK_CSP,
+        title: 'Weak Content-Security-Policy Configuration',
+        description: 'The Content-Security-Policy header contains unsafe directives like unsafe-inline, unsafe-eval, or overly permissive source allowlists that significantly reduce its effectiveness as an XSS mitigation and may create false sense of security.',
         severity: 'medium',
         category: 'configuration',
         scanner: 'security-headers',
@@ -96,13 +184,189 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Remove unsafe-inline and unsafe-eval directives. Use nonce-based or hash-based CSP for inline scripts. Restrict source allowlists to specific trusted domains rather than wildcards.',
-    },
+        remediation: 'Remove unsafe-inline and unsafe-eval directives. Use nonce-based or hash-based CSP for inline scripts. Restrict source allowlists to specific trusted domains rather than wildcards.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_REPORT_ONLY]: {
+        id: 1001,
+        code: VulnerabilityCode.HEADER_CSP_REPORT_ONLY,
+        title: 'Content-Security-Policy Report-Only Enabled',
+        description: 'The Content-Security-Policy header is deployed in report-only mode, which does not enforce protections and allows unsafe content to execute while only logging violations.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Switch to enforcing Content-Security-Policy once violations are reviewed. Use report-only during rollout, then enforce with strict directives.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_WEAK_DIRECTIVES]: {
+        id: 1002,
+        code: VulnerabilityCode.HEADER_CSP_WEAK_DIRECTIVES,
+        title: 'Content-Security-Policy Contains Unsafe Directives',
+        description: 'The Content-Security-Policy header includes unsafe directives such as unsafe-inline or unsafe-eval that reduce XSS protection and allow risky script execution paths.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove unsafe-inline and unsafe-eval directives. Replace inline scripts with nonces or hashes and restrict sources to trusted domains.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_DATA_URI_SCRIPT]: {
+        id: 1003,
+        code: VulnerabilityCode.HEADER_CSP_DATA_URI_SCRIPT,
+        title: 'Content-Security-Policy Allows data: in script-src',
+        description: 'The CSP allows data: URIs for script execution, which can enable script injection through crafted data URLs and weaken XSS protections.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove data: from script-src. Use nonce or hash-based CSP for any required inline scripts.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_BLOB_URI_SCRIPT]: {
+        id: 1004,
+        code: VulnerabilityCode.HEADER_CSP_BLOB_URI_SCRIPT,
+        title: 'Content-Security-Policy Allows blob: in script-src',
+        description: 'The CSP allows blob: URIs for script execution, which can be abused to load attacker-controlled scripts in some contexts and weaken XSS mitigations.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove blob: from script-src unless strictly required. Use a narrower allowlist or nonces for trusted scripts.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_WILDCARD_DEFAULT]: {
+        id: 1005,
+        code: VulnerabilityCode.HEADER_CSP_WILDCARD_DEFAULT,
+        title: 'Content-Security-Policy default-src Uses Wildcard',
+        description: 'The CSP default-src directive allows all origins, which effectively disables the protection and allows untrusted content to load.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Replace wildcard default-src with explicit trusted origins and tighten resource-specific directives.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_NO_BASE_URI]: {
+        id: 1006,
+        code: VulnerabilityCode.HEADER_CSP_NO_BASE_URI,
+        title: 'Content-Security-Policy Missing base-uri Directive',
+        description: 'The CSP does not include a base-uri directive, allowing the base URL to be set by injected markup and enabling abuse of relative URL resolution.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Add base-uri \'self\' (or a strict allowlist) to CSP to prevent base tag abuse.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_NO_OBJECT_SRC]: {
+        id: 1007,
+        code: VulnerabilityCode.HEADER_CSP_NO_OBJECT_SRC,
+        title: 'Content-Security-Policy Missing object-src Directive',
+        description: 'The CSP does not include an object-src directive, allowing embedded objects to load from arbitrary origins and weakening defense-in-depth against plugin-based risks.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Add object-src \'none\' (or a strict allowlist) to CSP to prevent plugin content loading.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_NO_FRAME_ANCESTORS]: {
+        id: 1008,
+        code: VulnerabilityCode.HEADER_CSP_NO_FRAME_ANCESTORS,
+        title: 'Content-Security-Policy Missing frame-ancestors Directive',
+        description: 'The CSP does not include a frame-ancestors directive, leaving pages potentially frameable and vulnerable to clickjacking attacks.',
+        severity: 'medium',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 4.7,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-1021', name: 'Improper Restriction of Rendered UI Layers', url: 'https://cwe.mitre.org/data/definitions/1021.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Add frame-ancestors \'none\' or a strict allowlist to CSP to prevent clickjacking.',
+    },
 
-    [VulnerabilityCode.HEADER_CORS_MISCONFIGURED]: {
-        id: 73,
-        code: VulnerabilityCode.HEADER_CORS_MISCONFIGURED,
-        title: 'CORS Misconfiguration',
+    [VulnerabilityCode.HEADER_CORS_MISCONFIGURED]: {
+        id: 73,
+        code: VulnerabilityCode.HEADER_CORS_MISCONFIGURED,
+        title: 'CORS Misconfiguration',
         description: 'Cross-Origin Resource Sharing is misconfigured with overly permissive Access-Control-Allow-Origin headers including wildcard (*) with credentials, or dynamic reflection of Origin header without proper validation, enabling cross-origin data theft.',
         severity: 'high',
         category: 'configuration',
@@ -118,8 +382,96 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Implement strict Origin validation with allowlist of trusted domains. Never reflect Origin header without validation. Do not use wildcard with Access-Control-Allow-Credentials.',
-    },
+        remediation: 'Implement strict Origin validation with allowlist of trusted domains. Never reflect Origin header without validation. Do not use wildcard with Access-Control-Allow-Credentials.',
+    },
+
+    [VulnerabilityCode.HEADER_CORS_STAR_WITH_CREDENTIALS]: {
+        id: 1014,
+        code: VulnerabilityCode.HEADER_CORS_STAR_WITH_CREDENTIALS,
+        title: 'CORS Wildcard With Credentials',
+        description: 'Access-Control-Allow-Origin is set to * while Access-Control-Allow-Credentials is enabled, which browsers block but signals a dangerous CORS policy that can be misapplied in some environments.',
+        severity: 'high',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 7.5,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'HIGH',
+        },
+        cwe: [
+            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Never use wildcard origins with credentials. Replace * with an explicit allowlist and set Vary: Origin.',
+    },
+
+    [VulnerabilityCode.HEADER_CORS_ORIGIN_REFLECT_NO_VARY]: {
+        id: 1015,
+        code: VulnerabilityCode.HEADER_CORS_ORIGIN_REFLECT_NO_VARY,
+        title: 'CORS Origin Reflection Without Vary',
+        description: 'The Origin header is reflected in Access-Control-Allow-Origin without Vary: Origin, which can lead to cache poisoning and unintended cross-origin access.',
+        severity: 'high',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 7.5,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'HIGH',
+        },
+        cwe: [
+            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Validate origins against an allowlist and always include Vary: Origin when dynamically setting Access-Control-Allow-Origin.',
+    },
+
+    [VulnerabilityCode.HEADER_CORS_NULL_ORIGIN]: {
+        id: 1016,
+        code: VulnerabilityCode.HEADER_CORS_NULL_ORIGIN,
+        title: 'CORS Allows Null Origin',
+        description: 'Access-Control-Allow-Origin allows the null origin, enabling requests from opaque origins such as sandboxed iframes and file URLs that can be abused to access sensitive data.',
+        severity: 'high',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 7.5,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'HIGH',
+        },
+        cwe: [
+            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove null from allowed origins. Restrict CORS to explicit trusted domains only.',
+    },
+
+    [VulnerabilityCode.HEADER_CORS_WILDCARD_SUBDOMAIN]: {
+        id: 1017,
+        code: VulnerabilityCode.HEADER_CORS_WILDCARD_SUBDOMAIN,
+        title: 'CORS Allows Wildcard Subdomains',
+        description: 'CORS policies allow wildcard subdomains that can be abused if any subdomain is compromised or can be controlled by untrusted parties.',
+        severity: 'high',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 7.5,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'HIGH',
+        },
+        cwe: [
+            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Replace wildcard subdomains with a strict allowlist of trusted origins.',
+    },
 
     // ========================================
     // DIRECTORY BROWSING
@@ -350,10 +702,10 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         remediation: 'Apply consistent frame protection across all pages. Use DENY or SAMEORIGIN rather than ALLOW-FROM. Audit all endpoints for missing protection. Use CSP frame-ancestors instead of X-Frame-Options.',
     },
 
-    [VulnerabilityCode.HEADER_MISSING_XCONTENT_TYPE]: {
-        id: 84,
-        code: VulnerabilityCode.HEADER_MISSING_XCONTENT_TYPE,
-        title: 'Missing Security Header - X-Content-Type-Options',
+    [VulnerabilityCode.HEADER_MISSING_XCONTENT_TYPE]: {
+        id: 84,
+        code: VulnerabilityCode.HEADER_MISSING_XCONTENT_TYPE,
+        title: 'Missing Security Header - X-Content-Type-Options',
         description: 'The application does not set X-Content-Type-Options: nosniff header, allowing browsers to perform MIME-type sniffing that can lead to XSS attacks when user-uploaded content is served with incorrect Content-Type and browsers execute it as script.',
         severity: 'low',
         category: 'configuration',
@@ -369,13 +721,35 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Add X-Content-Type-Options: nosniff header to all responses. Ensure correct Content-Type headers are set for all resources. Validate file types before serving user uploads.',
-    },
+        remediation: 'Add X-Content-Type-Options: nosniff header to all responses. Ensure correct Content-Type headers are set for all resources. Validate file types before serving user uploads.',
+    },
+
+    [VulnerabilityCode.HEADER_XCONTENT_TYPE_INVALID]: {
+        id: 1009,
+        code: VulnerabilityCode.HEADER_XCONTENT_TYPE_INVALID,
+        title: 'Invalid Security Header - X-Content-Type-Options',
+        description: 'The X-Content-Type-Options header is present but misconfigured (not set to nosniff), which can allow MIME sniffing and reduce protection against content-type confusion.',
+        severity: 'low',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Set X-Content-Type-Options to nosniff on all responses to prevent MIME sniffing.',
+    },
 
-    [VulnerabilityCode.HEADER_MISSING_REFERRER_POLICY]: {
-        id: 85,
-        code: VulnerabilityCode.HEADER_MISSING_REFERRER_POLICY,
-        title: 'Missing Security Header - Referrer-Policy',
+    [VulnerabilityCode.HEADER_MISSING_REFERRER_POLICY]: {
+        id: 85,
+        code: VulnerabilityCode.HEADER_MISSING_REFERRER_POLICY,
+        title: 'Missing Security Header - Referrer-Policy',
         description: 'The application does not implement Referrer-Policy header, potentially leaking sensitive URL information including session tokens, user IDs, or query parameters to external sites when users click links or resources are loaded from third-party domains.',
         severity: 'low',
         category: 'configuration',
@@ -391,8 +765,30 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Implement Referrer-Policy header with strict-origin-when-cross-origin or no-referrer policy. Avoid passing sensitive data in URLs. Use POST requests for sensitive operations.',
-    },
+        remediation: 'Implement Referrer-Policy header with strict-origin-when-cross-origin or no-referrer policy. Avoid passing sensitive data in URLs. Use POST requests for sensitive operations.',
+    },
+
+    [VulnerabilityCode.HEADER_REFERRER_POLICY_UNSAFE]: {
+        id: 1010,
+        code: VulnerabilityCode.HEADER_REFERRER_POLICY_UNSAFE,
+        title: 'Unsafe Referrer-Policy Configuration',
+        description: 'The Referrer-Policy header is set to a permissive value that can leak full URLs and sensitive query parameters to external origins.',
+        severity: 'low',
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Information Exposure', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Use strict-origin-when-cross-origin or no-referrer to minimize leakage of sensitive URL data.',
+    },
 
     [VulnerabilityCode.HEADER_MISSING_PERMISSIONS_POLICY]: {
         id: 86,

package/src/error-codes.ts

@@ -128,18 +128,36 @@ export enum VulnerabilityCode {
     HEADER_MISSING_HSTS = 'HEADER_MISSING_HSTS',
     HEADER_MISSING_XFRAME = 'HEADER_MISSING_XFRAME',
     HEADER_MISSING_XCONTENT_TYPE = 'HEADER_MISSING_XCONTENT_TYPE',
-    HEADER_MISSING_XSS_PROTECTION = 'HEADER_MISSING_XSS_PROTECTION',
-    HEADER_MISSING_REFERRER_POLICY = 'HEADER_MISSING_REFERRER_POLICY',
-    HEADER_MISSING_PERMISSIONS_POLICY = 'HEADER_MISSING_PERMISSIONS_POLICY',
-    HEADER_WEAK_CSP = 'HEADER_WEAK_CSP',
-    HEADER_CORS_MISCONFIGURED = 'HEADER_CORS_MISCONFIGURED',
-    HEADER_COEP_WITHOUT_COOP = 'HEADER_COEP_WITHOUT_COOP',
-    HEADER_CORP_UNUSUAL = 'HEADER_CORP_UNUSUAL',
-    HEADER_EXPECT_CT_PRESENT = 'HEADER_EXPECT_CT_PRESENT',
-    HEADER_SERVER_HEADER_PRESENT = 'HEADER_SERVER_HEADER_PRESENT',
-    HEADER_X_POWERED_BY_PRESENT = 'HEADER_X_POWERED_BY_PRESENT',
-    HEADER_X_XSS_PROTECTION_ENABLED = 'HEADER_X_XSS_PROTECTION_ENABLED',
-    COOKIE_SAMESITE_NONE_WITHOUT_SECURE = 'COOKIE_SAMESITE_NONE_WITHOUT_SECURE',
+    HEADER_MISSING_XSS_PROTECTION = 'HEADER_MISSING_XSS_PROTECTION',
+    HEADER_MISSING_REFERRER_POLICY = 'HEADER_MISSING_REFERRER_POLICY',
+    HEADER_MISSING_PERMISSIONS_POLICY = 'HEADER_MISSING_PERMISSIONS_POLICY',
+    HEADER_WEAK_CSP = 'HEADER_WEAK_CSP',
+    HEADER_CSP_REPORT_ONLY = 'HEADER_CSP_REPORT_ONLY',
+    HEADER_CSP_WEAK_DIRECTIVES = 'HEADER_CSP_WEAK_DIRECTIVES',
+    HEADER_CSP_DATA_URI_SCRIPT = 'HEADER_CSP_DATA_URI_SCRIPT',
+    HEADER_CSP_BLOB_URI_SCRIPT = 'HEADER_CSP_BLOB_URI_SCRIPT',
+    HEADER_CSP_WILDCARD_DEFAULT = 'HEADER_CSP_WILDCARD_DEFAULT',
+    HEADER_CSP_NO_BASE_URI = 'HEADER_CSP_NO_BASE_URI',
+    HEADER_CSP_NO_OBJECT_SRC = 'HEADER_CSP_NO_OBJECT_SRC',
+    HEADER_CSP_NO_FRAME_ANCESTORS = 'HEADER_CSP_NO_FRAME_ANCESTORS',
+    HEADER_CORS_MISCONFIGURED = 'HEADER_CORS_MISCONFIGURED',
+    HEADER_CORS_STAR_WITH_CREDENTIALS = 'HEADER_CORS_STAR_WITH_CREDENTIALS',
+    HEADER_CORS_ORIGIN_REFLECT_NO_VARY = 'HEADER_CORS_ORIGIN_REFLECT_NO_VARY',
+    HEADER_CORS_NULL_ORIGIN = 'HEADER_CORS_NULL_ORIGIN',
+    HEADER_CORS_WILDCARD_SUBDOMAIN = 'HEADER_CORS_WILDCARD_SUBDOMAIN',
+    HEADER_COEP_WITHOUT_COOP = 'HEADER_COEP_WITHOUT_COOP',
+    HEADER_CORP_UNUSUAL = 'HEADER_CORP_UNUSUAL',
+    HEADER_EXPECT_CT_PRESENT = 'HEADER_EXPECT_CT_PRESENT',
+    HEADER_SERVER_HEADER_PRESENT = 'HEADER_SERVER_HEADER_PRESENT',
+    HEADER_X_POWERED_BY_PRESENT = 'HEADER_X_POWERED_BY_PRESENT',
+    HEADER_X_XSS_PROTECTION_ENABLED = 'HEADER_X_XSS_PROTECTION_ENABLED',
+    HEADER_XCONTENT_TYPE_INVALID = 'HEADER_XCONTENT_TYPE_INVALID',
+    HEADER_REFERRER_POLICY_UNSAFE = 'HEADER_REFERRER_POLICY_UNSAFE',
+    HEADER_HSTS_BAD_MAX_AGE = 'HEADER_HSTS_BAD_MAX_AGE',
+    HEADER_HSTS_SHORT_MAX_AGE = 'HEADER_HSTS_SHORT_MAX_AGE',
+    HEADER_HSTS_NO_INCLUDESUBDOMAINS = 'HEADER_HSTS_NO_INCLUDESUBDOMAINS',
+    HEADER_HSTS_PRELOAD_LOW_MAX_AGE = 'HEADER_HSTS_PRELOAD_LOW_MAX_AGE',
+    COOKIE_SAMESITE_NONE_WITHOUT_SECURE = 'COOKIE_SAMESITE_NONE_WITHOUT_SECURE',
     COOKIE_SESSION_MISSING_SECURE = 'COOKIE_SESSION_MISSING_SECURE',
     COOKIE_MISSING_SECURE = 'COOKIE_MISSING_SECURE',
     COOKIE_SESSION_MISSING_HTTPONLY = 'COOKIE_SESSION_MISSING_HTTPONLY',