@zerothreatai/vulnerability-registry 3.0.0 → 4.0.0

package/dist/categories/configuration.js

@@ -14,6 +14,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Missing Security Header - Content-Security-Policy',
         description: 'The application does not implement Content-Security-Policy header, leaving it vulnerable to cross-site scripting attacks that could be mitigated by restricting the sources from which scripts, styles, and other resources can be loaded into the page.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -35,6 +36,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Missing Security Header - Strict-Transport-Security',
         description: 'The application does not implement HSTS (HTTP Strict Transport Security) header, leaving users vulnerable to SSL stripping attacks and man-in-the-middle downgrades from HTTPS to HTTP connections on initial visits or after cookie expiration.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -56,6 +58,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'HSTS Misconfiguration - Invalid Max-Age',
         description: 'The Strict-Transport-Security header uses an invalid or malformed max-age value, preventing reliable HTTPS enforcement.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -77,6 +80,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'HSTS Misconfiguration - Max-Age Too Short',
         description: 'The Strict-Transport-Security header uses a short max-age value that weakens HTTPS enforcement and allows downgrade risk to return quickly.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -98,6 +102,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'HSTS Misconfiguration - Missing includeSubDomains',
         description: 'The Strict-Transport-Security header is missing includeSubDomains, leaving subdomains unprotected from downgrade and stripping attacks.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -119,6 +124,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'HSTS Preload Requirements Not Met',
         description: 'The HSTS header indicates preload intent but does not meet preload requirements, such as a sufficiently long max-age or includeSubDomains, reducing preload effectiveness.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -140,6 +146,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Missing Security Header - X-Frame-Options',
         description: 'The application does not set X-Frame-Options header, making it vulnerable to clickjacking attacks where malicious websites can embed the application in invisible iframes and trick users into performing unintended actions through deceptive UI overlays.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -161,6 +168,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Weak Content-Security-Policy Configuration',
         description: 'The Content-Security-Policy header contains unsafe directives like unsafe-inline, unsafe-eval, or overly permissive source allowlists that significantly reduce its effectiveness as an XSS mitigation and may create false sense of security.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -182,6 +190,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Content-Security-Policy Report-Only Enabled',
         description: 'The Content-Security-Policy header is deployed in report-only mode, which does not enforce protections and allows unsafe content to execute while only logging violations.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -203,6 +212,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Content-Security-Policy Contains Unsafe Directives',
         description: 'The Content-Security-Policy header includes unsafe directives such as unsafe-inline or unsafe-eval that reduce XSS protection and allow risky script execution paths.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -224,6 +234,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Content-Security-Policy Allows data: in script-src',
         description: 'The CSP allows data: URIs for script execution, which can enable script injection through crafted data URLs and weaken XSS protections.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -245,6 +256,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Content-Security-Policy Allows blob: in script-src',
         description: 'The CSP allows blob: URIs for script execution, which can be abused to load attacker-controlled scripts in some contexts and weaken XSS mitigations.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -266,6 +278,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Content-Security-Policy default-src Uses Wildcard',
         description: 'The CSP default-src directive allows all origins, which effectively disables the protection and allows untrusted content to load.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -287,6 +300,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Content-Security-Policy Missing base-uri Directive',
         description: 'The CSP does not include a base-uri directive, allowing the base URL to be set by injected markup and enabling abuse of relative URL resolution.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -308,6 +322,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Content-Security-Policy Missing object-src Directive',
         description: 'The CSP does not include an object-src directive, allowing embedded objects to load from arbitrary origins and weakening defense-in-depth against plugin-based risks.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -329,6 +344,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Content-Security-Policy Missing frame-ancestors Directive',
         description: 'The CSP does not include a frame-ancestors directive, leaving pages potentially frameable and vulnerable to clickjacking attacks.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -350,6 +366,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'CORS Misconfiguration',
         description: 'Cross-Origin Resource Sharing is misconfigured with overly permissive Access-Control-Allow-Origin headers including wildcard (*) with credentials, or dynamic reflection of Origin header without proper validation, enabling cross-origin data theft.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -371,6 +388,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'CORS Wildcard With Credentials',
         description: 'Access-Control-Allow-Origin is set to * while Access-Control-Allow-Credentials is enabled, which browsers block but signals a dangerous CORS policy that can be misapplied in some environments.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -392,6 +410,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'CORS Origin Reflection Without Vary',
         description: 'The Origin header is reflected in Access-Control-Allow-Origin without Vary: Origin, which can lead to cache poisoning and unintended cross-origin access.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -413,6 +432,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'CORS Allows Null Origin',
         description: 'Access-Control-Allow-Origin allows the null origin, enabling requests from opaque origins such as sandboxed iframes and file URLs that can be abused to access sensitive data.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -434,6 +454,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'CORS Allows Wildcard Subdomains',
         description: 'CORS policies allow wildcard subdomains that can be abused if any subdomain is compromised or can be controlled by untrusted parties.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -452,12 +473,454 @@ export const CONFIG_VULNERABILITIES = {
     // ========================================
     // DIRECTORY BROWSING
     // ========================================
+    [VulnerabilityCode.DIRBROWSE_GENERIC]: {
+        id: 2000,
+        code: VulnerabilityCode.DIRBROWSE_GENERIC,
+        title: 'Directory Listing Enabled (Generic)',
+        description: 'Directory listing is enabled and exposes directory contents to unauthenticated visitors, revealing application structure and file names.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listing in the web server configuration and ensure directories have index files.',
+    },
+    [VulnerabilityCode.DIRBROWSE_GENERIC_SENSITIVE]: {
+        id: 2001,
+        code: VulnerabilityCode.DIRBROWSE_GENERIC_SENSITIVE,
+        title: 'Directory Listing Exposing Sensitive Content (Generic)',
+        description: 'Directory listing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listing and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_APACHE]: {
+        id: 2002,
+        code: VulnerabilityCode.DIRBROWSE_APACHE,
+        title: 'Apache Autoindex Enabled',
+        description: 'Apache autoindex is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex in Apache (Options -Indexes) and add index files.',
+    },
+    [VulnerabilityCode.DIRBROWSE_APACHE_SENSITIVE]: {
+        id: 2003,
+        code: VulnerabilityCode.DIRBROWSE_APACHE_SENSITIVE,
+        title: 'Apache Autoindex Exposing Sensitive Content',
+        description: 'Apache autoindex is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_NGINX]: {
+        id: 2004,
+        code: VulnerabilityCode.DIRBROWSE_NGINX,
+        title: 'Nginx Autoindex Enabled',
+        description: 'Nginx autoindex is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex in nginx (autoindex off) and add index files.',
+    },
+    [VulnerabilityCode.DIRBROWSE_NGINX_SENSITIVE]: {
+        id: 2005,
+        code: VulnerabilityCode.DIRBROWSE_NGINX_SENSITIVE,
+        title: 'Nginx Autoindex Exposing Sensitive Content',
+        description: 'Nginx autoindex is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_IIS]: {
+        id: 2006,
+        code: VulnerabilityCode.DIRBROWSE_IIS,
+        title: 'IIS Directory Browsing Enabled',
+        description: 'IIS directory browsing is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory browsing in IIS and ensure directories have index files.',
+    },
+    [VulnerabilityCode.DIRBROWSE_IIS_SENSITIVE]: {
+        id: 2007,
+        code: VulnerabilityCode.DIRBROWSE_IIS_SENSITIVE,
+        title: 'IIS Directory Browsing Exposing Sensitive Content',
+        description: 'IIS directory browsing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory browsing and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_TOMCAT]: {
+        id: 2008,
+        code: VulnerabilityCode.DIRBROWSE_TOMCAT,
+        title: 'Tomcat Directory Listing Enabled',
+        description: 'Tomcat directory listing is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listings in Tomcat and add index files to web directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_TOMCAT_SENSITIVE]: {
+        id: 2009,
+        code: VulnerabilityCode.DIRBROWSE_TOMCAT_SENSITIVE,
+        title: 'Tomcat Directory Listing Exposing Sensitive Content',
+        description: 'Tomcat directory listing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listings and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_CADDY]: {
+        id: 2010,
+        code: VulnerabilityCode.DIRBROWSE_CADDY,
+        title: 'Caddy File Server Browsing Enabled',
+        description: 'Caddy file server browsing is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable file_server browse in Caddy or restrict browsing to trusted users.',
+    },
+    [VulnerabilityCode.DIRBROWSE_CADDY_SENSITIVE]: {
+        id: 2011,
+        code: VulnerabilityCode.DIRBROWSE_CADDY_SENSITIVE,
+        title: 'Caddy File Server Browsing Exposing Sensitive Content',
+        description: 'Caddy file server browsing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable file_server browse and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_WEBDAV]: {
+        id: 2012,
+        code: VulnerabilityCode.DIRBROWSE_WEBDAV,
+        title: 'WebDAV Directory Listing Enabled',
+        description: 'WebDAV responses expose directory contents, allowing unauthenticated browsing of files and folders.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable unauthenticated WebDAV browsing or restrict access with authentication and authorization.',
+    },
+    [VulnerabilityCode.DIRBROWSE_WEBDAV_SENSITIVE]: {
+        id: 2013,
+        code: VulnerabilityCode.DIRBROWSE_WEBDAV_SENSITIVE,
+        title: 'WebDAV Directory Listing Exposing Sensitive Content',
+        description: 'WebDAV responses expose directories containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable unauthenticated WebDAV browsing and remove sensitive files from exposed directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_S3]: {
+        id: 2014,
+        code: VulnerabilityCode.DIRBROWSE_S3,
+        title: 'S3 Bucket Listing Enabled',
+        description: 'An S3 bucket listing is exposed, allowing unauthenticated enumeration of object keys.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable public ListBucket access and restrict bucket policies to authorized principals.',
+    },
+    [VulnerabilityCode.DIRBROWSE_S3_SENSITIVE]: {
+        id: 2015,
+        code: VulnerabilityCode.DIRBROWSE_S3_SENSITIVE,
+        title: 'S3 Bucket Listing Exposing Sensitive Content',
+        description: 'An S3 bucket listing is exposed and includes sensitive objects such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove public ListBucket access and rotate any exposed credentials or secrets.',
+    },
+    [VulnerabilityCode.DIRBROWSE_GCS]: {
+        id: 2016,
+        code: VulnerabilityCode.DIRBROWSE_GCS,
+        title: 'GCS Bucket Listing Enabled',
+        description: 'A Google Cloud Storage bucket listing is exposed, allowing unauthenticated enumeration of object keys.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Restrict bucket IAM policies to authorized principals and disable anonymous listing.',
+    },
+    [VulnerabilityCode.DIRBROWSE_GCS_SENSITIVE]: {
+        id: 2017,
+        code: VulnerabilityCode.DIRBROWSE_GCS_SENSITIVE,
+        title: 'GCS Bucket Listing Exposing Sensitive Content',
+        description: 'A Google Cloud Storage bucket listing is exposed and includes sensitive objects such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove public listing access and rotate any exposed credentials or secrets.',
+    },
+    [VulnerabilityCode.DIRBROWSE_AZURE_BLOB]: {
+        id: 2018,
+        code: VulnerabilityCode.DIRBROWSE_AZURE_BLOB,
+        title: 'Azure Blob Container Listing Enabled',
+        description: 'An Azure Blob container listing is exposed, allowing unauthenticated enumeration of blob names.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable public container listing and restrict access via SAS tokens or RBAC.',
+    },
+    [VulnerabilityCode.DIRBROWSE_AZURE_BLOB_SENSITIVE]: {
+        id: 2019,
+        code: VulnerabilityCode.DIRBROWSE_AZURE_BLOB_SENSITIVE,
+        title: 'Azure Blob Container Listing Exposing Sensitive Content',
+        description: 'An Azure Blob container listing is exposed and includes sensitive blobs such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove public listing access and rotate any exposed credentials or secrets.',
+    },
+    // Legacy generic codes (keep for backward compatibility)
     [VulnerabilityCode.DIRBROWSE_ENABLED]: {
         id: 74,
         code: VulnerabilityCode.DIRBROWSE_ENABLED,
         title: 'Directory Listing Enabled',
         description: 'Web server directory listing is enabled, exposing the contents of directories to anyone who browses to them without an index file. This reveals application structure, backup files, configuration files, and potentially sensitive data to attackers.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'directory-browsing',
         cvss: {
@@ -479,6 +942,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Directory Listing Exposing Sensitive Content',
         description: 'Directory listing is enabled on a directory containing sensitive files like backups, configuration files, source code, or credentials. This elevates the risk significantly as attackers can directly access sensitive information without guessing filenames.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'directory-browsing',
         cvss: {
@@ -503,6 +967,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Clickjacking - Page Frameable',
         description: 'The application pages can be embedded in iframes on malicious websites, enabling clickjacking attacks where attackers overlay transparent frames over deceptive UI elements to trick users into clicking hidden buttons or links that perform unintended actions.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -527,6 +992,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Insecure Deserialization - Java',
         description: 'Critical Java deserialization vulnerability where untrusted serialized objects are processed, allowing attackers to achieve remote code execution through gadget chains in common libraries like Apache Commons Collections, Spring Framework, or other classpath dependencies.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -548,6 +1014,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Insecure Deserialization - PHP',
         description: 'Critical PHP deserialization vulnerability where unserialize() processes attacker-controlled data, enabling object injection attacks through magic methods like __wakeup(), __destruct(), or __toString() in application or framework classes for remote code execution.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -569,6 +1036,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Insecure Deserialization - Python',
         description: 'Critical Python deserialization vulnerability through pickle/cPickle processing of untrusted data, enabling remote code execution via __reduce__ method exploitation. Python pickle is inherently unsafe and should never process untrusted input.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -590,6 +1058,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Insecure Deserialization - .NET',
         description: 'Critical .NET deserialization vulnerability through BinaryFormatter, ObjectStateFormatter, LosFormatter, or other dangerous formatters processing untrusted data, enabling remote code execution through gadget chains in the .NET runtime or third-party libraries.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -611,6 +1080,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Insecure Deserialization - Ruby',
         description: 'Critical Ruby deserialization vulnerability through Marshal.load or YAML.load processing untrusted data, enabling remote code execution through Ruby object instantiation gadgets that execute arbitrary code during object reconstruction.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -632,6 +1102,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Insecure Deserialization - Node.js',
         description: 'Critical Node.js deserialization vulnerability through node-serialize, funcster, or similar libraries that execute JavaScript during deserialization, enabling remote code execution when attacker-controlled serialized data containing functions or IIFE is processed.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -653,6 +1124,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Clickjacking - Partial Protection',
         description: 'Incomplete clickjacking protection where X-Frame-Options or frame-ancestors CSP is only applied on some pages, uses weak values like ALLOW-FROM with bypassable origins, or has inconsistent implementation allowing certain pages to be framed.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -674,6 +1146,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Missing Security Header - X-Content-Type-Options',
         description: 'The application does not set X-Content-Type-Options: nosniff header, allowing browsers to perform MIME-type sniffing that can lead to XSS attacks when user-uploaded content is served with incorrect Content-Type and browsers execute it as script.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -695,6 +1168,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Invalid Security Header - X-Content-Type-Options',
         description: 'The X-Content-Type-Options header is present but misconfigured (not set to nosniff), which can allow MIME sniffing and reduce protection against content-type confusion.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -716,6 +1190,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Missing Security Header - Referrer-Policy',
         description: 'The application does not implement Referrer-Policy header, potentially leaking sensitive URL information including session tokens, user IDs, or query parameters to external sites when users click links or resources are loaded from third-party domains.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -737,6 +1212,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Unsafe Referrer-Policy Configuration',
         description: 'The Referrer-Policy header is set to a permissive value that can leak full URLs and sensitive query parameters to external origins.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -758,6 +1234,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Missing Security Header - Permissions-Policy',
         description: 'The application does not implement Permissions-Policy (formerly Feature-Policy) header, allowing embedded frames or malicious scripts to access sensitive browser features like camera, microphone, geolocation, or payment APIs without explicit permission.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -779,6 +1256,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Missing Security Header - X-XSS-Protection',
         description: 'The legacy X-XSS-Protection header is not set. While deprecated in modern browsers, it can provide defense-in-depth for older browsers that still honor this header for their built-in XSS auditor feature.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -800,6 +1278,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Header Misconfiguration - COEP Without COOP',
         description: 'Cross-Origin-Embedder-Policy (COEP) is set without Cross-Origin-Opener-Policy (COOP), which can create inconsistent cross-origin isolation behavior and indicate incomplete or misapplied security header strategy for isolation-sensitive applications.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -821,6 +1300,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Header Misconfiguration - Unusual CORP Value',
         description: 'Cross-Origin-Resource-Policy (CORP) is set to a non-standard value, which may indicate a misconfiguration that provides no effective protection or creates unpredictable resource loading behavior across origins.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -842,6 +1322,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Deprecated Header - Expect-CT Present',
         description: 'The Expect-CT header is present even though the feature is deprecated and no longer enforced by major browsers, adding unnecessary configuration surface without meaningful security benefit.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -863,6 +1344,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Information Exposure - Server Header Present',
         description: 'The Server header reveals technology or version details that can assist attackers with fingerprinting and targeted exploitation, increasing the likelihood of tailored attacks against known software weaknesses.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -884,6 +1366,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Information Exposure - X-Powered-By Present',
         description: 'The X-Powered-By header discloses framework or runtime information that can be used to fingerprint the application stack and target known vulnerabilities in specific platforms or versions.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -905,6 +1388,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Deprecated Header - X-XSS-Protection Enabled',
         description: 'The X-XSS-Protection header is enabled, which is deprecated and can introduce security risks or inconsistent behavior in legacy browsers due to the removed XSS auditor feature.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -926,6 +1410,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Cookie Misconfiguration - SameSite=None Without Secure',
         description: 'A cookie is configured with SameSite=None but lacks the Secure attribute, enabling cross-site transmission over unencrypted connections and undermining cookie integrity and confidentiality controls.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -947,6 +1432,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Cookie Misconfiguration - Session Cookie Missing Secure',
         description: 'Session or authentication cookies are missing the Secure attribute, allowing them to be transmitted over unencrypted connections and increasing the risk of session hijacking or credential theft.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -968,6 +1454,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Cookie Misconfiguration - Missing Secure Attribute',
         description: 'Cookies are set without the Secure attribute, permitting transmission over plaintext HTTP and exposing cookie contents to network interception or manipulation.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -989,6 +1476,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Cookie Misconfiguration - Session Cookie Missing HttpOnly',
         description: 'Session or authentication cookies are missing the HttpOnly attribute, allowing client-side scripts to access sensitive cookie values and increasing the impact of XSS attacks.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1010,6 +1498,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Cookie Misconfiguration - Missing HttpOnly Attribute',
         description: 'Cookies are missing the HttpOnly attribute, allowing JavaScript access to cookie values and increasing the potential impact of client-side script injection.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1031,6 +1520,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Cookie Misconfiguration - Missing SameSite Attribute',
         description: 'Cookies do not specify SameSite, which can allow cross-site requests to include cookies by default and increase exposure to CSRF-style attacks or cross-site leakage.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1052,6 +1542,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Cookie Misconfiguration - __Host- Prefix Violations',
         description: 'Cookies with the __Host- prefix do not meet required attributes (Secure, Path=/, no Domain), weakening the protections provided by host-only cookie semantics.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1073,6 +1564,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Cookie Misconfiguration - __Secure- Prefix Violations',
         description: 'Cookies with the __Secure- prefix are missing the Secure attribute, which defeats the prefix requirement and weakens transport security protections.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1094,6 +1586,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Header Drift - Content-Security-Policy Inconsistent',
         description: 'Content-Security-Policy is present on some paths but missing on others, creating uneven defenses and potentially exposing unprotected routes to script injection or content loading risks.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1115,6 +1608,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Header Drift - Strict-Transport-Security Inconsistent',
         description: 'Strict-Transport-Security is present on some paths but missing on others, reducing the effectiveness of HTTPS enforcement and creating mixed transport behavior across the site.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1136,6 +1630,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Header Drift - X-Content-Type-Options Inconsistent',
         description: 'X-Content-Type-Options is present on some paths but missing on others, allowing inconsistent MIME sniffing behavior that could expose unprotected routes to content-type confusion.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1157,6 +1652,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Header Drift - Referrer-Policy Inconsistent',
         description: 'Referrer-Policy is present on some paths but missing on others, leading to inconsistent referrer leakage controls and potential exposure of sensitive URL data.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1178,6 +1674,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Header Drift - X-Frame-Options Inconsistent',
         description: 'X-Frame-Options or equivalent framing controls are present on some paths but missing on others, creating uneven clickjacking protection across the site.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1199,6 +1696,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Header Drift - Permissions-Policy Inconsistent',
         description: 'Permissions-Policy is present on some paths but missing on others, leading to inconsistent controls over browser features such as geolocation, camera, or microphone.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1220,6 +1718,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Header Drift - COOP Inconsistent',
         description: 'Cross-Origin-Opener-Policy is present on some paths but missing on others, which can lead to uneven cross-origin isolation guarantees and inconsistent window isolation behavior.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1241,6 +1740,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Header Drift - COEP Inconsistent',
         description: 'Cross-Origin-Embedder-Policy is present on some paths but missing on others, resulting in inconsistent embedding restrictions and cross-origin isolation posture.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1262,6 +1762,7 @@ export const CONFIG_VULNERABILITIES = {
         title: 'Header Drift - CORP Inconsistent',
         description: 'Cross-Origin-Resource-Policy is present on some paths but missing on others, which can leave inconsistent controls on resource sharing and embedding across the application.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {