@zerothreatai/vulnerability-registry 4.0.0 → 6.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/categories/authentication.js +17 -17
- package/dist/categories/configuration.js +80 -80
- package/dist/categories/injection.js +34 -34
- package/dist/categories/sensitive-paths.js +84 -84
- package/dist/categories/ssrf.js +11 -11
- package/dist/categories/xss.js +15 -15
- package/dist/compliance-codes.d.ts +207 -0
- package/dist/compliance-codes.js +213 -0
- package/dist/compliances/gdpr.d.ts +2 -0
- package/dist/compliances/gdpr.js +252 -0
- package/dist/compliances/helpers.d.ts +6 -0
- package/dist/compliances/helpers.js +11 -0
- package/dist/compliances/hipaa.d.ts +2 -0
- package/dist/compliances/hipaa.js +187 -0
- package/dist/compliances/index.d.ts +5 -0
- package/dist/compliances/index.js +5 -0
- package/dist/compliances/owasp.d.ts +2 -0
- package/dist/compliances/owasp.js +127 -0
- package/dist/compliances/pci-dss.d.ts +2 -0
- package/dist/compliances/pci-dss.js +260 -0
- package/dist/compliances/sans-top-25.d.ts +2 -0
- package/dist/compliances/sans-top-25.js +242 -0
- package/dist/index.d.ts +7 -1
- package/dist/index.js +7 -1
- package/dist/types.d.ts +33 -0
- package/dist/types.js +11 -1
- package/dist-cjs/categories/authentication.js +17 -17
- package/dist-cjs/categories/configuration.js +80 -80
- package/dist-cjs/categories/injection.js +34 -34
- package/dist-cjs/categories/sensitive-paths.js +84 -84
- package/dist-cjs/categories/ssrf.js +11 -11
- package/dist-cjs/categories/xss.js +15 -15
- package/dist-cjs/compliance-codes.js +216 -0
- package/dist-cjs/compliances/gdpr.js +255 -0
- package/dist-cjs/compliances/helpers.js +19 -0
- package/dist-cjs/compliances/hipaa.js +190 -0
- package/dist-cjs/compliances/index.js +13 -0
- package/dist-cjs/compliances/owasp.js +130 -0
- package/dist-cjs/compliances/pci-dss.js +263 -0
- package/dist-cjs/compliances/sans-top-25.js +245 -0
- package/dist-cjs/index.js +12 -1
- package/dist-cjs/types.js +12 -0
- package/package.json +40 -32
- package/scripts/assign-ids.ts +105 -0
- package/scripts/check-duplicate-ids.ts +45 -0
- package/src/categories/authentication.ts +17 -17
- package/src/categories/configuration.ts +80 -80
- package/src/categories/injection.ts +34 -34
- package/src/categories/sensitive-paths.ts +84 -84
- package/src/categories/ssrf.ts +11 -11
- package/src/categories/xss.ts +15 -15
- package/src/compliance-codes.ts +216 -0
- package/src/compliances/README.md +82 -0
- package/src/compliances/gdpr.ts +258 -0
- package/src/compliances/helpers.ts +29 -0
- package/src/compliances/hipaa.ts +193 -0
- package/src/compliances/index.ts +5 -0
- package/src/compliances/owasp.ts +133 -0
- package/src/compliances/pci-dss.ts +266 -0
- package/src/compliances/sans-top-25.ts +246 -0
- package/src/id-registry.json +1235 -0
- package/src/index.ts +12 -1
- package/src/types.ts +40 -4
- package/src/categories/authentication.d.ts +0 -8
- package/src/categories/authentication.d.ts.map +0 -1
- package/src/categories/authentication.js +0 -392
- package/src/categories/authentication.js.map +0 -1
- package/src/categories/configuration.d.ts +0 -8
- package/src/categories/configuration.d.ts.map +0 -1
- package/src/categories/configuration.js +0 -1782
- package/src/categories/configuration.js.map +0 -1
- package/src/categories/injection.d.ts +0 -8
- package/src/categories/injection.d.ts.map +0 -1
- package/src/categories/injection.js +0 -781
- package/src/categories/injection.js.map +0 -1
- package/src/categories/sensitive-paths.d.ts +0 -9
- package/src/categories/sensitive-paths.d.ts.map +0 -1
- package/src/categories/sensitive-paths.js +0 -1872
- package/src/categories/sensitive-paths.js.map +0 -1
- package/src/categories/ssrf.d.ts +0 -8
- package/src/categories/ssrf.d.ts.map +0 -1
- package/src/categories/ssrf.js +0 -258
- package/src/categories/ssrf.js.map +0 -1
- package/src/categories/xss.d.ts +0 -7
- package/src/categories/xss.d.ts.map +0 -1
- package/src/categories/xss.js +0 -340
- package/src/categories/xss.js.map +0 -1
- package/src/error-codes.d.ts +0 -280
- package/src/error-codes.d.ts.map +0 -1
- package/src/error-codes.js +0 -350
- package/src/error-codes.js.map +0 -1
- package/src/index.d.ts +0 -60
- package/src/index.d.ts.map +0 -1
- package/src/index.js +0 -92
- package/src/index.js.map +0 -1
- package/src/types.d.ts +0 -88
- package/src/types.d.ts.map +0 -1
- package/src/types.js +0 -6
- package/src/types.js.map +0 -1
|
@@ -13,7 +13,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
13
13
|
// CRITICAL - CREDENTIAL EXPOSURE
|
|
14
14
|
// ========================================
|
|
15
15
|
[VulnerabilityCode.SENS_CRIT_AWS_CREDENTIALS]: {
|
|
16
|
-
id:
|
|
16
|
+
id: 500,
|
|
17
17
|
code: VulnerabilityCode.SENS_CRIT_AWS_CREDENTIALS,
|
|
18
18
|
title: 'AWS Credentials Exposed',
|
|
19
19
|
description: 'AWS credentials file (.aws/credentials) is publicly accessible containing AWS Access Key ID and Secret Access Key, enabling complete access to AWS services including S3 buckets, EC2 instances, RDS databases, and all cloud resources associated with the compromised account.',
|
|
@@ -37,7 +37,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
37
37
|
},
|
|
38
38
|
|
|
39
39
|
[VulnerabilityCode.SENS_CRIT_SSH_PRIVATE_KEY]: {
|
|
40
|
-
id:
|
|
40
|
+
id: 501,
|
|
41
41
|
code: VulnerabilityCode.SENS_CRIT_SSH_PRIVATE_KEY,
|
|
42
42
|
title: 'SSH Private Key Exposed',
|
|
43
43
|
description: 'SSH private key file (id_rsa, id_ed25519) is publicly accessible, allowing attackers to authenticate to any system where the corresponding public key is authorized, potentially including production servers, databases, and version control systems.',
|
|
@@ -60,7 +60,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
60
60
|
},
|
|
61
61
|
|
|
62
62
|
[VulnerabilityCode.SENS_CRIT_SSL_PRIVATE_KEY]: {
|
|
63
|
-
id:
|
|
63
|
+
id: 502,
|
|
64
64
|
code: VulnerabilityCode.SENS_CRIT_SSL_PRIVATE_KEY,
|
|
65
65
|
title: 'SSL/TLS Private Key Exposed',
|
|
66
66
|
description: 'SSL/TLS private key file is publicly accessible, enabling attackers to decrypt all HTTPS traffic, perform man-in-the-middle attacks, and impersonate the server for phishing or credential theft operations against legitimate users.',
|
|
@@ -83,7 +83,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
83
83
|
},
|
|
84
84
|
|
|
85
85
|
[VulnerabilityCode.SENS_CRIT_RAILS_MASTER_KEY]: {
|
|
86
|
-
id:
|
|
86
|
+
id: 503,
|
|
87
87
|
code: VulnerabilityCode.SENS_CRIT_RAILS_MASTER_KEY,
|
|
88
88
|
title: 'Rails Master Key Exposed',
|
|
89
89
|
description: 'Rails master.key file is publicly accessible, allowing decryption of all Rails encrypted credentials including database passwords, API keys, and session secrets, enabling complete application compromise and access to all encrypted secrets.',
|
|
@@ -106,7 +106,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
106
106
|
},
|
|
107
107
|
|
|
108
108
|
[VulnerabilityCode.SENS_CRIT_TERRAFORM_STATE]: {
|
|
109
|
-
id:
|
|
109
|
+
id: 504,
|
|
110
110
|
code: VulnerabilityCode.SENS_CRIT_TERRAFORM_STATE,
|
|
111
111
|
title: 'Terraform State File Exposed',
|
|
112
112
|
description: 'Terraform state file (tfstate) is publicly accessible containing complete infrastructure configuration, resource IDs, IP addresses, and potentially sensitive outputs including database passwords and API keys stored in plain text.',
|
|
@@ -129,7 +129,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
129
129
|
},
|
|
130
130
|
|
|
131
131
|
[VulnerabilityCode.SENS_CRIT_KUBE_CONFIG]: {
|
|
132
|
-
id:
|
|
132
|
+
id: 505,
|
|
133
133
|
code: VulnerabilityCode.SENS_CRIT_KUBE_CONFIG,
|
|
134
134
|
title: 'Kubernetes Config Exposed',
|
|
135
135
|
description: 'Kubernetes kubeconfig file is publicly accessible containing cluster credentials, certificates, and tokens that allow full administrative access to Kubernetes clusters including ability to deploy, modify, and delete all workloads.',
|
|
@@ -152,7 +152,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
152
152
|
},
|
|
153
153
|
|
|
154
154
|
[VulnerabilityCode.SENS_CRIT_VAULT_SECRET]: {
|
|
155
|
-
id:
|
|
155
|
+
id: 506,
|
|
156
156
|
code: VulnerabilityCode.SENS_CRIT_VAULT_SECRET,
|
|
157
157
|
title: 'HashiCorp Vault Secret Exposed',
|
|
158
158
|
description: 'HashiCorp Vault secrets or root token exposed, providing access to the centralized secrets management system and all secrets stored within, potentially compromising hundreds of application credentials and encryption keys.',
|
|
@@ -178,7 +178,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
178
178
|
// HIGH - SOURCE CODE & CONFIG EXPOSURE
|
|
179
179
|
// ========================================
|
|
180
180
|
[VulnerabilityCode.SENS_HIGH_GIT_EXPOSED]: {
|
|
181
|
-
id:
|
|
181
|
+
id: 507,
|
|
182
182
|
code: VulnerabilityCode.SENS_HIGH_GIT_EXPOSED,
|
|
183
183
|
title: 'Git Repository Exposed',
|
|
184
184
|
description: 'Git repository metadata (.git/HEAD, .git/config) is publicly accessible, allowing attackers to download the complete repository including all source code, commit history, configuration files, and potentially credentials committed accidentally.',
|
|
@@ -201,7 +201,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
201
201
|
},
|
|
202
202
|
|
|
203
203
|
[VulnerabilityCode.SENS_HIGH_ENV_FILE]: {
|
|
204
|
-
id:
|
|
204
|
+
id: 508,
|
|
205
205
|
code: VulnerabilityCode.SENS_HIGH_ENV_FILE,
|
|
206
206
|
title: 'Environment File Exposed',
|
|
207
207
|
description: 'Environment configuration file (.env, .env.local, .env.production) is publicly accessible containing application secrets, database credentials, API keys, and other sensitive configuration that should never be exposed to end users.',
|
|
@@ -224,7 +224,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
224
224
|
},
|
|
225
225
|
|
|
226
226
|
[VulnerabilityCode.SENS_HIGH_WORDPRESS_CONFIG]: {
|
|
227
|
-
id:
|
|
227
|
+
id: 509,
|
|
228
228
|
code: VulnerabilityCode.SENS_HIGH_WORDPRESS_CONFIG,
|
|
229
229
|
title: 'WordPress Configuration File Exposed',
|
|
230
230
|
description: 'WordPress wp-config.php file is accessible and readable, exposing database credentials, authentication keys, salts, table prefix, and debug settings that allow complete compromise of the WordPress installation and underlying database.',
|
|
@@ -247,7 +247,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
247
247
|
},
|
|
248
248
|
|
|
249
249
|
[VulnerabilityCode.SENS_HIGH_SPRING_ACTUATOR]: {
|
|
250
|
-
id:
|
|
250
|
+
id: 510,
|
|
251
251
|
code: VulnerabilityCode.SENS_HIGH_SPRING_ACTUATOR,
|
|
252
252
|
title: 'Spring Boot Actuator Endpoints Exposed',
|
|
253
253
|
description: 'Spring Boot Actuator management endpoints are publicly accessible without authentication, exposing application internals including environment variables, configuration properties, health status, thread dumps, and potentially enabling remote code execution through certain endpoints.',
|
|
@@ -271,7 +271,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
271
271
|
},
|
|
272
272
|
|
|
273
273
|
[VulnerabilityCode.SENS_HIGH_SPRING_HEAPDUMP]: {
|
|
274
|
-
id:
|
|
274
|
+
id: 511,
|
|
275
275
|
code: VulnerabilityCode.SENS_HIGH_SPRING_HEAPDUMP,
|
|
276
276
|
title: 'Spring Boot Heapdump Exposed',
|
|
277
277
|
description: 'Spring Boot Actuator heapdump endpoint is accessible allowing download of JVM heap memory containing sensitive runtime data including session tokens, passwords, encryption keys, personal data, and other secrets temporarily held in application memory.',
|
|
@@ -294,7 +294,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
294
294
|
},
|
|
295
295
|
|
|
296
296
|
[VulnerabilityCode.SENS_HIGH_PHPINFO]: {
|
|
297
|
-
id:
|
|
297
|
+
id: 512,
|
|
298
298
|
code: VulnerabilityCode.SENS_HIGH_PHPINFO,
|
|
299
299
|
title: 'PHP Info Page Exposed',
|
|
300
300
|
description: 'PHP info page (phpinfo.php) is publicly accessible revealing complete server configuration including PHP version, loaded modules, environment variables, system paths, and potentially database connection strings that aid attackers in planning targeted attacks.',
|
|
@@ -317,7 +317,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
317
317
|
},
|
|
318
318
|
|
|
319
319
|
[VulnerabilityCode.SENS_HIGH_LARAVEL_DEBUG]: {
|
|
320
|
-
id:
|
|
320
|
+
id: 513,
|
|
321
321
|
code: VulnerabilityCode.SENS_HIGH_LARAVEL_DEBUG,
|
|
322
322
|
title: 'Laravel Debug Mode Enabled',
|
|
323
323
|
description: 'Laravel application is running with debug mode enabled in production, exposing detailed stack traces, database queries, environment variables, and potentially the APP_KEY which can be used to decrypt session data and forge authenticated sessions.',
|
|
@@ -340,7 +340,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
340
340
|
},
|
|
341
341
|
|
|
342
342
|
[VulnerabilityCode.SENS_HIGH_GRAPHQL_INTROSPECTION]: {
|
|
343
|
-
id:
|
|
343
|
+
id: 514,
|
|
344
344
|
code: VulnerabilityCode.SENS_HIGH_GRAPHQL_INTROSPECTION,
|
|
345
345
|
title: 'GraphQL Introspection Enabled',
|
|
346
346
|
description: 'GraphQL API has introspection enabled in production, allowing attackers to query the complete schema including all types, queries, mutations, and fields, which reveals the entire API structure and aids in discovering sensitive operations and data access points.',
|
|
@@ -363,7 +363,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
363
363
|
},
|
|
364
364
|
|
|
365
365
|
[VulnerabilityCode.SENS_HIGH_DATABASE_BACKUP]: {
|
|
366
|
-
id:
|
|
366
|
+
id: 515,
|
|
367
367
|
code: VulnerabilityCode.SENS_HIGH_DATABASE_BACKUP,
|
|
368
368
|
title: 'Database Backup File Exposed',
|
|
369
369
|
description: 'Database backup or dump file (.sql, .dump, .bak) is publicly accessible containing complete database contents including user credentials, personal information, business data, and all other stored information enabling massive data breach.',
|
|
@@ -389,7 +389,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
389
389
|
// MEDIUM - API & SERVICE EXPOSURE
|
|
390
390
|
// ========================================
|
|
391
391
|
[VulnerabilityCode.SENS_MED_SWAGGER_DOCS]: {
|
|
392
|
-
id:
|
|
392
|
+
id: 516,
|
|
393
393
|
code: VulnerabilityCode.SENS_MED_SWAGGER_DOCS,
|
|
394
394
|
title: 'Swagger/OpenAPI Documentation Exposed',
|
|
395
395
|
description: 'API documentation (swagger.json, openapi.yaml) is publicly accessible revealing complete API structure including all endpoints, parameters, authentication methods, and data models which aids attackers in understanding and exploiting the API systematically.',
|
|
@@ -412,7 +412,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
412
412
|
},
|
|
413
413
|
|
|
414
414
|
[VulnerabilityCode.SENS_MED_PROMETHEUS_METRICS]: {
|
|
415
|
-
id:
|
|
415
|
+
id: 517,
|
|
416
416
|
code: VulnerabilityCode.SENS_MED_PROMETHEUS_METRICS,
|
|
417
417
|
title: 'Prometheus Metrics Endpoint Exposed',
|
|
418
418
|
description: 'Prometheus metrics endpoint (/metrics) is publicly accessible exposing application performance data, error rates, request patterns, resource usage, and potentially business metrics that reveal internal operations and aid in planning attacks.',
|
|
@@ -435,7 +435,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
435
435
|
},
|
|
436
436
|
|
|
437
437
|
[VulnerabilityCode.SENS_MED_ADMIN_PANEL]: {
|
|
438
|
-
id:
|
|
438
|
+
id: 518,
|
|
439
439
|
code: VulnerabilityCode.SENS_MED_ADMIN_PANEL,
|
|
440
440
|
title: 'Admin Panel Publicly Accessible',
|
|
441
441
|
description: 'Administrative interface is accessible from the public internet without IP restrictions, enabling brute force attacks against admin credentials and exposing sensitive management functionality that should be restricted to internal networks only.',
|
|
@@ -458,7 +458,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
458
458
|
},
|
|
459
459
|
|
|
460
460
|
[VulnerabilityCode.SENS_MED_SOURCE_MAP]: {
|
|
461
|
-
id:
|
|
461
|
+
id: 519,
|
|
462
462
|
code: VulnerabilityCode.SENS_MED_SOURCE_MAP,
|
|
463
463
|
title: 'JavaScript Source Maps Exposed',
|
|
464
464
|
description: 'JavaScript source map files (.js.map) are publicly accessible allowing attackers to view original unminified source code including comments, variable names, internal logic, and potentially security-sensitive implementation details.',
|
|
@@ -483,7 +483,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
483
483
|
// EXTENDED SENSITIVE PATH EXPOSURES
|
|
484
484
|
// ========================================
|
|
485
485
|
[VulnerabilityCode.SENS_MED_UN_PROTECTED_CONFIG_JSON]: {
|
|
486
|
-
id:
|
|
486
|
+
id: 520,
|
|
487
487
|
code: VulnerabilityCode.SENS_MED_UN_PROTECTED_CONFIG_JSON,
|
|
488
488
|
title: 'Un Protected Config JSON',
|
|
489
489
|
description: 'The application exposes un protected config json in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -506,7 +506,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
506
506
|
},
|
|
507
507
|
|
|
508
508
|
[VulnerabilityCode.SENS_HIGH_WEB_SERVER_CONFIGURATION_FILE_DETECTED]: {
|
|
509
|
-
id:
|
|
509
|
+
id: 521,
|
|
510
510
|
code: VulnerabilityCode.SENS_HIGH_WEB_SERVER_CONFIGURATION_FILE_DETECTED,
|
|
511
511
|
title: 'Web Server Configuration File Detected',
|
|
512
512
|
description: 'The application exposes web server configuration file detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -529,7 +529,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
529
529
|
},
|
|
530
530
|
|
|
531
531
|
[VulnerabilityCode.SENS_HIGH_APPSETTINGS_JSON_EXPOSED]: {
|
|
532
|
-
id:
|
|
532
|
+
id: 522,
|
|
533
533
|
code: VulnerabilityCode.SENS_HIGH_APPSETTINGS_JSON_EXPOSED,
|
|
534
534
|
title: 'Appsettings JSON Exposed',
|
|
535
535
|
description: 'The application exposes appsettings json exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -552,7 +552,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
552
552
|
},
|
|
553
553
|
|
|
554
554
|
[VulnerabilityCode.SENS_HIGH_SPRING_CONFIG_EXPOSED]: {
|
|
555
|
-
id:
|
|
555
|
+
id: 523,
|
|
556
556
|
code: VulnerabilityCode.SENS_HIGH_SPRING_CONFIG_EXPOSED,
|
|
557
557
|
title: 'Spring Config Exposed',
|
|
558
558
|
description: 'The application exposes spring config exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -575,7 +575,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
575
575
|
},
|
|
576
576
|
|
|
577
577
|
[VulnerabilityCode.SENS_HIGH_NPMRC_EXPOSED]: {
|
|
578
|
-
id:
|
|
578
|
+
id: 524,
|
|
579
579
|
code: VulnerabilityCode.SENS_HIGH_NPMRC_EXPOSED,
|
|
580
580
|
title: 'Npmrc Exposed',
|
|
581
581
|
description: 'The application exposes npmrc exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -598,7 +598,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
598
598
|
},
|
|
599
599
|
|
|
600
600
|
[VulnerabilityCode.SENS_LOW_TOML_PROJECT_FILE_EXPOSED]: {
|
|
601
|
-
id:
|
|
601
|
+
id: 525,
|
|
602
602
|
code: VulnerabilityCode.SENS_LOW_TOML_PROJECT_FILE_EXPOSED,
|
|
603
603
|
title: 'TOML Project File Exposed',
|
|
604
604
|
description: 'The application exposes toml project file exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -621,7 +621,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
621
621
|
},
|
|
622
622
|
|
|
623
623
|
[VulnerabilityCode.SENS_HIGH_RAILS_DATABASE_YML_EXPOSED]: {
|
|
624
|
-
id:
|
|
624
|
+
id: 526,
|
|
625
625
|
code: VulnerabilityCode.SENS_HIGH_RAILS_DATABASE_YML_EXPOSED,
|
|
626
626
|
title: 'Rails Database YML Exposed',
|
|
627
627
|
description: 'The application exposes rails database yml exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -644,7 +644,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
644
644
|
},
|
|
645
645
|
|
|
646
646
|
[VulnerabilityCode.SENS_HIGH_DRUPAL_SETTINGS_PHP_EXPOSED]: {
|
|
647
|
-
id:
|
|
647
|
+
id: 527,
|
|
648
648
|
code: VulnerabilityCode.SENS_HIGH_DRUPAL_SETTINGS_PHP_EXPOSED,
|
|
649
649
|
title: 'Drupal Settings PHP Exposed',
|
|
650
650
|
description: 'The application exposes drupal settings php exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -667,7 +667,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
667
667
|
},
|
|
668
668
|
|
|
669
669
|
[VulnerabilityCode.SENS_HIGH_MAGENTO_ENV_PHP_EXPOSED]: {
|
|
670
|
-
id:
|
|
670
|
+
id: 528,
|
|
671
671
|
code: VulnerabilityCode.SENS_HIGH_MAGENTO_ENV_PHP_EXPOSED,
|
|
672
672
|
title: 'Magento Env PHP Exposed',
|
|
673
673
|
description: 'The application exposes magento env php exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -690,7 +690,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
690
690
|
},
|
|
691
691
|
|
|
692
692
|
[VulnerabilityCode.SENS_HIGH_JOLOKIA_EXPOSED]: {
|
|
693
|
-
id:
|
|
693
|
+
id: 529,
|
|
694
694
|
code: VulnerabilityCode.SENS_HIGH_JOLOKIA_EXPOSED,
|
|
695
695
|
title: 'Jolokia Exposed',
|
|
696
696
|
description: 'The application exposes jolokia exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -713,7 +713,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
713
713
|
},
|
|
714
714
|
|
|
715
715
|
[VulnerabilityCode.SENS_HIGH_SVN_WORKING_COPY_DATABASE_EXPOSED]: {
|
|
716
|
-
id:
|
|
716
|
+
id: 530,
|
|
717
717
|
code: VulnerabilityCode.SENS_HIGH_SVN_WORKING_COPY_DATABASE_EXPOSED,
|
|
718
718
|
title: 'SVN Working Copy Database Exposed',
|
|
719
719
|
description: 'The application exposes svn working copy database exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -736,7 +736,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
736
736
|
},
|
|
737
737
|
|
|
738
738
|
[VulnerabilityCode.SENS_HIGH_SUBVERSION_REPOSITORY_DETECTED]: {
|
|
739
|
-
id:
|
|
739
|
+
id: 531,
|
|
740
740
|
code: VulnerabilityCode.SENS_HIGH_SUBVERSION_REPOSITORY_DETECTED,
|
|
741
741
|
title: 'Subversion Repository Detected',
|
|
742
742
|
description: 'The application exposes subversion repository detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -759,7 +759,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
759
759
|
},
|
|
760
760
|
|
|
761
761
|
[VulnerabilityCode.SENS_MED_MERCURIAL_REPOSITORY_FOUND]: {
|
|
762
|
-
id:
|
|
762
|
+
id: 532,
|
|
763
763
|
code: VulnerabilityCode.SENS_MED_MERCURIAL_REPOSITORY_FOUND,
|
|
764
764
|
title: 'Mercurial Repository Found',
|
|
765
765
|
description: 'The application exposes mercurial repository found in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -782,7 +782,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
782
782
|
},
|
|
783
783
|
|
|
784
784
|
[VulnerabilityCode.SENS_MED_MERCURIAL_HGRC_EXPOSED]: {
|
|
785
|
-
id:
|
|
785
|
+
id: 533,
|
|
786
786
|
code: VulnerabilityCode.SENS_MED_MERCURIAL_HGRC_EXPOSED,
|
|
787
787
|
title: 'Mercurial Hgrc Exposed',
|
|
788
788
|
description: 'The application exposes mercurial hgrc exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -805,7 +805,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
805
805
|
},
|
|
806
806
|
|
|
807
807
|
[VulnerabilityCode.SENS_MED_CVS_ROOT_EXPOSED]: {
|
|
808
|
-
id:
|
|
808
|
+
id: 534,
|
|
809
809
|
code: VulnerabilityCode.SENS_MED_CVS_ROOT_EXPOSED,
|
|
810
810
|
title: 'CVS Root Exposed',
|
|
811
811
|
description: 'The application exposes cvs root exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -828,7 +828,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
828
828
|
},
|
|
829
829
|
|
|
830
830
|
[VulnerabilityCode.SENS_MED_CVS_ENTRIES_EXPOSED]: {
|
|
831
|
-
id:
|
|
831
|
+
id: 535,
|
|
832
832
|
code: VulnerabilityCode.SENS_MED_CVS_ENTRIES_EXPOSED,
|
|
833
833
|
title: 'CVS Entries Exposed',
|
|
834
834
|
description: 'The application exposes cvs entries exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -851,7 +851,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
851
851
|
},
|
|
852
852
|
|
|
853
853
|
[VulnerabilityCode.SENS_MED_BAZAAR_REPO_EXPOSED]: {
|
|
854
|
-
id:
|
|
854
|
+
id: 536,
|
|
855
855
|
code: VulnerabilityCode.SENS_MED_BAZAAR_REPO_EXPOSED,
|
|
856
856
|
title: 'Bazaar Repo Exposed',
|
|
857
857
|
description: 'The application exposes bazaar repo exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -874,7 +874,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
874
874
|
},
|
|
875
875
|
|
|
876
876
|
[VulnerabilityCode.SENS_HIGH_SPRING_BOOT_THREAD_DUMP_EXPOSED]: {
|
|
877
|
-
id:
|
|
877
|
+
id: 537,
|
|
878
878
|
code: VulnerabilityCode.SENS_HIGH_SPRING_BOOT_THREAD_DUMP_EXPOSED,
|
|
879
879
|
title: 'Spring Boot Thread Dump Exposed',
|
|
880
880
|
description: 'The application exposes spring boot thread dump exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -897,7 +897,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
897
897
|
},
|
|
898
898
|
|
|
899
899
|
[VulnerabilityCode.SENS_HIGH_REDIS_RDB_DUMP_DETECTED]: {
|
|
900
|
-
id:
|
|
900
|
+
id: 538,
|
|
901
901
|
code: VulnerabilityCode.SENS_HIGH_REDIS_RDB_DUMP_DETECTED,
|
|
902
902
|
title: 'Redis Rdb Dump Detected',
|
|
903
903
|
description: 'The application exposes redis rdb dump detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -920,7 +920,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
920
920
|
},
|
|
921
921
|
|
|
922
922
|
[VulnerabilityCode.SENS_LOW_ATLASSIAN_BITBUCKET_PIPELINES_CONFIGURATION_DETECTED]: {
|
|
923
|
-
id:
|
|
923
|
+
id: 539,
|
|
924
924
|
code: VulnerabilityCode.SENS_LOW_ATLASSIAN_BITBUCKET_PIPELINES_CONFIGURATION_DETECTED,
|
|
925
925
|
title: 'Atlassian Bitbucket Pipelines Configuration Detected',
|
|
926
926
|
description: 'The application exposes atlassian bitbucket pipelines configuration detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -943,7 +943,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
943
943
|
},
|
|
944
944
|
|
|
945
945
|
[VulnerabilityCode.SENS_LOW_AZURE_PIPELINES_CONFIGURATION_DETECTED]: {
|
|
946
|
-
id:
|
|
946
|
+
id: 540,
|
|
947
947
|
code: VulnerabilityCode.SENS_LOW_AZURE_PIPELINES_CONFIGURATION_DETECTED,
|
|
948
948
|
title: 'AZURE Pipelines Configuration Detected',
|
|
949
949
|
description: 'The application exposes azure pipelines configuration detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -966,7 +966,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
966
966
|
},
|
|
967
967
|
|
|
968
968
|
[VulnerabilityCode.SENS_LOW_AWS_CODE_BUILD_BUILDSPEC_DETECTED]: {
|
|
969
|
-
id:
|
|
969
|
+
id: 541,
|
|
970
970
|
code: VulnerabilityCode.SENS_LOW_AWS_CODE_BUILD_BUILDSPEC_DETECTED,
|
|
971
971
|
title: 'AWS Code Build Buildspec Detected',
|
|
972
972
|
description: 'The application exposes aws code build buildspec detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -989,7 +989,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
989
989
|
},
|
|
990
990
|
|
|
991
991
|
[VulnerabilityCode.SENS_LOW_GITHUB_ACTIONS_WORKFLOW_DETECTED]: {
|
|
992
|
-
id:
|
|
992
|
+
id: 542,
|
|
993
993
|
code: VulnerabilityCode.SENS_LOW_GITHUB_ACTIONS_WORKFLOW_DETECTED,
|
|
994
994
|
title: 'Github Actions Workflow Detected',
|
|
995
995
|
description: 'The application exposes github actions workflow detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1012,7 +1012,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1012
1012
|
},
|
|
1013
1013
|
|
|
1014
1014
|
[VulnerabilityCode.SENS_MED_DOCKER_COMPOSE_CONFIGURATION_DETECTED]: {
|
|
1015
|
-
id:
|
|
1015
|
+
id: 543,
|
|
1016
1016
|
code: VulnerabilityCode.SENS_MED_DOCKER_COMPOSE_CONFIGURATION_DETECTED,
|
|
1017
1017
|
title: 'Docker Compose Configuration Detected',
|
|
1018
1018
|
description: 'The application exposes docker compose configuration detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1035,7 +1035,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1035
1035
|
},
|
|
1036
1036
|
|
|
1037
1037
|
[VulnerabilityCode.SENS_HIGH_TRACE_AXD]: {
|
|
1038
|
-
id:
|
|
1038
|
+
id: 544,
|
|
1039
1039
|
code: VulnerabilityCode.SENS_HIGH_TRACE_AXD,
|
|
1040
1040
|
title: 'Trace Axd',
|
|
1041
1041
|
description: 'The application exposes trace axd in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1058,7 +1058,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1058
1058
|
},
|
|
1059
1059
|
|
|
1060
1060
|
[VulnerabilityCode.SENS_HIGH_ELMAH_AXD_EXPOSED]: {
|
|
1061
|
-
id:
|
|
1061
|
+
id: 545,
|
|
1062
1062
|
code: VulnerabilityCode.SENS_HIGH_ELMAH_AXD_EXPOSED,
|
|
1063
1063
|
title: 'Elmah Axd Exposed',
|
|
1064
1064
|
description: 'The application exposes elmah axd exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1081,7 +1081,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1081
1081
|
},
|
|
1082
1082
|
|
|
1083
1083
|
[VulnerabilityCode.SENS_MED_LARAVEL_LOG_VIEWER_ENABLED]: {
|
|
1084
|
-
id:
|
|
1084
|
+
id: 546,
|
|
1085
1085
|
code: VulnerabilityCode.SENS_MED_LARAVEL_LOG_VIEWER_ENABLED,
|
|
1086
1086
|
title: 'Laravel Log Viewer Enabled',
|
|
1087
1087
|
description: 'The application exposes laravel log viewer enabled in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1104,7 +1104,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1104
1104
|
},
|
|
1105
1105
|
|
|
1106
1106
|
[VulnerabilityCode.SENS_MED_APACHE_HTACCESS_FILE_DETECTED]: {
|
|
1107
|
-
id:
|
|
1107
|
+
id: 547,
|
|
1108
1108
|
code: VulnerabilityCode.SENS_MED_APACHE_HTACCESS_FILE_DETECTED,
|
|
1109
1109
|
title: 'Apache Htaccess File Detected',
|
|
1110
1110
|
description: 'The application exposes apache htaccess file detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1127,7 +1127,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1127
1127
|
},
|
|
1128
1128
|
|
|
1129
1129
|
[VulnerabilityCode.SENS_MED_APACHE_SERVER_INFO_EXPOSED]: {
|
|
1130
|
-
id:
|
|
1130
|
+
id: 548,
|
|
1131
1131
|
code: VulnerabilityCode.SENS_MED_APACHE_SERVER_INFO_EXPOSED,
|
|
1132
1132
|
title: 'Apache Server Info Exposed',
|
|
1133
1133
|
description: 'The application exposes apache server info exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1150,7 +1150,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1150
1150
|
},
|
|
1151
1151
|
|
|
1152
1152
|
[VulnerabilityCode.SENS_HIGH_SQLITE_DATABASE_DETECTED]: {
|
|
1153
|
-
id:
|
|
1153
|
+
id: 549,
|
|
1154
1154
|
code: VulnerabilityCode.SENS_HIGH_SQLITE_DATABASE_DETECTED,
|
|
1155
1155
|
title: 'Sqlite Database Detected',
|
|
1156
1156
|
description: 'The application exposes sqlite database detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1173,7 +1173,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1173
1173
|
},
|
|
1174
1174
|
|
|
1175
1175
|
[VulnerabilityCode.SENS_MED_PACKAGE_DEPENDENCIES_DETECTED]: {
|
|
1176
|
-
id:
|
|
1176
|
+
id: 550,
|
|
1177
1177
|
code: VulnerabilityCode.SENS_MED_PACKAGE_DEPENDENCIES_DETECTED,
|
|
1178
1178
|
title: 'Package Dependencies Detected',
|
|
1179
1179
|
description: 'The application exposes package dependencies detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1196,7 +1196,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1196
1196
|
},
|
|
1197
1197
|
|
|
1198
1198
|
[VulnerabilityCode.SENS_MED_PHP_COMPOSER_DEPENDENCIES_DETECTED]: {
|
|
1199
|
-
id:
|
|
1199
|
+
id: 551,
|
|
1200
1200
|
code: VulnerabilityCode.SENS_MED_PHP_COMPOSER_DEPENDENCIES_DETECTED,
|
|
1201
1201
|
title: 'PHP Composer Dependencies Detected',
|
|
1202
1202
|
description: 'The application exposes php composer dependencies detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1219,7 +1219,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1219
1219
|
},
|
|
1220
1220
|
|
|
1221
1221
|
[VulnerabilityCode.SENS_LOW_PYTHON_REQUIREMENTS_DETECTED]: {
|
|
1222
|
-
id:
|
|
1222
|
+
id: 552,
|
|
1223
1223
|
code: VulnerabilityCode.SENS_LOW_PYTHON_REQUIREMENTS_DETECTED,
|
|
1224
1224
|
title: 'Python Requirements Detected',
|
|
1225
1225
|
description: 'The application exposes python requirements detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1242,7 +1242,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1242
1242
|
},
|
|
1243
1243
|
|
|
1244
1244
|
[VulnerabilityCode.SENS_HIGH_AWS_CONFIG_EXPOSED]: {
|
|
1245
|
-
id:
|
|
1245
|
+
id: 553,
|
|
1246
1246
|
code: VulnerabilityCode.SENS_HIGH_AWS_CONFIG_EXPOSED,
|
|
1247
1247
|
title: 'AWS Config Exposed',
|
|
1248
1248
|
description: 'The application exposes aws config exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1265,7 +1265,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1265
1265
|
},
|
|
1266
1266
|
|
|
1267
1267
|
[VulnerabilityCode.SENS_HIGH_AZURE_CREDENTIALS_EXPOSED]: {
|
|
1268
|
-
id:
|
|
1268
|
+
id: 554,
|
|
1269
1269
|
code: VulnerabilityCode.SENS_HIGH_AZURE_CREDENTIALS_EXPOSED,
|
|
1270
1270
|
title: 'AZURE Credentials Exposed',
|
|
1271
1271
|
description: 'The application exposes azure credentials exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1288,7 +1288,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1288
1288
|
},
|
|
1289
1289
|
|
|
1290
1290
|
[VulnerabilityCode.SENS_HIGH_HELM_VALUES_EXPOSED]: {
|
|
1291
|
-
id:
|
|
1291
|
+
id: 555,
|
|
1292
1292
|
code: VulnerabilityCode.SENS_HIGH_HELM_VALUES_EXPOSED,
|
|
1293
1293
|
title: 'Helm Values Exposed',
|
|
1294
1294
|
description: 'The application exposes helm values exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1311,7 +1311,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1311
1311
|
},
|
|
1312
1312
|
|
|
1313
1313
|
[VulnerabilityCode.SENS_MED_SSH_PUBLIC_KEY_EXPOSED]: {
|
|
1314
|
-
id:
|
|
1314
|
+
id: 556,
|
|
1315
1315
|
code: VulnerabilityCode.SENS_MED_SSH_PUBLIC_KEY_EXPOSED,
|
|
1316
1316
|
title: 'SSH Public Key Exposed',
|
|
1317
1317
|
description: 'The application exposes ssh public key exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1334,7 +1334,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1334
1334
|
},
|
|
1335
1335
|
|
|
1336
1336
|
[VulnerabilityCode.SENS_MED_SSL_CERTIFICATE_EXPOSED]: {
|
|
1337
|
-
id:
|
|
1337
|
+
id: 557,
|
|
1338
1338
|
code: VulnerabilityCode.SENS_MED_SSL_CERTIFICATE_EXPOSED,
|
|
1339
1339
|
title: 'SSL Certificate Exposed',
|
|
1340
1340
|
description: 'The application exposes ssl certificate exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1357,7 +1357,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1357
1357
|
},
|
|
1358
1358
|
|
|
1359
1359
|
[VulnerabilityCode.SENS_MED_GRAPH_QL_ENDPOINT_EXPOSED]: {
|
|
1360
|
-
id:
|
|
1360
|
+
id: 558,
|
|
1361
1361
|
code: VulnerabilityCode.SENS_MED_GRAPH_QL_ENDPOINT_EXPOSED,
|
|
1362
1362
|
title: 'Graph Ql Endpoint Exposed',
|
|
1363
1363
|
description: 'The application exposes graph ql endpoint exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1380,7 +1380,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1380
1380
|
},
|
|
1381
1381
|
|
|
1382
1382
|
[VulnerabilityCode.SENS_MED_GRAPHI_QL_EXPOSED]: {
|
|
1383
|
-
id:
|
|
1383
|
+
id: 559,
|
|
1384
1384
|
code: VulnerabilityCode.SENS_MED_GRAPHI_QL_EXPOSED,
|
|
1385
1385
|
title: 'Graphi Ql Exposed',
|
|
1386
1386
|
description: 'The application exposes graphi ql exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1403,7 +1403,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1403
1403
|
},
|
|
1404
1404
|
|
|
1405
1405
|
[VulnerabilityCode.SENS_MED_TERRAFORM_LOCK_EXPOSED]: {
|
|
1406
|
-
id:
|
|
1406
|
+
id: 560,
|
|
1407
1407
|
code: VulnerabilityCode.SENS_MED_TERRAFORM_LOCK_EXPOSED,
|
|
1408
1408
|
title: 'Terraform Lock Exposed',
|
|
1409
1409
|
description: 'The application exposes terraform lock exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1426,7 +1426,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1426
1426
|
},
|
|
1427
1427
|
|
|
1428
1428
|
[VulnerabilityCode.SENS_HIGH_TERRAFORM_VARS_EXPOSED]: {
|
|
1429
|
-
id:
|
|
1429
|
+
id: 561,
|
|
1430
1430
|
code: VulnerabilityCode.SENS_HIGH_TERRAFORM_VARS_EXPOSED,
|
|
1431
1431
|
title: 'Terraform Vars Exposed',
|
|
1432
1432
|
description: 'The application exposes terraform vars exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1449,7 +1449,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1449
1449
|
},
|
|
1450
1450
|
|
|
1451
1451
|
[VulnerabilityCode.SENS_MED_ERROR_LOG_EXPOSED]: {
|
|
1452
|
-
id:
|
|
1452
|
+
id: 562,
|
|
1453
1453
|
code: VulnerabilityCode.SENS_MED_ERROR_LOG_EXPOSED,
|
|
1454
1454
|
title: 'Error Log Exposed',
|
|
1455
1455
|
description: 'The application exposes error log exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1472,7 +1472,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1472
1472
|
},
|
|
1473
1473
|
|
|
1474
1474
|
[VulnerabilityCode.SENS_MED_ACCESS_LOG_EXPOSED]: {
|
|
1475
|
-
id:
|
|
1475
|
+
id: 563,
|
|
1476
1476
|
code: VulnerabilityCode.SENS_MED_ACCESS_LOG_EXPOSED,
|
|
1477
1477
|
title: 'Access Log Exposed',
|
|
1478
1478
|
description: 'The application exposes access log exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1495,7 +1495,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1495
1495
|
},
|
|
1496
1496
|
|
|
1497
1497
|
[VulnerabilityCode.SENS_MED_DEBUG_LOG_EXPOSED]: {
|
|
1498
|
-
id:
|
|
1498
|
+
id: 564,
|
|
1499
1499
|
code: VulnerabilityCode.SENS_MED_DEBUG_LOG_EXPOSED,
|
|
1500
1500
|
title: 'Debug Log Exposed',
|
|
1501
1501
|
description: 'The application exposes debug log exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1518,7 +1518,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1518
1518
|
},
|
|
1519
1519
|
|
|
1520
1520
|
[VulnerabilityCode.SENS_MED_APPLICATION_LOG_EXPOSED]: {
|
|
1521
|
-
id:
|
|
1521
|
+
id: 565,
|
|
1522
1522
|
code: VulnerabilityCode.SENS_MED_APPLICATION_LOG_EXPOSED,
|
|
1523
1523
|
title: 'Application Log Exposed',
|
|
1524
1524
|
description: 'The application exposes application log exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1541,7 +1541,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1541
1541
|
},
|
|
1542
1542
|
|
|
1543
1543
|
[VulnerabilityCode.SENS_HIGH_LARAVEL_LOG_EXPOSED]: {
|
|
1544
|
-
id:
|
|
1544
|
+
id: 566,
|
|
1545
1545
|
code: VulnerabilityCode.SENS_HIGH_LARAVEL_LOG_EXPOSED,
|
|
1546
1546
|
title: 'Laravel Log Exposed',
|
|
1547
1547
|
description: 'The application exposes laravel log exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1564,7 +1564,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1564
1564
|
},
|
|
1565
1565
|
|
|
1566
1566
|
[VulnerabilityCode.SENS_HIGH_WORD_PRESS_DEBUG_LOG_EXPOSED]: {
|
|
1567
|
-
id:
|
|
1567
|
+
id: 567,
|
|
1568
1568
|
code: VulnerabilityCode.SENS_HIGH_WORD_PRESS_DEBUG_LOG_EXPOSED,
|
|
1569
1569
|
title: 'Word Press Debug Log Exposed',
|
|
1570
1570
|
description: 'The application exposes word press debug log exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1587,7 +1587,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1587
1587
|
},
|
|
1588
1588
|
|
|
1589
1589
|
[VulnerabilityCode.SENS_HIGH_ADMINER_EXPOSED]: {
|
|
1590
|
-
id:
|
|
1590
|
+
id: 568,
|
|
1591
1591
|
code: VulnerabilityCode.SENS_HIGH_ADMINER_EXPOSED,
|
|
1592
1592
|
title: 'Adminer Exposed',
|
|
1593
1593
|
description: 'The application exposes adminer exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1610,7 +1610,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1610
1610
|
},
|
|
1611
1611
|
|
|
1612
1612
|
[VulnerabilityCode.SENS_MED_WSDL_EXPOSED]: {
|
|
1613
|
-
id:
|
|
1613
|
+
id: 569,
|
|
1614
1614
|
code: VulnerabilityCode.SENS_MED_WSDL_EXPOSED,
|
|
1615
1615
|
title: 'WSDL Exposed',
|
|
1616
1616
|
description: 'The application exposes wsdl exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1633,7 +1633,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1633
1633
|
},
|
|
1634
1634
|
|
|
1635
1635
|
[VulnerabilityCode.SENS_HIGH_DEBUG_ENDPOINT_EXPOSED]: {
|
|
1636
|
-
id:
|
|
1636
|
+
id: 570,
|
|
1637
1637
|
code: VulnerabilityCode.SENS_HIGH_DEBUG_ENDPOINT_EXPOSED,
|
|
1638
1638
|
title: 'Debug Endpoint Exposed',
|
|
1639
1639
|
description: 'The application exposes debug endpoint exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1656,7 +1656,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1656
1656
|
},
|
|
1657
1657
|
|
|
1658
1658
|
[VulnerabilityCode.SENS_HIGH_GO_DEBUG_VARS_EXPOSED]: {
|
|
1659
|
-
id:
|
|
1659
|
+
id: 571,
|
|
1660
1660
|
code: VulnerabilityCode.SENS_HIGH_GO_DEBUG_VARS_EXPOSED,
|
|
1661
1661
|
title: 'Go Debug Vars Exposed',
|
|
1662
1662
|
description: 'The application exposes go debug vars exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1679,7 +1679,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1679
1679
|
},
|
|
1680
1680
|
|
|
1681
1681
|
[VulnerabilityCode.SENS_HIGH_GO_PPROF_EXPOSED]: {
|
|
1682
|
-
id:
|
|
1682
|
+
id: 572,
|
|
1683
1683
|
code: VulnerabilityCode.SENS_HIGH_GO_PPROF_EXPOSED,
|
|
1684
1684
|
title: 'Go Pprof Exposed',
|
|
1685
1685
|
description: 'The application exposes go pprof exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1702,7 +1702,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1702
1702
|
},
|
|
1703
1703
|
|
|
1704
1704
|
[VulnerabilityCode.SENS_MED_WORD_PRESS_XML_RPC_EXPOSED]: {
|
|
1705
|
-
id:
|
|
1705
|
+
id: 573,
|
|
1706
1706
|
code: VulnerabilityCode.SENS_MED_WORD_PRESS_XML_RPC_EXPOSED,
|
|
1707
1707
|
title: 'Word Press XML Rpc Exposed',
|
|
1708
1708
|
description: 'The application exposes word press xml rpc exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1725,7 +1725,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1725
1725
|
},
|
|
1726
1726
|
|
|
1727
1727
|
[VulnerabilityCode.SENS_LOW_TEST_ENDPOINT_EXPOSED]: {
|
|
1728
|
-
id:
|
|
1728
|
+
id: 574,
|
|
1729
1729
|
code: VulnerabilityCode.SENS_LOW_TEST_ENDPOINT_EXPOSED,
|
|
1730
1730
|
title: 'Test Endpoint Exposed',
|
|
1731
1731
|
description: 'The application exposes test endpoint exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1748,7 +1748,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1748
1748
|
},
|
|
1749
1749
|
|
|
1750
1750
|
[VulnerabilityCode.SENS_LOW_STAGING_ENDPOINT_EXPOSED]: {
|
|
1751
|
-
id:
|
|
1751
|
+
id: 575,
|
|
1752
1752
|
code: VulnerabilityCode.SENS_LOW_STAGING_ENDPOINT_EXPOSED,
|
|
1753
1753
|
title: 'Staging Endpoint Exposed',
|
|
1754
1754
|
description: 'The application exposes staging endpoint exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1771,7 +1771,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1771
1771
|
},
|
|
1772
1772
|
|
|
1773
1773
|
[VulnerabilityCode.SENS_LOW_EDITOR_BACKUP_FILE_DETECTED]: {
|
|
1774
|
-
id:
|
|
1774
|
+
id: 576,
|
|
1775
1775
|
code: VulnerabilityCode.SENS_LOW_EDITOR_BACKUP_FILE_DETECTED,
|
|
1776
1776
|
title: 'Editor Backup File Detected',
|
|
1777
1777
|
description: 'The application exposes editor backup file detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1794,7 +1794,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1794
1794
|
},
|
|
1795
1795
|
|
|
1796
1796
|
[VulnerabilityCode.SENS_LOW_VIM_SWAP_FILE_DETECTED]: {
|
|
1797
|
-
id:
|
|
1797
|
+
id: 577,
|
|
1798
1798
|
code: VulnerabilityCode.SENS_LOW_VIM_SWAP_FILE_DETECTED,
|
|
1799
1799
|
title: 'VIM Swap File Detected',
|
|
1800
1800
|
description: 'The application exposes vim swap file detected in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1817,7 +1817,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1817
1817
|
},
|
|
1818
1818
|
|
|
1819
1819
|
[VulnerabilityCode.SENS_LOW_DIRECTORY_LISTING_ENABLED]: {
|
|
1820
|
-
id:
|
|
1820
|
+
id: 578,
|
|
1821
1821
|
code: VulnerabilityCode.SENS_LOW_DIRECTORY_LISTING_ENABLED,
|
|
1822
1822
|
title: 'Directory Listing Enabled',
|
|
1823
1823
|
description: 'The application exposes directory listing enabled in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1840,7 +1840,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1840
1840
|
},
|
|
1841
1841
|
|
|
1842
1842
|
[VulnerabilityCode.SENS_HIGH_AZURE_STORAGE_CONFIG_EXPOSED]: {
|
|
1843
|
-
id:
|
|
1843
|
+
id: 579,
|
|
1844
1844
|
code: VulnerabilityCode.SENS_HIGH_AZURE_STORAGE_CONFIG_EXPOSED,
|
|
1845
1845
|
title: 'AZURE Storage Config Exposed',
|
|
1846
1846
|
description: 'The application exposes azure storage config exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1863,7 +1863,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1863
1863
|
},
|
|
1864
1864
|
|
|
1865
1865
|
[VulnerabilityCode.SENS_HIGH_MONGO_RC_EXPOSED]: {
|
|
1866
|
-
id:
|
|
1866
|
+
id: 580,
|
|
1867
1867
|
code: VulnerabilityCode.SENS_HIGH_MONGO_RC_EXPOSED,
|
|
1868
1868
|
title: 'Mongo Rc Exposed',
|
|
1869
1869
|
description: 'The application exposes mongo rc exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1886,7 +1886,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1886
1886
|
},
|
|
1887
1887
|
|
|
1888
1888
|
[VulnerabilityCode.SENS_LOW_AWSSAM_TEMPLATE_EXPOSED]: {
|
|
1889
|
-
id:
|
|
1889
|
+
id: 581,
|
|
1890
1890
|
code: VulnerabilityCode.SENS_LOW_AWSSAM_TEMPLATE_EXPOSED,
|
|
1891
1891
|
title: 'Awssam Template Exposed',
|
|
1892
1892
|
description: 'The application exposes awssam template exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1909,7 +1909,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1909
1909
|
},
|
|
1910
1910
|
|
|
1911
1911
|
[VulnerabilityCode.SENS_LOW_SERVERLESS_CONFIG_EXPOSED]: {
|
|
1912
|
-
id:
|
|
1912
|
+
id: 582,
|
|
1913
1913
|
code: VulnerabilityCode.SENS_LOW_SERVERLESS_CONFIG_EXPOSED,
|
|
1914
1914
|
title: 'Serverless Config Exposed',
|
|
1915
1915
|
description: 'The application exposes serverless config exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|
|
@@ -1932,7 +1932,7 @@ export const SENSITIVE_PATH_VULNERABILITIES: Record<string, VulnerabilityDefinit
|
|
|
1932
1932
|
},
|
|
1933
1933
|
|
|
1934
1934
|
[VulnerabilityCode.SENS_LOW_CLOUD_FORMATION_TEMPLATE_EXPOSED]: {
|
|
1935
|
-
id:
|
|
1935
|
+
id: 583,
|
|
1936
1936
|
code: VulnerabilityCode.SENS_LOW_CLOUD_FORMATION_TEMPLATE_EXPOSED,
|
|
1937
1937
|
title: 'Cloud Formation Template Exposed',
|
|
1938
1938
|
description: 'The application exposes cloud formation template exposed in a web-accessible location, which can reveal sensitive configuration, credentials, or operational details and enable attackers to further compromise the system or pivot to other assets.',
|