From 48953206976238234ecacf052625ccf7a358f34a Mon Sep 17 00:00:00 2001 From: "andre.bolinhas" Date: Sun, 8 Nov 2026 17:10:01 +0000 Subject: [PATCH] Correct the phpunit rule origin --- cve.json | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 60 insertions(+), 6 deletions(-) diff --git a/cve.json b/cve.json index 37477ad..18a05fd 100644 --- a/cve.json +++ b/cve.json @@ -1,5 +1,5 @@ { - "build_datetime": "2026-11-08T16:48:55Z", + "build_datetime": "2026-11-08T17:09:53Z", "rulesets": [ { "id": "edgeguard-cve", @@ -28,7 +28,7 @@ "https://cwiki.apache.org/confluence/display/WW/S2-032", "https://nvd.nist.gov/vuln/detail/CVE-2016-3081" ], - "origin": "hand-written. The imported pattern was the Nuclei probe's entire OGNL expression, ending in \"&cmd=cat /etc/passwd\", so it only matched an attacker who chose that command with those parameters in that order. This is the 60-character prefix every S2-032 payload shares: the method: prefix plus the _memberAccess assignment that unlocks OGNL. No legitimate request carries it, and every variant does." + "origin": "hand-written. The imported pattern was the Nuclei probe's entire OGNL expression, ending in \"\u0026cmd=cat /etc/passwd\", so it only matched an attacker who chose that command with those parameters in that order. This is the 60-character prefix every S2-032 payload shares: the method: prefix plus the _memberAccess assignment that unlocks OGNL. No legitimate request carries it, and every variant does." }, { "id": "CVE-2017-9841-N1", @@ -46,11 +46,11 @@ "https://nvd.nist.gov/vuln/detail/CVE-2017-9841", "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2017/CVE-2017-9841.yaml" ], - "origin": "imported from the Nuclei template by tools/nuclei-importer. Severity is critical deliberately: it is what makes the rule act at all. The action field is not read by the engine — the decision is severity-derived score against the tenant threshold — so a sub-threshold rule neither blocks nor records anything." + "origin": "imported from the Nuclei template by tools/nuclei-importer, then promoted to block by hand. Its path is a file that should never be web-reachable, so a request for it is the attack and there is nothing legitimate to refuse. The other rules in this channel carry action \"log\": the engine records those and adds nothing to the anomaly score, so they cannot refuse anything on their own." }, { "id": "CVE-2026-104935-N1", - "name": "Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header", + "name": "Ivanti Connect Secure \u003c= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header", "pattern": "(?i)X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu\\.cgi", "targets": [ "headers" @@ -68,7 +68,7 @@ }, { "id": "CVE-2026-105134-N1", - "name": "AhsayCBS <= 10.3.4 - Unauthenticated RCE", + "name": "AhsayCBS \u003c= 10.3.4 - Unauthenticated RCE", "pattern": "(?i)\\.\\./\\.\\./webapps/rps\"\\)\\}\\}", "targets": [ "headers" @@ -86,7 +86,7 @@ }, { "id": "CVE-2026-110447-N1", - "name": "Collabora Built-in CODE Server < 26.4.303 - OS Command Injection", + "name": "Collabora Built-in CODE Server \u003c 26.4.303 - OS Command Injection", "pattern": "(?i)/\\.\\./apps/richdocumentscode_arm64/proxy\\.php", "targets": [ "uri" @@ -120,6 +120,60 @@ ], "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation" }, + { + "id": "CVE-2026-34908-N1", + "name": "UniFi OS - Authentication Bypass via Path Traversal (..%2f)", + "pattern": "(?i)/auth/validate-sso/\\.\\./\\.\\./\\.\\./proxy/users/api/v2/ucs/update/latest_package", + "targets": [ + "uri" + ], + "action": "log", + "severity": "high", + "category": "cve", + "cve": "CVE-2026-34908", + "enabled": true, + "references": [ + "https://nvd.nist.gov/vuln/detail/CVE-2026-34908", + "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-34908.yaml" + ], + "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation" + }, + { + "id": "CVE-2026-34910-N1", + "name": "UniFi OS Server - Command Injection", + "pattern": "(?i)/auth/validate-sso/\\.\\./\\.\\./\\.\\./proxy/users/api/v2/ucs/update/latest_package", + "targets": [ + "uri" + ], + "action": "log", + "severity": "high", + "category": "cve", + "cve": "CVE-2026-34910", + "enabled": true, + "references": [ + "https://nvd.nist.gov/vuln/detail/CVE-2026-34910", + "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-34910.yaml" + ], + "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation" + }, + { + "id": "CVE-2026-75650-N1", + "name": "Adobe Commerce/Magento \u003c= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI", + "pattern": "(?i)text=\\{\\{block class=Magento\\\\Backend\\\\Block\\\\Widget\\\\Grid\\\\ColumnSet rowUrl=\\$this\\.template_styles cache_key=y\\}\\}", + "targets": [ + "query" + ], + "action": "log", + "severity": "high", + "category": "cve", + "cve": "CVE-2026-75650", + "enabled": true, + "references": [ + "https://nvd.nist.gov/vuln/detail/CVE-2026-75650", + "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-75650.yaml" + ], + "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation" + }, { "id": "CVE-2026-87902-N1", "name": "WordPress Core - PHP Template Path Traversal",