Publish CVE channel
This commit is contained in:
Andre committed
1 parent
ff9d215c3f
commit
a27f575b1d
1 file changed
+112
-2
@@ -1,5 +1,5 @@
|
||||
{
|
||||
"build_datetime": "2026-11-04T15:00:48Z",
|
||||
"build_datetime": "2026-11-08T16:48:55Z",
|
||||
"rulesets": [
|
||||
{
|
||||
"id": "edgeguard-cve",
|
||||
@@ -10,6 +10,26 @@
|
||||
"enabled": true,
|
||||
"priority": 1,
|
||||
"rules": [
|
||||
{
|
||||
"id": "CVE-2016-3081-M1",
|
||||
"name": "Apache Struts S2-032 - OGNL execution via the method: prefix",
|
||||
"pattern": "(?i)method:#_memberAccess=@ognl\\.OgnlContext@DEFAULT_MEMBER_ACCESS",
|
||||
"targets": [
|
||||
"uri",
|
||||
"query",
|
||||
"body"
|
||||
],
|
||||
"action": "log",
|
||||
"severity": "high",
|
||||
"category": "cve",
|
||||
"cve": "CVE-2016-3081",
|
||||
"enabled": true,
|
||||
"references": [
|
||||
"https://cwiki.apache.org/confluence/display/WW/S2-032",
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2016-3081"
|
||||
],
|
||||
"origin": "hand-written. The imported pattern was the Nuclei probe's entire OGNL expression, ending in \"&cmd=cat /etc/passwd\", so it only matched an attacker who chose that command with those parameters in that order. This is the 60-character prefix every S2-032 payload shares: the method: prefix plus the _memberAccess assignment that unlocks OGNL. No legitimate request carries it, and every variant does."
|
||||
},
|
||||
{
|
||||
"id": "CVE-2017-9841-N1",
|
||||
"name": "PHPUnit - Remote Code Execution",
|
||||
@@ -26,7 +46,97 @@
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2017-9841",
|
||||
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2017/CVE-2017-9841.yaml"
|
||||
],
|
||||
"origin": "imported from the Nuclei template by tools/nuclei-importer. Severity is critical deliberately: it is what makes the rule act at all. The action field is not read by the engine \u2014 the decision is severity-derived score against the tenant threshold \u2014 so a sub-threshold rule neither blocks nor records anything."
|
||||
"origin": "imported from the Nuclei template by tools/nuclei-importer. Severity is critical deliberately: it is what makes the rule act at all. The action field is not read by the engine — the decision is severity-derived score against the tenant threshold — so a sub-threshold rule neither blocks nor records anything."
|
||||
},
|
||||
{
|
||||
"id": "CVE-2026-104935-N1",
|
||||
"name": "Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header",
|
||||
"pattern": "(?i)X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu\\.cgi",
|
||||
"targets": [
|
||||
"headers"
|
||||
],
|
||||
"action": "log",
|
||||
"severity": "high",
|
||||
"category": "cve",
|
||||
"cve": "CVE-2026-104935",
|
||||
"enabled": true,
|
||||
"references": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2026-104935",
|
||||
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-104935.yaml"
|
||||
],
|
||||
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
||||
},
|
||||
{
|
||||
"id": "CVE-2026-105134-N1",
|
||||
"name": "AhsayCBS <= 10.3.4 - Unauthenticated RCE",
|
||||
"pattern": "(?i)\\.\\./\\.\\./webapps/rps\"\\)\\}\\}",
|
||||
"targets": [
|
||||
"headers"
|
||||
],
|
||||
"action": "log",
|
||||
"severity": "high",
|
||||
"category": "cve",
|
||||
"cve": "CVE-2026-105134",
|
||||
"enabled": true,
|
||||
"references": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2026-105134",
|
||||
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-105134.yaml"
|
||||
],
|
||||
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
||||
},
|
||||
{
|
||||
"id": "CVE-2026-110447-N1",
|
||||
"name": "Collabora Built-in CODE Server < 26.4.303 - OS Command Injection",
|
||||
"pattern": "(?i)/\\.\\./apps/richdocumentscode_arm64/proxy\\.php",
|
||||
"targets": [
|
||||
"uri"
|
||||
],
|
||||
"action": "log",
|
||||
"severity": "high",
|
||||
"category": "cve",
|
||||
"cve": "CVE-2026-110447",
|
||||
"enabled": true,
|
||||
"references": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2026-110447",
|
||||
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-110447.yaml"
|
||||
],
|
||||
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
||||
},
|
||||
{
|
||||
"id": "CVE-2026-21589-N1",
|
||||
"name": "Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read",
|
||||
"pattern": "(?i)/1\\.0/_/download/resources/com\\.atlassian\\.bitbucket\\.server\\.bitbucket-webpack-INTERNAL:avatar/avatar/\\.\\.::\\.\\.::\\.\\.::\\.\\.::\\.\\.::WEB-INF::urlrewrite\\.xml",
|
||||
"targets": [
|
||||
"uri"
|
||||
],
|
||||
"action": "log",
|
||||
"severity": "high",
|
||||
"category": "cve",
|
||||
"cve": "CVE-2026-21589",
|
||||
"enabled": true,
|
||||
"references": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2026-21589",
|
||||
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-21589.yaml"
|
||||
],
|
||||
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
||||
},
|
||||
{
|
||||
"id": "CVE-2026-87902-N1",
|
||||
"name": "WordPress Core - PHP Template Path Traversal",
|
||||
"pattern": "(?i)pagename=templates/\\.\\./\\.\\./\\.\\./\\.\\./wp-includes/theme-compat/footer",
|
||||
"targets": [
|
||||
"query"
|
||||
],
|
||||
"action": "log",
|
||||
"severity": "high",
|
||||
"category": "cve",
|
||||
"cve": "CVE-2026-87902",
|
||||
"enabled": true,
|
||||
"references": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2026-87902",
|
||||
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-87902.yaml"
|
||||
],
|
||||
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user