Skip to content

Commit f3ce97c

Browse files
TimmyBugcrowdjhas3c
TimmyBugcrowd
and
jhas3c
authored
V1.11 (#392)
* Update vulnerability-rating-taxonomy.json * v1.11 * Revert "Update vulnerability-rating-taxonomy.json" This reverts commit 3222464. * Update vulnerability-rating-taxonomy.json Co-authored-by: Deepak Kumar Jha <[email protected]> --------- Co-authored-by: Deepak Kumar Jha <[email protected]>
1 parent 967aa57 commit f3ce97c

File tree

2 files changed

+67
-1
lines changed

2 files changed

+67
-1
lines changed

‎CHANGELOG.md

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,72 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p
1010

1111
### Changed
1212

13+
## [v1.11](https://github.com/bugcrowd/vulnerability-rating-taxonomy/compare/v1.10...v1.11) - 2023-11-20
14+
### Added
15+
- Sensitive Data Exposure - Disclosure of Secrets - PII Leakage/Exposure: VARIES
16+
- Sensitive Data Exposure - Disclosure of Secrets - Sensitive data Leakage/Exposure: P1
17+
- Server-Side Injection - Content Spoofing - HTML Content Injection: P5
18+
- Broken Authentication and Session Management - Failure to invalidate session - Permission change: VARIES
19+
- Server Security Misconfiguration - Request Smuggling: VARIES
20+
- Cryptographic Weakness - Insufficient Entropy - Limited Random Number Generator (RNG) Entropy Source: P4
21+
- Cryptographic Weakness - Insufficient_Entropy - Use of True Random Number Generator (TRNG) for Non-Security Purpose: P5
22+
- Cryptographic Weakness - Insufficient_Entropy - Pseudo-Random Number Generator (PRNG) Seed Reuse: P5
23+
- Cryptographic Weakness - Insufficient_Entropy - Predictable Pseudo-Random Number Generator (PRNG) Seed: P4
24+
- Cryptographic Weakness - Insufficient_Entropy - Small Seed Space in Pseudo-Random Number Generator (PRNG): P4
25+
- Cryptographic Weakness - Insufficient_Entropy - Initialization Vector (IV) Reuse: P5
26+
- Cryptographic Weakness - Insufficient_Entropy - Predictable Initialization Vector (IV): P4
27+
- Cryptographic Weakness - Insecure Implementation - Missing Cryptographic Step: VARIES
28+
- Cryptographic Weakness - Insecure Implementation - Improper Following of Specification (Other): VARIES
29+
- Cryptographic Weakness - Weak Hash - Lack of Salt: VARIES
30+
- Cryptographic Weakness - Weak Hash - Use of Predictable Salt: P5
31+
- Cryptographic Weakness - Weak Hash - Predictable Hash Collision: VARIES
32+
- Cryptographic Weakness - Insufficient Verification of Data Authenticity - Integrity Check Value (ICV): P4
33+
- Cryptographic Weakness - Insufficient Verification of Data Authenticity - Cryptographic Signature: VARIES
34+
- Cryptographic Weakness - Insecure Key Generation - Improper Asymmetric Prime Selection: VARIES
35+
- Cryptographic Weakness - Insecure Key Generation - Improper Asymmetric Exponent Selection: VARIES
36+
- Cryptographic Weakness - Insecure Key Generation - Insufficient Key Stretching: VARIES
37+
- Cryptographic Weakness - Insecure Key Generation - Insufficient Key Space: P3
38+
- Cryptographic Weakness - Insecure Key Generation - Key Exchage Without Entity Authentication: P3
39+
- Cryptographic Weakness - Key Reuse - Lack of Perfect Forward Secrecy: P4
40+
- Cryptographic Weakness - Key Reuse - Intra-Environment: P5
41+
- Cryptographic Weakness - Key Reuse - Inter-Environment: P2
42+
- Cryptographic Weakness - Side-Channel Attack - Padding Oracle Attack: P4
43+
- Cryptographic Weakness - Side-Channel Attack - Timing Attack: P4
44+
- Cryptographic Weakness - Side-Channel Attack - Power Analysis Attack: P5
45+
- Cryptographic Weakness - Side-Channel Attack - Emanations Attack: P5
46+
- Cryptographic Weakness - Side-Channel Attack - Differential Fault Analysis: VARIES
47+
- Cryptographic Weakness - Use of Expired Cryptographic Key (or Certificate): P4
48+
- Cryptographic Weakness - Incomplete Cleanup of Keying Material: P5
49+
- Cryptographic Weakness - Broken Cryptography - Use of Broken Cryptographic Primitive: P3
50+
- Cryptographic Weakness - Broken Cryptography - Use of Vulnerable Cryptographic Library: P4
51+
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Manipulate Non-Sensitive Information: P5
52+
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Manipulate Sensitive Information | GUID/Complex Object Identifiers: P4
53+
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read Sensitive Information | Iteratable Object Identifiers: P3
54+
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Alter Sensitive Information | Iteratable Object Identifiers: P2
55+
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read Sensitive Information (PII) | Iteratable Object Identifiers: P1
56+
57+
### Changed
58+
FROM:
59+
- Cross-Site Scripting (XSS) - IE-Only - Older Version (< IE11): P5
60+
TO:
61+
- Cross-Site Scripting (XSS) - IE-Only: P5
62+
63+
- FROM:
64+
- Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - Internal High Impact: P2
65+
- Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - Internal Scan and/or Medium Impact: P3
66+
- Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - External: P4
67+
- Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - DNS Query Only : P5
68+
TO:
69+
- Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - Internal High Impact: P2
70+
- Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - Internal Scan and/or Medium Impact: P3
71+
- Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - External - Low impact: P5
72+
- Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - External - DNS Query Only: P5
73+
74+
### Removed
75+
- Cross-Site Scripting (XSS) - IE-Only - IE11: P4
76+
- Broken Cryptography - Cryptographic Flaw - Incorrect Usage: P1
77+
- Automotive Security Misconfiguration - Infotainment, Radio Head Unit - PII Leakage: P1
78+
1379
## [v1.10.1](https://github.com/bugcrowd/vulnerability-rating-taxonomy/compare/v1.10...v1.10.1) - 2021-03-29
1480
### Changed
1581
- renamed `secure code warriors` mapping to `secure code warrior`

‎vulnerability-rating-taxonomy.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"metadata": {
3-
"release_date": "2021-03-29T00:00:00+00:00"
3+
"release_date": "2023-11-20T00:00:00+00:00"
44
},
55
"content": [
66
{

0 commit comments

Comments
 (0)