From af2b616a1213d886fe2b673bf7152dfedd784eed Mon Sep 17 00:00:00 2001 From: Tiago Mendo Date: Thu, 1 Oct 2026 11:12:05 +0100 Subject: [PATCH] fix: replace CWE category entries with proper weakness CWEs Categories are prohibited for vulnerability mapping (https://cwe.mitre.org/data/definitions/604.html). Reapplied onto the YAML front-matter format on main, and extended to the files added since the original change. - CWE-1035 -> CWE-1395 (Dependency on Vulnerable Third-Party Component), 47 files - CWE-16 -> CWE-1004 / CWE-693 / CWE-295 / CWE-299 - CWE-264 -> CWE-400 / CWE-757 - CWE-310 -> CWE-326 Co-Authored-By: Claude Sonnet 5.5 --- angularjs-library-with-known-vulnerabilities.md | 4 ++-- axios-library-with-known-vulnerabilities.md | 4 ++-- backbone-library-with-known-vulnerabilities.md | 4 ++-- bootstrap-library-with-known-vulnerabilities.md | 4 ++-- browser-content-sniffing-allowed.md | 4 ++-- ...cient-key-size-or-usage-or-insecure-signature-algorithm.md | 4 ++-- certificate-without-revocation-information.md | 4 ++-- chartjs-library-with-known-vulnerabilities.md | 4 ++-- ckeditor-library-with-known-vulnerabilities.md | 4 ++-- cookie-without-httponly-flag.md | 4 ++-- dojo-library-with-known-vulnerabilities.md | 4 ++-- dompurify-library-with-known-vulnerabilities.md | 4 ++-- drupal-version-with-known-vulnerabilities.md | 4 ++-- dwr-library-with-known-vulnerabilities.md | 4 ++-- easyxdm-library-with-known-vulnerabilities.md | 4 ++-- ember-library-with-known-vulnerabilities.md | 4 ++-- ext-js-library-with-known-vulnerabilities.md | 4 ++-- flowplayer-library-with-known-vulnerabilities.md | 4 ++-- froala-library-with-known-vulnerabilities.md | 4 ++-- handlebars-library-with-known-vulnerabilities.md | 4 ++-- highcharts-library-with-known-vulnerabilities.md | 4 ++-- http-trace-method-enabled.md | 4 ++-- insecure-browser-xss-protection-enabled.md | 4 ++-- joomla-version-with-known-vulnerabilities.md | 4 ++-- jplayer-library-with-known-vulnerabilities.md | 4 ++-- jquery-file-upload-library-with-known-vulnerabilities.md | 4 ++-- jquery-library-with-known-vulnerabilities.md | 4 ++-- jquery-migrate-library-with-known-vulnerabilities.md | 4 ++-- jquery-mobile-library-with-known-vulnerabilities.md | 4 ++-- jquery-ui-library-with-known-vulnerabilities.md | 4 ++-- jszip-library-with-known-vulnerabilities.md | 4 ++-- knockout-library-with-known-vulnerabilities.md | 4 ++-- lodash-library-with-known-vulnerabilities.md | 4 ++-- mathjax-library-with-known-vulnerabilities.md | 4 ++-- momentjs-library-with-known-vulnerabilities.md | 4 ++-- mustache-library-with-known-vulnerabilities.md | 4 ++-- nextjs-library-with-known-vulnerabilities.md | 4 ++-- pdfjs-library-with-known-vulnerabilities.md | 4 ++-- plupload-library-with-known-vulnerabilities.md | 4 ++-- potential-dos-on-tls-client-renegotiation.md | 4 ++-- prettyphoto-library-with-known-vulnerabilities.md | 4 ++-- prototype-library-with-known-vulnerabilities.md | 4 ++-- react-library-with-known-vulnerabilities.md | 4 ++-- secure-renegotiation-is-not-supported.md | 4 ++-- select2-library-with-known-vulnerabilities.md | 4 ++-- sessvars-library-with-known-vulnerabilities.md | 4 ++-- svelte-library-with-known-vulnerabilities.md | 4 ++-- swfobject-library-with-known-vulnerabilities.md | 4 ++-- tinymce-library-with-known-vulnerabilities.md | 4 ++-- uaparserjs-library-with-known-vulnerabilities.md | 4 ++-- underscorejs-library-with-known-vulnerabilities.md | 4 ++-- untrusted-tls-certificate.md | 4 ++-- vuejs-library-with-known-vulnerabilities.md | 4 ++-- wordpress-plugin-with-known-vulnerabilities.md | 4 ++-- wordpress-version-with-known-vulnerabilities.md | 4 ++-- yui-library-with-known-vulnerabilities.md | 4 ++-- 56 files changed, 112 insertions(+), 112 deletions(-) diff --git a/angularjs-library-with-known-vulnerabilities.md b/angularjs-library-with-known-vulnerabilities.md index e90675f..970aef1 100644 --- a/angularjs-library-with-known-vulnerabilities.md +++ b/angularjs-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: AngularJS library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/axios-library-with-known-vulnerabilities.md b/axios-library-with-known-vulnerabilities.md index 06ddcc4..b715925 100644 --- a/axios-library-with-known-vulnerabilities.md +++ b/axios-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Axios library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/backbone-library-with-known-vulnerabilities.md b/backbone-library-with-known-vulnerabilities.md index 7e56c5f..3e0120b 100644 --- a/backbone-library-with-known-vulnerabilities.md +++ b/backbone-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Backbone library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/bootstrap-library-with-known-vulnerabilities.md b/bootstrap-library-with-known-vulnerabilities.md index f0f89aa..f8046bb 100644 --- a/bootstrap-library-with-known-vulnerabilities.md +++ b/bootstrap-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Bootstrap library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/browser-content-sniffing-allowed.md b/browser-content-sniffing-allowed.md index d4915f0..39c5536 100644 --- a/browser-content-sniffing-allowed.md +++ b/browser-content-sniffing-allowed.md @@ -3,8 +3,8 @@ name: Browser content sniffing allowed severity: low cvss-score: 4.7 cvss-vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N -cwe-id: CWE-16 -cwe-name: Configuration +cwe-id: CWE-693 +cwe-name: Protection Mechanism Failure compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/certificate-with-insufficient-key-size-or-usage-or-insecure-signature-algorithm.md b/certificate-with-insufficient-key-size-or-usage-or-insecure-signature-algorithm.md index 7b2d64b..506320c 100644 --- a/certificate-with-insufficient-key-size-or-usage-or-insecure-signature-algorithm.md +++ b/certificate-with-insufficient-key-size-or-usage-or-insecure-signature-algorithm.md @@ -3,8 +3,8 @@ name: Certificate with insufficient key size or usage, or insecure signature alg severity: low cvss-score: 4.2 cvss-vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-310 -cwe-name: Cryptographic Issues +cwe-id: CWE-326 +cwe-name: Inadequate Encryption Strength correlatable: SAST compliance: HIPAA: 164.306(a), 164.312(c)(1), 164.312(e)(1) diff --git a/certificate-without-revocation-information.md b/certificate-without-revocation-information.md index 6600c9e..522ccb0 100644 --- a/certificate-without-revocation-information.md +++ b/certificate-without-revocation-information.md @@ -3,8 +3,8 @@ name: Certificate without revocation information severity: low cvss-score: 5.3 cvss-vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N -cwe-id: CWE-16 -cwe-name: Configuration +cwe-id: CWE-299 +cwe-name: Improper Check for Certificate Revocation compliance: HIPAA: 164.306(a), 164.312(c)(1), 164.312(e)(1) ISO 27001: A.5.14, A.8.9, A.8.24 diff --git a/chartjs-library-with-known-vulnerabilities.md b/chartjs-library-with-known-vulnerabilities.md index 6bdfed8..89e01c9 100644 --- a/chartjs-library-with-known-vulnerabilities.md +++ b/chartjs-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Chart.js library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/ckeditor-library-with-known-vulnerabilities.md b/ckeditor-library-with-known-vulnerabilities.md index 4c8e968..89ad6cd 100644 --- a/ckeditor-library-with-known-vulnerabilities.md +++ b/ckeditor-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: CKEditor library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/cookie-without-httponly-flag.md b/cookie-without-httponly-flag.md index 1480006..c8c8f9c 100644 --- a/cookie-without-httponly-flag.md +++ b/cookie-without-httponly-flag.md @@ -3,8 +3,8 @@ name: Cookie without HttpOnly flag severity: low cvss-score: 3.1 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N -cwe-id: CWE-16 -cwe-name: Configuration +cwe-id: CWE-1004 +cwe-name: Sensitive Cookie Without 'HttpOnly' Flag correlatable: SAST compliance: HIPAA: 164.306(a) diff --git a/dojo-library-with-known-vulnerabilities.md b/dojo-library-with-known-vulnerabilities.md index 95a083c..15fc43d 100644 --- a/dojo-library-with-known-vulnerabilities.md +++ b/dojo-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Dojo library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/dompurify-library-with-known-vulnerabilities.md b/dompurify-library-with-known-vulnerabilities.md index e01b485..48c6ed7 100644 --- a/dompurify-library-with-known-vulnerabilities.md +++ b/dompurify-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: DOMPurify library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/drupal-version-with-known-vulnerabilities.md b/drupal-version-with-known-vulnerabilities.md index 4a24986..e7b5c05 100644 --- a/drupal-version-with-known-vulnerabilities.md +++ b/drupal-version-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Drupal version with known vulnerabilities severity: high cvss-score: 9.1 cvss-vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/dwr-library-with-known-vulnerabilities.md b/dwr-library-with-known-vulnerabilities.md index f803816..2a76082 100644 --- a/dwr-library-with-known-vulnerabilities.md +++ b/dwr-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: DWR library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/easyxdm-library-with-known-vulnerabilities.md b/easyxdm-library-with-known-vulnerabilities.md index d903c9a..a5ebe1d 100644 --- a/easyxdm-library-with-known-vulnerabilities.md +++ b/easyxdm-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: easyXDM library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/ember-library-with-known-vulnerabilities.md b/ember-library-with-known-vulnerabilities.md index f33d20f..4ab3220 100644 --- a/ember-library-with-known-vulnerabilities.md +++ b/ember-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Ember library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/ext-js-library-with-known-vulnerabilities.md b/ext-js-library-with-known-vulnerabilities.md index cf9c311..b5a5a54 100644 --- a/ext-js-library-with-known-vulnerabilities.md +++ b/ext-js-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Ext JS library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/flowplayer-library-with-known-vulnerabilities.md b/flowplayer-library-with-known-vulnerabilities.md index 6eb44df..57b6528 100644 --- a/flowplayer-library-with-known-vulnerabilities.md +++ b/flowplayer-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Flowplayer library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/froala-library-with-known-vulnerabilities.md b/froala-library-with-known-vulnerabilities.md index b3e163a..6936f99 100644 --- a/froala-library-with-known-vulnerabilities.md +++ b/froala-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Froala library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/handlebars-library-with-known-vulnerabilities.md b/handlebars-library-with-known-vulnerabilities.md index b6cfda0..fe6a816 100644 --- a/handlebars-library-with-known-vulnerabilities.md +++ b/handlebars-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Handlebars library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/highcharts-library-with-known-vulnerabilities.md b/highcharts-library-with-known-vulnerabilities.md index b9469c7..d046857 100644 --- a/highcharts-library-with-known-vulnerabilities.md +++ b/highcharts-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Highcharts library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/http-trace-method-enabled.md b/http-trace-method-enabled.md index b232c09..e47162d 100644 --- a/http-trace-method-enabled.md +++ b/http-trace-method-enabled.md @@ -3,8 +3,8 @@ name: HTTP TRACE method enabled severity: low cvss-score: 3.7 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N -cwe-id: CWE-16 -cwe-name: Configuration +cwe-id: CWE-693 +cwe-name: Protection Mechanism Failure compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/insecure-browser-xss-protection-enabled.md b/insecure-browser-xss-protection-enabled.md index ab18e75..c3a99dd 100644 --- a/insecure-browser-xss-protection-enabled.md +++ b/insecure-browser-xss-protection-enabled.md @@ -3,8 +3,8 @@ name: Insecure browser XSS protection enabled severity: low cvss-score: 4.7 cvss-vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N -cwe-id: CWE-16 -cwe-name: Configuration +cwe-id: CWE-693 +cwe-name: Protection Mechanism Failure compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/joomla-version-with-known-vulnerabilities.md b/joomla-version-with-known-vulnerabilities.md index fa5c4d3..85fa374 100644 --- a/joomla-version-with-known-vulnerabilities.md +++ b/joomla-version-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Joomla! version with known vulnerabilities severity: high cvss-score: 9.1 cvss-vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/jplayer-library-with-known-vulnerabilities.md b/jplayer-library-with-known-vulnerabilities.md index e84b748..7893755 100644 --- a/jplayer-library-with-known-vulnerabilities.md +++ b/jplayer-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: jPlayer library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/jquery-file-upload-library-with-known-vulnerabilities.md b/jquery-file-upload-library-with-known-vulnerabilities.md index 6a7f2cb..24b468c 100644 --- a/jquery-file-upload-library-with-known-vulnerabilities.md +++ b/jquery-file-upload-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: jQuery File Upload library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/jquery-library-with-known-vulnerabilities.md b/jquery-library-with-known-vulnerabilities.md index 60d375d..b457222 100644 --- a/jquery-library-with-known-vulnerabilities.md +++ b/jquery-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: JQuery library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component correlatable: SAST compliance: HIPAA: 164.306(a) diff --git a/jquery-migrate-library-with-known-vulnerabilities.md b/jquery-migrate-library-with-known-vulnerabilities.md index f1780ea..9c84810 100644 --- a/jquery-migrate-library-with-known-vulnerabilities.md +++ b/jquery-migrate-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: JQuery Migrate library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component correlatable: SAST compliance: HIPAA: 164.306(a) diff --git a/jquery-mobile-library-with-known-vulnerabilities.md b/jquery-mobile-library-with-known-vulnerabilities.md index 5670e15..dbc738e 100644 --- a/jquery-mobile-library-with-known-vulnerabilities.md +++ b/jquery-mobile-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: JQuery Mobile library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component correlatable: SAST compliance: HIPAA: 164.306(a) diff --git a/jquery-ui-library-with-known-vulnerabilities.md b/jquery-ui-library-with-known-vulnerabilities.md index 77e45e5..fa4ec82 100644 --- a/jquery-ui-library-with-known-vulnerabilities.md +++ b/jquery-ui-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: jQuery UI library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component correlatable: SAST compliance: HIPAA: 164.306(a) diff --git a/jszip-library-with-known-vulnerabilities.md b/jszip-library-with-known-vulnerabilities.md index 4365b7c..3e2d0eb 100644 --- a/jszip-library-with-known-vulnerabilities.md +++ b/jszip-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: JSZip library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/knockout-library-with-known-vulnerabilities.md b/knockout-library-with-known-vulnerabilities.md index f3527ba..d20d680 100644 --- a/knockout-library-with-known-vulnerabilities.md +++ b/knockout-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Knockout library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/lodash-library-with-known-vulnerabilities.md b/lodash-library-with-known-vulnerabilities.md index a4dce98..737ae3a 100644 --- a/lodash-library-with-known-vulnerabilities.md +++ b/lodash-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Lodash library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/mathjax-library-with-known-vulnerabilities.md b/mathjax-library-with-known-vulnerabilities.md index f688310..b5b64ff 100644 --- a/mathjax-library-with-known-vulnerabilities.md +++ b/mathjax-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: MathJax library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/momentjs-library-with-known-vulnerabilities.md b/momentjs-library-with-known-vulnerabilities.md index be6fb6b..401290a 100644 --- a/momentjs-library-with-known-vulnerabilities.md +++ b/momentjs-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Moment.js library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/mustache-library-with-known-vulnerabilities.md b/mustache-library-with-known-vulnerabilities.md index c9f8756..3f237ae 100644 --- a/mustache-library-with-known-vulnerabilities.md +++ b/mustache-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Mustache library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/nextjs-library-with-known-vulnerabilities.md b/nextjs-library-with-known-vulnerabilities.md index 95c270f..3f64250 100644 --- a/nextjs-library-with-known-vulnerabilities.md +++ b/nextjs-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Next.js library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/pdfjs-library-with-known-vulnerabilities.md b/pdfjs-library-with-known-vulnerabilities.md index 3954808..6b3082c 100644 --- a/pdfjs-library-with-known-vulnerabilities.md +++ b/pdfjs-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: PDF.js library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/plupload-library-with-known-vulnerabilities.md b/plupload-library-with-known-vulnerabilities.md index 081c18a..e8024ce 100644 --- a/plupload-library-with-known-vulnerabilities.md +++ b/plupload-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Plupload library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/potential-dos-on-tls-client-renegotiation.md b/potential-dos-on-tls-client-renegotiation.md index 62df79c..f7c3f88 100644 --- a/potential-dos-on-tls-client-renegotiation.md +++ b/potential-dos-on-tls-client-renegotiation.md @@ -3,8 +3,8 @@ name: Potential DoS on TLS Client Renegotiation severity: low cvss-score: 5.3 cvss-vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L -cwe-id: CWE-264 -cwe-name: Permissions, Privileges, and Access Controls +cwe-id: CWE-400 +cwe-name: Uncontrolled Resource Consumption compliance: HIPAA: 164.306(a), 164.312(c)(1), 164.312(e)(1) ISO 27001: A.5.14, A.8.9, A.8.24 diff --git a/prettyphoto-library-with-known-vulnerabilities.md b/prettyphoto-library-with-known-vulnerabilities.md index d440802..a286cf9 100644 --- a/prettyphoto-library-with-known-vulnerabilities.md +++ b/prettyphoto-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: prettyPhoto library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/prototype-library-with-known-vulnerabilities.md b/prototype-library-with-known-vulnerabilities.md index 8b3b0a8..82db04a 100644 --- a/prototype-library-with-known-vulnerabilities.md +++ b/prototype-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Prototype library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/react-library-with-known-vulnerabilities.md b/react-library-with-known-vulnerabilities.md index 93a48a8..c1157ee 100644 --- a/react-library-with-known-vulnerabilities.md +++ b/react-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: React library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/secure-renegotiation-is-not-supported.md b/secure-renegotiation-is-not-supported.md index 84066b9..5b210c8 100644 --- a/secure-renegotiation-is-not-supported.md +++ b/secure-renegotiation-is-not-supported.md @@ -3,8 +3,8 @@ name: Secure Renegotiation is not supported severity: low cvss-score: 4.2 cvss-vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-264 -cwe-name: Permissions, Privileges, and Access Controls +cwe-id: CWE-757 +cwe-name: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') compliance: HIPAA: 164.306(a), 164.312(c)(1), 164.312(e)(1) ISO 27001: A.5.14, A.8.9, A.8.24 diff --git a/select2-library-with-known-vulnerabilities.md b/select2-library-with-known-vulnerabilities.md index f7929f1..b4ad772 100644 --- a/select2-library-with-known-vulnerabilities.md +++ b/select2-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Select2 library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/sessvars-library-with-known-vulnerabilities.md b/sessvars-library-with-known-vulnerabilities.md index 0ec0d3b..18b8894 100644 --- a/sessvars-library-with-known-vulnerabilities.md +++ b/sessvars-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Sessvars library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/svelte-library-with-known-vulnerabilities.md b/svelte-library-with-known-vulnerabilities.md index 29adca0..3f784c1 100644 --- a/svelte-library-with-known-vulnerabilities.md +++ b/svelte-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Svelte library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/swfobject-library-with-known-vulnerabilities.md b/swfobject-library-with-known-vulnerabilities.md index 76af4ef..ef18a8b 100644 --- a/swfobject-library-with-known-vulnerabilities.md +++ b/swfobject-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: SWFObject library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/tinymce-library-with-known-vulnerabilities.md b/tinymce-library-with-known-vulnerabilities.md index ea07d84..c66e8c4 100644 --- a/tinymce-library-with-known-vulnerabilities.md +++ b/tinymce-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: TinyMCE library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/uaparserjs-library-with-known-vulnerabilities.md b/uaparserjs-library-with-known-vulnerabilities.md index f2e7ce9..55b4622 100644 --- a/uaparserjs-library-with-known-vulnerabilities.md +++ b/uaparserjs-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: UAParser.js library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/underscorejs-library-with-known-vulnerabilities.md b/underscorejs-library-with-known-vulnerabilities.md index d68965c..847f827 100644 --- a/underscorejs-library-with-known-vulnerabilities.md +++ b/underscorejs-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Underscore.js library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/untrusted-tls-certificate.md b/untrusted-tls-certificate.md index ea28fdd..4564cca 100644 --- a/untrusted-tls-certificate.md +++ b/untrusted-tls-certificate.md @@ -3,8 +3,8 @@ name: Untrusted TLS certificate severity: medium cvss-score: 5.3 cvss-vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N -cwe-id: CWE-16 -cwe-name: Configuration +cwe-id: CWE-295 +cwe-name: Improper Certificate Validation correlatable: SAST compliance: HIPAA: 164.306(a), 164.312(c)(1), 164.312(e)(1) diff --git a/vuejs-library-with-known-vulnerabilities.md b/vuejs-library-with-known-vulnerabilities.md index e48dd1a..2ed3ebf 100644 --- a/vuejs-library-with-known-vulnerabilities.md +++ b/vuejs-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: Vue.js library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/wordpress-plugin-with-known-vulnerabilities.md b/wordpress-plugin-with-known-vulnerabilities.md index c752d25..3ba1d3e 100644 --- a/wordpress-plugin-with-known-vulnerabilities.md +++ b/wordpress-plugin-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: WordPress plugin with known vulnerabilities severity: high cvss-score: 7.3 cvss-vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) owasp10: A5, A6 diff --git a/wordpress-version-with-known-vulnerabilities.md b/wordpress-version-with-known-vulnerabilities.md index e56ba8c..56cc112 100644 --- a/wordpress-version-with-known-vulnerabilities.md +++ b/wordpress-version-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: WordPress version with known vulnerabilities severity: high cvss-score: 7.3 cvss-vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9 diff --git a/yui-library-with-known-vulnerabilities.md b/yui-library-with-known-vulnerabilities.md index 61d7af5..1111659 100644 --- a/yui-library-with-known-vulnerabilities.md +++ b/yui-library-with-known-vulnerabilities.md @@ -3,8 +3,8 @@ name: YUI library with known vulnerabilities severity: low cvss-score: 4.8 cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N -cwe-id: CWE-1035 -cwe-name: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities +cwe-id: CWE-1395 +cwe-name: Dependency on Vulnerable Third-Party Component compliance: HIPAA: 164.306(a) ISO 27001: A.8.9