Add CVE triage and disposition artifacts for scan hits
This commit is contained in:
beatz174-bit
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"generated_at": "2026-04-07T03:49:38.723646+00:00",
|
||||
"description": "Host-level CVE suppressions derived from triage dispositions.",
|
||||
"suppressions": [
|
||||
{
|
||||
"host": "prometheus.lan.ddnsgeek.com",
|
||||
"signature": "CVE-2009-3733",
|
||||
"reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
|
||||
"suppression_scope": "host-specific",
|
||||
"source": "cve-triage",
|
||||
"updated_at": "2026-04-07T03:49:38.723646+00:00"
|
||||
},
|
||||
{
|
||||
"host": "prometheus.lan.ddnsgeek.com",
|
||||
"signature": "CVE-2011-0966",
|
||||
"reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
|
||||
"suppression_scope": "host-specific",
|
||||
"source": "cve-triage",
|
||||
"updated_at": "2026-04-07T03:49:38.723646+00:00"
|
||||
},
|
||||
{
|
||||
"host": "prometheus.lan.ddnsgeek.com",
|
||||
"signature": "CVE-2018-10822",
|
||||
"reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
|
||||
"suppression_scope": "host-specific",
|
||||
"source": "cve-triage",
|
||||
"updated_at": "2026-04-07T03:49:38.723646+00:00"
|
||||
},
|
||||
{
|
||||
"host": "prometheus.lan.ddnsgeek.com",
|
||||
"signature": "CVE-2018-10824",
|
||||
"reason": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
|
||||
"suppression_scope": "host-specific",
|
||||
"source": "cve-triage",
|
||||
"updated_at": "2026-04-07T03:49:38.723646+00:00"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
{
|
||||
"host": "auth.lan.ddnsgeek.com",
|
||||
"generated_at": "2026-04-07T03:49:38.723646+00:00",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"findings": [
|
||||
{
|
||||
"host": "auth.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2005-3299",
|
||||
"affected_host": "auth.lan.ddnsgeek.com",
|
||||
"endpoint": "443/tcp",
|
||||
"product_version_evidence": [
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
|
||||
],
|
||||
"exploit_precondition": "Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "needs-manual-test",
|
||||
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/auth.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 2
|
||||
},
|
||||
{
|
||||
"file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "443/tcp",
|
||||
"evidence": "| IDs: CVE:CVE-2005-3299"
|
||||
},
|
||||
{
|
||||
"file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "443/tcp",
|
||||
"evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"host": "auth.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2009-3733",
|
||||
"affected_host": "auth.lan.ddnsgeek.com",
|
||||
"endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
|
||||
"product_version_evidence": [
|
||||
"No explicit product/version fingerprint in nmap service line."
|
||||
],
|
||||
"exploit_precondition": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "needs-manual-test",
|
||||
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/auth.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 2
|
||||
},
|
||||
{
|
||||
"file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml",
|
||||
"evidence": "Possible path traversal in VMWare (CVE-2009-3733)"
|
||||
},
|
||||
{
|
||||
"file": "results/auth.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
|
||||
"evidence": "Possible path traversal in VMWare (CVE-2009-3733)"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# CVE triage sheet - auth.lan.ddnsgeek.com
|
||||
|
||||
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
|
||||
|
||||
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|
||||
|---|---|---|---|---|---|---|
|
||||
| CVE-2005-3299 | auth.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior. | not-reproduced | **needs-manual-test** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
| CVE-2009-3733 | auth.lan.ddnsgeek.com | `/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml` | No explicit product/version fingerprint in nmap service line. | Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files. | not-reproduced | **needs-manual-test** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
@@ -0,0 +1,93 @@
|
||||
{
|
||||
"host": "familytree.lan.ddnsgeek.com",
|
||||
"generated_at": "2026-04-07T03:49:38.723646+00:00",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"findings": [
|
||||
{
|
||||
"host": "familytree.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2003-1418",
|
||||
"affected_host": "familytree.lan.ddnsgeek.com",
|
||||
"endpoint": "unknown",
|
||||
"product_version_evidence": [
|
||||
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"tcpwrapped syn-ack ttl 56"
|
||||
],
|
||||
"exploit_precondition": "Target must expose Apache mod_include with vulnerable SSI execution behavior.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "needs-manual-test",
|
||||
"disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 1
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"host": "familytree.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2005-3299",
|
||||
"affected_host": "familytree.lan.ddnsgeek.com",
|
||||
"endpoint": "443/tcp",
|
||||
"product_version_evidence": [
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
|
||||
],
|
||||
"exploit_precondition": "Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "needs-manual-test",
|
||||
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 2
|
||||
},
|
||||
{
|
||||
"file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "443/tcp",
|
||||
"evidence": "| IDs: CVE:CVE-2005-3299"
|
||||
},
|
||||
{
|
||||
"file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "443/tcp",
|
||||
"evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"host": "familytree.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2009-3733",
|
||||
"affected_host": "familytree.lan.ddnsgeek.com",
|
||||
"endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml",
|
||||
"product_version_evidence": [
|
||||
"No explicit product/version fingerprint in nmap service line."
|
||||
],
|
||||
"exploit_precondition": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "needs-manual-test",
|
||||
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 2
|
||||
},
|
||||
{
|
||||
"file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml",
|
||||
"evidence": "Possible path traversal in VMWare (CVE-2009-3733)"
|
||||
},
|
||||
{
|
||||
"file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "443/tcp",
|
||||
"evidence": "|_ /sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml: Possible path traversal in VMWare (CVE-2009-3733)"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
# CVE triage sheet - familytree.lan.ddnsgeek.com
|
||||
|
||||
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
|
||||
|
||||
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|
||||
|---|---|---|---|---|---|---|
|
||||
| CVE-2003-1418 | familytree.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must expose Apache mod_include with vulnerable SSI execution behavior. | not-reproduced | **needs-manual-test** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
| CVE-2005-3299 | familytree.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior. | not-reproduced | **needs-manual-test** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
| CVE-2009-3733 | familytree.lan.ddnsgeek.com | `/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml` | No explicit product/version fingerprint in nmap service line. | Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files. | not-reproduced | **needs-manual-test** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
@@ -0,0 +1,30 @@
|
||||
{
|
||||
"host": "kuma.lan.ddnsgeek.com",
|
||||
"generated_at": "2026-04-07T03:49:38.723646+00:00",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"findings": [
|
||||
{
|
||||
"host": "kuma.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2017-9798",
|
||||
"affected_host": "kuma.lan.ddnsgeek.com",
|
||||
"endpoint": "unknown",
|
||||
"product_version_evidence": [
|
||||
"http syn-ack ttl 52 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"http syn-ack ttl 53 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"ssl/http syn-ack ttl 52 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"ssl/http syn-ack ttl 53 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
|
||||
],
|
||||
"exploit_precondition": "Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "needs-manual-test",
|
||||
"disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/kuma.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 31
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
# CVE triage sheet - kuma.lan.ddnsgeek.com
|
||||
|
||||
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
|
||||
|
||||
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|
||||
|---|---|---|---|---|---|---|
|
||||
| CVE-2017-9798 | kuma.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 52 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 53 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions. | not-reproduced | **needs-manual-test** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
@@ -0,0 +1,32 @@
|
||||
{
|
||||
"host": "monitor-kuma.lan.ddnsgeek.com",
|
||||
"generated_at": "2026-04-07T03:49:38.723646+00:00",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"findings": [
|
||||
{
|
||||
"host": "monitor-kuma.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2017-9798",
|
||||
"affected_host": "monitor-kuma.lan.ddnsgeek.com",
|
||||
"endpoint": "unknown",
|
||||
"product_version_evidence": [
|
||||
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"tcpwrapped syn-ack ttl 56"
|
||||
],
|
||||
"exploit_precondition": "Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "needs-manual-test",
|
||||
"disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/monitor-kuma.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 31
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
# CVE triage sheet - monitor-kuma.lan.ddnsgeek.com
|
||||
|
||||
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
|
||||
|
||||
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|
||||
|---|---|---|---|---|---|---|
|
||||
| CVE-2017-9798 | monitor-kuma.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTP Server with mod_http2 and be susceptible to OptionBleed conditions. | not-reproduced | **needs-manual-test** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
@@ -0,0 +1,32 @@
|
||||
{
|
||||
"host": "nextcloud.lan.ddnsgeek.com",
|
||||
"generated_at": "2026-04-07T03:49:38.723646+00:00",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"findings": [
|
||||
{
|
||||
"host": "nextcloud.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2003-1418",
|
||||
"affected_host": "nextcloud.lan.ddnsgeek.com",
|
||||
"endpoint": "unknown",
|
||||
"product_version_evidence": [
|
||||
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"tcpwrapped syn-ack ttl 56"
|
||||
],
|
||||
"exploit_precondition": "Target must expose Apache mod_include with vulnerable SSI execution behavior.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "needs-manual-test",
|
||||
"disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/nextcloud.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 1
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
# CVE triage sheet - nextcloud.lan.ddnsgeek.com
|
||||
|
||||
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
|
||||
|
||||
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|
||||
|---|---|---|---|---|---|---|
|
||||
| CVE-2003-1418 | nextcloud.lan.ddnsgeek.com | `unknown` | http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must expose Apache mod_include with vulnerable SSI execution behavior. | not-reproduced | **needs-manual-test** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
@@ -0,0 +1,127 @@
|
||||
{
|
||||
"host": "prometheus.lan.ddnsgeek.com",
|
||||
"generated_at": "2026-04-07T03:49:38.723646+00:00",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"findings": [
|
||||
{
|
||||
"host": "prometheus.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2009-3733",
|
||||
"affected_host": "prometheus.lan.ddnsgeek.com",
|
||||
"endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
|
||||
"product_version_evidence": [
|
||||
"No explicit product/version fingerprint in nmap service line."
|
||||
],
|
||||
"exploit_precondition": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "not-applicable",
|
||||
"disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 2
|
||||
},
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml",
|
||||
"evidence": "Possible path traversal in VMWare (CVE-2009-3733) (401 Unauthorized)"
|
||||
},
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
|
||||
"evidence": "Possible path traversal in VMWare (CVE-2009-3733) (401 Unauthorized)"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"host": "prometheus.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2011-0966",
|
||||
"affected_host": "prometheus.lan.ddnsgeek.com",
|
||||
"endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\MDC\\Tomcat\\webapps\\triveni\\WEB-INF\\classes\\schedule.properties",
|
||||
"product_version_evidence": [
|
||||
"No explicit product/version fingerprint in nmap service line."
|
||||
],
|
||||
"exploit_precondition": "Target must be Cisco Unified Operations Manager 8.0/8.5 with vulnerable auditLog.do traversal handling.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "not-applicable",
|
||||
"disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 4
|
||||
},
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\boot.ini",
|
||||
"evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)"
|
||||
},
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\MDC\\Tomcat\\webapps\\triveni\\WEB-INF\\classes\\schedule.properties",
|
||||
"evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)"
|
||||
},
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\lib\\classpath\\com\\cisco\\nm\\cmf\\dbservice2\\DBServer.properties",
|
||||
"evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)"
|
||||
},
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\log\\dbpwdChange.log",
|
||||
"evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows) (401 Unauthorized)"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"host": "prometheus.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2018-10822",
|
||||
"affected_host": "prometheus.lan.ddnsgeek.com",
|
||||
"endpoint": "/uir//etc/passwd",
|
||||
"product_version_evidence": [
|
||||
"No explicit product/version fingerprint in nmap service line."
|
||||
],
|
||||
"exploit_precondition": "Target must be affected D-Link router firmware exposing /uir/ traversal path.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "not-applicable",
|
||||
"disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 1
|
||||
},
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "/uir//etc/passwd",
|
||||
"evidence": "Possible D-Link router directory traversal vulnerability (CVE-2018-10822) (401 Unauthorized)"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"host": "prometheus.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2018-10824",
|
||||
"affected_host": "prometheus.lan.ddnsgeek.com",
|
||||
"endpoint": "/uir//tmp/csman/0",
|
||||
"product_version_evidence": [
|
||||
"No explicit product/version fingerprint in nmap service line."
|
||||
],
|
||||
"exploit_precondition": "Target must be affected D-Link router firmware exposing plaintext credential path under /tmp/csman.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "not-applicable",
|
||||
"disposition_rationale": "Only unauthorized responses were observed; vulnerable behavior was not reproduced and signature is likely a false positive.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 1
|
||||
},
|
||||
{
|
||||
"file": "results/prometheus.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "/uir//tmp/csman/0",
|
||||
"evidence": "Possible D-Link router plaintext password file exposure (CVE-2018-10824) (401 Unauthorized)"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
# CVE triage sheet - prometheus.lan.ddnsgeek.com
|
||||
|
||||
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
|
||||
|
||||
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|
||||
|---|---|---|---|---|---|---|
|
||||
| CVE-2009-3733 | prometheus.lan.ddnsgeek.com | `/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml` | No explicit product/version fingerprint in nmap service line. | Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files. | not-reproduced | **not-applicable** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
| CVE-2011-0966 | prometheus.lan.ddnsgeek.com | `/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program%20Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.properties` | No explicit product/version fingerprint in nmap service line. | Target must be Cisco Unified Operations Manager 8.0/8.5 with vulnerable auditLog.do traversal handling. | not-reproduced | **not-applicable** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
| CVE-2018-10822 | prometheus.lan.ddnsgeek.com | `/uir//etc/passwd` | No explicit product/version fingerprint in nmap service line. | Target must be affected D-Link router firmware exposing /uir/ traversal path. | not-reproduced | **not-applicable** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
| CVE-2018-10824 | prometheus.lan.ddnsgeek.com | `/uir//tmp/csman/0` | No explicit product/version fingerprint in nmap service line. | Target must be affected D-Link router firmware exposing plaintext credential path under /tmp/csman. | not-reproduced | **not-applicable** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"host": "shifts.lan.ddnsgeek.com",
|
||||
"generated_at": "2026-04-07T03:49:38.723646+00:00",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"findings": [
|
||||
{
|
||||
"host": "shifts.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2011-3192",
|
||||
"affected_host": "shifts.lan.ddnsgeek.com",
|
||||
"endpoint": "443/tcp",
|
||||
"product_version_evidence": [
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
|
||||
],
|
||||
"exploit_precondition": "Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "needs-manual-test",
|
||||
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/shifts.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 2
|
||||
},
|
||||
{
|
||||
"file": "results/shifts.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "443/tcp",
|
||||
"evidence": "| IDs: CVE:CVE-2011-3192 BID:49303"
|
||||
},
|
||||
{
|
||||
"file": "results/shifts.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "443/tcp",
|
||||
"evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
# CVE triage sheet - shifts.lan.ddnsgeek.com
|
||||
|
||||
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
|
||||
|
||||
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|
||||
|---|---|---|---|---|---|---|
|
||||
| CVE-2011-3192 | shifts.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API); ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition. | not-reproduced | **needs-manual-test** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"host": "stockfill.lan.ddnsgeek.com",
|
||||
"generated_at": "2026-04-07T03:49:38.723646+00:00",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"findings": [
|
||||
{
|
||||
"host": "stockfill.lan.ddnsgeek.com",
|
||||
"cve": "CVE-2011-3192",
|
||||
"affected_host": "stockfill.lan.ddnsgeek.com",
|
||||
"endpoint": "443/tcp",
|
||||
"product_version_evidence": [
|
||||
"ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
|
||||
],
|
||||
"exploit_precondition": "Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition.",
|
||||
"reproducibility": "not-reproduced",
|
||||
"disposition": "needs-manual-test",
|
||||
"disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
|
||||
"required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
|
||||
"evidence_sources": [
|
||||
{
|
||||
"file": "results/stockfill.lan.ddnsgeek.com/scans/_patterns.log",
|
||||
"match_count": 2
|
||||
},
|
||||
{
|
||||
"file": "results/stockfill.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "443/tcp",
|
||||
"evidence": "| IDs: BID:49303 CVE:CVE-2011-3192"
|
||||
},
|
||||
{
|
||||
"file": "results/stockfill.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
|
||||
"endpoint": "443/tcp",
|
||||
"evidence": "| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
# CVE triage sheet - stockfill.lan.ddnsgeek.com
|
||||
|
||||
Generated (UTC): 2026-04-07T03:49:38.723646+00:00
|
||||
|
||||
| CVE | Affected host | Endpoint | Product/version evidence | Exploit precondition | Reproducibility | Disposition |
|
||||
|---|---|---|---|---|---|---|
|
||||
| CVE-2011-3192 | stockfill.lan.ddnsgeek.com | `443/tcp` | ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | Target must run Apache HTTPD with byte-range handling vulnerable to the Apache Range header DoS condition. | not-reproduced | **needs-manual-test** |
|
||||
| | | | | | | Required reproduction gate: Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient. |
|
||||
Reference in New Issue
Block a user