5cd5332397
This commit adds: - Database migrations for app_delta fingerprints and client certificates - Scripts for certificate generation and fingerprint backfilling - Comprehensive security audit reports and findings tracking - Implementation documentation for certificate authentication - Test utilities for certificate renewal and fingerprinting - GE-ENFORCE collector fix documentation Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
41 lines
5.0 KiB
CSV
41 lines
5.0 KiB
CSV
Task,Category,Description,Estimated_Severity,Validation_Status,Notes
|
|
upload_employees_photo_1,File Upload,Employee photo upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1 (Agent Binary Injection)"
|
|
upload_geenforce_payload_1,File Upload,GEEnforce payload upload (3 issues),HIGH,Unvalidated,"Similar pattern to vuln #1, multiple issues found"
|
|
upload_guides_image_1,File Upload,Guides image upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
|
|
upload_printedparts_file_1,File Upload,Printed parts file upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
|
|
upload_screenshot_magic_bypass_1,File Upload,Screenshot upload magic byte bypass,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
|
|
upload_slides_multi_1,File Upload,Slides multi-file upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
|
|
upload_warranty_proof_1,File Upload,Warranty proof upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
|
|
scripts_body_upload_validation_1,File Upload,Scripts body upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
|
|
ratelimit_apitoken_create_1,Rate Limiting,API token creation rate limiting,MEDIUM,Unvalidated,"Similar pattern to vuln #5 (Token Refresh Rate Limit Bypass)"
|
|
ratelimit_auth_change_password_1,Rate Limiting,Password change rate limiting,MEDIUM,Unvalidated,"Similar pattern to vuln #5"
|
|
ratelimit_guides_image_spam_1,Rate Limiting,Guides image upload spam protection,MEDIUM,Unvalidated,"Similar pattern to vuln #5"
|
|
ratelimit_printedparts_file_spam_1,Rate Limiting,Printed parts file upload spam,MEDIUM,Unvalidated,"Similar pattern to vuln #5"
|
|
ratelimit_scripts_upload_1,Rate Limiting,Scripts upload rate limiting,MEDIUM,Unvalidated,"Similar pattern to vuln #5"
|
|
ratelimit_setup_create_admin_1,Rate Limiting,Setup admin creation rate limiting,HIGH,Unvalidated,"Similar pattern to vuln #5, but affects admin creation"
|
|
ratelimit_warranty_proof_spam_1,Rate Limiting,Warranty proof upload spam,MEDIUM,Unvalidated,"Similar pattern to vuln #5"
|
|
endpoints_agentupgrade_race_1,Race Condition,Agent upgrade race condition,LOW,Unvalidated,"Similar pattern to vuln #7 (Event Dedup Race)"
|
|
endpoints_script_push_race_1,Race Condition,Script push race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
|
|
race_computers_collector_1,Race Condition,Computers collector race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
|
|
race_geenforce_collector_1,Race Condition,GEEnforce collector race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
|
|
race_machines_collector_1,Race Condition,Machines collector race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
|
|
race_measuringtools_collector_1,Race Condition,Measuring tools collector race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
|
|
race_network_collector_1,Race Condition,Network collector race condition (2 issues),MEDIUM,Unvalidated,"Similar pattern to vuln #7, multiple issues"
|
|
race_printers_collector_1,Race Condition,Printers collector race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
|
|
application_package_signed_check_1,Upload Validation,Application package signature verification,MEDIUM,Unvalidated,"Related to vuln #1 pattern"
|
|
maplevel_blueprint_upload_1,Upload Validation,Map level blueprint upload validation,MEDIUM,Unvalidated,"Similar to file upload issues"
|
|
models_image_upload_validation_1,Upload Validation,Models image upload validation,MEDIUM,Unvalidated,"Similar to file upload issues"
|
|
settings_branding_logo_upload_1,Upload Validation,Settings branding logo upload,MEDIUM,Unvalidated,"Similar to file upload issues"
|
|
apitoken_no_rotation_1,Token Management,API token non-rotation,MEDIUM,Unvalidated,"Similar pattern to vuln #4 (Refresh Token Non-Rotation)"
|
|
printedparts_kiosk_token_reuse_1,Token Management,Printed parts kiosk token reuse,MEDIUM,Unvalidated,"Similar pattern to vuln #4"
|
|
usb_kiosk_token_reuse_1,Token Management,USB kiosk token reuse,MEDIUM,Unvalidated,"Similar pattern to vuln #4"
|
|
collector_managed_token_timing_1,Timing Attack,Collector managed token timing attack,HIGH,Unvalidated,"Similar pattern to vuln #3 (Collector API Key Timing)"
|
|
setup_token_timing_1,Timing Attack,Setup token timing attack,MEDIUM,Unvalidated,"Similar pattern to vuln #3"
|
|
info_disclosure_application_exists_1,Info Disclosure,Application enumeration,LOW,Unvalidated,"Similar pattern to vuln #2 (Account Enumeration)"
|
|
collector_plugin_scoped_keys_1,Auth/Authz,Collector plugin-scoped keys,MEDIUM,Unvalidated,"Auth bypass or misconfiguration"
|
|
timing_geenforce_1,Timing Attack,GEEnforce timing attack,N/A,No Finding,"0 findings - not a vulnerability"
|
|
info_disclosure_asset_exists_1,Info Disclosure,Asset enumeration,N/A,No Finding,"0 findings - not a vulnerability"
|
|
info_disclosure_script_exists_1,Info Disclosure,Script enumeration,N/A,No Finding,"0 findings - not a vulnerability"
|
|
info_disclosure_user_exists_1,Info Disclosure,User enumeration,N/A,No Finding,"0 findings - not a vulnerability"
|
|
applications_installer_version_detect_1,Misc,Applications installer version detection,N/A,No Finding,"0 findings - not a vulnerability"
|