Merge branch 'main' into fix-incident-examples

extension-definition-specifications/incident-ef7/Incident Extension Suite.adoc

@@ -276,7 +276,7 @@ include::examples/example_2.1.json[]
 [[event]]
 === 2.2. Event
 
-An Event is an activity that has a harmful effect or which will be investigated or already has been investigated as potentially having a harmful effect.  Events can be used to further enrich and explain Sightings by allowing analysts to indicate if these sightings are part of a potential threat, and if so how they connects to a larger incident. Some activity, described in an Event, will be found to be not harmful when investigated.
+An Event is an activity that has a harmful effect or which will be investigated or already has been investigated as potentially having a harmful effect. The activity is not necessarily performed by an attacker. For example, an event could result from a user or system administrator's mistake. Events can be used to further enrich and explain Sightings by allowing analysts to indicate if these sightings are part of a potential threat, and if so how they connects to a larger incident. Some activity, described in an Event, will be found to be not harmful when investigated.
 
 This new SDO extension *MUST* use [stixliteral]#extension-definition--4ca6de00-5b0d-45ef-a1dc-ea7279ea910e# as its extension ID.
 
@@ -439,12 +439,16 @@ Using these embedded relationships ensures that an incomplete sequence cannot be
 |*Source* |*Type* |*Target* |*Description*
 // relationships:start
 
-
 |[stixtype]#<<event,event>># 
 |[stixrelationship]#causes#
 |[stixtype]#<<impact,impact>># 
 |The event caused the impact.
 
+|[stixtype]#<<event,event>># 
+|[stixrelationship]#led-to#
+|[stixtype]#<<task,task>># 
+|The event led to performing the task.
+
 |[stixtype]#<<event,event>>#
 |[stixrelationship]#impacts#
 |[stixtype]#{infrastructure_url}[infrastructure]#, +
@@ -670,11 +674,6 @@ using the [stixrelationship]#related-to# relationship type or, as with open voca
 |[stixrelationship]#causes#
 |[stixtype]#<<impact,impact>>#
 |An event causes an impact.
-
-|[stixtype]#<<task,task>>#
-|[stixrelationship]#causes#
-|[stixtype]#<<impact,impact>>#
-|A task causes an impact.
 // relationships:end
 
 // end::impact-relationships[]
@@ -1189,6 +1188,12 @@ Using these embedded relationships ensures that an incomplete sequence cannot be
 
 |*Source* |*Type* |*Target* |*Description*
 // relationships:start
+
+|[stixtype]#<<event,event>># 
+|[stixrelationship]#led-to#
+|[stixtype]#<<task,task>># 
+|The event led to performing the task.
+
 |[stixtype]#{identity_url}[identity]#
 |[stixrelationship]#assigned#
 |[stixtype]#<<task,task>>#

extension-definition-specifications/incident-ef7/stix-viz-config.json

@@ -1,7 +1,7 @@
 {
     "incident": {
-	"embeddedRelationships": [ [ "extensions.extension-definition—​ef765651-680c-498d-9894-99799f2fa126.events.event_ref", "has_event", true],
-				   [ "extensions.extension-definition—​ef765651-680c-498d-9894-99799f2fa126.tasks.task_ref", "has_task", true]
+	"embeddedRelationships": [ [ "extensions.extension-definition--ef765651-680c-498d-9894-99799f2fa126.events.event_ref", "has_event", true],
+				   [ "extensions.extension-definition--ef765651-680c-498d-9894-99799f2fa126.tasks.task_ref", "has_task", true]
 				 ]
     },
     "event": {

objects/vulnerability/vulnerability--00186f23-b7a3-445e-bfce-7aa2ef7bd659.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3e4d116f-945b-4f69-ae0d-cf5dbab156c5",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00186f23-b7a3-445e-bfce-7aa2ef7bd659",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-20T00:18:46.714978Z",
+            "modified": "2024-08-20T00:18:46.714978Z",
+            "name": "CVE-2024-7925",
+            "description": "A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php. The manipulation of the argument phome with the input ShowPHPInfo leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-7925"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--002f3865-5fc3-43a5-9172-53e3796dc15e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e51b3054-7be4-4abf-8609-c958e8531cbe",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--002f3865-5fc3-43a5-9172-53e3796dc15e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-08T00:18:27.56366Z",
+            "modified": "2024-08-08T00:18:27.56366Z",
+            "name": "CVE-2024-42245",
+            "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"sched/fair: Make sure to try to detach at least one movable task\"\n\nThis reverts commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06.\n\nb0defa7ae03ec changed the load balancing logic to ignore env.max_loop if\nall tasks examined to that point were pinned. The goal of the patch was\nto make it more likely to be able to detach a task buried in a long list\nof pinned tasks. However, this has the unfortunate side effect of\ncreating an O(n) iteration in detach_tasks(), as we now must fully\niterate every task on a cpu if all or most are pinned. Since this load\nbalance code is done with rq lock held, and often in softirq context, it\nis very easy to trigger hard lockups. We observed such hard lockups with\na user who affined O(10k) threads to a single cpu.\n\nWhen I discussed this with Vincent he initially suggested that we keep\nthe limit on the number of tasks to detach, but increase the number of\ntasks we can search. However, after some back and forth on the mailing\nlist, he recommended we instead revert the original patch, as it seems\nlikely no one was actually getting hit by the original issue.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-42245"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0052bd39-d8a7-4741-a3a9-65ed7b0321d5.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--bbbc88d9-24c5-4c4b-a7bf-6060cc2e108e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0052bd39-d8a7-4741-a3a9-65ed7b0321d5",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-22T00:18:37.362843Z",
+            "modified": "2024-08-22T00:18:37.362843Z",
+            "name": "CVE-2024-7977",
+            "description": "Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-7977"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--005c943b-ec1c-4bda-a491-9790bf8e439b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--948d94a8-0c9f-4027-a25e-4bdaae24f7aa",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--005c943b-ec1c-4bda-a491-9790bf8e439b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-03T00:17:58.751984Z",
+            "modified": "2024-08-03T00:17:58.751984Z",
+            "name": "CVE-2024-38884",
+            "description": "An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform an Authentication Bypass attack due to improperly implemented security checks for standard authentication mechanisms",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-38884"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0072f778-4ecb-4966-80d8-bda0c8d32b8b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a2eeb0bf-22e0-42a0-839d-f92e67a2f8ad",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0072f778-4ecb-4966-80d8-bda0c8d32b8b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-02T00:18:13.39737Z",
+            "modified": "2024-08-02T00:18:13.39737Z",
+            "name": "CVE-2024-7334",
+            "description": "A vulnerability was found in TOTOLINK EX1200L 9.3.5u.6146_B20201023. It has been rated as critical. This issue affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273257 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-7334"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--00746e31-b34e-4661-b862-c90ebf4c76ef.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--cdf1bbea-7bcc-464f-84ba-9bcee25c3076",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00746e31-b34e-4661-b862-c90ebf4c76ef",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-14T00:18:47.715885Z",
+            "modified": "2024-08-14T00:18:47.715885Z",
+            "name": "CVE-2024-38136",
+            "description": "Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-38136"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--00be2000-132f-4d53-9673-2ce8c234a28e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--9e117a3c-f383-4823-8c95-efdd14b46485",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00be2000-132f-4d53-9673-2ce8c234a28e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-14T00:18:46.953989Z",
+            "modified": "2024-08-14T00:18:46.953989Z",
+            "name": "CVE-2024-41623",
+            "description": "An issue in D3D Security D3D IP Camera (D8801) v.V9.1.17.1.4-20180428 allows a local attacker to execute arbitrary code via a crafted payload",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-41623"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--00cd22b0-4eed-4b1d-9980-ea20b6df16c9.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--0bf9a695-3e1f-4b33-9d8b-b04482590d0b",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00cd22b0-4eed-4b1d-9980-ea20b6df16c9",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-16T00:18:34.233621Z",
+            "modified": "2024-08-16T00:18:34.233621Z",
+            "name": "CVE-2024-31799",
+            "description": "Information Disclosure in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to read the WiFi passphrase via the UART Debugging Port.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-31799"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--00db81c2-988c-435c-8e07-63f2911f7844.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--4483624f-85cd-41bf-9b11-13aa69e7a210",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00db81c2-988c-435c-8e07-63f2911f7844",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-08T00:18:27.324154Z",
+            "modified": "2024-08-08T00:18:27.324154Z",
+            "name": "CVE-2024-34620",
+            "description": "Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privileged service.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-34620"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--00f1e8ee-84cf-4240-833c-dc51080caa18.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a25344b6-ba9b-4cb8-818d-43ed9960f622",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00f1e8ee-84cf-4240-833c-dc51080caa18",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-20T00:18:47.209112Z",
+            "modified": "2024-08-20T00:18:47.209112Z",
+            "name": "CVE-2024-43399",
+            "description": "Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the vulnerability allows an attacker to extract files to any desired location within the server running MobSF. This vulnerability is fixed in 4.0.7.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-43399"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--01001bd9-da76-4678-ad9e-49c79029e9c9.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--09618f7f-4f72-4753-9801-5ca03dfc685d",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--01001bd9-da76-4678-ad9e-49c79029e9c9",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-21T00:18:39.998682Z",
+            "modified": "2024-08-21T00:18:39.998682Z",
+            "name": "CVE-2024-42605",
+            "description": "Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/edit_page.php?link_id=1",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-42605"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--012972f9-3f47-4740-820b-11055513e321.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b46f4d19-0e56-48d1-a086-3b96ff421c11",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--012972f9-3f47-4740-820b-11055513e321",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-04T00:20:09.729504Z",
+            "modified": "2024-08-04T00:20:09.729504Z",
+            "name": "CVE-2024-7291",
+            "description": "The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-7291"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--012fead3-b0fe-4eda-a304-8e6bf8d8bacb.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--ac0a8960-4d49-4ede-bc67-a9655e8dda4e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--012fead3-b0fe-4eda-a304-8e6bf8d8bacb",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-22T00:18:24.427467Z",
+            "modified": "2024-08-22T00:18:24.427467Z",
+            "name": "CVE-2022-48881",
+            "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd: Fix refcount leak in amd_pmc_probe\n\npci_get_domain_bus_and_slot() takes reference, the caller should release\nthe reference by calling pci_dev_put() after use. Call pci_dev_put() in\nthe error path to fix this.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2022-48881"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0135eb96-40de-4984-8a20-1a980a5254d4.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d030a7bd-199c-4707-898a-e3d0f40bc777",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0135eb96-40de-4984-8a20-1a980a5254d4",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-07-29T00:19:19.911657Z",
+            "modified": "2024-07-29T00:19:19.911657Z",
+            "name": "CVE-2024-41691",
+            "description": "This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext FTP credentials from the vulnerable system.\n\nSuccessful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the FTP server associated with the targeted system.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-41691"
+                }
+            ]
+        }
+    ]
+}