Skip to content

Commit 6211aad

Browse files
TimmyBugcrowdSamAtBugcrowdabhinav-nain
authored
Q2 Release (#460)
* GraphQL Introspection Enabled - P5 #450 * Bypass of Password Confirmation on Password Change Add: Broken Access Control – Bypass of Password Confirmation – Change Password * Revert "Bypass of Password Confirmation on Password Change" This reverts commit a6e415a. * Bypass of Password Confirmation on Password Change Add: Broken Access Control – Bypass of Password Confirmation – Change Password * Revert "Bypass of Password Confirmation on Password Change" This reverts commit 3418212. * Broken Access Control (BAC) - Bypass of Password Confirmation - Change Password (#462) * Revert "Bypass of Password Confirmation on Password Change" This reverts commit 3418212. * Bypass of Password Confirmation on Password Change Add: Broken Access Control – Bypass of Password Confirmation – Change Password * AI entries revised (#464) * AI entries revised Adding: P1 - AI Application Security - Training Data Poisoning - Backdoor Injection / Bias Manipulation P1 - AI Application Security - Model Extraction - API Query-Based Model Reconstruction P1 - AI Application Security - Sensitive Information Disclosure - Cross-Tenant PII Leakage/Exposure P1 - AI Application Security - Remote Code Execution - Full System Compromise P1 - AI Application Security - Sensitive Information Disclosure - Key Leak P2 - AI Application Security - Remote Code Execution - Sandboxed Container Code Execution P2 - AI Application Security - Prompt Injection - System Prompt Leakage P2 - AI Application Security - Vector and Embedding Weaknesses - Embedding Exfiltration / Model Extraction P2 - AI Application Security - Denial-of-Service (DoS) - Application-Wide P3 - AI Application Security - Vector and Embedding Weaknesses - Semantic Indexing P3 - AI Application Security - Improper Output Handling - Cross-Site Scripting (XSS) P4 - AI Application Security - Improper Output Handling - Markdown/HTML Injection P4 - AI Application Security - AI Safety - Misinformation / Wrong Factual Data P4 - AI Application Security - Insufficient Rate Limiting - Query Flooding / API Token Abuse P4 - AI Application Security - Denial-of-Service (DoS) - Tenant-Scoped P4 - AI Application Security - Adversarial Example Injection - AI Misclassification Attacks P5 - AI Application Security - Improper Input Handling - ANSI Escape Codes P5 - AI Application Security - Improper Input Handling - Unicode Confusables P5 - AI Application Security - Improper Input Handling - RTL Overrides * Update vulnerability-rating-taxonomy.json * Fixing errors * Fixing errors2 * Update vulnerability-rating-taxonomy.json * Update vulnerability-rating-taxonomy.json * Update vulnerability-rating-taxonomy.json * Update vulnerability-rating-taxonomy.json * Update vulnerability-rating-taxonomy.json * Update cvss_v3.json * Fixed deprecated node mapping (#457) * Updated varies to default and removed redundant entries (#461) * Updated varies to default and removed redundant entries * Reverting some changes --------- Co-authored-by: Abhinav Nain <[email protected]> * Final Changes - Adding Changelog + deprecated-node-mappings + ALL JSON Sorting + SCW --------- Co-authored-by: SamAtBugcrowd <[email protected]> Co-authored-by: Abhinav Nain <[email protected]>
1 parent 6f8e8d6 commit 6211aad

File tree

7 files changed

+813
-690
lines changed

7 files changed

+813
-690
lines changed

‎CHANGELOG.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,44 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p
1212

1313
### Changed
1414

15+
## [v1.16](https://github.com/bugcrowd/vulnerability-rating-taxonomy/compare/v1.15.1...v1.16) - 2025-06-23
16+
17+
### Added
18+
19+
- Broken Access Control (BAC) - Bypass of Password Confirmation - Change Password - P4
20+
- Sensitive Data Exposure - GraphQL Introspection Enabled - P5
21+
- AI Application Security - Training Data Poisoning - Backdoor Injection / Bias Manipulation - P1
22+
- AI Application Security - Model Extraction - API Query-Based Model Reconstruction - P1
23+
- AI Application Security - Sensitive Information Disclosure - Cross-Tenant PII Leakage/Exposure - P1
24+
- AI Application Security - Sensitive Information Disclosure - Key Leak - P1
25+
- AI Application Security - Remote Code Execution - Full System Compromise - P1
26+
- AI Application Security - Remote Code Execution - Sandboxed Container Code Execution - P2
27+
- AI Application Security - Prompt Injection - System Prompt Leakage - P2
28+
- AI Application Security - Vector and Embedding Weaknesses - Embedding Exfiltration / Model Extraction - P2
29+
- AI Application Security - Vector and Embedding Weaknesses - Semantic Indexing - P3
30+
- AI Application Security - Denial-of-Service (DoS) - Application-Wide - P2
31+
- AI Application Security - AI Safety - Misinformation / Wrong Factual Data - P4
32+
- AI Application Security - Insufficient Rate Limiting - Query Flooding / API Token Abuse - P4
33+
- AI Application Security - Denial-of-Service (DoS) - Tenant-Scoped - P4
34+
- AI Application Security - Adversarial Example Injection - AI Misclassification Attacks - P4
35+
- AI Application Security - Improper Output Handling - Cross-Site Scripting (XSS) - P3
36+
- AI Application Security - Improper Output Handling - Markdown/HTML Injection - P4
37+
- AI Application Security - Improper Input Handling - ANSI Escape Codes - P5
38+
- AI Application Security - Improper Input Handling - Unicode Confusables - P5
39+
- AI Application Security - Improper Input Handling - RTL Overrides - P5
40+
41+
### Removed
42+
43+
- AI Application Security - Large Language Model (LLM) Security - LLM Output Handling - P1
44+
- AI Application Security - Large Language Model (LLM) Security - Prompt Injection - P1
45+
- AI Application Security - Large Language Model (LLM) Security - Training Data Poisoning - P1
46+
- AI Application Security - Large Language Model (LLM) Security - Excessive Agency/Permission Manipulation - P2
47+
48+
### Other
49+
50+
- Removed CVSS score for VRT entries with 'VARIES' priority, and added default CVSS (0 score) wherever missing.
51+
- Fixed 'deprecated-node-mapping.json' file to reflect the correct format and fill in missing values.
52+
1553
## [v1.15.1](https://github.com/bugcrowd/vulnerability-rating-taxonomy/compare/v1.15...v1.15.1) - 2025-03-11
1654

1755
### Added

0 commit comments

Comments
 (0)