Releases: bugcrowd/vulnerability-rating-taxonomy
Releases · bugcrowd/vulnerability-rating-taxonomy
v1.16 - 2025-06-23
Added
- Broken Access Control (BAC) - Bypass of Password Confirmation - Change Password - P4
- Sensitive Data Exposure - GraphQL Introspection Enabled - P5
- AI Application Security - Training Data Poisoning - Backdoor Injection / Bias Manipulation - P1
- AI Application Security - Model Extraction - API Query-Based Model Reconstruction - P1
- AI Application Security - Sensitive Information Disclosure - Cross-Tenant PII Leakage/Exposure - P1
- AI Application Security - Sensitive Information Disclosure - Key Leak - P1
- AI Application Security - Remote Code Execution - Full System Compromise - P1
- AI Application Security - Remote Code Execution - Sandboxed Container Code Execution - P2
- AI Application Security - Prompt Injection - System Prompt Leakage - P2
- AI Application Security - Vector and Embedding Weaknesses - Embedding Exfiltration / Model Extraction - P2
- AI Application Security - Vector and Embedding Weaknesses - Semantic Indexing - P3
- AI Application Security - Denial-of-Service (DoS) - Application-Wide - P2
- AI Application Security - AI Safety - Misinformation / Wrong Factual Data - P4
- AI Application Security - Insufficient Rate Limiting - Query Flooding / API Token Abuse - P4
- AI Application Security - Denial-of-Service (DoS) - Tenant-Scoped - P4
- AI Application Security - Adversarial Example Injection - AI Misclassification Attacks - P4
- AI Application Security - Improper Output Handling - Cross-Site Scripting (XSS) - P3
- AI Application Security - Improper Output Handling - Markdown/HTML Injection - P4
- AI Application Security - Improper Input Handling - ANSI Escape Codes - P5
- AI Application Security - Improper Input Handling - Unicode Confusables - P5
- AI Application Security - Improper Input Handling - RTL Overrides - P5
Removed
- AI Application Security - Large Language Model (LLM) Security - LLM Output Handling - P1
- AI Application Security - Large Language Model (LLM) Security - Prompt Injection - P1
- AI Application Security - Large Language Model (LLM) Security - Training Data Poisoning - P1
- AI Application Security - Large Language Model (LLM) Security - Excessive Agency/Permission Manipulation - P2
Other
- Removed CVSS score for VRT entries with 'VARIES' priority, and added default CVSS (0 score) wherever missing.
- Fixed 'deprecated-node-mapping.json' file to reflect the correct format and fill in missing values.
v1.15.1 - 2025-03-11
Added
- Server Security Misconfiguration - Cache Deception - Varies
Other
- Fixed minor issues with deprecated-node-mapping.json file.
- Adding missing issues from deprecated-node-mapping.json file.
v1.15 - 2025-02-12
Added
- Decentralized Application Misconfiguration - Insecure Data Storage - Plaintext Private Key - P1
- Decentralized Application Misconfiguration - Insecure Data Storage - Sensitive Information Exposure - Varies
- Decentralized Application Misconfiguration - Improper Authorization - Insufficient Signature Validation - Varies
- Decentralized Application Misconfiguration - DeFi Security - Flash Loan Attack - Varies
- Decentralized Application Misconfiguration - DeFi Security - Pricing Oracle Manipulation - Varies
- Decentralized Application Misconfiguration - DeFi Security - Function-Level Accounting Error - Varies
- Decentralized Application Misconfiguration - DeFi Security - Improper Implementation of Governance - Varies
- Decentralized Application Misconfiguration - Marketplace Security - Signer Account Takeover - P1
- Decentralized Application Misconfiguration - Marketplace Security - Unauthorized Asset Transfer - P1
- Decentralized Application Misconfiguration - Marketplace Security - Orderbook Manipulation - P1
- Decentralized Application Misconfiguration - Marketplace Security - Malicious Order Offer - P2
- Decentralized Application Misconfiguration - Marketplace Security - Price or Fee Manipulation - P2
- Decentralized Application Misconfiguration - Marketplace Security - OFAC Bypass - P3
- Decentralized Application Misconfiguration - Marketplace Security - Improper Validation and Checks For Deposits and Withdrawals - Varies
- Decentralized Application Misconfiguration - Marketplace Security - Miscalculated Accounting Logic - Varies
- Decentralized Application Misconfiguration - Marketplace Security - Denial of Service - Varies
- Decentralized Application Misconfiguration - Protocol Security Misconfiguration - Node-level Denial of Service - P1
- Protocol Specific Misconfiguration - Frontrunning-Enabled Attack - P2
- Protocol Specific Misconfiguration - Sandwich-Enabled Attack - P2
- Protocol Specific Misconfiguration - Misconfigured Staking Logic - Varies
- Protocol Specific Misconfiguration - Improper Validation and Finalization Logic - Varies
- Smart Contract Misconfiguration - Reentrancy Attack - P1
- Smart Contract Misconfiguration - Smart Contract Owner Takeover - P1
- Smart Contract Misconfiguration - Uninitialized Variables - P1
- Smart Contract Misconfiguration - Unauthorized Transfer of Funds - P1
- Smart Contract Misconfiguration - Integer Overflow / Underflow - P2
- Smart Contract Misconfiguration - Unauthorized Smart Contract Approval - P2
- Smart Contract Misconfiguration - Irreversible Function Call - P3
- Smart Contract Misconfiguration - Function-level Denial of Service - P3
- Smart Contract Misconfiguration - Malicious Superuser Risk - P3
- Smart Contract Misconfiguration - Improper Fee Implementation - P3
- Smart Contract Misconfiguration - Improper Use of Modifier - P4
- Smart Contract Misconfiguration - Improper Decimals Implementation - P4
- Smart Contract Misconfiguration - Inaccurate Rounding Calculation - Varies
- Smart Contract Misconfiguration - Bypass of Function Modifiers & Checks - Varies
- Zero Knowledge Security Misconfiguration - Missing Constraint - Varies
- Zero Knowledge Security Misconfiguration - Mismatching Bit Lengths - Varies
- Zero Knowledge Security Misconfiguration - Misconfigured Trusted Setup - Varies
- Zero Knowledge Security Misconfiguration - Missing Range Check - Varies
- Zero Knowledge Security Misconfiguration - Improper Proof Validation and Finalization Logic - P1
- Zero Knowledge Security Misconfiguration - Deanonymization of Data - P1
- Blockchain Infrastructure Misconfiguration - Improper Bridge Validation and Verification Logic - Varies
- Broken Authentication and Session Management - SAML Replay - P5
Changed
FROM:
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read/Edit/Delete Sensitive Information/Iterable Object Identifiers - P1
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Edit/Delete Sensitive Information/Iterable Object Identifiers - P2
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read Sensitive Information/Iterable Object Identifiers - P3
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read/Edit/Delete Sensitive Information/Complex Object Identifiers(GUID) - P4
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read/Edit/Delete Non-Sensitive Information - P5
TO:
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Modify/View Sensitive Information(Iterable Object Identifiers) - P1
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Modify Sensitive Information(Iterable Object Identifiers) - P2
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - View Sensitive Information(Iterable Object Identifiers) - P3
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Modify/View Sensitive Information(Complex Object Identifiers GUID/UUID) - P4
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - View Non-Sensitive Information - P5
Other
- CVSS Score correction for Server Security Misconfiguration - Mail Server Misconfiguration - Email Spoofing to Inbox due to Missing or Misconfigured DMARC on Email Domain - P4.
- All JSONs, i.e., VRT and its mapping JSONs are now alphabetically sorted.
- Internal library changes to add a new helper script that aids in sorting the JSONs.
v1.14.2 - 2024-10-25
Removed
- Server Security Misconfiguration - Misconfigured DNS - High Impact Subdomain Takeover: P2
Changed
From:
- Server Security Misconfiguration - Misconfigured DNS - Basic Subdomain Takeover: P3
To:
- Server Security Misconfiguration - Misconfigured DNS - Subdomain Takeover: P3
v1.14.1 - 2024-07-18
Changed
vulnerability-rating-taxononomy.jsoncorrection
v1.14 - 2024-07-09
Added
- Server Security Misconfiguration - Email verification bypass - P5
- Server Security Misconfiguration - Missing Subresource Integrity - P5
- Sensitive Data Exposure - Token Leakage via Referer - Password Reset Token - P5
- Server Security Misconfiguration - Software Package Takeover - VARIES
- Broken Access Control (BAC) - Privilege Escalation - VARIES
- Data Biases - Representation Bias - VARIES
- Data Biases - Pre-existing Bias - VARIES
- Algorithmic Biases - Processing Bias - VARIES
- Algorithmic Biases - Aggregation Bias - VARIES
- Societal Biases - Confirmation Bias - VARIES
- Societal Biases - Systemic Bias - VARIES
- Misinterpretation Biases - Context Ignorance - VARIES
- Developer Biases - Implicit Bias - VARIES
Removed
- Broken Authentication and Session Management - Privilege Escalation - VARIES
v1.13 - 2024-04-02
Added
- Physical Security Issues - Bypass of physical access control - VARIES
- Physical Security Issues - Weakness in physical access control - Clonable Key - VARIES
- Physical Security Issues - Weakness in physical access control - Master Key Identification - VARIES
- Physical Security Issues - Weakness in physical access control - Commonly Keyed System - P2
- Insecure OS/Firmware - Weakness in Firmware Updates - Firmware cannot be updated - VARIES
- Insecure OS/Firmware - Weakness in Firmware Updates - Firmware does not validate update integrity- P3
- Insecure OS/Firmware - Weakness in Firmware Updates - Firmware is not encrypted- P5
- Insecure OS/Firmware - Kiosk Escape or Breakout - VARIES
- Insecure OS/Firmware - Poorly Configured Disk Encryption - VARIES
- Insecure OS/Firmware - Shared Credentials on Storage - P3
- Insecure OS/Firmware - Over-Permissioned Credentials on Storage - P2
- Insecure OS/Firmware - Local Administrator on default environment - P2
- Insecure OS/Firmware - Poorly Configured Operating System Security - VARIES
- Insecure OS/Firmware - Recovery of Disk Contains Sensitive Material - VARIES
- Insecure OS/Firmware - Failure to Remove Sensitive Artifacts from Disk - VARIES
- Insecure OS/Firmware - Data not encrypted at rest - Sensitive - VARIES
- Insecure OS/Firmware - Data not encrypted at rest - Non sensitive - P5
v1.12 - 2023-12-18
Added
- Application Level DoS - Excessive Resource Consumption - Injection (Prompt) - VARIES
- AI Application Security - Large Language Model (LLM) Security - Prompt Injection - P1
- AI Application Security - Large Language Model (LLM) Security - LLM Output Handling - P1
- AI Application Security - Large Language Model (LLM) Security - Training Data Poisoning - P1
- AI Application Security - Large Language Model (LLM) Security - Excessive Agency/Permission Manipulation - P2
v1.11 - 2023-11-20
Added
- Sensitive Data Exposure - Disclosure of Secrets - PII Leakage/Exposure: VARIES
- Server-Side Injection - Content Spoofing - HTML Content Injection: P5
- Broken Authentication and Session Management - Failure to invalidate session - Permission change: VARIES
- Server Security Misconfiguration - Request Smuggling: VARIES
- Server-Side Injection - LDAP Injection: VARIES
- Cryptographic Weakness - Insufficient Entropy - Limited Random Number Generator (RNG) Entropy Source: P4
- Cryptographic Weakness - Insufficient_Entropy - Use of True Random Number Generator (TRNG) for Non-Security Purpose: P5
- Cryptographic Weakness - Insufficient_Entropy - Pseudo-Random Number Generator (PRNG) Seed Reuse: P5
- Cryptographic Weakness - Insufficient_Entropy - Predictable Pseudo-Random Number Generator (PRNG) Seed: P4
- Cryptographic Weakness - Insufficient_Entropy - Small Seed Space in Pseudo-Random Number Generator (PRNG): P4
- Cryptographic Weakness - Insufficient_Entropy - Initialization Vector (IV) Reuse: P5
- Cryptographic Weakness - Insufficient_Entropy - Predictable Initialization Vector (IV): P4
- Cryptographic Weakness - Insecure Implementation - Missing Cryptographic Step: VARIES
- Cryptographic Weakness - Insecure Implementation - Improper Following of Specification (Other): VARIES
- Cryptographic Weakness - Weak Hash - Lack of Salt: VARIES
- Cryptographic Weakness - Weak Hash - Use of Predictable Salt: P5
- Cryptographic Weakness - Weak Hash - Predictable Hash Collision: VARIES
- Cryptographic Weakness - Insufficient Verification of Data Authenticity - Integrity Check Value (ICV): P4
- Cryptographic Weakness - Insufficient Verification of Data Authenticity - Cryptographic Signature: VARIES
- Cryptographic Weakness - Insecure Key Generation - Improper Asymmetric Prime Selection: VARIES
- Cryptographic Weakness - Insecure Key Generation - Improper Asymmetric Exponent Selection: VARIES
- Cryptographic Weakness - Insecure Key Generation - Insufficient Key Stretching: VARIES
- Cryptographic Weakness - Insecure Key Generation - Insufficient Key Space: P3
- Cryptographic Weakness - Insecure Key Generation - Key Exchage Without Entity Authentication: P3
- Cryptographic Weakness - Key Reuse - Lack of Perfect Forward Secrecy: P4
- Cryptographic Weakness - Key Reuse - Intra-Environment: P5
- Cryptographic Weakness - Key Reuse - Inter-Environment: P2
- Cryptographic Weakness - Side-Channel Attack - Padding Oracle Attack: P4
- Cryptographic Weakness - Side-Channel Attack - Timing Attack: P4
- Cryptographic Weakness - Side-Channel Attack - Power Analysis Attack: P5
- Cryptographic Weakness - Side-Channel Attack - Emanations Attack: P5
- Cryptographic Weakness - Side-Channel Attack - Differential Fault Analysis: VARIES
- Cryptographic Weakness - Use of Expired Cryptographic Key (or Certificate): P4
- Cryptographic Weakness - Incomplete Cleanup of Keying Material: P5
- Cryptographic Weakness - Broken Cryptography - Use of Broken Cryptographic Primitive: P3
- Cryptographic Weakness - Broken Cryptography - Use of Vulnerable Cryptographic Library: P4
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read/Edit/Delete Non-Sensitive Information: P5
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read/Edit/Delete Sensitive Information/GUID/Complex Object Identifiers: P4
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read Sensitive Information/Iterable Object Identifiers: P3
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Edit/Delete Sensitive Information/Iterable Object Identifiers: P2
- Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read/Edit/Delete Sensitive Information (PII)/Iterable Object Identifier: P1
Changed
FROM:
- Cross-Site Scripting (XSS) - IE-Only - Older Version (< IE11): P5
TO:
- Cross-Site Scripting (XSS) - IE-Only: P5
FROM:
- Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - Internal High Impact: P2
- Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - Internal Scan and/or Medium Impact: P3
- Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - External: P4
- Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - DNS Query Only : P5
TO:
- Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - Internal High Impact: P2
- Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - Internal Scan and/or Medium Impact: P3
- Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - External - Low impact: P5
- Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - External - DNS Query Only: P5
FROM:
- Automotive Security Misconfiguration - Infotainment, Radio Head Unit - PII Leakage: P1
TO:
- Automotive Security Misconfiguration - Infotainment, Radio Head Unit - Sensitive data Leakage/Exposure: P1
Removed
- Cross-Site Scripting (XSS) - IE-Only - IE11: P4
- Cross-Site Scripting (XSS) - XSS Filter Disabled: P5
- Broken Cryptography - Cryptographic Flaw - Incorrect Usage: P1
