Add changelog for version 3.6 (white)

infobyte · Feb 20, 2019 · 415371d · 415371d
1 parent f47ee97
commit 415371d
Show file tree

Hide file tree

Showing 31 changed files with 97 additions and 30 deletions.
diff --git a/CHANGELOG/3.6/Fix_encoding.md b/CHANGELOG/3.6/Fix_encoding.md
diff --git a/CHANGELOG/3.6/active_and_readonly.md b/CHANGELOG/3.6/active_and_readonly.md
diff --git a/CHANGELOG/3.6/acunetix_plugin_bug.md b/CHANGELOG/3.6/acunetix_plugin_bug.md
diff --git a/CHANGELOG/3.6/add_dashboard_pagination.md b/CHANGELOG/3.6/add_dashboard_pagination.md
diff --git a/CHANGELOG/3.6/add_fields_to_vuln_template.md b/CHANGELOG/3.6/add_fields_to_vuln_template.md
diff --git a/CHANGELOG/3.6/add_gitlab_ci_yml.md b/CHANGELOG/3.6/add_gitlab_ci_yml.md
diff --git a/CHANGELOG/3.6/add_status_code.md b/CHANGELOG/3.6/add_status_code.md
diff --git a/CHANGELOG/3.6/attachment_api_invalid_vuln_id.md b/CHANGELOG/3.6/attachment_api_invalid_vuln_id.md
diff --git a/CHANGELOG/3.6/attachments_csrf_vuln.md b/CHANGELOG/3.6/attachments_csrf_vuln.md
diff --git a/CHANGELOG/3.6/bug_lynis_plugin.md b/CHANGELOG/3.6/bug_lynis_plugin.md
diff --git a/CHANGELOG/3.6/date.md b/CHANGELOG/3.6/date.md
@@ -0,0 +1 @@
+Feb 21th, 2019
diff --git a/CHANGELOG/3.6/delete_ipdb.md b/CHANGELOG/3.6/delete_ipdb.md
diff --git a/CHANGELOG/3.6/dynamic_vars_in_searcher.md b/CHANGELOG/3.6/dynamic_vars_in_searcher.md
diff --git a/CHANGELOG/3.6/extra_config_in_server_ini.md b/CHANGELOG/3.6/extra_config_in_server_ini.md
diff --git a/CHANGELOG/3.6/fix_bug_initdb.md b/CHANGELOG/3.6/fix_bug_initdb.md
diff --git a/CHANGELOG/3.6/fix_duplicate_custom_fields.md b/CHANGELOG/3.6/fix_duplicate_custom_fields.md
diff --git a/CHANGELOG/3.6/fix_nessus_plugin_host_issue.md b/CHANGELOG/3.6/fix_nessus_plugin_host_issue.md
diff --git a/CHANGELOG/3.6/fix_search_exploits_logic.md b/CHANGELOG/3.6/fix_search_exploits_logic.md
diff --git a/CHANGELOG/3.6/fix_sqlmap.md b/CHANGELOG/3.6/fix_sqlmap.md
diff --git a/CHANGELOG/3.6/fix_ws_loop.md b/CHANGELOG/3.6/fix_ws_loop.md
diff --git a/CHANGELOG/3.6/keep_selected_vulns.md b/CHANGELOG/3.6/keep_selected_vulns.md
diff --git a/CHANGELOG/3.6/name_not_consistent.md b/CHANGELOG/3.6/name_not_consistent.md
diff --git a/CHANGELOG/3.6/nessus_hostnames_bug.md b/CHANGELOG/3.6/nessus_hostnames_bug.md
diff --git a/CHANGELOG/3.6/send_searcher_alert_with_custom_mail.md b/CHANGELOG/3.6/send_searcher_alert_with_custom_mail.md
diff --git a/CHANGELOG/3.6/sslyze_automatic_detection.md b/CHANGELOG/3.6/sslyze_automatic_detection.md
diff --git a/CHANGELOG/3.6/summary_issuetracker_readonly.md b/CHANGELOG/3.6/summary_issuetracker_readonly.md
diff --git a/CHANGELOG/3.6/update_dnsmap_plugin.md b/CHANGELOG/3.6/update_dnsmap_plugin.md
diff --git a/CHANGELOG/3.6/updated_NetSparker.md b/CHANGELOG/3.6/updated_NetSparker.md
diff --git a/CHANGELOG/3.6/white.md b/CHANGELOG/3.6/white.md
@@ -0,0 +1,30 @@
+ * Fix CSRF (Cross-Site Request Forgery) vulnerability in vulnerability attachments API.
+   This allowed an attacker to upload evidence to vulns. He/she required to know the
+   desired workspace name and vulnerability id so it complicated the things a bit. We
+   classified this vuln as a low impact one.
+ * Readonly and disabled workspaces
+ * Add fields 'impact', 'easeofresolution' and 'policyviolations' to vulnerability_template
+ * Add pagination in  'Command history', 'Last Vulnerabilities', 'Activity logs' into dashboard
+ * Add status_code field to web vulnerability
+ * Preserve selection after bulk edition of vulnerabilities in the Web UI
+ * Faraday's database will be created using UTF-8 encoding
+ * Fix bug of "select a different workspace" from an empty list loop.
+ * Fix bug when creating duplicate custom fields
+ * Fix bug when loading in server.ini with extra configs
+ * Fix `./manage.py command`. It wasn't working since the last schema migration
+ * `./manage.py createsuperuser` command renamed to `./manage.py create-superuser`
+ * Fix bug when non-numeric vulnerability IDs were passed to the attachments API
+ * Fix logic in search exploits
+ * Add ability to 'Searcher' to execute rules in loop with dynamic variables
+ * Send searcher alert with custom mail
+ * Add gitlab-ci.yml file to execute test and pylint on gitlab runner
+ * Fix 500 error when updating services and vulns with specific read-only parameters set
+
+ * Fix SQLMap plugin to support newer versions of the tool
+ * Improve service's parser for Lynis plugin
+ * Fix bug when parsing URLs in Acunetix reports
+ * Fix and update NetSparker Plugin
+ * Fix bug in nessus plugin. It was trying to create a host without IP. Enabled logs on the server for plugin processing (use --debug)
+ * Fix bug when parsing hostnames in Nessus reports
+ * Fix SSLyze report automatic detection, so reports can be imported from the web ui
+ * Update Dnsmap Plugin
diff --git a/CHANGELOG/RELEASE.md b/CHANGELOG/RELEASE.md
@@ -9,6 +9,39 @@ New features in the latest update
 =====================================
 
 
+3.6 [Feb 21th, 2019]:
+---
+ * Fix CSRF (Cross-Site Request Forgery) vulnerability in vulnerability attachments API.
+   This allowed an attacker to upload evidence to vulns. He/she required to know the
+   desired workspace name and vulnerability id so it complicated the things a bit. We
+   classified this vuln as a low impact one.
+ * Readonly and disabled workspaces
+ * Add fields 'impact', 'easeofresolution' and 'policyviolations' to vulnerability_template
+ * Add pagination in  'Command history', 'Last Vulnerabilities', 'Activity logs' into dashboard
+ * Add status_code field to web vulnerability
+ * Preserve selection after bulk edition of vulnerabilities in the Web UI
+ * Faraday's database will be created using UTF-8 encoding
+ * Fix bug of "select a different workspace" from an empty list loop.
+ * Fix bug when creating duplicate custom fields
+ * Fix bug when loading in server.ini with extra configs
+ * Fix `./manage.py command`. It wasn't working since the last schema migration
+ * `./manage.py createsuperuser` command renamed to `./manage.py create-superuser`
+ * Fix bug when non-numeric vulnerability IDs were passed to the attachments API
+ * Fix logic in search exploits
+ * Add ability to 'Searcher' to execute rules in loop with dynamic variables
+ * Send searcher alert with custom mail
+ * Add gitlab-ci.yml file to execute test and pylint on gitlab runner
+ * Fix 500 error when updating services and vulns with specific read-only parameters set
+
+ * Fix SQLMap plugin to support newer versions of the tool
+ * Improve service's parser for Lynis plugin
+ * Fix bug when parsing URLs in Acunetix reports
+ * Fix and update NetSparker Plugin
+ * Fix bug in nessus plugin. It was trying to create a host without IP. Enabled logs on the server for plugin processing (use --debug)
+ * Fix bug when parsing hostnames in Nessus reports
+ * Fix SSLyze report automatic detection, so reports can be imported from the web ui
+ * Update Dnsmap Plugin
+
 3.5 [Jan 16th, 2019]:
 ---
  * Redesgin of new/edit vulnerability forms

diff --git a/RELEASE.md b/RELEASE.md
@@ -9,6 +9,39 @@ New features in the latest update
 =====================================
 
 
+3.6 [Feb 21th, 2019]:
+---
+ * Fix CSRF (Cross-Site Request Forgery) vulnerability in vulnerability attachments API.
+   This allowed an attacker to upload evidence to vulns. He/she required to know the
+   desired workspace name and vulnerability id so it complicated the things a bit. We
+   classified this vuln as a low impact one.
+ * Readonly and disabled workspaces
+ * Add fields 'impact', 'easeofresolution' and 'policyviolations' to vulnerability_template
+ * Add pagination in  'Command history', 'Last Vulnerabilities', 'Activity logs' into dashboard
+ * Add status_code field to web vulnerability
+ * Preserve selection after bulk edition of vulnerabilities in the Web UI
+ * Faraday's database will be created using UTF-8 encoding
+ * Fix bug of "select a different workspace" from an empty list loop.
+ * Fix bug when creating duplicate custom fields
+ * Fix bug when loading in server.ini with extra configs
+ * Fix `./manage.py command`. It wasn't working since the last schema migration
+ * `./manage.py createsuperuser` command renamed to `./manage.py create-superuser`
+ * Fix bug when non-numeric vulnerability IDs were passed to the attachments API
+ * Fix logic in search exploits
+ * Add ability to 'Searcher' to execute rules in loop with dynamic variables
+ * Send searcher alert with custom mail
+ * Add gitlab-ci.yml file to execute test and pylint on gitlab runner
+ * Fix 500 error when updating services and vulns with specific read-only parameters set
+
+ * Fix SQLMap plugin to support newer versions of the tool
+ * Improve service's parser for Lynis plugin
+ * Fix bug when parsing URLs in Acunetix reports
+ * Fix and update NetSparker Plugin
+ * Fix bug in nessus plugin. It was trying to create a host without IP. Enabled logs on the server for plugin processing (use --debug)
+ * Fix bug when parsing hostnames in Nessus reports
+ * Fix SSLyze report automatic detection, so reports can be imported from the web ui
+ * Update Dnsmap Plugin
+
 3.5 [Jan 16th, 2019]:
 ---
  * Redesgin of new/edit vulnerability forms