Vulnerability Exposure Index (VEX) Database - SCP Foundation

Type here to search all available records…

18,452 VEX records have been documented by SIMULACRUM authorities.

ⓘ Unsure how to continue? Refer below for further information.

OVERVIEW

Security is crucial to Project SIMULACRUM's continued success. The Vulnerability Exposure Index (VEX) database provides a centralized catalogue for disclosing and documenting known threats to SIMULACRUM's environment, inhabitants, items, virtual sandboxes, and external infrastructure. VEX records are enumerated by their entry IDs (VEX-YYYY-NNN) which documents the year that the identified vulnerability was discovered in and a unique sequence numerical for categorization.

Click here for more information...

VEX records provide in-depth information regarding specific vulnerabilities. This includes a description, impact, status, severity, related item(s), assigned authorities, mitigation procedures, and any repercussions determined to be directly or indirectly caused by the threat itself. All records are appropriately color-coded based on severity.

Severity indicates the perceived risk that a vulnerability possesses if left unmitigated. This metric is assessed by a numerical scale ranging from 0.0 (Informational) to 0.1 - 2.5 (Low), 2.6 - 5.0 (Medium), 5.1 - 7.5 (High), or 7.6 - 10.0 (Critical). Severity does not always suggest that an unmitigated threat will have widespread effects; rather it indicates the perceived damage that it can potentially cause overall.

To determine the scale at which a vulnerability can affect multiple systems or users, VEX records document a vulnerability's Impact. Impact is measured as MINIMAL, LOW, MEDIUM, HIGH, or CRITICAL, depending on the number of items (if any) that may be affected by a specific threat. Impact assessments are not all inclusive, and may incorporate additional considerations such as SIMULACRUM sandbox size, Site structure, player capacity, or physical resource utilization.

In order to assist operators and personnel utilizing this database, VEX records will also display the last known Status of a vulnerability. Status documents whether a vulnerability is PENDING, ERADICATED, REMEDIED, ACTIVE, or FUTILE. As status only reflects a vulnerability's last known activity, any outstanding impact or repercussions caused by a particular threat are not considered in this metric.1

Individual VEX records are documented and supported by an assigned Authority. Authorities can be comprised of SIMULACRUM operators, administrators, or other third-party organizations and Groups of Interest (GoI). Assigned authorities are responsible for reporting, and classifying cyberanomalous threats as they manifest. Multiple authorities may also collaborate together in order to properly document discovered vulnerabilities, improve relations, and/or enhance cooperation efforts made between other virtualized or physical parties. Utilize the above search function to locate particular VEX records, or refer below to several of the most recently submitted entries.

Click here to hide information...

RECENT RECORDS

VEX ID:
VEX-2045-003
SEVERITY:
7.4

RELATED ITEMS:

SCP-6882

DESCRIPTION:

Improper access controls across SIMULACRUM meshlayer firmware versions would allow affected players to bypass predefined world boundaries. This, in essence, allowed for uninterrupted access to any bordering sandboxes.

In some versions, players were not only able to bypass these borders, but could also access edit parameters within their sandbox, thus granting them access to elevated administrator commands.

REPERCUSSIONS:

Simulations bordering vulnerable sandboxes were mostly reserved for testing and containment of undocumented large-scale virtual aggressors (LSVAs) or other unknown anomalous phenomenon. Players exploiting this vulnerability could disrupt these simulations through physical interaction or by executing elevated commands.

Players with internal system access to their own sandboxes could also "piggyback" off their instances and into other remote sandboxes. In one case, several unknown attackers were able to sabotage the SCP-6882 virtual instance and hijack its noospheric platform interface, causing connected players to undergo rapid mental and physical deterioration before an unexpected sandbox crash later occured.

Attackers were able to successfully input coordinate commands to bypass detection; however, improper values resulted in threat actors falling out-of-bounds and missing subsequent bound checks. Recovery efforts have been futile.

MITIGATION:

Firmware updates are available for all affected virtual sandboxes. Complete system restart is necessary to apply changes. Additional vendor-specific hotfix patches have been successfully deployed across all platforms and unattached virtual instances.

STATUS:
ERADICATED
IMPACT:
Low
AUTHORITY:
Dr. Jakob Reigen

VEX ID:
VEX-2032-682
SEVERITY:
9.8

RELATED ITEMS:

SCP-INTEGER

MAKER

SIMULA-9025-1B

SIMULA-7621-3C

DESCRIPTION:

Unsecured data root paths between sandboxes from the PRIME INDEX could allow semiohazardous phenomenon to affect multiple SIMULACRUM layers.

REPERCUSSIONS:

Disaster recovery systems flagged and restored a cascading network file system crash after a failed interaction between two sandboxes. Prior to the alerted incident, SIMULA-9025-1B — an abstracted reality intended to test interactions between ontokinetic, semiohazardous, and other reality-altering anomalies — had initiated a resource request from SIMULA-7621-3C.

During the response operation by SIMULA-7621-3C, an undetected HAZARD was also transferred. This COMPLEX was then successfully executed after both sandboxes confirmed its presence and attempted to forcibly delete the THREAT. Due to outdated data signatures, the HAZARD began systematically updating all reference pointers, files, and datasets with abstractions, halting system functions across 3,451 connected instances.

COMPLEX manifested itself within SIMULA-9025-1B, alerting host player MAKER. Attempts by MAKER to notify SIMULACRUM administrators of the MALWARE2 subsequently failed as null counters disrupted operations. Automated systems were unable to fully repair either sandboxes or regenerate MAKER from backup player matrices.

MITIGATION:

Standard requests sent by client and serving sandboxes have been updated to introduce an additional CHECK flag to determine if data being sent or received contains anomalous traces. Host-based detection/removal systems have also been updated across all active SIMULACRUM instances to cleanse deployments of potential reality-altering hazards.

PRIME INDEX roots have been updated to utilize the latest security protocols. Improved pathing methods between sandboxes have also been introduced to now disconnect instances determined to be at risk of anomalous leakage.

SIMULACRUM authorities have all received additional training on dealing with active cognitive hazards, including semiohazardous and infohazardous phenomenon.

STATUS:
ACTIVE
IMPACT:
CRITICAL
AUTHORITY:
Dr. Devin Collins

VEX ID:
VEX-2423-019
SEVERITY:
4.8

RELATED ITEMS:

SCP-6872

SCP-2718

DESCRIPTION:

A buffer overflow in the commit_action module in SCP-6872 would incorrectly reference SCP-2718, resulting in multiple errors and extraordinary physical harm onto players. Continued conflicts could cause a denial of service (crash) and possibly execute additional root-level commands.

In some instances, players experiencing multiple requests between both SCP-6872 and SCP-2718 could also be afflicted by both conditions simultaneously, leading to corrupted reference caches and other errors.

REPERCUSSIONS:

During the rapid deployment of sub-simulations within SCP-6872, an increased strain on incoming state requests resulted in players being incorrectly assigned to SCP-2718. During this period, players experiencing the "DECEASED" state would not be transported to their simulated death sequences— rather, affected individuals would either be terminated from their hosting simulation entirely or remain permanently immobile and unable to disconnect from their sessions. This resulted in players being in multiple states of "DECEASED" between several sandboxes.

In other circumstances, physical players would be completely ejected from all sandboxes. Excessive electric discharge caused by the vulnerability sent uncontrolled shocks through sensitive neural interfaces, physically disabling players and locking their player pods indefinitely. Players would still report active heartbeats despite being clinically deceased, bypassing all system monitoring tools for extended periods of time. This resulted in player pods being contaminated with excess organisms, including bacteria, mites, mold, and flies.

All later attempts to remove players from their pods universally ended in failure.

MITIGATION:

Additional software-level checks against possible overflows have been implemented to prevent any issues with SCP-6872 and SCP-2718. Additional system monitoring tools have been implemented to confirm player status through haptic and audio feedback. All active neural network interfaces have also been issued a firmware update and all player pods have been refitted with emergency release latches.

STATUS:
REMEDIED
IMPACT:
Medium
AUTHORITY:
[AUTOMATED]

VEX ID:
VEX-2076-303
SEVERITY:
1.7

RELATED ITEMS:

SIMULA-Y200-2K

cron version 23

Docker version 1001001010001.3

DESCRIPTION:

On Docker versions that form a valid number string in binary, cron would read it as a valid character string instead. This would cause various issues, including system failure.

REPERCUSSIONS:

SIMULA-Y200-2K is a sandboxed reality designed to output a single value — the default system time of baseline reality pre-SIMULACRUM. This is done to maintain legacy systems that expect a standard time on certain functions instead of the advanced system time of IEEE 4098.32, the standardized SIMULACRUM timestamp.

Retrieval of the legacy system timestamp is done through a cron script, which first checks for the current Docker version, and only fetches a new system timestamp if the version number had recently changed. Due to issues with cron, Docker version number strings would sometimes be misinterpreted as invalid character strings when updated.

Because of this, severe momentary failure for all SIMULA instances that depended on the legacy system time occurred. As of 2075, 321 SIMULA instances were dependent on legacy timestamps, subsequently leading to indirect system failures of those sandboxes and 8,321,098,321 other connected dependencies.

MITIGATION:

A patch to cron's developer has been sent to disable interpretation of binary strings as regular characters. System administrators are currently collaborating with Docker to ensure that no version number is an interpretable character string.

STATUS:
REMEDIED
IMPACT:
CRITICAL
AUTHORITY:
Dr. Basir

VEX ID:
VEX-2099-002
SEVERITY:
7.2

RELATED ITEMS:

SCP-8155

Neurological Maternal Decay Syndrome

DESCRIPTION:

A collection of five unaccounted glitches manifesting over the course of two months that were able to successfully severely damage the hosted mainframe via the use of 9 16 server crashes.

REPERCUSSIONS:

In the immediate culmination of SCP-8155 via all five glitches resulted in a severe malfunction within SIMULA-2099-02 manifesting as an account of a en masse ontological breakdown as well as all female SIMULACRUM participants to contract a supreme version of "Maternal Decay Syndrome," a SIMULACRUM virus acting as a neurological memetic impairment that ceased all female inhabitants abilities to reproduce, reciprocate love for their young, as well as a deconstruction and destruction of all familial conceptual base components implemented into the SIMULACRUM server.

MITIGATION:

Attempts to derail the situation via repairs to the mainframe were attempted by VEX-2196-002. Initial attempts were futile, however over the course of multiple server restarts, 2196-002 were successful in mitigating the threat posed by SCP-8155, albeit with significant financial and mental costs that resulted in the derealization of their participation within all SCP Foundation-acting parties, most likely due to an error in the management of VEX-2099-002.

Mitigation was deemed successful, however, the actual nature as well as origins of how SCP-8155 was able to impact the vex server mainframe's on such a large and impactful basis is unknown and currently being extensively investigated.

STATUS:
ERADICATED
IMPACT:
HIGH
AUTHORITY:
Dr. Christopher Blashman

CONTRIBUTION

Contributions can be made using the following VEX record format:

Click here to view VEX format template...

[[div class="red/blue/orange/green/purple"]]
[[table style="width: 100%; border-collapse:collapse; margin-top: 2.5rem; margin-bottom: 2.5rem;"]]
[[row]]
[[hcell]]
**VEX ID:**
[[/hcell]]
[[cell colspan="3" style="text-align: center;"]]
VEX-YYYY-NNN
[[/cell]]
[[hcell]]
**SEVERITY:**
[[/hcell]]
[[cell style="text-align: center; font-weight: bold; color: rgb(var(--accent-color));"]]
Severity should be placed here. Be sure that the color of the table matches the value range of the severity. (0 should be purple, 0.1 - 2.5 should be green, 2.5 - 5 should be blue, 5 - 7.5 should be orange, and 7.5 to 10 should red)
[[/cell]]
[[/row]]
[[row]]
[[hcell colspan="6"]]
**RELATED ITEMS:**
[[/hcell]]
[[/row]]
[[row]]
[[cell colspan="6"]]
* A list of anomalies or systems relating to, or directly caused by the vulnerability should be placed here.
* Add as many items as needed here.
[[/cell]]
[[/row]]
[[row]]
[[hcell colspan="6"]]
**DESCRIPTION:**
[[/hcell]]
[[/row]]
[[row]]
[[cell colspan="6"]]
Information describing what the actual vulnerability is should go here. Refrain from adding too much information regarding other systems or processes. This field should be solely reserved for documenting what the vulnerability is and how it operates.
[[/cell]]
[[/row]]
[[row]]
[[hcell colspan="6"]]
**REPERCUSSIONS:**
[[/hcell]]
[[/row]]
[[row]]
[[cell colspan="6"]]
Information describing the effects of the described vulnerability should go here. This field can be used to document the systems responsible for the vulnerability, events which happened as a direct or indirect result of the vulnerability, or any other pertinent details.
[[/cell]]
[[/row]]
[[row]]
[[hcell colspan="6"]]
**MITIGATION:**
[[/hcell]]
[[/row]]
[[row]]
[[cell colspan="6"]]
Information involving how to mitigate the described vulnerability should go here. Be descriptive regarding the steps or actions required to be taken to prevent further issues or exploitation.
[[/cell]]
[[/row]]
[[row]]
[[hcell]]
**STATUS:**
[[/hcell]]
[[cell style="font-weight: bold; text-align: center;"]]
[[span class="red/blue/orange/green/purple"]]STATUS HERE (PENDING/ERADICATED/REMEDIED/INACTIVE/ACTIVE/FUTILE)[/span]]
[[/cell]]
[[hcell]]
**IMPACT:**
[[/hcell]]
[[cell style="text-align: center; font-weight: bold;"]]
[[span class="red/blue/orange/green/purple"]]IMPACT HERE (MINIMAL/LOW/MEDIUM/HIGH/CRITICAL)[[/span]]
[[/cell]]
[[hcell]]
**AUTHORITY:**
[[/hcell]]
[[cell style="text-align: center;"]]
The individual or group responsible for documenting this vulnerabilty goes here. This will most likely be a researcher, doctor, or Foundation agent who takes responsibility for this record.
[[/cell]]
[[/row]]
[[/table]]
[[/div]]

Click here to close VEX format template...

Note that only a single color (VIOLET, GREEN, BLUE, ORANGE, or RED) should be selected when using a [[div]] or [[span]], if required. For example, in order to properly display a colored word like FUTILE, please use the following formatting:

[[span class="red"]]FUTILE[[/span]]

Alternatively, if a VEX record needs to be BLUE, please encapsulate your VEX record table with the following syntax:

[[div class="blue"]]

…

[[/div]]

Upon documenting a VEX record, please be sure to verify that all of the formatting is correct and accurate. If there are no issues, a new VEX record should populate in the Recent Records section.

Footnotes

1. For example, a successfully executed malware signature that was quarantined and REMEDIED by intrusion prevention systems (IPSs) would not be considered ACTIVE even if impacted data or systems are still currently affected.

2. SLANDER.