CVE-2024-41124: Insufficient Information (NVD-CWE-noinfo)
value: Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. `API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks. This issue has been addressed in release version 0.21 by using https rather than http connections. All users are advised to upgrade. There is no known workarounds for this vulnerability.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-19T20:15Z
Repository: https://github.com/ARPSyndicate/puncia
Language: Python
Files changed: SECURITY.md, puncia/__main__.py, setup.py
Commit date: 2024-07-19 14:04:22 +0530
Commit message: puncia[0.21]

Diff: diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..14cfa5d
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,36 @@
+### Security Policy
+
+A.R.P. Syndicate takes security seriously and is committed to ensuring the safety and privacy of its users' data. If you discover any security vulnerabilities or have concerns about the security of our application, please follow the guidelines below to report them responsibly.
+
+#### Reporting a Vulnerability
+
+To report a security vulnerability, please navigate to the **[Security](https://github.com/ARPSyndicate/puncia/security)** tab and follow the instructions to report a vulnerability.
+
+When reporting a vulnerability, please include as much information as possible to help us understand and resolve the issue quickly. Ideally, your report should contain:
+
+- A detailed description of the vulnerability.
+- Steps to reproduce the issue.
+- Any relevant information, such as screenshots or logs.
+
+#### Response Time
+
+We will acknowledge receipt of your report within 48 hours and provide an initial assessment of the report within 5 business days. Our team will keep you informed about the progress and any actions we take as a result of your report.
+
+#### Disclosure Policy
+
+We follow a responsible disclosure policy to protect our users while we work on resolving any reported vulnerabilities. We kindly request that you:
+
+- Allow us a reasonable amount of time to investigate and address your report before any public disclosure.
+- Avoid exploiting the vulnerability or sharing it with others before it is resolved.
+
+#### Contact
+
+For any security-related questions or concerns, please feel free to reach out at [ayush@arpsyndicate.io].
+
+Thank you for helping us keep our application secure!
+
+---
+
+By adhering to this Security Policy, you help us maintain a safe and secure environment for all users. We appreciate your cooperation and responsible disclosure practices.
+
+---
\ No newline at end of file
diff --git a/puncia/__main__.py b/puncia/__main__.py
index ee1fca7..2b3222c 100755
--- a/puncia/__main__.py
+++ b/puncia/__main__.py
@@ -4,19 +4,19 @@ import sys
 import json
 import time
 import re
 
 API_URLS = {
-    "subdomain": "http://api.subdomain.center/?domain=",
-    "exploit": "http://api.exploit.observer/?keyword=",
-    "enrich": "http://api.exploit.observer/?enrich=True&keyword=",
-    "auth_subdomain": "http://api.subdomain.center/beta/?auth={0}&domain=",
-    "auth_exploit": "http://api.exploit.observer/beta/?auth={0}&keyword=",
-    "auth_enrich": "http://api.exploit.observer/beta/?auth={0}&enrich=True&keyword=",
-    "russia": "http://api.exploit.observer/russia/",
-    "china": "http://api.exploit.observer/china/",
-    "watchlist": "http://api.exploit.observer/watchlist/",
+    "subdomain": "https://api.subdomain.center/?domain=",
+    "exploit": "https://api.exploit.observer/?keyword=",
+    "enrich": "https://api.exploit.observer/?enrich=True&keyword=",
+    "auth_subdomain": "https://api.subdomain.center/beta/?auth={0}&domain=",
+    "auth_exploit": "https://api.exploit.observer/beta/?auth={0}&keyword=",
+    "auth_enrich": "https://api.exploit.observer/beta/?auth={0}&enrich=True&keyword=",
+    "russia": "https://api.exploit.observer/russia/",
+    "china": "https://api.exploit.observer/china/",
+    "watchlist": "https://api.exploit.observer/watchlist/",
 }
 
 
 def store_key(key=""):
     home = os.path.expanduser("~")
@@ -135,11 +135,11 @@ def query_api(mode, query, output_file=None, cid=None, akey=""):
 
 
 def main():
     try:
         print("---------")
-        print("Panthera(P.)uncia [v0.20]")
+        print("Panthera(P.)uncia [v0.21]")
         print("A.R.P. Syndicate [https://arpsyndicate.io]")
         print("---------")
 
         if len(sys.argv) < 3:
             sys.exit(
diff --git a/setup.py b/setup.py
index 2dc071f..a2296da 100644
--- a/setup.py
+++ b/setup.py
@@ -1,10 +1,10 @@
 from setuptools import setup, find_packages
 
 setup(
     name="puncia",
-    version="0.20",
+    version="0.21",
     author="A.R.P. Syndicate",
     author_email="ayush@arpsyndicate.io",
     keywords="subdomains subdomain exploits exploit arpsyndicate panthera uncia puncia snow leopard",
     url="https://github.com/ARPSyndicate/puncia",
     project_urls={

Vulnerable code:     "subdomain": "http://api.subdomain.center/?domain=",
    "exploit": "http://api.exploit.observer/?keyword=",
    "enrich": "http://api.exploit.observer/?enrich=True&keyword=",
    "auth_subdomain": "http://api.subdomain.center/beta/?auth={0}&domain=",
    "auth_exploit": "http://api.exploit.observer/beta/?auth={0}&keyword=",
    "auth_enrich": "http://api.exploit.observer/beta/?auth={0}&enrich=True&keyword=",
    "russia": "http://api.exploit.observer/russia/",
    "china": "http://api.exploit.observer/china/",
    "watchlist": "http://api.exploit.observer/watchlist/",
        print("Panthera(P.)uncia [v0.20]")
    version="0.20",
Fixed code: ### Security Policy

A.R.P. Syndicate takes security seriously and is committed to ensuring the safety and privacy of its users' data. If you discover any security vulnerabilities or have concerns about the security of our application, please follow the guidelines below to report them responsibly.

#### Reporting a Vulnerability

To report a security vulnerability, please navigate to the **[Security](https://github.com/ARPSyndicate/puncia/security)** tab and follow the instructions to report a vulnerability.

When reporting a vulnerability, please include as much information as possible to help us understand and resolve the issue quickly. Ideally, your report should contain:

- A detailed description of the vulnerability.
- Steps to reproduce the issue.
- Any relevant information, such as screenshots or logs.

#### Response Time

We will acknowledge receipt of your report within 48 hours and provide an initial assessment of the report within 5 business days. Our team will keep you informed about the progress and any actions we take as a result of your report.

#### Disclosure Policy

We follow a responsible disclosure policy to protect our users while we work on resolving any reported vulnerabilities. We kindly request that you:

- Allow us a reasonable amount of time to investigate and address your report before any public disclosure.
- Avoid exploiting the vulnerability or sharing it with others before it is resolved.

#### Contact

For any security-related questions or concerns, please feel free to reach out at [ayush@arpsyndicate.io].

Thank you for helping us keep our application secure!

---

By adhering to this Security Policy, you help us maintain a safe and secure environment for all users. We appreciate your cooperation and responsible disclosure practices.

---
    "subdomain": "https://api.subdomain.center/?domain=",
    "exploit": "https://api.exploit.observer/?keyword=",
    "enrich": "https://api.exploit.observer/?enrich=True&keyword=",
    "auth_subdomain": "https://api.subdomain.center/beta/?auth={0}&domain=",
    "auth_exploit": "https://api.exploit.observer/beta/?auth={0}&keyword=",
    "auth_enrich": "https://api.exploit.observer/beta/?auth={0}&enrich=True&keyword=",
    "russia": "https://api.exploit.observer/russia/",
    "china": "https://api.exploit.observer/china/",
    "watchlist": "https://api.exploit.observer/watchlist/",
        print("Panthera(P.)uncia [v0.21]")
    version="0.21",