CVE-2024-41124 (published 2024-07-19T20:15Z)

Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. `API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks. This issue has been addressed in release version 0.21 by using https rather than http connections. All users are advised to upgrade. There is no known workarounds for this vulnerability.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/ARPSyndicate/puncia
commit_details: repo_url: https://github.com/ARPSyndicate/puncia
author: Ayush Singh
author_date: 2024-07-19 14:04:22+05:30
msg: puncia[0.21]
repository: repo_url: https://github.com/ARPSyndicate/puncia
repo_name: ARPSyndicate/puncia
description: The Panthera(P.)uncia of Cybersecurity - Official CLI utility for Subdomain Center & Exploit Observer. 
repo_language: Python
owner: ARPSyndicate
file_changes: filename: SECURITY.md
change_type: ModificationType.ADD
diff: @@ -0,0 +1,36 @@
+### Security Policy
+
+A.R.P. Syndicate takes security seriously and is committed to ensuring the safety and privacy of its users' data. If you discover any security vulnerabilities or have concerns about the security of our application, please follow the guidelines below to report them responsibly.
+
+#### Reporting a Vulnerability
+
+To report a security vulnerability, please navigate to the **[Security](https://github.com/ARPSyndicate/puncia/security)** tab and follow the instructions to report a vulnerability.
+
+When reporting a vulnerability, please include as much information as possible to help us understand and resolve the issue quickly. Ideally, your report should contain:
+
+- A detailed description of the vulnerability.
+- Steps to reproduce the issue.
+- Any relevant information, such as screenshots or logs.
+
+#### Response Time
+
+We will acknowledge receipt of your report within 48 hours and provide an initial assessment of the report within 5 business days. Our team will keep you informed about the progress and any actions we take as a result of your report.
+
+#### Disclosure Policy
+
+We follow a responsible disclosure policy to protect our users while we work on resolving any reported vulnerabilities. We kindly request that you:
+
+- Allow us a reasonable amount of time to investigate and address your report before any public disclosure.
+- Avoid exploiting the vulnerability or sharing it with others before it is resolved.
+
+#### Contact
+
+For any security-related questions or concerns, please feel free to reach out at [ayush@arpsyndicate.io].
+
+Thank you for helping us keep our application secure!
+
+---
+
+By adhering to this Security Policy, you help us maintain a safe and secure environment for all users. We appreciate your cooperation and responsible disclosure practices.
+
+---
\ No newline at end of file

programming_language: Markdown
filename: __main__.py
change_type: ModificationType.MODIFY
diff: @@ -6,15 +6,15 @@ import time
 import re
 
 API_URLS = {
-    "subdomain": "http://api.subdomain.center/?domain=",
-    "exploit": "http://api.exploit.observer/?keyword=",
-    "enrich": "http://api.exploit.observer/?enrich=True&keyword=",
-    "auth_subdomain": "http://api.subdomain.center/beta/?auth={0}&domain=",
-    "auth_exploit": "http://api.exploit.observer/beta/?auth={0}&keyword=",
-    "auth_enrich": "http://api.exploit.observer/beta/?auth={0}&enrich=True&keyword=",
-    "russia": "http://api.exploit.observer/russia/",
-    "china": "http://api.exploit.observer/china/",
-    "watchlist": "http://api.exploit.observer/watchlist/",
+    "subdomain": "https://api.subdomain.center/?domain=",
+    "exploit": "https://api.exploit.observer/?keyword=",
+    "enrich": "https://api.exploit.observer/?enrich=True&keyword=",
+    "auth_subdomain": "https://api.subdomain.center/beta/?auth={0}&domain=",
+    "auth_exploit": "https://api.exploit.observer/beta/?auth={0}&keyword=",
+    "auth_enrich": "https://api.exploit.observer/beta/?auth={0}&enrich=True&keyword=",
+    "russia": "https://api.exploit.observer/russia/",
+    "china": "https://api.exploit.observer/china/",
+    "watchlist": "https://api.exploit.observer/watchlist/",
 }
 
 
@@ -137,7 +137,7 @@ def query_api(mode, query, output_file=None, cid=None, akey=""):
 def main():
     try:
         print("---------")
-        print("Panthera(P.)uncia [v0.20]")
+        print("Panthera(P.)uncia [v0.21]")
         print("A.R.P. Syndicate [https://arpsyndicate.io]")
         print("---------")
 

programming_language: Python
filename: setup.py
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="puncia",
-    version="0.20",
+    version="0.21",
     author="A.R.P. Syndicate",
     author_email="ayush@arpsyndicate.io",
     keywords="subdomains subdomain exploits exploit arpsyndicate panthera uncia puncia snow leopard",

programming_language: Markdown