{
  "host": "familytree.lan.ddnsgeek.com",
  "generated_at": "2026-04-14T07:48:16.890425+00:00",
  "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
  "findings": [
    {
      "host": "familytree.lan.ddnsgeek.com",
      "cve": "CVE-2003-1418",
      "affected_host": "familytree.lan.ddnsgeek.com",
      "endpoint": "unknown",
      "product_version_evidence": [
        "http       syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
        "http     syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
        "http    syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
        "ssl/http   syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
        "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
        "tcpwrapped syn-ack ttl 56"
      ],
      "exploit_precondition": "Target must expose Apache mod_include with vulnerable SSI execution behavior.",
      "reproducibility": "not-reproduced",
      "disposition": "needs-manual-test",
      "disposition_rationale": "Signature-based identification only; exploitability depends on module/configuration and requires targeted validation.",
      "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
      "evidence_sources": [
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
          "match_count": 1
        }
      ]
    },
    {
      "host": "familytree.lan.ddnsgeek.com",
      "cve": "CVE-2005-3299",
      "affected_host": "familytree.lan.ddnsgeek.com",
      "endpoint": "443/tcp",
      "product_version_evidence": [
        "ssl/http   syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
        "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)"
      ],
      "exploit_precondition": "Target must run Apache 2.0.x with mod_imap module enabled and vulnerable to cross-site scripting behavior.",
      "reproducibility": "not-reproduced",
      "disposition": "needs-manual-test",
      "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
      "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
      "evidence_sources": [
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
          "match_count": 2
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "443/tcp",
          "evidence": "|     IDs:  CVE:CVE-2005-3299"
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "443/tcp",
          "evidence": "|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299"
        }
      ]
    },
    {
      "host": "familytree.lan.ddnsgeek.com",
      "cve": "CVE-2009-3733",
      "affected_host": "familytree.lan.ddnsgeek.com",
      "endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
      "product_version_evidence": [
        "No explicit product/version fingerprint in nmap service line."
      ],
      "exploit_precondition": "Target must expose VMware SDK endpoint (/sdk) and allow traversal into host files.",
      "reproducibility": "not-reproduced",
      "disposition": "needs-manual-test",
      "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
      "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
      "evidence_sources": [
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
          "match_count": 2
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "/sdk/../../../../../../../etc/vmware/hostd/vmInventory.xml",
          "evidence": "Possible path traversal in VMWare (CVE-2009-3733)"
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml",
          "evidence": "Possible path traversal in VMWare (CVE-2009-3733)"
        }
      ]
    },
    {
      "host": "familytree.lan.ddnsgeek.com",
      "cve": "CVE-2011-0966",
      "affected_host": "familytree.lan.ddnsgeek.com",
      "endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\MDC\\Tomcat\\webapps\\triveni\\WEB-INF\\classes\\schedule.properties",
      "product_version_evidence": [
        "No explicit product/version fingerprint in nmap service line."
      ],
      "exploit_precondition": "Target must be Cisco Unified Operations Manager 8.0/8.5 with vulnerable auditLog.do traversal handling.",
      "reproducibility": "not-reproduced",
      "disposition": "needs-manual-test",
      "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
      "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
      "evidence_sources": [
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
          "match_count": 4
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\boot.ini",
          "evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows)"
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\MDC\\Tomcat\\webapps\\triveni\\WEB-INF\\classes\\schedule.properties",
          "evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows)"
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\lib\\classpath\\com\\cisco\\nm\\cmf\\dbservice2\\DBServer.properties",
          "evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows)"
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program%20Files\\CSCOpx\\log\\dbpwdChange.log",
          "evidence": "Possible CiscoWorks (CuOM 8.0 and 8.5) Directory traversal (CVE-2011-0966) (Windows)"
        }
      ]
    },
    {
      "host": "familytree.lan.ddnsgeek.com",
      "cve": "CVE-2013-6235",
      "affected_host": "familytree.lan.ddnsgeek.com",
      "endpoint": "unknown",
      "product_version_evidence": [
        "http       syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
        "http     syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
        "http    syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
        "ssl/http   syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
        "ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)",
        "tcpwrapped syn-ack ttl 56"
      ],
      "exploit_precondition": "Validate affected product/version and exploit path prerequisites before filing.",
      "reproducibility": "not-reproduced",
      "disposition": "needs-manual-test",
      "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
      "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
      "evidence_sources": [
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
          "match_count": 1
        }
      ]
    },
    {
      "host": "familytree.lan.ddnsgeek.com",
      "cve": "CVE-2018-10822",
      "affected_host": "familytree.lan.ddnsgeek.com",
      "endpoint": "/uir//etc/passwd",
      "product_version_evidence": [
        "No explicit product/version fingerprint in nmap service line."
      ],
      "exploit_precondition": "Target must be affected D-Link router firmware exposing /uir/ traversal path.",
      "reproducibility": "not-reproduced",
      "disposition": "needs-manual-test",
      "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
      "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
      "evidence_sources": [
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
          "match_count": 1
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "/uir//etc/passwd",
          "evidence": "Possible D-Link router directory traversal vulnerability (CVE-2018-10822)"
        }
      ]
    },
    {
      "host": "familytree.lan.ddnsgeek.com",
      "cve": "CVE-2018-10824",
      "affected_host": "familytree.lan.ddnsgeek.com",
      "endpoint": "/uir//tmp/csman/0",
      "product_version_evidence": [
        "No explicit product/version fingerprint in nmap service line."
      ],
      "exploit_precondition": "Target must be affected D-Link router firmware exposing plaintext credential path under /tmp/csman.",
      "reproducibility": "not-reproduced",
      "disposition": "needs-manual-test",
      "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
      "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
      "evidence_sources": [
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
          "match_count": 1
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "/uir//tmp/csman/0",
          "evidence": "Possible D-Link router plaintext password file exposure (CVE-2018-10824)"
        }
      ]
    },
    {
      "host": "familytree.lan.ddnsgeek.com",
      "cve": "CVE-2019-1653",
      "affected_host": "familytree.lan.ddnsgeek.com",
      "endpoint": "/cgi-bin/config.exp",
      "product_version_evidence": [
        "No explicit product/version fingerprint in nmap service line."
      ],
      "exploit_precondition": "Validate affected product/version and exploit path prerequisites before filing.",
      "reproducibility": "not-reproduced",
      "disposition": "needs-manual-test",
      "disposition_rationale": "Script/banner evidence exists, but no direct proof of exploit impact was captured in scan output.",
      "required_reproduction_step_before_ticket": "Before creating a ticket, reproduce vulnerable behavior directly (e.g., crafted request causing data exposure, traversal read, or exploitable crash) and attach request/response proof. Banner or script signature matches alone are insufficient.",
      "evidence_sources": [
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/_patterns.log",
          "match_count": 2
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "/cgi-bin/export_debug_msg.exp",
          "evidence": "Cisco RV320/RV325 Unauthenticated Diagnostic Data & Configuration Export (CVE-2019-1653)"
        },
        {
          "file": "results/familytree.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt",
          "endpoint": "/cgi-bin/config.exp",
          "evidence": "Cisco RV320/RV325 Unauthenticated Diagnostic Data & Configuration Export (CVE-2019-1653)"
        }
      ]
    }
  ]
}