vulnersCom/nmap-vulners v1.5

nmap-vulners 1.5

on GitHub

The free script speaks to the API again: it had been escaping its query,
which the service answers with errorCode 303, so every CPE lookup
returned nothing while the copy shipped with nmap kept working.

26 CPE aliases corrected against the catalogue and against what the
service actually returns - nginx alone goes from 4 bulletins to 124.

The scan cache no longer answers questions it never asked: a failed
request is not remembered as "clean", concurrent hosts do not read each
other's placeholders, and two hosts running the same software cost one
request.

The HTTP fingerprinter finds every match rather than the first, follows
redirects, keeps the paths a broken pipeline dropped, and asks for "/",
which the shipped path list never contained.

vulners.nse 1.9, vulners_enterprise.nse 1.14.

Also in this release

• author is the Vulners Team, and LICENSE is now the Nmap Public Source
  License that the scripts have always declared
• installers for POSIX and Windows: one line each. They find nmap's data
  directory by asking nmap, replace the vulners.nse that ships with it, and
  then verify that nmap really resolves the copy they installed
• a test suite that runs inside nmap (110 cases), end-to-end runs driving the
  real nmap binary (33), and a repository hygiene gate - all three in CI,
  together with the installers on Linux, macOS and Windows
• the README was rewritten, with recordings of the three scripts in action

Install

curl -fsSL https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/install.sh | sh

PowerShell:

irm https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/install.ps1 | iex

Full Changelog: v1.4-beta...v1.5