Home/Alerts/Alert detail/

Viewstate without MAC Signature (Unsure)

Risk:
High

Type:
Passive

CWE:
CWE-642

Summary: This website uses ASP.NET’s Viewstate but maybe without any MAC.

Solution: Ensure the MAC is set for all pages on this website.

References: https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff649308(v=pandp.10)

Latest Security News

CISOs Are Gaining C-Suite Swagger, but Has It Come With a Cost?

DoJ Busts Up Another Multinational DPRK IT Worker Scam

Zyxel warns of bad signature update causing firewall boot loops

Microsoft to deprecate WSUS driver synchronization in 90 days

MITRE's Latest ATT&CK Simulations Tackle Cloud Defenses

MITRE's Latest ATT&CK Simulations Tackles Cloud Defenses

Cisco: Critical Meeting Management Bug Requires Urgent Patch

3 Use Cases for Third-Party API Security

Top Alert List

Content Security Policy (CSP) Header Not Set

CSP

MediumAbsence of Anti-CSRF Tokens

MediumMissing Anti-clickjacking Header

MediumContent Security Policy (CSP) Header Not Set

InformationalInformation Disclosure - Suspicious Comments

InformationalModern Web Application

LowCross-Domain JavaScript Source File Inclusion

InformationalRe-examine Cache-control Directives

LowCSP: X-Content-Security-Policy

Latest CVE List

CVE-2025-23006 SonicWall SMA1000 Appliances Deserialization Vulnerability

CVE-2020-11023 JQuery Cross-Site Scripting (XSS) Vulnerability

CVE-2024-50603 Aviatrix Controllers OS Command Injection Vulnerability

CVE-2024-55591 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CVE-2025-21333 Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

CVE-2025-21334 Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

CVE-2025-21335 Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

CVE-2024-12686 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability

CVE-2023-48365 Qlik Sense HTTP Tunneling Vulnerability

CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Common CWEs

CWE-657 Violation of Secure Design Principles

CWE-1334 Unauthorized Error Injection Can Degrade Hardware Redundancy

CWE-109 Struts: Validator Turned Off

CWE-13 ASP.NET Misconfiguration: Password in Configuration File

CWE-581 Object Model Violation: Just One of Equals and Hashcode Defined

CWE-14 Compiler Removal of Code to Clear Buffers

CWE-1284 Improper Validation of Specified Quantity in Input

CWE-821 Incorrect Synchronization

CWE-231 Improper Handling of Extra Values

CWE-236 Improper Handling of Undefined Parameters

Free online web security scanner

Don't show website scan report rating on the leaderboard

Viewstate without MAC Signature (Unsure)

High