Viewstate without MAC Signature (Unsure)

Home/Alerts/Alert detail/

Risk:
High

Type:
Passive

CWE:
CWE-642

Summary: This website uses ASP.NET’s Viewstate but maybe without any MAC.

Solution: Ensure the MAC is set for all pages on this website.

References: https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff649308(v=pandp.10)

Top Security News

New Ymir Ransomware Exploits Memory for Stealthy Attacks; Targets Corporate Networks

Hackers now use AppDomain Injection to drop CobaltStrike beacons

Attackers are exploiting 2 zero-days in Palo Alto Networks firewalls (CVE-2024-0012, CVE-2024-9474)

Urgent: Critical WordPress Plugin Vulnerability Exposes Over 4 Million Sites

Privileged Accounts, Hidden Threats: Why Privileged Access Security Must Be a Top Priority

Download: CIS Critical Security Controls v8.1

Researchers Warn of Privilege Escalation Risks in Google's Vertex AI ML Platform

PAN-OS Firewall Vulnerability Under Active Exploitation – IoCs Released

Common Alerts

LowSecure Pages Include Mixed Content

LowInsufficient Site Isolation Against Spectre Vulnerability

LowStrict-Transport-Security Disabled

InformationalContent Security Policy (CSP) Report-Only Header Found

LowCSP: X-Content-Security-Policy

InformationalContent-Type Header Missing

LowHTTPS Content Available via HTTP

MediumHTTP Only Site

HighPath Traversal

InformationalInformation Disclosure - Suspicious Comments

Top CVE List

CVE-2021-41277 Metabase GeoJSON API Local File Inclusion Vulnerability

CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

CVE-2019-15949 Nagios XI Remote Code Execution Vulnerability

CVE-2024-9463 Palo Alto Networks Expedition OS Command Injection Vulnerability

CVE-2024-9474 Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

CVE-2021-26858 Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2024-1212 Progress Kemp LoadMaster OS Command Injection Vulnerability

CVE-2024-38813 VMware vCenter Server Privilege Escalation Vulnerability

CVE-2024-9465 Palo Alto Networks Expedition SQL Injection Vulnerability

Common CWEs

CWE-412 Unrestricted Externally Accessible Lock

CWE-11 ASP.NET Misconfiguration: Creating Debug Binary

CWE-183 Permissive List of Allowed Inputs

CWE-1120 Excessive Code Complexity

CWE-826 Premature Release of Resource During Expected Lifetime

CWE-913 Improper Control of Dynamically-Managed Code Resources

CWE-527 Exposure of Version-Control Repository to an Unauthorized Control Sphere

CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

HighCWE-129 Improper Validation of Array Index

CWE-176 Improper Handling of Unicode Encoding

Free security scan for your website

Don't show website scan report rating on the leaderboard