Home/Alerts/Alert detail/

Viewstate without MAC Signature (Unsure)

Risk:
High

Type:
Passive

CWE:
CWE-642

Summary: This website uses ASP.NET’s Viewstate but maybe without any MAC.

Solution: Ensure the MAC is set for all pages on this website.

References: https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff649308(v=pandp.10)

Top Security News

New NailaoLocker ransomware used against EU healthcare orgs

Black Basta ransomware gang's internal chat logs leak online

Chinese hackers abuse Microsoft APP-v tool to evade antivirus

Cisco Confirms Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks

Windows Server 2025 released—here are the new features

SonicWall firewall bug leveraged in attacks after PoC exploit release

Data Leak Exposes TopSec's Role in China's Censorship-as-a-Service Operations

CISA Flags Craft CMS Vulnerability CVE-2025-23209 Amid Active Attacks

Top Alert List

Content Security Policy (CSP) Header Not Set

CSP

MediumMissing Anti-clickjacking Header

MediumAbsence of Anti-CSRF Tokens

InformationalInformation Disclosure - Suspicious Comments

MediumContent Security Policy (CSP) Header Not Set

LowCross-Domain JavaScript Source File Inclusion

HighPII Disclosure

InformationalModern Web Application

MediumCross-Domain Misconfiguration

Latest CVE List

CVE-2017-3066 Adobe ColdFusion Deserialization Vulnerability

CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

CVE-2025-24989 Microsoft Power Pages Improper Access Control Vulnerability

CVE-2025-23209 Craft CMS Code Injection Vulnerability

CVE-2025-0111 Palo Alto Networks PAN-OS File Read Vulnerability

CVE-2024-53704 SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

CVE-2025-0108 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

CVE-2024-57727 SimpleHelp Path Traversal Vulnerability

CVE-2024-41710 Mitel SIP Phones Argument Injection Vulnerability

CVE-2025-24200 Apple iOS and iPadOS Incorrect Authorization Vulnerability

Common CWEs

CWE-431 Missing Handler

MediumCWE-1022 Use of Web Link to Untrusted Target with window.opener Access

CWE-1351 Improper Handling of Hardware Behavior in Exceptionally Cold Environments

CWE-420 Unprotected Alternate Channel

CWE-788 Access of Memory Location After End of Buffer

CWE-533 DEPRECATED: Information Exposure Through Server Log Files

CWE-920 Improper Restriction of Power Consumption

CWE-368 Context Switching Race Condition

CWE-302 Authentication Bypass by Assumed-Immutable Data

LowCWE-783 Operator Precedence Logic Error

Free online web security scanner

Don't show website scan report rating on the leaderboard