Viewstate without MAC Signature (Sure)

Home/Alerts/Alert detail/

Risk:
High

Type:
Passive

CWE:
CWE-642

Summary: This website uses ASP.NET’s Viewstate but without any MAC.

Solution: Ensure the MAC is set for all pages on this website.

References: https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff649308(v=pandp.10)

Latest Security News

How CISOs Can Communicate With Their Boards Effectively

Middle East Cyberwar Rages On, With No End in Sight

AI Could Generate 10,000 Malware Variants, Evading Detection in 88% of Case

Apache fixes remote code execution bypass in Tomcat web server

Microsoft fixes bug behind random Office 365 deactivation errors

Rockstar2FA Collapse Fuels Expansion of FlowerStorm Phishing-as-a-Service

Top 10 Cybersecurity Trends to Expect in 2025

U.S. Judge Rules Against NSO Group in WhatsApp Pegasus Spyware Case

Top Alert List

MediumAbsence of Anti-CSRF Tokens

Content Security Policy (CSP) Header Not Set

InformationalInformation Disclosure - Suspicious Comments

LowStrict-Transport-Security Multiple Header Entries (Non-compliant with Spec)

LowCookie without SameSite Attribute

CSP

InformationalRe-examine Cache-control Directives

MediumMissing Anti-clickjacking Header

InformationalModern Web Application

LowX-Content-Type-Options Header Missing

Top CVE List

CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability

CVE-2019-11001 Reolink Multiple IP Cameras OS Command Injection Vulnerability

CVE-2022-23227 NUUO NVRmini 2 Devices Missing Authentication Vulnerability

CVE-2021-40407 Reolink RLC-410W IP Camera OS Command Injection Vulnerability

CVE-2023-36884 Microsoft Windows Search Remote Code Execution Vulnerability

CVE-2024-35250 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload Vulnerability

CVE-2020-5849 Unraid Authentication Bypass Vulnerability

CVE-2024-43451 Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

Common CWEs

CWE-1254 Incorrect Comparison Logic Granularity

CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

CWE-1094 Excessive Index Range Scan for a Data Resource

CWE-914 Improper Control of Dynamically-Identified Variables

CWE-1073 Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses

CWE-66 Improper Handling of File Names that Identify Virtual Resources

CWE-358 Improperly Implemented Security Check for Standard

HighCWE-257 Storing Passwords in a Recoverable Format

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Free security scan for your website

Don't show website scan report rating on the leaderboard