X-AspNet-Version Response Header

Home/Alerts/Alert detail/

Risk:
Low

Type:
Passive

Summary: Server leaks information via “X-AspNet-Version”/“X-AspNetMvc-Version” HTTP response header field(s).

Solution: Configure the server so it will not return those headers.

Other info: An attacker can use this information to exploit known vulnerabilities.

References

https://www.troyhunt.com/shhh-dont-let-your-response-headers/

https://blogs.msdn.microsoft.com/varunm/2013/04/23/remove-unwanted-http-response-headers/

Top Security News

CISA orders federal agencies to secure Microsoft 365 tenants

Recorded Future CEO applauds "undesirable" designation by Russia

BeyondTrust fixes critical vulnerability in remote access, support solutions (CVE-2024-12356)

Google Chrome uses AI to analyze pages in new scam detection feature

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware

Exploit released for critical WhatsUp Gold RCE flaw, patch now

Microsoft fixes exploited zero-day (CVE-2024-49138)

Common Alerts

LowIn Page Banner Information Leak

LowHash Disclosure - MD4 / MD5

InformationalServer Leaks its Webserver Application via "Server" HTTP Response Header Field

MediumCross-Domain Misconfiguration

MediumCRLF Injection

MediumWeak Authentication Method

MediumVulnerable JS Library

LowInformation Disclosure - Sensitive Information in Browser sessionStorage

LowOld Asp.Net Version in Use

Medium.htaccess Information Leak

Latest CVE List

CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

CVE-2018-14933 NUUO NVRmini Devices OS Command Injection Vulnerability

CVE-2022-23227 NUUO NVRmini 2 Devices Missing Authentication Vulnerability

CVE-2019-11001 Reolink Multiple IP Cameras OS Command Injection Vulnerability

CVE-2021-40407 Reolink RLC-410W IP Camera OS Command Injection Vulnerability

CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload Vulnerability

CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability

CVE-2024-35250 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

CVE-2024-50623 Cleo Multiple Products Unrestricted File Upload Vulnerability

CVE-2024-49138 Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Top CWE List

CWE-581 Object Model Violation: Just One of Equals and Hashcode Defined

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

HighCWE-863 Incorrect Authorization

HighCWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-1051 Initialization with Hard-Coded Network Resource Configuration Data

CWE-1395 Dependency on Vulnerable Third-Party Component

CWE-66 Improper Handling of File Names that Identify Virtual Resources

HighCWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic

CWE-1426 Improper Validation of Generative AI Output

Free security scan for your website

Don't show website scan report rating on the leaderboard