Deprecated Feature Policy Header Set

Home/Alerts/Alert detail/

Risk:
Low

Type:
Passive

Summary: The header has now been renamed to Permissions-Policy.

Solution: Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header instead of the Feature-Policy header.

References

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy

https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/

Latest Security News

Middle East Cyberwar Rages On, With No End in Sight

AI Could Generate 10,000 Malware Variants, Evading Detection in 88% of Case

Apache fixes remote code execution bypass in Tomcat web server

Microsoft fixes bug behind random Office 365 deactivation errors

Rockstar2FA Collapse Fuels Expansion of FlowerStorm Phishing-as-a-Service

Top 10 Cybersecurity Trends to Expect in 2025

U.S. Judge Rules Against NSO Group in WhatsApp Pegasus Spyware Case

Italy Fines OpenAI €15 Million for ChatGPT GDPR Data Privacy Violations

Top Alert List

MediumAbsence of Anti-CSRF Tokens

Content Security Policy (CSP) Header Not Set

InformationalInformation Disclosure - Suspicious Comments

LowStrict-Transport-Security Multiple Header Entries (Non-compliant with Spec)

LowCookie without SameSite Attribute

CSP

InformationalRe-examine Cache-control Directives

MediumMissing Anti-clickjacking Header

InformationalModern Web Application

LowX-Content-Type-Options Header Missing

Latest CVE List

CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

CVE-2018-14933 NUUO NVRmini Devices OS Command Injection Vulnerability

CVE-2022-23227 NUUO NVRmini 2 Devices Missing Authentication Vulnerability

CVE-2019-11001 Reolink Multiple IP Cameras OS Command Injection Vulnerability

CVE-2021-40407 Reolink RLC-410W IP Camera OS Command Injection Vulnerability

CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload Vulnerability

CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability

CVE-2024-35250 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

CVE-2024-50623 Cleo Multiple Products Unrestricted File Upload Vulnerability

CVE-2024-49138 Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Common CWEs

CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection')

CWE-471 Modification of Assumed-Immutable Data (MAID)

CWE-695 Use of Low-Level Functionality

CWE-439 Behavioral Change in New Version or Environment

MediumCWE-273 Improper Check for Dropped Privileges

MediumCWE-390 Detection of Error Condition Without Action

CWE-307 Improper Restriction of Excessive Authentication Attempts

CWE-553 Command Shell in Externally Accessible Directory

CWE-221 Information Loss or Omission

CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation

Free security scan for your website

Don't show website scan report rating on the leaderboard