Deprecated Feature Policy Header Set

Home/Alerts/Alert detail/

Risk:
Low

Type:
Passive

Summary: The header has now been renamed to Permissions-Policy.

Solution: Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header instead of the Feature-Policy header.

References

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy

https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/

Top Security News

New Ymir Ransomware Exploits Memory for Stealthy Attacks; Targets Corporate Networks

Hackers now use AppDomain Injection to drop CobaltStrike beacons

Attackers are exploiting 2 zero-days in Palo Alto Networks firewalls (CVE-2024-0012, CVE-2024-9474)

Urgent: Critical WordPress Plugin Vulnerability Exposes Over 4 Million Sites

Privileged Accounts, Hidden Threats: Why Privileged Access Security Must Be a Top Priority

Download: CIS Critical Security Controls v8.1

Researchers Warn of Privilege Escalation Risks in Google's Vertex AI ML Platform

PAN-OS Firewall Vulnerability Under Active Exploitation – IoCs Released

Common Alerts

MediumCSP: script-src unsafe-eval

HighLog4Shell (CVE-2021-44228)

HighSQL Injection - Hypersonic SQL

HighSOAP XML Injection

InformationalPossible Username Enumeration

LowPermissions Policy Header Not Set

InformationalServer Leaks its Webserver Application via "Server" HTTP Response Header Field

LowPrivate IP Disclosure

InformationalSplit Viewstate in Use

HighServer Side Code Injection - ASP Code Injection

Latest CVE List

CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

CVE-2024-38813 VMware vCenter Server Privilege Escalation Vulnerability

CVE-2024-1212 Progress Kemp LoadMaster OS Command Injection Vulnerability

CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

CVE-2024-9474 Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

CVE-2024-9463 Palo Alto Networks Expedition OS Command Injection Vulnerability

CVE-2024-9465 Palo Alto Networks Expedition SQL Injection Vulnerability

CVE-2024-49039 Microsoft Windows Task Scheduler Privilege Escalation Vulnerability

CVE-2024-43451 Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

CVE-2021-41277 Metabase GeoJSON API Local File Inclusion Vulnerability

Common CWEs

CWE-152 Improper Neutralization of Macro Symbols

CWE-1264 Hardware Logic with Insecure De-Synchronization between Control and Data Channels

CWE-410 Insufficient Resource Pool

CWE-235 Improper Handling of Extra Parameters

CWE-1327 Binding to an Unrestricted IP Address

CWE-836 Use of Password Hash Instead of Password for Authentication

HighCWE-256 Plaintext Storage of a Password

CWE-118 Incorrect Access of Indexable Resource ('Range Error')

CWE-607 Public Static Final Field References Mutable Object

HighCWE-330 Use of Insufficiently Random Values

Free security scan for your website

Don't show website scan report rating on the leaderboard