Home/Alerts/Alert detail/

Deprecated Feature Policy Header Set

Risk:
Low

Type:
Passive

Summary: The header has now been renamed to Permissions-Policy.

Solution: Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header instead of the Feature-Policy header.

References

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy

https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/

Top Security News

Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039)

Bitbucket services “hard down” due to major worldwide outage

SonicWall Urges Immediate Patch for Critical CVE-2025-23006 Flaw Amid Likely Exploitation

Hackers exploit 16 zero-days on first day of Pwn2Own Automotive 2025

Windows Server 2025 released—here are the new features

Ivanti Flaw CVE-2025-0282 Actively Exploited, Impacts Connect Secure and Policy Secure

U.S. Sanctions Chinese Cybersecurity Firm Over Treasury Hack Tied to Salt Typhoon

TikTok is back up in the US after Trump says he will extend deadline

Common Alerts

MediumHTTP to HTTPS Insecure Transition in Form Post

MediumVulnerable JS Library

HighNoSQL Injection - MongoDB (Time Based)

HighPath Traversal

InformationalBase64 Disclosure

InformationalCross Site Scripting (Persistent) - Spider

InformationalContent-Type Header Empty

LowDangerous JS Functions

HighLDAP Injection

LowDeprecated Feature Policy Header Set

Latest CVE List

CVE-2025-23006 SonicWall SMA1000 Appliances Deserialization Vulnerability

CVE-2020-11023 JQuery Cross-Site Scripting (XSS) Vulnerability

CVE-2024-50603 Aviatrix Controllers OS Command Injection Vulnerability

CVE-2024-55591 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CVE-2025-21333 Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

CVE-2025-21334 Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

CVE-2025-21335 Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

CVE-2024-12686 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability

CVE-2023-48365 Qlik Sense HTTP Tunneling Vulnerability

CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Common CWEs

CWE-1076 Insufficient Adherence to Expected Conventions

CWE-586 Explicit Call to Finalize()

CWE-300 Channel Accessible by Non-Endpoint

CWE-610 Externally Controlled Reference to a Resource in Another Sphere

CWE-303 Incorrect Implementation of Authentication Algorithm

MediumCWE-364 Signal Handler Race Condition

CWE-675 Multiple Operations on Resource in Single-Operation Context

HighCWE-486 Comparison of Classes by Name

CWE-491 Public cloneable() Method Without Final ('Object Hijack')

MediumCWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Free online web security scanner

Don't show website scan report rating on the leaderboard