Sec-Fetch-Site Header is Missing

Home/Alerts/Alert detail/

Risk:
Informational

Type:
Passive

CWE:
CWE-352

Summary: Specifies the relationship between request initiator’s origin and target’s origin.

Solution: Ensure that Sec-Fetch-Site header is included in request headers.

References: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site

Latest Security News

Canada Orders TikTok to Shut Down Canadian Operations Over Security Concerns

Hackers increasingly use Winos4.0 post-exploitation kit in attacks

Microsoft Notepad to get AI-powered rewriting tool on Windows 11

Cisco bug lets hackers run commands as root on UWRB access points

New SteelFox malware hijacks Windows PCs using vulnerable driver

VEILDrive Attack Exploits Microsoft Services to Evade Detection and Distribute Malware

Washington courts' systems offline following weekend cyberattack

Germany drafts law to protect researchers who find security flaws

Common Alerts

HighServer Side Include

HighSQL Injection - SQLite

MediumBypassing 403

MediumEmails Found in the Viewstate

LowMultiple HREFs Redirect Detected (Potential Sensitive Information Leak)

InformationalCross Site Scripting (Persistent) - Prime

Medium.htaccess Information Leak

MediumWeak Authentication Method

InformationalSec-Fetch-Site Header Has an Invalid Value

MediumX-Frame-Options Setting Malformed

Latest CVE List

CVE-2024-8957 PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability

CVE-2024-8956 PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

CVE-2024-20481 Cisco ASA and FTD Denial-of-Service Vulnerability

CVE-2024-37383 RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

CVE-2024-47575 Fortinet FortiManager Missing Authentication Vulnerability

CVE-2024-38094 Microsoft SharePoint Deserialization Vulnerability

CVE-2024-9537 ScienceLogic SL1 Unspecified Vulnerability

CVE-2024-40711 Veeam Backup and Replication Deserialization Vulnerability

CVE-2024-30088 Microsoft Windows Kernel TOCTOU Race Condition Vulnerability

CVE-2024-9680 Mozilla Firefox Use-After-Free Vulnerability

Top CWE List

CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

MediumCWE-250 Execution with Unnecessary Privileges

CWE-328 Use of Weak Hash

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

HighCWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-1426 Improper Validation of Generative AI Output

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CWE-290 Authentication Bypass by Spoofing

CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action

MediumCWE-353 Missing Support for Integrity Check

Free security scan for your website

Don't show website scan report rating on the leaderboard