Security Alerts

0

Directory Browsing

Medium

2

Private IP Disclosure

Low

3-1

Session ID in URL Rewrite

Medium

3-2

Session ID in URL Rewrite

Medium

3-3

Referer Exposes Session ID

Medium

6-1

High

6-2

High

6-3

High

6-4

High

6-5

High

7

Remote File Inclusion

High

41

Source Code Disclosure - Git

High

42

Source Code Disclosure - SVN

Medium

43

Source Code Disclosure - File Inclusion

High

10003

Vulnerable JS Library

Medium

10009

In Page Banner Information Leak

Low

10010

Cookie No HttpOnly Flag

Low

10011

Cookie Without Secure Flag

Low

10015

Re-examine Cache-control Directives

Informational

10017

Cross-Domain JavaScript Source File Inclusion

Low

10019-1

Content-Type Header Missing

Informational

10019-2

Content-Type Header Empty

Informational

10020-1

Missing Anti-clickjacking Header

Medium

10020-2

Multiple X-Frame-Options Header Entries

Medium

10020-3

X-Frame-Options Defined via META (Non-compliant with Spec)

Medium

10020-4

X-Frame-Options Setting Malformed

Medium

10021

X-Content-Type-Options Header Missing

Low

10023

Information Disclosure - Debug Error Messages

Low

10024

Information Disclosure - Sensitive Information in URL

Informational

10025

Information Disclosure - Sensitive Information in HTTP Referrer Header

Informational

10026

HTTP Parameter Override

Medium

10027

Information Disclosure - Suspicious Comments

Informational

10028

High

10029

Cookie Poisoning

Informational

10030

User Controllable Charset

Informational

10031

User Controllable HTML Element Attribute (Potential XSS)

Informational

10032-1

Potential IP Addresses Found in the Viewstate

Medium

10032-2

Emails Found in the Viewstate

Medium

10032-3

Old Asp.Net Version in Use

Low

10032-4

Viewstate without MAC Signature (Unsure)

High

10032-5

Viewstate without MAC Signature (Sure)

High

10032-6

Split Viewstate in Use

Informational

10033

Directory Browsing

Medium

10034

Heartbleed OpenSSL Vulnerability (Indicative)

High

10035-1

Strict-Transport-Security Header Not Set

Low

10035-2

Strict-Transport-Security Disabled

Low

10035-3

Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec)

Low

10035-4

Strict-Transport-Security Header on Plain HTTP Response

Informational

10035-5

Strict-Transport-Security Missing Max-Age (Non-compliant with Spec)

Low

10035-6

Strict-Transport-Security Defined via META (Non-compliant with Spec)

Low

10035-7

Strict-Transport-Security Max-Age Malformed (Non-compliant with Spec)

Low

10035-8

Strict-Transport-Security Malformed Content (Non-compliant with Spec)

Low

10036-1

Server Leaks its Webserver Application via "Server" HTTP Response Header Field

Informational

10036-2

Server Leaks Version Information via "Server" HTTP Response Header Field

Low

10037

Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)

Low

10038-1

Content Security Policy (CSP) Header Not Set

Medium

10038-2

Obsolete Content Security Policy (CSP) Header Found

Informational

10038-3

Content Security Policy (CSP) Report-Only Header Found

Informational

10039

X-Backend-Server Header Information Leak

Low

10040

Secure Pages Include Mixed Content

Low

10041

HTTP to HTTPS Insecure Transition in Form Post

Medium

10042

HTTPS to HTTP Insecure Transition in Form Post

Medium

10043

User Controllable JavaScript Event (XSS)

Informational

10044-1

Big Redirect Detected (Potential Sensitive Information Leak)

Low

10044-2

Multiple HREFs Redirect Detected (Potential Sensitive Information Leak)

Low

10045-1

Source Code Disclosure - /WEB-INF Folder

High

10045-2

Properties File Disclosure - /WEB-INF folder

High

10047

HTTPS Content Available via HTTP

Low

10048-1

Remote Code Execution - Shell Shock

High

10048-2

Remote Code Execution - Shell Shock

High

10049-1

Non-Storable Content

Informational

10049-2

Storable but Non-Cacheable Content

Informational

10049-3

Storable and Cacheable Content

Informational

10050-1

Retrieved from Cache

Informational

10050-2

Retrieved from Cache

Informational

10051

Relative Path Confusion

Medium

10052

X-ChromeLogger-Data (XCOLD) Header Information Leak

Medium

10053

Apache Range Header DoS (CVE-2011-3192)

Medium

10054-1

Cookie without SameSite Attribute

Low

10054-2

Cookie with SameSite Attribute None

Low

10054-3

Cookie with Invalid SameSite Attribute

Low

10055-1

CSP: X-Content-Security-Policy

Low

10055-2

CSP: X-WebKit-CSP

Low

10055-3

Low

10055-4

CSP: Wildcard Directive

Medium

10055-5

CSP: script-src unsafe-inline

Medium

10055-6

CSP: style-src unsafe-inline

Medium

10055-7

CSP: script-src unsafe-hashes

Medium

10055-8

CSP: style-src unsafe-hashes

Medium

10055-9

CSP: Malformed Policy (Non-ASCII)

Medium

10055-10

CSP: script-src unsafe-eval

Medium

10055-11

CSP: Meta Policy Invalid Directive

Medium

10055-12

CSP: Header & Meta

Informational

10056

X-Debug-Token Information Leak

Low

10057

Username Hash Found

Informational

10058

Informational

10061

X-AspNet-Version Response Header

Low

10062

High

10063-1

Permissions Policy Header Not Set

Low

10063-2

Deprecated Feature Policy Header Set

Low

10094-1

ASP.NET ViewState Disclosure

Informational

10094-2

ASP.NET ViewState Integrity

High

10094-3

Base64 Disclosure

Informational

10095

Backup File Disclosure

Medium

10096

Timestamp Disclosure - Unix

Low

10097

Hash Disclosure - MD4 / MD5

Low

10098

Cross-Domain Misconfiguration

Medium

10099

Source Code Disclosure - PHP

Medium

10101

Access Control Issue - Improper Authentication

High

10102

Access Control Issue - Improper Authorization

High

10103

Image Exposes Location or Privacy Data

Informational

10104

User Agent Fuzzer

Informational

10105-1

Authentication Credentials Captured

Medium

10105-2

Weak Authentication Method

Medium

10106

Medium

10107

Httpoxy - Proxy Header Misuse

High

10108

Reverse Tabnabbing

Medium

10109

Modern Web Application

Informational

10110

Dangerous JS Functions

Low

10111

Authentication Request Identified

Informational

10112

Session Management Response Identified

Informational

10113

Verification Request Identified

Informational

10202

Absence of Anti-CSRF Tokens

Medium

20012

Anti-CSRF Tokens Check

Medium

20014

HTTP Parameter Pollution

Informational

20015

Heartbleed OpenSSL Vulnerability

High

20016-1

Cross-Domain Misconfiguration - Adobe - Read

High

20016-2

Cross-Domain Misconfiguration - Adobe - Send

High

20016-3

Cross-Domain Misconfiguration - Silverlight

High

20017

Source Code Disclosure - CVE-2012-1823

High

20018

Remote Code Execution - CVE-2012-1823

High

20019-1

External Redirect

High

20019-2

External Redirect

High

20019-3

External Redirect

High

20019-4

External Redirect

High

30001

Buffer Overflow

Medium

30002

Format String Error

Medium

30003

Integer Overflow Error

Medium

40003

Medium

40008

Parameter Tampering

Medium

40009

Server Side Include

High

40012

Cross Site Scripting (Reflected)

High

40013

Session Fixation

High

40014

Cross Site Scripting (Persistent)

High

40015

High

40016

Cross Site Scripting (Persistent) - Prime

Informational

40017

Cross Site Scripting (Persistent) - Spider

Informational

40018

High

40019

SQL Injection - MySQL

High

40020

SQL Injection - Hypersonic SQL

High

40021

SQL Injection - Oracle

High

40022

SQL Injection - PostgreSQL

High

40023

Possible Username Enumeration

Informational

40024

SQL Injection - SQLite

High

40025

Proxy Disclosure

Medium

40026

Cross Site Scripting (DOM Based)

High

40027

SQL Injection - MsSQL

High

40028

ELMAH Information Leak

Medium

40029

Trace.axd Information Leak

Medium

40031

Out of Band XSS

High

40032

.htaccess Information Leak

Medium

40033

NoSQL Injection - MongoDB

High

40034

.env Information Leak

Medium

40035

Hidden File Found

Medium

40036

Medium

40038

Medium

40039

Web Cache Deception

Medium

40040-1

Informational

40040-2

CORS Misconfiguration

Medium

40040-3

CORS Misconfiguration

High

40041

Medium

40042

Spring Actuator Information Leak

Medium

40043-1

Log4Shell (CVE-2021-44228)

High

40043-2

Log4Shell (CVE-2021-45046)

High

40044

Exponential Entity Expansion (Billion Laughs Attack)

Medium

40045

High

40046

Server Side Request Forgery

High

40047

Text4shell (CVE-2022-42889)

High

50007-1

GraphQL Endpoint Supports Introspection

Informational

50007-2

GraphQL Server Implementation Identified

Informational

90001

Insecure JSF ViewState

Medium

90002

Java Serialization Object

Medium

90003

Sub Resource Integrity Attribute Missing

Medium

90004-1

Insufficient Site Isolation Against Spectre Vulnerability

Low

90004-2

Insufficient Site Isolation Against Spectre Vulnerability

Low

90004-3

Insufficient Site Isolation Against Spectre Vulnerability

Low

90005-1

Sec-Fetch-Site Header is Missing

Informational

90005-2

Sec-Fetch-Mode Header is Missing

Informational

90005-3

Sec-Fetch-Dest Header is Missing

Informational

90005-4

Sec-Fetch-User Header is Missing

Informational

90005-5

Sec-Fetch-Site Header Has an Invalid Value

Informational

90005-6

Sec-Fetch-Mode Header Has an Invalid Value

Informational

90005-7

Sec-Fetch-Dest Header Has an Invalid Value

Informational

90005-8

Sec-Fetch-User Header Has an Invalid Value

Informational

90011

Charset Mismatch

Informational

90017

Medium

90018

Advanced SQL Injection

High

90019-1

Server Side Code Injection - PHP Code Injection

High

90019-2

Server Side Code Injection - ASP Code Injection

High

90020

Remote OS Command Injection

High

90021

XPath Injection

High

90022

Application Error Disclosure

Medium

90023

XML External Entity Attack

High

90024

Generic Padding Oracle

High

90025

Expression Language Injection

High

90026

SOAP Action Spoofing

High

90027

Cookie Slack Detector

Informational

90028

Insecure HTTP Method

Medium

90029

SOAP XML Injection

High

90033

Loosely Scoped Cookie

Informational

90034

Cloud Metadata Potentially Exposed

High

90035

Server Side Template Injection

High

90036

Server Side Template Injection (Blind)

High

90039

NoSQL Injection - MongoDB (Time Based)

High

110001

Application Error Disclosure via WebSockets

Medium

110002

Base64 Disclosure in WebSocket message

Informational

110003

Information Disclosure - Debug Error Messages via WebSocket

Low

110004

Email address found in WebSocket message

Informational

110005

Personally Identifiable Information via WebSocket

High

110006

Private IP Disclosure via WebSocket

Low

110007

Username Hash Found in WebSocket message

Informational

110008

Information Disclosure - Suspicious Comments in XML via WebSocket

Informational

110009

Full Path Disclosure

Low

120000-1

Information Disclosure - Information in Browser localStorage

Informational

120000-2

Information Disclosure - Information in Browser sessionStorage

Informational

120001-1

Information Disclosure - Sensitive Information in Browser localStorage

Low

120001-2

Information Disclosure - Sensitive Information in Browser sessionStorage

Low

120002-1

Information Disclosure - JWT in Browser localStorage

Medium

120002-2

Information Disclosure - JWT in Browser sessionStorage

Informational