Vulnerabilities Index | ScyScan

: 0
Directory Browsing
Medium; 2
Private IP Disclosure
Low; 3-1
Session ID in URL Rewrite
Medium; 3-2
Session ID in URL Rewrite
Medium; 3-3
Referer Exposes Session ID
Medium; 6-1
Path Traversal
High; 6-2
Path Traversal
High; 6-3
Path Traversal
High; 6-4
Path Traversal
High; 6-5
Path Traversal
High; 7
Remote File Inclusion
High; 41
Source Code Disclosure - Git
High; 42
Source Code Disclosure - SVN
Medium; 43
Source Code Disclosure - File Inclusion
High; 10003
Vulnerable JS Library
Medium; 10009
In Page Banner Information Leak
Low; 10010
Cookie No HttpOnly Flag
Low; 10011
Cookie Without Secure Flag
Low; 10015
Re-examine Cache-control Directives
Informational; 10017
Cross-Domain JavaScript Source File Inclusion
Low; 10019-1
Content-Type Header Missing
Informational; 10019-2
Content-Type Header Empty
Informational; 10020-1
Missing Anti-clickjacking Header
Medium; 10020-2
Multiple X-Frame-Options Header Entries
Medium; 10020-3
X-Frame-Options Defined via META (Non-compliant with Spec)
Medium; 10020-4
X-Frame-Options Setting Malformed
Medium; 10021
X-Content-Type-Options Header Missing
Low; 10023
Information Disclosure - Debug Error Messages
Low; 10024
Information Disclosure - Sensitive Information in URL
Informational; 10025
Information Disclosure - Sensitive Information in HTTP Referrer Header
Informational; 10026
HTTP Parameter Override
Medium; 10027
Information Disclosure - Suspicious Comments
Informational; 10028
Open Redirect
High; 10029
Cookie Poisoning
Informational; 10030
User Controllable Charset
Informational; 10031
User Controllable HTML Element Attribute (Potential XSS)
Informational; 10032-1
Potential IP Addresses Found in the Viewstate
Medium; 10032-2
Emails Found in the Viewstate
Medium; 10032-3
Old Asp.Net Version in Use
Low; 10032-4
Viewstate without MAC Signature (Unsure)
High; 10032-5
Viewstate without MAC Signature (Sure)
High; 10032-6
Split Viewstate in Use
Informational; 10033
Directory Browsing
Medium; 10034
Heartbleed OpenSSL Vulnerability (Indicative)
High; 10035-1
Strict-Transport-Security Header Not Set
Low; 10035-2
Strict-Transport-Security Disabled
Low; 10035-3
Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec)
Low; 10035-4
Strict-Transport-Security Header on Plain HTTP Response
Informational; 10035-5
Strict-Transport-Security Missing Max-Age (Non-compliant with Spec)
Low; 10035-6
Strict-Transport-Security Defined via META (Non-compliant with Spec)
Low; 10035-7
Strict-Transport-Security Max-Age Malformed (Non-compliant with Spec)
Low; 10035-8
Strict-Transport-Security Malformed Content (Non-compliant with Spec)
Low; 10036-1
Server Leaks its Webserver Application via "Server" HTTP Response Header Field
Informational; 10036-2
Server Leaks Version Information via "Server" HTTP Response Header Field
Low; 10037
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
Low; 10038-1
Content Security Policy (CSP) Header Not Set
Medium; 10038-2
Obsolete Content Security Policy (CSP) Header Found
Informational; 10038-3
Content Security Policy (CSP) Report-Only Header Found
Informational; 10039
X-Backend-Server Header Information Leak
Low; 10040
Secure Pages Include Mixed Content
Low; 10041
HTTP to HTTPS Insecure Transition in Form Post
Medium; 10042
HTTPS to HTTP Insecure Transition in Form Post
Medium; 10043
User Controllable JavaScript Event (XSS)
Informational; 10044-1
Big Redirect Detected (Potential Sensitive Information Leak)
Low; 10044-2
Multiple HREFs Redirect Detected (Potential Sensitive Information Leak)
Low; 10045-1
Source Code Disclosure - /WEB-INF Folder
High; 10045-2
Properties File Disclosure - /WEB-INF folder
High; 10047
HTTPS Content Available via HTTP
Low; 10048-1
Remote Code Execution - Shell Shock
High; 10048-2
Remote Code Execution - Shell Shock
High; 10049-1
Non-Storable Content
Informational; 10049-2
Storable but Non-Cacheable Content
Informational; 10049-3
Storable and Cacheable Content
Informational; 10050-1
Retrieved from Cache
Informational; 10050-2
Retrieved from Cache
Informational; 10051
Relative Path Confusion
Medium; 10052
X-ChromeLogger-Data (XCOLD) Header Information Leak
Medium; 10053
Apache Range Header DoS (CVE-2011-3192)
Medium; 10054-1
Cookie without SameSite Attribute
Low; 10054-2
Cookie with SameSite Attribute None
Low; 10054-3
Cookie with Invalid SameSite Attribute
Low; 10055-1
CSP: X-Content-Security-Policy
Low; 10055-2
CSP: X-WebKit-CSP
Low; 10055-3
CSP: Notices
Low; 10055-4
CSP: Wildcard Directive
Medium; 10055-5
CSP: script-src unsafe-inline
Medium; 10055-6
CSP: style-src unsafe-inline
Medium; 10055-7
CSP: script-src unsafe-hashes
Medium; 10055-8
CSP: style-src unsafe-hashes
Medium; 10055-9
CSP: Malformed Policy (Non-ASCII)
Medium; 10055-10
CSP: script-src unsafe-eval
Medium; 10055-11
CSP: Meta Policy Invalid Directive
Medium; 10055-12
CSP: Header & Meta
Informational; 10056
X-Debug-Token Information Leak
Low; 10057
Username Hash Found
Informational; 10058
GET for POST
Informational; 10061
X-AspNet-Version Response Header
Low; 10062
PII Disclosure
High; 10063-1
Permissions Policy Header Not Set
Low; 10063-2
Deprecated Feature Policy Header Set
Low; 10094-1
ASP.NET ViewState Disclosure
Informational; 10094-2
ASP.NET ViewState Integrity
High; 10094-3
Base64 Disclosure
Informational; 10095
Backup File Disclosure
Medium; 10096
Timestamp Disclosure - Unix
Low; 10097
Hash Disclosure - MD4 / MD5
Low; 10098
Cross-Domain Misconfiguration
Medium; 10099
Source Code Disclosure - PHP
Medium; 10101
Access Control Issue - Improper Authentication
High; 10102
Access Control Issue - Improper Authorization
High; 10103
Image Exposes Location or Privacy Data
Informational; 10104
User Agent Fuzzer
Informational; 10105-1
Authentication Credentials Captured
Medium; 10105-2
Weak Authentication Method
Medium; 10106
HTTP Only Site
Medium; 10107
Httpoxy - Proxy Header Misuse
High; 10108
Reverse Tabnabbing
Medium; 10109
Modern Web Application
Informational; 10110
Dangerous JS Functions
Low; 10111
Authentication Request Identified
Informational; 10112
Session Management Response Identified
Informational; 10113
Verification Request Identified
Informational; 10202
Absence of Anti-CSRF Tokens
Medium; 20012
Anti-CSRF Tokens Check
Medium; 20014
HTTP Parameter Pollution
Informational; 20015
Heartbleed OpenSSL Vulnerability
High; 20016-1
Cross-Domain Misconfiguration - Adobe - Read
High; 20016-2
Cross-Domain Misconfiguration - Adobe - Send
High; 20016-3
Cross-Domain Misconfiguration - Silverlight
High; 20017
Source Code Disclosure - CVE-2012-1823
High; 20018
Remote Code Execution - CVE-2012-1823
High; 20019-1
External Redirect
High; 20019-2
External Redirect
High; 20019-3
External Redirect
High; 20019-4
External Redirect
High; 30001
Buffer Overflow
Medium; 30002
Format String Error
Medium; 30003
Integer Overflow Error
Medium; 40003
CRLF Injection
Medium; 40008
Parameter Tampering
Medium; 40009
Server Side Include
High; 40012
Cross Site Scripting (Reflected)
High; 40013
Session Fixation
High; 40014
Cross Site Scripting (Persistent)
High; 40015
LDAP Injection
High; 40016
Cross Site Scripting (Persistent) - Prime
Informational; 40017
Cross Site Scripting (Persistent) - Spider
Informational; 40018
SQL Injection
High; 40019
SQL Injection - MySQL
High; 40020
SQL Injection - Hypersonic SQL
High; 40021
SQL Injection - Oracle
High; 40022
SQL Injection - PostgreSQL
High; 40023
Possible Username Enumeration
Informational; 40024
SQL Injection - SQLite
High; 40025
Proxy Disclosure
Medium; 40026
Cross Site Scripting (DOM Based)
High; 40027
SQL Injection - MsSQL
High; 40028
ELMAH Information Leak
Medium; 40029
Trace.axd Information Leak
Medium; 40031
Out of Band XSS
High; 40032
.htaccess Information Leak
Medium; 40033
NoSQL Injection - MongoDB
High; 40034
.env Information Leak
Medium; 40035
Hidden File Found
Medium; 40036
JWT Scan Rule
Medium; 40038
Bypassing 403
Medium; 40039
Web Cache Deception
Medium; 40040-1
CORS Header
Informational; 40040-2
CORS Misconfiguration
Medium; 40040-3
CORS Misconfiguration
High; 40041
File Upload
Medium; 40042
Spring Actuator Information Leak
Medium; 40043-1
Log4Shell (CVE-2021-44228)
High; 40043-2
Log4Shell (CVE-2021-45046)
High; 40044
Exponential Entity Expansion (Billion Laughs Attack)
Medium; 40045
Spring4Shell
High; 40046
Server Side Request Forgery
High; 40047
Text4shell (CVE-2022-42889)
High; 50007-1
GraphQL Endpoint Supports Introspection
Informational; 50007-2
GraphQL Server Implementation Identified
Informational; 90001
Insecure JSF ViewState
Medium; 90002
Java Serialization Object
Medium; 90003
Sub Resource Integrity Attribute Missing
Medium; 90004-1
Insufficient Site Isolation Against Spectre Vulnerability
Low; 90004-2
Insufficient Site Isolation Against Spectre Vulnerability
Low; 90004-3
Insufficient Site Isolation Against Spectre Vulnerability
Low; 90005-1
Sec-Fetch-Site Header is Missing
Informational; 90005-2
Sec-Fetch-Mode Header is Missing
Informational; 90005-3
Sec-Fetch-Dest Header is Missing
Informational; 90005-4
Sec-Fetch-User Header is Missing
Informational; 90005-5
Sec-Fetch-Site Header Has an Invalid Value
Informational; 90005-6
Sec-Fetch-Mode Header Has an Invalid Value
Informational; 90005-7
Sec-Fetch-Dest Header Has an Invalid Value
Informational; 90005-8
Sec-Fetch-User Header Has an Invalid Value
Informational; 90011
Charset Mismatch
Informational; 90017
XSLT Injection
Medium; 90018
Advanced SQL Injection
High; 90019-1
Server Side Code Injection - PHP Code Injection
High; 90019-2
Server Side Code Injection - ASP Code Injection
High; 90020
Remote OS Command Injection
High; 90021
XPath Injection
High; 90022
Application Error Disclosure
Medium; 90023
XML External Entity Attack
High; 90024
Generic Padding Oracle
High; 90025
Expression Language Injection
High; 90026
SOAP Action Spoofing
High; 90027
Cookie Slack Detector
Informational; 90028
Insecure HTTP Method
Medium; 90029
SOAP XML Injection
High; 90033
Loosely Scoped Cookie
Informational; 90034
Cloud Metadata Potentially Exposed
High; 90035
Server Side Template Injection
High; 90036
Server Side Template Injection (Blind)
High; 90039
NoSQL Injection - MongoDB (Time Based)
High; 110001
Application Error Disclosure via WebSockets
Medium; 110002
Base64 Disclosure in WebSocket message
Informational; 110003
Information Disclosure - Debug Error Messages via WebSocket
Low; 110004
Email address found in WebSocket message
Informational; 110005
Personally Identifiable Information via WebSocket
High; 110006
Private IP Disclosure via WebSocket
Low; 110007
Username Hash Found in WebSocket message
Informational; 110008
Information Disclosure - Suspicious Comments in XML via WebSocket
Informational; 110009
Full Path Disclosure
Low; 120000-1
Information Disclosure - Information in Browser localStorage
Informational; 120000-2
Information Disclosure - Information in Browser sessionStorage
Informational; 120001-1
Information Disclosure - Sensitive Information in Browser localStorage
Low; 120001-2
Information Disclosure - Sensitive Information in Browser sessionStorage
Low; 120002-1
Information Disclosure - JWT in Browser localStorage
Medium; 120002-2
Information Disclosure - JWT in Browser sessionStorage
Informational