CWE-204 on ZAP

Possible Username Enumeration

Mon, 01 Jan 0001 00:00:00 +0000

It may be possible to enumerate usernames, based on differing HTTP responses when valid and invalid usernames are provided. This would greatly increase the probability of success of password brute-forcing attacks against the system. Note that false positives may sometimes be minimised by increasing the ‘Attack Strength’ Option in ZAP. Please manually check the ‘Other Info’ field to confirm if this is actually an issue.

Proxy Disclosure

Mon, 01 Jan 0001 00:00:00 +0000

1 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine

A list of targets for an attack against the application.
Potential vulnerabilities on the proxy servers that service the application.
The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated.

Proxy Disclosure

Mon, 01 Jan 0001 00:00:00 +0000

1 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine

A list of targets for an attack against the application.
Potential vulnerabilities on the proxy servers that service the application.
The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated.