| 41 |
Source Code Disclosure - Git |
beta |
High |
Active |
| 42 |
Source Code Disclosure - SVN |
beta |
Medium |
Active |
| 43 |
Source Code Disclosure - File Inclusion |
beta |
High |
Active |
| 10009 |
In Page Banner Information Leak |
release |
Low |
Passive |
| 10010 |
Cookie No HttpOnly Flag |
release |
Low |
Passive |
| 10011 |
Cookie Without Secure Flag |
release |
Low |
Passive |
| 10019-1 |
Content-Type Header Missing |
release |
Informational |
Passive |
| 10019-2 |
Content-Type Header Empty |
release |
Informational |
Passive |
| 10020-1 |
Missing Anti-clickjacking Header |
release |
Medium |
Passive |
| 10020-2 |
Multiple X-Frame-Options Header Entries |
release |
Medium |
Passive |
| 10020-3 |
X-Frame-Options Defined via META (Non-compliant with Spec) |
release |
Medium |
Passive |
| 10020-4 |
X-Frame-Options Setting Malformed |
release |
Medium |
Passive |
| 10021 |
X-Content-Type-Options Header Missing |
release |
Low |
Passive |
| 10026 |
HTTP Parameter Override |
beta |
Medium |
Passive |
| 10032-1 |
Potential IP Addresses Found in the Viewstate |
release |
Medium |
Passive |
| 10032-2 |
Emails Found in the Viewstate |
release |
Medium |
Passive |
| 10032-3 |
Old Asp.Net Version in Use |
release |
Low |
Passive |
| 10032-4 |
Viewstate without MAC Signature (Unsure) |
release |
High |
Passive |
| 10032-5 |
Viewstate without MAC Signature (Sure) |
release |
High |
Passive |
| 10032-6 |
Split Viewstate in Use |
release |
Informational |
Passive |
| 10033 |
Directory Browsing |
release |
Medium |
Passive |
| 10035-1 |
Strict-Transport-Security Header Not Set |
release |
Low |
Passive |
| 10035-2 |
Strict-Transport-Security Disabled |
release |
Low |
Passive |
| 10035-3 |
Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec) |
release |
Low |
Passive |
| 10035-4 |
Strict-Transport-Security Header on Plain HTTP Response |
release |
Informational |
Passive |
| 10035-5 |
Strict-Transport-Security Missing Max-Age (Non-compliant with Spec) |
release |
Low |
Passive |
| 10035-6 |
Strict-Transport-Security Defined via META (Non-compliant with Spec) |
release |
Low |
Passive |
| 10035-7 |
Strict-Transport-Security Max-Age Malformed (Non-compliant with Spec) |
release |
Low |
Passive |
| 10035-8 |
Strict-Transport-Security Malformed Content (Non-compliant with Spec) |
release |
Low |
Passive |
| 10036-1 |
Server Leaks its Webserver Application via "Server" HTTP Response Header Field |
release |
Informational |
Passive |
| 10036-2 |
Server Leaks Version Information via "Server" HTTP Response Header Field |
release |
Low |
Passive |
| 10038-1 |
Content Security Policy (CSP) Header Not Set |
release |
Medium |
Passive |
| 10038-2 |
Obsolete Content Security Policy (CSP) Header Found |
release |
Informational |
Passive |
| 10038-3 |
Content Security Policy (CSP) Report-Only Header Found |
release |
Informational |
Passive |
| 10039 |
X-Backend-Server Header Information Leak |
release |
Low |
Passive |
| 10040 |
Secure Pages Include Mixed Content |
release |
Low |
Passive |
| 10041 |
HTTP to HTTPS Insecure Transition in Form Post |
release |
Medium |
Passive |
| 10042 |
HTTPS to HTTP Insecure Transition in Form Post |
release |
Medium |
Passive |
| 10045-1 |
Source Code Disclosure - /WEB-INF Folder |
release |
High |
Active |
| 10045-2 |
Properties File Disclosure - /WEB-INF folder |
release |
High |
Active |
| 10047 |
HTTPS Content Available via HTTP |
release |
Low |
Active |
| 10051 |
Relative Path Confusion |
beta |
Medium |
Active |
| 10055-1 |
CSP: X-Content-Security-Policy |
release |
Low |
Passive |
| 10055-2 |
CSP: X-WebKit-CSP |
release |
Low |
Passive |
| 10055-3 |
CSP: Notices |
release |
Low |
Passive |
| 10055-4 |
CSP: Wildcard Directive |
release |
Medium |
Passive |
| 10055-5 |
CSP: script-src unsafe-inline |
release |
Medium |
Passive |
| 10055-6 |
CSP: style-src unsafe-inline |
release |
Medium |
Passive |
| 10055-7 |
CSP: script-src unsafe-hashes |
release |
Medium |
Passive |
| 10055-8 |
CSP: style-src unsafe-hashes |
release |
Medium |
Passive |
| 10055-9 |
CSP: Malformed Policy (Non-ASCII) |
release |
Medium |
Passive |
| 10055-10 |
CSP: script-src unsafe-eval |
release |
Medium |
Passive |
| 10055-11 |
CSP: Meta Policy Invalid Directive |
release |
Medium |
Passive |
| 10055-12 |
CSP: Header & Meta |
release |
Informational |
Passive |
| 10055-13 |
CSP: Failure to Define Directive with No Fallback |
release |
Medium |
Passive |
| 10058 |
GET for POST |
release |
Informational |
Active |
| 10061 |
X-AspNet-Version Response Header |
release |
Low |
Passive |
| 10099 |
Source Code Disclosure - PHP |
beta |
Medium |
Passive |
| 10103 |
Image Exposes Location or Privacy Data |
beta |
Informational |
Passive |
| 10106 |
HTTP Only Site |
release |
Medium |
Active |
| 10108 |
Reverse Tabnabbing |
release |
Medium |
Passive |
| 10109 |
Modern Web Application |
release |
Informational |
Passive |
| 20012 |
Anti-CSRF Tokens Check |
beta |
Medium |
Active |
| 20016-1 |
Cross-Domain Misconfiguration - Adobe - Read |
beta |
High |
Active |
| 20016-2 |
Cross-Domain Misconfiguration - Adobe - Send |
beta |
High |
Active |
| 20016-3 |
Cross-Domain Misconfiguration - Silverlight |
beta |
High |
Active |
| 40023 |
Possible Username Enumeration |
beta |
Informational |
Active |
| 40025 |
Proxy Disclosure |
beta |
Medium |
Active |
| 40028 |
ELMAH Information Leak |
release |
Medium |
Active |
| 40029 |
Trace.axd Information Leak |
release |
Medium |
Active |
| 40032 |
.htaccess Information Leak |
release |
Medium |
Active |
| 40034 |
.env Information Leak |
release |
Medium |
Active |
| 40035 |
Hidden File Found |
release |
Medium |
Active |
| 40039 |
Web Cache Deception |
alpha |
Medium |
Active |
| 50007-1 |
GraphQL Endpoint Supports Introspection |
alpha |
Informational |
Tool |
| 90001 |
Insecure JSF ViewState |
release |
Medium |
Passive |
| 90003 |
Sub Resource Integrity Attribute Missing |
release |
Medium |
Passive |
| 90011-1 |
Charset Mismatch (Header Versus Meta Content-Type Charset) |
release |
Informational |
Passive |
| 90011-2 |
Charset Mismatch (Header Versus Meta Charset) |
release |
Informational |
Passive |
| 90011-3 |
Charset Mismatch (Meta Charset Versus Meta Content-Type Charset) |
release |
Informational |
Passive |
| 90011-4 |
Charset Mismatch |
release |
Informational |
Passive |
| 90022 |
Application Error Disclosure |
release |
Medium |
Passive |
| 90024 |
Generic Padding Oracle |
release |
High |
Active |
| 90027 |
Cookie Slack Detector |
beta |
Informational |
Active |
| 90028-1 |
Insecure HTTP Method - DELETE |
beta |
Medium |
Active |
| 90028-2 |
Insecure HTTP Method - PUT |
beta |
Medium |
Active |
| 90028-3 |
Insecure HTTP Method - TRACE |
beta |
Medium |
Active |
| 90028-4 |
Insecure HTTP Method - CONNECT |
beta |
Medium |
Active |
| 90028-5 |
Insecure HTTP Method - PROPFIND |
beta |
Informational |
Active |
| 90028-6 |
Insecure HTTP Method - PUT |
beta |
Medium |
Active |
| 90030 |
WSDL File Detection |
beta |
|
Passive |
| 90033 |
Loosely Scoped Cookie |
release |
Informational |
Passive |
| 90034 |
Cloud Metadata Potentially Exposed |
release |
High |
Active |
| 100030 |
Backup File Detected |
alpha |
Low |
Script Active |
| 100043-1 |
Vulnerable Swagger UI Version Detected |
alpha |
High |
Script Active |
| 100043-2 |
Exposed Secrets in Swagger/OpenAPI Path |
alpha |
High |
Script Active |
| 110009 |
Full Path Disclosure |
alpha |
Low |
Passive |