| 0 |
Directory Browsing |
release |
Medium |
Active |
| 3-1 |
Session ID in URL Rewrite |
release |
Medium |
Passive |
| 3-2 |
Session ID in URL Rewrite |
release |
Medium |
Passive |
| 3-3 |
Referer Exposes Session ID |
release |
Medium |
Passive |
| 10009 |
In Page Banner Information Leak |
release |
Low |
Passive |
| 10010 |
Cookie No HttpOnly Flag |
release |
Low |
Passive |
| 10011 |
Cookie Without Secure Flag |
release |
Low |
Passive |
| 10015 |
Re-examine Cache-control Directives |
release |
Informational |
Passive |
| 10017 |
Cross-Domain JavaScript Source File Inclusion |
release |
Low |
Passive |
| 10019-1 |
Content-Type Header Missing |
release |
Informational |
Passive |
| 10019-2 |
Content-Type Header Empty |
release |
Informational |
Passive |
| 10020-1 |
Missing Anti-clickjacking Header |
release |
Medium |
Passive |
| 10020-2 |
Multiple X-Frame-Options Header Entries |
release |
Medium |
Passive |
| 10020-3 |
X-Frame-Options Defined via META (Non-compliant with Spec) |
release |
Medium |
Passive |
| 10020-4 |
X-Frame-Options Setting Malformed |
release |
Medium |
Passive |
| 10021 |
X-Content-Type-Options Header Missing |
release |
Low |
Passive |
| 10024 |
Information Disclosure - Sensitive Information in URL |
release |
Informational |
Passive |
| 10025 |
Information Disclosure - Sensitive Information in HTTP Referrer Header |
release |
Informational |
Passive |
| 10029 |
Cookie Poisoning |
release |
Informational |
Passive |
| 10030 |
User Controllable Charset |
release |
Informational |
Passive |
| 10032-1 |
Potential IP Addresses Found in the Viewstate |
release |
Medium |
Passive |
| 10032-2 |
Emails Found in the Viewstate |
release |
Medium |
Passive |
| 10032-3 |
Old Asp.Net Version in Use |
release |
Low |
Passive |
| 10032-4 |
Viewstate without MAC Signature (Unsure) |
release |
High |
Passive |
| 10032-5 |
Viewstate without MAC Signature (Sure) |
release |
High |
Passive |
| 10032-6 |
Split Viewstate in Use |
release |
Informational |
Passive |
| 10033 |
Directory Browsing |
release |
Medium |
Passive |
| 10035-1 |
Strict-Transport-Security Header Not Set |
release |
Low |
Passive |
| 10035-2 |
Strict-Transport-Security Disabled |
release |
Low |
Passive |
| 10035-3 |
Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec) |
release |
Low |
Passive |
| 10035-4 |
Strict-Transport-Security Header on Plain HTTP Response |
release |
Informational |
Passive |
| 10035-5 |
Strict-Transport-Security Missing Max-Age (Non-compliant with Spec) |
release |
Low |
Passive |
| 10035-6 |
Strict-Transport-Security Defined via META (Non-compliant with Spec) |
release |
Low |
Passive |
| 10035-7 |
Strict-Transport-Security Max-Age Malformed (Non-compliant with Spec) |
release |
Low |
Passive |
| 10035-8 |
Strict-Transport-Security Malformed Content (Non-compliant with Spec) |
release |
Low |
Passive |
| 10036-1 |
Server Leaks its Webserver Application via "Server" HTTP Response Header Field |
release |
Informational |
Passive |
| 10036-2 |
Server Leaks Version Information via "Server" HTTP Response Header Field |
release |
Low |
Passive |
| 10037 |
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) |
release |
Low |
Passive |
| 10038-1 |
Content Security Policy (CSP) Header Not Set |
release |
Medium |
Passive |
| 10038-2 |
Obsolete Content Security Policy (CSP) Header Found |
release |
Informational |
Passive |
| 10038-3 |
Content Security Policy (CSP) Report-Only Header Found |
release |
Informational |
Passive |
| 10039 |
X-Backend-Server Header Information Leak |
release |
Low |
Passive |
| 10040 |
Secure Pages Include Mixed Content |
release |
Low |
Passive |
| 10047 |
HTTPS Content Available via HTTP |
release |
Low |
Active |
| 10049-1 |
Non-Storable Content |
beta |
Informational |
Passive |
| 10049-2 |
Storable but Non-Cacheable Content |
beta |
Informational |
Passive |
| 10049-3 |
Storable and Cacheable Content |
beta |
Informational |
Passive |
| 10050-1 |
Retrieved from Cache |
release |
Informational |
Passive |
| 10050-2 |
Retrieved from Cache |
release |
Informational |
Passive |
| 10052 |
X-ChromeLogger-Data (XCOLD) Header Information Leak |
release |
Medium |
Passive |
| 10054-1 |
Cookie without SameSite Attribute |
release |
Low |
Passive |
| 10054-2 |
Cookie with SameSite Attribute None |
release |
Low |
Passive |
| 10054-3 |
Cookie with Invalid SameSite Attribute |
release |
Low |
Passive |
| 10055-1 |
CSP: X-Content-Security-Policy |
release |
Low |
Passive |
| 10055-2 |
CSP: X-WebKit-CSP |
release |
Low |
Passive |
| 10055-3 |
CSP: Notices |
release |
Low |
Passive |
| 10055-4 |
CSP: Wildcard Directive |
release |
Medium |
Passive |
| 10055-5 |
CSP: script-src unsafe-inline |
release |
Medium |
Passive |
| 10055-6 |
CSP: style-src unsafe-inline |
release |
Medium |
Passive |
| 10055-7 |
CSP: script-src unsafe-hashes |
release |
Medium |
Passive |
| 10055-8 |
CSP: style-src unsafe-hashes |
release |
Medium |
Passive |
| 10055-9 |
CSP: Malformed Policy (Non-ASCII) |
release |
Medium |
Passive |
| 10055-10 |
CSP: script-src unsafe-eval |
release |
Medium |
Passive |
| 10055-11 |
CSP: Meta Policy Invalid Directive |
release |
Medium |
Passive |
| 10055-12 |
CSP: Header & Meta |
release |
Informational |
Passive |
| 10055-13 |
CSP: Failure to Define Directive with No Fallback |
release |
Medium |
Passive |
| 10056 |
X-Debug-Token Information Leak |
release |
Low |
Passive |
| 10061 |
X-AspNet-Version Response Header |
release |
Low |
Passive |
| 10063-1 |
Permissions Policy Header Not Set |
beta |
Low |
Passive |
| 10063-2 |
Deprecated Feature Policy Header Set |
beta |
Low |
Passive |
| 10096 |
Timestamp Disclosure - Unix |
release |
Low |
Passive |
| 10098 |
Cross-Domain Misconfiguration |
release |
Medium |
Passive |
| 10104 |
User Agent Fuzzer |
release |
Informational |
Active |
| 10109 |
Modern Web Application |
release |
Informational |
Passive |
| 10202 |
Absence of Anti-CSRF Tokens |
release |
Medium |
Passive |
| 10205-1 |
HTTPS Configuration |
alpha |
Informational |
Active |
| 10205-2 |
HTTPS Security Configuration Issues |
alpha |
High |
Active |
| 20012 |
Anti-CSRF Tokens Check |
beta |
Medium |
Active |
| 40003 |
CRLF Injection |
release |
Medium |
Active |
| 40025 |
Proxy Disclosure |
beta |
Medium |
Active |
| 40039 |
Web Cache Deception |
alpha |
Medium |
Active |
| 40040-1 |
CORS Header |
beta |
Informational |
Active |
| 40040-2 |
CORS Misconfiguration |
beta |
Medium |
Active |
| 40040-3 |
CORS Misconfiguration |
beta |
High |
Active |
| 90003 |
Sub Resource Integrity Attribute Missing |
release |
Medium |
Passive |
| 90004-1 |
Cross-Origin-Resource-Policy Header Missing or Invalid |
beta |
Low |
Passive |
| 90004-2 |
Cross-Origin-Embedder-Policy Header Missing or Invalid |
beta |
Low |
Passive |
| 90004-3 |
Cross-Origin-Opener-Policy Header Missing or Invalid |
beta |
Low |
Passive |
| 90005-1 |
Sec-Fetch-Site Header is Missing |
alpha |
Informational |
Passive |
| 90005-2 |
Sec-Fetch-Mode Header is Missing |
alpha |
Informational |
Passive |
| 90005-3 |
Sec-Fetch-Dest Header is Missing |
alpha |
Informational |
Passive |
| 90005-4 |
Sec-Fetch-User Header is Missing |
alpha |
Informational |
Passive |
| 90005-5 |
Sec-Fetch-Site Header Has an Invalid Value |
alpha |
Informational |
Passive |
| 90005-6 |
Sec-Fetch-Mode Header Has an Invalid Value |
alpha |
Informational |
Passive |
| 90005-7 |
Sec-Fetch-Dest Header Has an Invalid Value |
alpha |
Informational |
Passive |
| 90005-8 |
Sec-Fetch-User Header Has an Invalid Value |
alpha |
Informational |
Passive |
| 90011-1 |
Charset Mismatch (Header Versus Meta Content-Type Charset) |
release |
Informational |
Passive |
| 90011-2 |
Charset Mismatch (Header Versus Meta Charset) |
release |
Informational |
Passive |
| 90011-3 |
Charset Mismatch (Meta Charset Versus Meta Content-Type Charset) |
release |
Informational |
Passive |
| 90011-4 |
Charset Mismatch |
release |
Informational |
Passive |
| 90027 |
Cookie Slack Detector |
beta |
Informational |
Active |
| 90033 |
Loosely Scoped Cookie |
release |
Informational |
Passive |