Highest False Positives Last Month

These were the alerts most frequently flagged as false positives using Alert Filters last month.

Note that this does not necessarily mean they are false positives, it could mean that the people using ZAP are not interested in these specific vulnerabilities.

Position Alert Status Rule Type
1 Cookie without SameSite Attribute release Passive
2 Session ID in URL Rewrite release Passive
3 Information Disclosure - Suspicious Comments release Passive
4 Cross-Domain Misconfiguration release Passive
5 Retrieved from Cache release Passive
6 X-Content-Type-Options Header Missing release Passive
7 Content Security Policy (CSP) Header Not Set release Passive
8 Strict-Transport-Security Header release Passive
9 Loosely Scoped Cookie release Passive
10 Re-examine Cache-control Directives release Passive
11 SQL Injection release Active
12 HTTP Server Response Header release Passive
13 User Agent Fuzzer release Active
14 Cross-Domain JavaScript Source File Inclusion release Passive
15 Timestamp Disclosure - Unix release Passive
16 CSP release Passive
17 Session Management Response Identified beta Passive
18 Cookie No HttpOnly Flag release Passive
19 Modern Web Application release Passive
20 PII Disclosure release Passive