Download

Highest False Positives Last Month

  1. Documentation
  2. Statistics
  3. Highest False Positives Last Month

These were the alerts most frequently flagged as false positives using Alert Filters last month.

Note that this does not necessarily mean they are false positives, it could mean that the people using ZAP are not interested in these specific vulnerabilities.

Position Alert Status Rule Type
1 Cookie without SameSite Attribute release Passive
2 Information Disclosure - Suspicious Comments release Passive
3 Session ID in URL Rewrite release Passive
4 SQL Injection release Active
5 Cross-Domain Misconfiguration release Passive
6 Source Code Disclosure - PHP beta Passive
7 X-Content-Type-Options Header Missing release Passive
8 Re-examine Cache-control Directives release Passive
9 Loosely Scoped Cookie release Passive
10 Content Security Policy (CSP) Header Not Set release Passive
11 Retrieved from Cache release Passive
12 Strict-Transport-Security Header release Passive
13 Cross-Domain JavaScript Source File Inclusion release Passive
14 Session Management Response Identified beta Passive
15 CSP release Passive
16 HTTP Server Response Header release Passive
17 Sub Resource Integrity Attribute Missing release Passive
18 Cookie No HttpOnly Flag release Passive
19 Modern Web Application release Passive
20 Timestamp Disclosure - Unix release Passive