Vulnerabilities

Vulnerabilities Index

ID	Name	Type	Criticality	CWE ID
0	Directory Browsing	Active	Medium	CWE-548
2	Private IP Disclosure	Passive	-	CWE-200
3	Referer Exposes Session ID	Passive	-	CWE-200
6	Path Traversal	Active	High	CWE-22
7	Remote File Inclusion	Active	High	CWE-98
41	Source Code Disclosure - Git	Active	High	CWE-541
42	Source Code Disclosure - SVN	Active	Medium	CWE-541
43	Source Code Disclosure - File Inclusion	Active	High	CWE-541
10009	In Page Banner Information Leak	Passive	-	CWE-200
10010	Cookie No HttpOnly Flag	Passive	-	CWE-1004
10011	Cookie Without Secure Flag	Passive	-	CWE-614
10015	Incomplete or No Cache-control and Pragma HTTP Header Set	Passive	-	CWE-525
10017	Cross-Domain JavaScript Source File Inclusion	Passive	-	CWE-829
10020	X-Frame-Options Header Not Set	Passive	-	CWE-1021
10021	X-Content-Type-Options Header Missing	Passive	-	CWE-693
10023	Information Disclosure - Debug Error Messages	Passive	-	CWE-200
10024	Information Disclosure - Sensitive Information in URL	Passive	-
10027	Information Disclosure - Suspicious Comments	Passive	-
10028	Open Redirect	Passive	-	CWE-601
10032	Viewstate without MAC Signature (Unsure)	Passive	-
10033	Directory Browsing - Apache 2	Passive	-	CWE-548
10035	Strict-Transport-Security Header Not Set	Passive	-	CWE-319
10036	Server Leaks Version Information via “Server” HTTP Response Header Field	Passive	-	CWE-200
10037	Server Leaks Information via “X-Powered-By” HTTP Response Header Field(s)	Passive	-	CWE-200
10038	Content Security Policy (CSP) Header Not Set	Passive	-	CWE-693
10039	X-Backend-Server Header Information Leak	Passive	-
10040	Secure Pages Include Mixed Content (Including Scripts)	Passive	-	CWE-311
10041	HTTP to HTTPS Insecure Transition in Form Post	Passive	-	CWE-319
10042	HTTPS to HTTP Insecure Transition in Form Post	Passive	-	CWE-319
10044	Big Redirect Detected (Potential Sensitive Information Leak)	Passive	-	CWE-201
10047	HTTPS Content Available via HTTP	Active	Low	CWE-311
10048	Remote Code Execution - Shell Shock	Active	High	CWE-78
10051	Relative Path Confusion	Active	Medium	CWE-20
10052	X-ChromeLogger-Data (XCOLD) Header Information Leak	Passive	-
10054	Cookie Without SameSite Attribute	Passive	-	CWE-1275
10055	CSP Scanner: Wildcard Directive	Passive	-	CWE-693
10056	X-Debug-Token Information Leak	Passive	-	CWE-200
10061	X-AspNet-Version Response Header Scanner	Passive	-	CWE-933
10062	PII Disclosure	Passive	-	CWE-359
10063	Permissions Policy Header Not Set	Passive	-	CWE-693
10095	Backup File Disclosure	Active	Medium	CWE-530
10096	Timestamp Disclosure - Unix	Passive	-	CWE-200
10097	Hash Disclosure - Mac OSX salted SHA-1	Passive	-
10098	Cross-Domain Misconfiguration	Passive	-	CWE-264
10099	Source Code Disclosure - SQL	Passive	-	CWE-540
10105	Weak Authentication Method	Passive	-	CWE-326
10106	HTTP Only Site	Active	Medium
10107	Httpoxy - Proxy Header Misuse	Active	High	CWE-20
10108	Reverse Tabnabbing	Passive	-	CWE-1022
10110	Dangerous JS Functions	Passive	-
10202	Absence of Anti-CSRF Tokens	Passive	-
20012	Anti CSRF Tokens Scanner	Active	Medium	CWE-352
20016	Cross-Domain Misconfiguration - Adobe - Send	Active	High	CWE-264
20017	Source Code Disclosure - CVE-2012-1823	Active	High	CWE-20
20018	Remote Code Execution - CVE-2012-1823	Active	High
20019	External Redirect	Active	High
30001	Buffer Overflow	Active	Medium	CWE-120
30002	Format String Error	Active	Medium	CWE-134
30003	Integer Overflow Error	Active	Medium	CWE-190
40003	CRLF Injection	Active	Medium	CWE-113
40008	Parameter Tampering	Active	Medium	CWE-472
40009	Server Side Include	Active	High	CWE-97
40012	Cross Site Scripting (Reflected)	Active	High	CWE-79
40013	Session ID Expiry Time/Max-Age is Excessive	Active	High	CWE-384
40014	Cross Site Scripting Weakness (Persistent in JSON Response)	Active	High	CWE-79
40015	LDAP Injection	Active	High	CWE-90
40018	SQL Injection	Active	High	CWE-89
40019	SQL Injection - MySQL	Active	High	CWE-89
40020	SQL Injection - Hypersonic SQL - Time Based	Active	High	CWE-89
40021	SQL Injection - Oracle - Time Based	Active	High	CWE-89
40022	SQL Injection - PostgreSQL - Time Based	Active	High	CWE-89
40024	SQL Injection - SQLite	Active	High	CWE-89
40025	Proxy Disclosure	Active	Medium	CWE-200
40026	Cross Site Scripting (DOM Based)	Active	High	CWE-79
40027	SQL Injection - MsSQL	Active	High	CWE-89
40028	ELMAH Information Leak	Active	Medium	CWE-94
40029	Trace.axd Information Leak	Active	Medium	CWE-215
40032	.htaccess Information Leak	Active	Medium	CWE-94
40033	NoSQL Injection - MongoDB	Active	High	CWE-943
40034	.env Information Leak	Active	Medium	CWE-215
40035	Hidden File Found	Active	Medium	CWE-538
40038	Bypassing 403	Active	Medium
40039	Web Cache Deception	Active	Medium
40040	CORS Misconfiguration	Active	Medium	CWE-942
40042	Spring Actuator Information Leak	Active	Medium	CWE-215
40043	Log4Shell (CVE-2021-44228)	Active	High	CWE-117
40045	Spring4Shell	Active	High	CWE-78
90002	Java Serialization Object	Passive	-
90003	Sub Resource Integrity Attribute Missing	Passive	-	CWE-345
90004	Insufficient Site Isolation Against Spectre Vulnerability	Passive	-
90017	XSLT Injection	Active	Medium	CWE-91
90019	Server Side Code Injection - ASP Code Injection	Active	High	CWE-94
90020	Remote OS Command Injection	Active	High	CWE-78
90021	XPath Injection	Active	High	CWE-643
90022	Application Error Disclosure	Passive	-	CWE-200
90023	XML External Entity Attack	Active	High	CWE-611
90024	Generic Padding Oracle	Active	High
90025	Expression Language Injection	Active	High	CWE-917
90026	SOAP Action Spoofing	Active	High
90028	Insecure HTTP Method	Active	Medium	CWE-200
90029	SOAP XML Injection	Active	High
90034	Cloud Metadata Potentially Exposed	Active	High
90035	Server Side Template Injection	Active	High	CWE-94
90036	Server Side Template Injection (Blind)	Active	High	CWE-74
421001	Possible Insecure Direct Object References (IDOR)	Passive	High	CWE-639
422000	Improper Access	Active	High
422001	Possible Broken Object-Level Authorization (BOLA)	Active	High	CWE-639
422002	Tenancy Check	Active	High
422003	Possible Broken Function Level Authorization	Active	High