docs
Login
Start Free Trial
Login
Start Free Trial
Vulnerabilities
StackHawk Documentation
Home
Getting Started
Overview
Scanning Quick Start
Scanning Next Steps
Scan Authenticated Routes
Automate Tests with GitHub Actions
HawkScan
Overview
Scan Discovery
Spider Configuration
Custom Scan Discovery
Configuration
Extended Configuration
OpenAPI Configuration
GraphQL Configuration
SOAP API Configuration
Spring4Shell Configuration
Custom Test Scripts
gRPC Configuration
Authenticated Scanning
3rd Party OAuth
Inject Multiple Cookies and Tokens
Form Based Authentication
HTTP Authentication
External Command Authentication
YAML Config
Running HawkScan
Viewing Scan Results
Troubleshooting
Upgrading to 4.0.0
StackHawk CLI
Automate (CI/CD)
CI/CD with HawkScan
AWS Code Services
Azure Pipelines
Azure Pipelines with Docker
Azure Pipelines with the StackHawk Azure Extension
Atlassian Bamboo
Bitbucket Pipelines
Buildkite
CircleCI
Concourse CI
Harness
GitHub Actions
GitHub Code Scanning
GitLab
GitLab Vulnerability Report
Jenkins
Spinnaker
Travis CI
StackHawk Platform
Overview
Policy Management
Application Policy Management
StackHawk Policies
Applications
Scans
Reports
Attack Surface
Repositories
Roles
Teams
Technology Flags
Browser Support
SSO/SAML Integration
Integrations
Overview
Datadog
Defect Dojo
GitHub
Pull Request Checks
GitHub CodeQL
Jira Cloud
Bitbucket
Jira Security
Microsoft
Azure Repos
Azure DevOps Boards
Defender for Cloud
Teams
Slack
Snyk Code
Vanta
Webhook
Log4Shell Detection
Vulnerabilities
StackHawk API
Support + More
Contact Support
Single Endpoint Walkthrough
Best Practices
Changelog
Downloads
GitHub
Api Docs
StackHawk.com
Vulnerabilities
Vulnerabilities Index
ID
Name
Type
Criticality
CWE ID
0
Directory Browsing
Active
Medium
CWE-548
2
Private IP Disclosure
Passive
-
CWE-200
3
Referer Exposes Session ID
Passive
-
CWE-200
6
Path Traversal
Active
High
CWE-22
7
Remote File Inclusion
Active
High
CWE-98
41
Source Code Disclosure - Git
Active
High
CWE-541
42
Source Code Disclosure - SVN
Active
Medium
CWE-541
43
Source Code Disclosure - File Inclusion
Active
High
CWE-541
10009
In Page Banner Information Leak
Passive
-
CWE-200
10010
Cookie No HttpOnly Flag
Passive
-
CWE-1004
10011
Cookie Without Secure Flag
Passive
-
CWE-614
10015
Incomplete or No Cache-control and Pragma HTTP Header Set
Passive
-
CWE-525
10017
Cross-Domain JavaScript Source File Inclusion
Passive
-
CWE-829
10020
X-Frame-Options Header Not Set
Passive
-
CWE-1021
10021
X-Content-Type-Options Header Missing
Passive
-
CWE-693
10023
Information Disclosure - Debug Error Messages
Passive
-
CWE-200
10024
Information Disclosure - Sensitive Information in URL
Passive
-
10027
Information Disclosure - Suspicious Comments
Passive
-
10028
Open Redirect
Passive
-
CWE-601
10032
Viewstate without MAC Signature (Unsure)
Passive
-
10033
Directory Browsing - Apache 2
Passive
-
CWE-548
10035
Strict-Transport-Security Header Not Set
Passive
-
CWE-319
10036
Server Leaks Version Information via “Server” HTTP Response Header Field
Passive
-
CWE-200
10037
Server Leaks Information via “X-Powered-By” HTTP Response Header Field(s)
Passive
-
CWE-200
10038
Content Security Policy (CSP) Header Not Set
Passive
-
CWE-693
10039
X-Backend-Server Header Information Leak
Passive
-
10040
Secure Pages Include Mixed Content (Including Scripts)
Passive
-
CWE-311
10041
HTTP to HTTPS Insecure Transition in Form Post
Passive
-
CWE-319
10042
HTTPS to HTTP Insecure Transition in Form Post
Passive
-
CWE-319
10044
Big Redirect Detected (Potential Sensitive Information Leak)
Passive
-
CWE-201
10047
HTTPS Content Available via HTTP
Active
Low
CWE-311
10048
Remote Code Execution - Shell Shock
Active
High
CWE-78
10051
Relative Path Confusion
Active
Medium
CWE-20
10052
X-ChromeLogger-Data (XCOLD) Header Information Leak
Passive
-
10054
Cookie Without SameSite Attribute
Passive
-
CWE-1275
10055
CSP Scanner: Wildcard Directive
Passive
-
CWE-693
10056
X-Debug-Token Information Leak
Passive
-
CWE-200
10061
X-AspNet-Version Response Header Scanner
Passive
-
CWE-933
10062
PII Disclosure
Passive
-
CWE-359
10063
Permissions Policy Header Not Set
Passive
-
CWE-693
10095
Backup File Disclosure
Active
Medium
CWE-530
10096
Timestamp Disclosure - Unix
Passive
-
CWE-200
10097
Hash Disclosure - Mac OSX salted SHA-1
Passive
-
10098
Cross-Domain Misconfiguration
Passive
-
CWE-264
10099
Source Code Disclosure - SQL
Passive
-
CWE-540
10105
Weak Authentication Method
Passive
-
CWE-326
10106
HTTP Only Site
Active
Medium
10107
Httpoxy - Proxy Header Misuse
Active
High
CWE-20
10108
Reverse Tabnabbing
Passive
-
CWE-1022
10110
Dangerous JS Functions
Passive
-
10202
Absence of Anti-CSRF Tokens
Passive
-
20012
Anti CSRF Tokens Scanner
Active
Medium
CWE-352
20016
Cross-Domain Misconfiguration - Adobe - Send
Active
High
CWE-264
20017
Source Code Disclosure - CVE-2012-1823
Active
High
CWE-20
20018
Remote Code Execution - CVE-2012-1823
Active
High
20019
External Redirect
Active
High
30001
Buffer Overflow
Active
Medium
CWE-120
30002
Format String Error
Active
Medium
CWE-134
30003
Integer Overflow Error
Active
Medium
CWE-190
40003
CRLF Injection
Active
Medium
CWE-113
40008
Parameter Tampering
Active
Medium
CWE-472
40009
Server Side Include
Active
High
CWE-97
40012
Cross Site Scripting (Reflected)
Active
High
CWE-79
40013
Session ID Expiry Time/Max-Age is Excessive
Active
High
CWE-384
40014
Cross Site Scripting Weakness (Persistent in JSON Response)
Active
High
CWE-79
40015
LDAP Injection
Active
High
CWE-90
40018
SQL Injection
Active
High
CWE-89
40019
SQL Injection - MySQL
Active
High
CWE-89
40020
SQL Injection - Hypersonic SQL - Time Based
Active
High
CWE-89
40021
SQL Injection - Oracle - Time Based
Active
High
CWE-89
40022
SQL Injection - PostgreSQL - Time Based
Active
High
CWE-89
40024
SQL Injection - SQLite
Active
High
CWE-89
40025
Proxy Disclosure
Active
Medium
CWE-200
40026
Cross Site Scripting (DOM Based)
Active
High
CWE-79
40027
SQL Injection - MsSQL
Active
High
CWE-89
40028
ELMAH Information Leak
Active
Medium
CWE-94
40029
Trace.axd Information Leak
Active
Medium
CWE-215
40032
.htaccess Information Leak
Active
Medium
CWE-94
40033
NoSQL Injection - MongoDB
Active
High
CWE-943
40034
.env Information Leak
Active
Medium
CWE-215
40035
Hidden File Found
Active
Medium
CWE-538
40038
Bypassing 403
Active
Medium
40039
Web Cache Deception
Active
Medium
40040
CORS Misconfiguration
Active
Medium
CWE-942
40042
Spring Actuator Information Leak
Active
Medium
CWE-215
40043
Log4Shell (CVE-2021-44228)
Active
High
CWE-117
40045
Spring4Shell
Active
High
CWE-78
90002
Java Serialization Object
Passive
-
90003
Sub Resource Integrity Attribute Missing
Passive
-
CWE-345
90004
Insufficient Site Isolation Against Spectre Vulnerability
Passive
-
90017
XSLT Injection
Active
Medium
CWE-91
90019
Server Side Code Injection - ASP Code Injection
Active
High
CWE-94
90020
Remote OS Command Injection
Active
High
CWE-78
90021
XPath Injection
Active
High
CWE-643
90022
Application Error Disclosure
Passive
-
CWE-200
90023
XML External Entity Attack
Active
High
CWE-611
90024
Generic Padding Oracle
Active
High
90025
Expression Language Injection
Active
High
CWE-917
90026
SOAP Action Spoofing
Active
High
90028
Insecure HTTP Method
Active
Medium
CWE-200
90029
SOAP XML Injection
Active
High
90034
Cloud Metadata Potentially Exposed
Active
High
90035
Server Side Template Injection
Active
High
CWE-94
90036
Server Side Template Injection (Blind)
Active
High
CWE-74
421001
Possible Insecure Direct Object References (IDOR)
Passive
High
CWE-639
422000
Improper Access
Active
High
422001
Possible Broken Object-Level Authorization (BOLA)
Active
High
CWE-639
422002
Tenancy Check
Active
High
422003
Possible Broken Function Level Authorization
Active
High
We use first and third party cookies to ensure that we give you the best experience on our website and in our products. If you continue to use this site we will assume that you are happy with it and we'll let corporate know.
OK
Privacy Policy
Close Third Party Cookies Banner