List of Issues

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. ^OWASP

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. ^OWASP

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. ^OWASP

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. ^OWASP

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. ^OWASP

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. ^OWASP

The application does not enforce using a strong password, which makes it easier for attackers to find users’ passwords.

The application does not enforce using a strong password, which makes it easier for attackers to find users’ passwords.

The Unicode Standard represents a very significant advance over all previous methods of encoding characters. For the first time, all of the world’s characters can be represented in a uniform manner, making it feasible for the vast majority of programs to be globalized: built to handle any language in the world.
In many ways, the use of Unicode makes programs much more robust and secure. When systems used a hodge-podge of different charsets for representing characters, there were security and corruption problems that resulted from differences between those charsets, or from the way in which programs converted to and from them.
However, because Unicode contains such a large number of characters, and incorporates the varied writing systems of the world, incorrect usage can expose programs or systems to possible security attacks like below one:

• Visual Security Issues
• UTF-8 Exploits
• Text Comparison (Sorting, Searching, Matching)
• Buffer Overflows
• Deletion of Code Points

Hackers can use these attacks to bypass WAFs and exploit XSS and SQL Injection vulnerabilities.

Insecure deserialization occurs when an application deserializes a user-supplied object string without checking its integrity. It allows attackers to manipulate the system state and execute remote commands.

Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. ^OWASP

The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a “dynamic file inclusion” mechanisms implemented in the target application. The vulnerability occurs due to the use of user-supplied input without proper validation. ^OWASP

In a Local File Inclusion the content of the local file is reflected in the response. The application might execute the content of the file if it contains code.

Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation. ^OWASP

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

Unhandled exceptions have two primary risks.

• Denial of service: When an unhandled exception occurs, it might cause memory leakage or consume server resources by performing more process than usual.
• Leaking information: Unhandled exceptions can generate error messages with sensitive information. When these error messages are shown to users, attackers can take advantage of them to develop their attack on the target.

When processing an incoming HTTP request, the webserver needs to know which component or virtual host should complete the request. The Host HTTP header is used for this purpose.
All HTTP headers including the Host header are user-controlled data. If the application uses the value of any HTTP header without validation, a header injection attack occurs.
Host header injection allows attackers to manipulate the response to perform arbitrary redirection, cache poisoning, and information disclosure.

When processing an incoming HTTP request, the webserver needs to know which component or virtual host should complete the request. The Host HTTP header is used for this purpose.
All HTTP headers including the Host header are user-controlled data. If the application uses the value of any HTTP header without validation, a header injection attack occurs.
Host header injection allows attackers to manipulate the response to perform arbitrary redirection, cache poisoning, and information disclosure.

When processing an incoming HTTP request, the webserver needs to know which component or virtual host should complete the request. The Host HTTP header is used for this purpose.
All HTTP headers including the Host header are user-controlled data. If the application uses the value of any HTTP header without validation, a header injection attack occurs.
Host header injection allows attackers to manipulate the response to perform arbitrary redirection, cache poisoning, and information disclosure.

When processing an incoming HTTP request, the webserver needs to know which component or virtual host should complete the request. The Host HTTP header is used for this purpose.
All HTTP headers including the Host header are user-controlled data. If the application uses the value of any HTTP header without validation, a header injection attack occurs.
Host header injection allows attackers to manipulate the response to perform arbitrary redirection, cache poisoning, and information disclosure.

Attackers can sniff and capture sensitive information like passwords when they’re served and transmitted over the unencrypted HTTP traffic.

Attackers can sniff and capture sensitive information like passwords when they’re served and transmitted over the unencrypted HTTP traffic.

Attackers can sniff and capture sensitive information like passwords when they’re served and transmitted over the unencrypted HTTP traffic.

The Secure cookie flag prevents the browser from sending the cookie over an unencrypted connection. A cookie with a Secure flag is sent to the server only with an encrypted request over the HTTPS protocol. Therefore it can’t easily be accessed by a man-in-the-middle attacker.

The Secure cookie flag prevents the browser from sending the cookie over an unencrypted connection. A cookie with a Secure flag is sent to the server only with an encrypted request over the HTTPS protocol. Therefore it can’t easily be accessed by a man-in-the-middle attacker.

The HttpOnly cookie flag prevents JavaScript Document.cookie API from accessing the cookie. When this flag is set, the cookie is only sent to the server. In many cases, cookies are not needed on the client-side. Session cookies are a good example of cookies that don’t need to be available to JavaScript. Using the HttpOnly flag can help to mitigate Cross-Site-Scripting(XSS) attacks.

The SameSite cookie flag with the right value prevents the browser from sending the cookie in cross-origin requests. It provides some protection against cross-site request forgery attacks (CSRF).

When HTTPS is enabled but, HTTP requests are not redirected to HTTPS automatically, users have to open the HTTPS URL explicitly. Otherwise, communication is not encrypted and can be captured by an attacker who has access to a network interface.

The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks. ^MITRE

HTTP traffic can often be sniffed and captured by an attacker who has access to a network interface. In HTTP basic authentication, user credentials are sent in Base64 encoding which, can easily be decoded into plain text.

Sensitive information is exposed on this page. Attackers can use this information to extend their attack.

The OpenSSL version used is outdated and has security flaws.

Sensitive information is exposed on this page. Attackers can use this information to extend their attack.

Source code on a web server often contains sensitive information and should not be accessible to users.

The PHP version used is outdated and has security flaws.

Often, web applications reveal when a username exists on system, either as a consequence of mis-configuration or as a design decision. For example, sometimes, when we submit wrong credentials, we receive a message that states that either the username is present on the system or the provided password is wrong. The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username and password attack. ^OWASP

In HTTP communications, traffic is not encrypted and can be captured by an attacker who has access to a network interface.

The Secure cookie flag prevents the browser from sending the cookie over an unencrypted connection. A cookie with a Secure flag is sent to the server only with an encrypted request over the HTTPS protocol. Therefore it can’t easily be accessed by a man-in-the-middle attacker.

The Secure cookie flag prevents the browser from sending the cookie over an unencrypted connection. A cookie with a Secure flag is sent to the server only with an encrypted request over the HTTPS protocol. Therefore it can’t easily be accessed by a man-in-the-middle attacker.

The Secure cookie flag prevents the browser from sending the cookie over an unencrypted connection. A cookie with a Secure flag is sent to the server only with an encrypted request over the HTTPS protocol. Therefore it can’t easily be accessed by a man-in-the-middle attacker.

The Secure cookie flag prevents the browser from sending the cookie over an unencrypted connection. A cookie with a Secure flag is sent to the server only with an encrypted request over the HTTPS protocol. Therefore it can’t easily be accessed by a man-in-the-middle attacker.

The Secure cookie flag prevents the browser from sending the cookie over an unencrypted connection. A cookie with a Secure flag is sent to the server only with an encrypted request over the HTTPS protocol. Therefore it can’t easily be accessed by a man-in-the-middle attacker.

Attackers can often predict unreferenced resources on web applications. These files may disclose sensitive information that can facilitate a focused attack against the application. Unreferenced pages may contain powerful functionality that can be used to attack the application. ^OWASP

Attackers can often predict unreferenced resources on web applications. These files may disclose sensitive information that can facilitate a focused attack against the application. Unreferenced pages may contain powerful functionality that can be used to attack the application. ^OWASP

Attackers can often predict unreferenced resources on web applications. These files may disclose sensitive information that can facilitate a focused attack against the application. Unreferenced pages may contain powerful functionality that can be used to attack the application. ^OWASP

Attackers can often predict unreferenced resources on web applications. These files may disclose sensitive information that can facilitate a focused attack against the application. Unreferenced pages may contain powerful functionality that can be used to attack the application. ^OWASP

The HttpOnly cookie flag prevents JavaScript Document.cookie API from accessing the cookie. When this flag is set, the cookie is only sent to the server. In many cases, cookies are not needed on the client-side. Session cookies are a good example of cookies that don’t need to be available to JavaScript. Using the HttpOnly flag can help to mitigate Cross-Site-Scripting(XSS) attacks.

The HttpOnly cookie flag prevents JavaScript Document.cookie API from accessing the cookie. When this flag is set, the cookie is only sent to the server. In many cases, cookies are not needed on the client-side. Session cookies are a good example of cookies that don’t need to be available to JavaScript. Using the HttpOnly flag can help to mitigate Cross-Site-Scripting(XSS) attacks.

The HttpOnly cookie flag prevents JavaScript Document.cookie API from accessing the cookie. When this flag is set, the cookie is only sent to the server. In many cases, cookies are not needed on the client-side. Session cookies are a good example of cookies that don’t need to be available to JavaScript. Using the HttpOnly flag can help to mitigate Cross-Site-Scripting(XSS) attacks.

The HttpOnly cookie flag prevents JavaScript Document.cookie API from accessing the cookie. When this flag is set, the cookie is only sent to the server. In many cases, cookies are not needed on the client-side. Session cookies are a good example of cookies that don’t need to be available to JavaScript. Using the HttpOnly flag can help to mitigate Cross-Site-Scripting(XSS) attacks.

The user browser can save and remember the entered values for user input fields with autocomplete enabled attributes. This might reveal sensitive information like passwords, especially in public and multi-user computers.

The user browser can save and remember the entered values for user input fields with autocomplete enabled attributes. This might reveal sensitive information like passwords, especially in public and multi-user computers.

A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible. ^MITRE

A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible. ^MITRE

A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible. ^MITRE

A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible. ^MITRE

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware. ^Mozilla

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>. Sites can use this to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites. ^Mozilla

Subresource Integrity (SRI) is a security feature that enables browsers to verify that resources they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched resource must match. ^Moilla

The SameSite cookie flag with the right value prevents the browser from sending the cookie in cross-origin requests. It provides some protection against cross-site request forgery attacks (CSRF).

A bad configured web server can leak Apache version number in the Server HTTP header or in the body of error pages. Attackers use this information for finding vulnerabilities in Apache web server.

An inline frame tag (iframe) on the page refers to an external resource, and no sandbox is set. This allows the external URL to trick users into doing unwanted actions like submitting passwords.

HTTP TRACE method allows a client to see the whole request that the webserver has received. The main purpose of this feature is for testing or diagnostic information.
This method can reveal sensitive information like Cookies and Authorization tokens to clients when they’re not supposed to access these data. This is often called a Cross-Site Tracing (XST) attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

Spambots can harvest email addresses from webpages and use them for sending spam emails.

Spambots can harvest email addresses from webpages and use them for sending spam emails.

Spambots can harvest email addresses from webpages and use them for sending spam emails.

Spambots can harvest email addresses from webpages and use them for sending spam emails.

Web browsers need to be aware of the encoding of characters to display it right. When the character encoding is not explicitly defined, the browser has to either guess the encoding or use a default encoding. This will allow attackers to use different encodings like UTF-7 to exploit vulnerabilities like XSS.

Web browsers need to be aware of the encoding of characters to display it right. When the character encoding is not explicitly defined, the browser has to either guess the encoding or use a default encoding. This will allow attackers to use different encodings like UTF-7 to exploit vulnerabilities like XSS.

Web browsers need to be aware of the encoding of characters to display it right. When the character encoding is not explicitly defined, the browser has to either guess the encoding or use a default encoding. This will allow attackers to use different encodings like UTF-7 to exploit vulnerabilities like XSS.

Attackers can often predict unreferenced resources on web applications. These files may disclose sensitive information that can facilitate a focused attack against the application. Unreferenced pages may contain powerful functionality that can be used to attack the application. ^OWASP

Attackers can often predict unreferenced resources on web applications. These files may disclose sensitive information that can facilitate a focused attack against the application. Unreferenced pages may contain powerful functionality that can be used to attack the application. ^OWASP

Attackers can often predict unreferenced resources on web applications. These files may disclose sensitive information that can facilitate a focused attack against the application. Unreferenced pages may contain powerful functionality that can be used to attack the application. ^OWASP

The X-Content-Type-Options response HTTP header is used by the server to prevent browsers from guessing the media type ( MIME type).
This is known as MIME sniffing in which the browser guesses the correct MIME type by looking at the contents of the resource.
The absence of this header might cause browsers to transform non-executable content into executable content.

Web cache or HTTP cache is a system for optimizing the web. Browsers cache contents of a resource once and reuse it on consequent requests. Caching images on the web can boost page load time. But clients should not be allowed to cache pages that display sensitive, dynamic, or user specific contents.

The Referrer-Policy HTTP header controls how much referrer information (sent via the Referer header) should be included with requests. ^Mozilla
The Referer (sic) header contains the address of the previous web page from which a link to the currently requested page was followed, which has lots of fairly innocent uses including analytics, logging, or optimized caching. However, there are more problematic uses such as tracking or stealing information, or even just side effects such as inadvertently leaking sensitive information. ^Mozilla

Private IP addresses are used in private networks like local area networks (LANs). A private IP address can reveal information about the IP planning scheme used in the private network.
This information does not create any direct impact on the target, though it can help attackers develop their attack.

Private IP addresses are used in private networks like local area networks (LANs). A private IP address can reveal information about the IP planning scheme used in the private network.
This information does not create any direct impact on the target, though it can help attackers develop their attack.

The HTTP X-XSS-Protection response header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. ^Mozilla

• Chrome has removed their XSS Auditor
• Firefox has not, and will not implement X-XSS-Protection
• Edge has retired their XSS filter

This means that if you do not need to support legacy browsers, it is recommended that you use Content-Security-Policy without allowing unsafe-inline scripts instead.

The X-Powered-By header describes the technologies used by the webserver. This information exposes the server to attackers. Using the information in this header, attackers can find vulnerabilities easier.

An <input> element with type="file" lets user choose one or more files from their device storage. Then, the files can be uploaded to a remote server.
An unrestricted file upload functionality can cause an arbitrary file upload vulnerability where malicious users can upload (and execute) any file to the server.

SQL commands reveal information about the structure of the underlying database.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.

Knowing the PHP version used by the server, attackers can find vulnerabilities easier. This information exposes the server to attackers.

File and directory paths reveal information about the structure of the file system of the underlying OS.
This information does not create any direct impact on the target, though it provides valuable information attackers can use in their attack.