ZAP Scan Baseline Report - Githubissues

Akshaya-Parthi / zap

Automate Security Testing with ZAP and GitHub Actions

0 stars 0 forks source link

ZAP Scan Baseline Report #1

Open github-actions[bot] opened 2 years ago

github-actions[bot] commented 2 years ago

Site: https://dotnetthoughts.net New Alerts
- Absence of Anti-CSRF Tokens [10202] total: 11:
- Application Error Disclosure [90022] total: 1:
  - https://dotnetthoughts.net/how-to-create-socialmedia-posts-using-python/
- Content Security Policy (CSP) Header Not Set [10038] total: 11:
- Cross-Domain Misconfiguration [10098] total: 11:
- Missing Anti-clickjacking Header [10020] total: 11:
- Cross-Domain JavaScript Source File Inclusion [10017] total: 11:
- Information Disclosure - Debug Error Messages [10023] total: 4:
- Private IP Disclosure [2] total: 4:
- Strict-Transport-Security Header Not Set [10035] total: 11:
- Timestamp Disclosure - Unix [10096] total: 12:
- X-Content-Type-Options Header Missing [10021] total: 11:
- Information Disclosure - Suspicious Comments [10027] total: 12:
- Modern Web Application [10109] total: 12:
- Re-examine Cache-control Directives [10015] total: 11:
- Retrieved from Cache [10050] total: 11:

View the following link to download the report. RunnerID:2899105653

github-actions[bot] commented 2 years ago

Site: https://gitlab.cloudifyops.com New Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 9:
- Cookie with SameSite Attribute None [10054] total: 12:
- Strict-Transport-Security Header Not Set [10035] total: 12:
- Timestamp Disclosure - Unix [10096] total: 9:
- X-Content-Type-Options Header Missing [10021] total: 1:
  - https://gitlab.cloudifyops.com/robots.txt
- Information Disclosure - Suspicious Comments [10027] total: 13:
- Modern Web Application [10109] total: 4:
- Re-examine Cache-control Directives [10015] total: 9:
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 4:

View the following link to download the report. RunnerID:2918145271

github-actions[bot] commented 2 years ago

Site: https://drive.google.com New Alerts
- Absence of Anti-CSRF Tokens [10202] total: 1:
  - https://drive.google.com/
- CSP: Wildcard Directive [10055] total: 4:
- CSP: script-src unsafe-inline [10055] total: 3:
- CSP: style-src unsafe-inline [10055] total: 4:
- Content Security Policy (CSP) Header Not Set [10038] total: 1:
  - https://drive.google.com/static
- CSP: Notices [10055] total: 3:
- Cookie with SameSite Attribute None [10054] total: 2:
  - https://drive.google.com/
  - https://drive.google.com/robots.txt
- Cookie without SameSite Attribute [10054] total: 1:
  - https://drive.google.com/
- Cross-Domain JavaScript Source File Inclusion [10017] total: 1:
  - https://drive.google.com/
- Strict-Transport-Security Header Not Set [10035] total: 12:
- Timestamp Disclosure - Unix [10096] total: 4:
- Information Disclosure - Sensitive Information in URL [10024] total: 1:
  - https://drive.google.com/home?authuser
- Information Disclosure - Suspicious Comments [10027] total: 2:
  - https://drive.google.com/
  - https://drive.google.com/
- Loosely Scoped Cookie [90033] total: 3:
- Modern Web Application [10109] total: 1:
  - https://drive.google.com/

View the following link to download the report. RunnerID:2924159180

github-actions[bot] commented 2 years ago

Site: https://zimmergren.net New Alerts
- Absence of Anti-CSRF Tokens [10202] total: 8:
- Content Security Policy (CSP) Header Not Set [10038] total: 10:
- Missing Anti-clickjacking Header [10020] total: 10:
- Cross-Domain JavaScript Source File Inclusion [10017] total: 8:
- Strict-Transport-Security Header Not Set [10035] total: 10:
- Timestamp Disclosure - Unix [10096] total: 2:
  - https://zimmergren.net/
  - https://zimmergren.net/security-scanning-with-github-actions-and-owasp-zap/
- X-Content-Type-Options Header Missing [10021] total: 10:
- Information Disclosure - Suspicious Comments [10027] total: 11:
- Modern Web Application [10109] total: 10:
- Re-examine Cache-control Directives [10015] total: 10:
- Retrieved from Cache [10050] total: 11:

View the following link to download the report. RunnerID:2924189409

github-actions[bot] commented 2 years ago

Site: https://www.jenkins.io New Alerts
- PII Disclosure [10062] total: 4:
- Absence of Anti-CSRF Tokens [10202] total: 12:
- Content Security Policy (CSP) Header Not Set [10038] total: 11:
- Cross-Domain JavaScript Source File Inclusion [10017] total: 9:
- Information Disclosure - Debug Error Messages [10023] total: 1:
  - https://www.jenkins.io/projects/remoting/
- Private IP Disclosure [2] total: 1:
  - https://www.jenkins.io/blog/2017/04/20/secure-jenkins-on-azure/
- Secure Pages Include Mixed Content [10040] total: 1:
  - https://www.jenkins.io/blog/2010/02/24/hudson-at-pycon/
- Timestamp Disclosure - Unix [10096] total: 9:
- Information Disclosure - Suspicious Comments [10027] total: 12:
- Modern Web Application [10109] total: 12:
- Re-examine Cache-control Directives [10015] total: 11:
- Retrieved from Cache [10050] total: 11:

View the following link to download the report. RunnerID:2925644513