ZAP Scan Baseline Report

Site: https://cdnjs.cloudflare.com
Site: https://preview.owasp-juice.shop New Alerts
- Missing Anti-clickjacking Header [10020] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer2Bh&sid=jAvI3tW9YB5PXYWlAAKC
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer3DI&sid=LhEoDLet-ujLUI6eAAKI
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer4Aq&sid=aVY2YsOl80XRTX8gAAKM
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer57f&sid=RVBjoOVi1nEVbyDDAAKO
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer6QJ&sid=qkmkDdF2P7KOnBxGAAKV
  - ..
- Session ID in URL Rewrite [3] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer2Bi&sid=jAvI3tW9YB5PXYWlAAKC
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer3DL&sid=LhEoDLet-ujLUI6eAAKI
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer4Av&sid=aVY2YsOl80XRTX8gAAKM
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer57i&sid=RVBjoOVi1nEVbyDDAAKO
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=websocket&sid=aVY2YsOl80XRTX8gAAKM
  - ..
- Private IP Disclosure [2] total: 1:
  - https://preview.owasp-juice.shop/rest/admin/application-configuration
- X-Content-Type-Options Header Missing [10021] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer28t
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer2Bi&sid=jAvI3tW9YB5PXYWlAAKC
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer374
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer3DL&sid=LhEoDLet-ujLUI6eAAKI
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer42E
  - ..
  Ignored Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 8:
- Cross-Domain Misconfiguration [10098] total: 10:
- Cross-Domain JavaScript Source File Inclusion [10017] total: 6:
- Dangerous JS Functions [10110] total: 2:
- Deprecated Feature Policy Header Set [10063] total: 7:
- Permissions Policy Header Not Set [10063] total: 2:
- Strict-Transport-Security Header Not Set [10035] total: 10:
- Timestamp Disclosure - Unix [10096] total: 10:
- Base64 Disclosure [10094] total: 10:
- Information Disclosure - Suspicious Comments [10027] total: 2:
- Modern Web Application [10109] total: 3:
- Non-Storable Content [10049] total: 1:
- Re-examine Cache-control Directives [10015] total: 8:
- Sec-Fetch-Dest Header is Missing [90005] total: 2:
- Sec-Fetch-Mode Header is Missing [90005] total: 2:
- Sec-Fetch-Site Header is Missing [90005] total: 2:
- Sec-Fetch-User Header is Missing [90005] total: 2:
- Storable and Cacheable Content [10049] total: 1:
- Storable but Non-Cacheable Content [10049] total: 8:

View the following link to download the report. RunnerID:9045488472

This issue has been automatically marked as stale because it has not had recent activity. :calendar: It will be closed automatically in one week if no further activity occurs.

Site: https://cdnjs.cloudflare.com
Site: https://preview.owasp-juice.shop New Alerts
- Missing Anti-clickjacking Header [10020] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-aLO&sid=T3bNePdxwjoorWrqAADj
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-bJV&sid=-UOu2UuVPrjRL--8AADs
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-cPT&sid=AWPpio_E7sbNYMlHAADy
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-d7O&sid=zYCnLsehhhprTUIhAAD2
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-eST&sid=oOTDzl81fC_svuEjAAD7
  - ..
- Session ID in URL Rewrite [3] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-aLQ&sid=T3bNePdxwjoorWrqAADj
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-bJY&sid=-UOu2UuVPrjRL--8AADs
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-cPV&sid=AWPpio_E7sbNYMlHAADy
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-d7Q&sid=zYCnLsehhhprTUIhAAD2
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=websocket&sid=-UOu2UuVPrjRL--8AADs
  - ..
- Private IP Disclosure [2] total: 1:
  - https://preview.owasp-juice.shop/rest/admin/application-configuration
- X-Content-Type-Options Header Missing [10021] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-aIU
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-aLQ&sid=T3bNePdxwjoorWrqAADj
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-bEk
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-bJY&sid=-UOu2UuVPrjRL--8AADs
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O_K-c5-
  - ..
  Ignored Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 8:
- Cross-Domain Misconfiguration [10098] total: 10:
- Cross-Domain JavaScript Source File Inclusion [10017] total: 6:
- Dangerous JS Functions [10110] total: 2:
- Deprecated Feature Policy Header Set [10063] total: 7:
- Permissions Policy Header Not Set [10063] total: 1:
- Strict-Transport-Security Header Not Set [10035] total: 10:
- Timestamp Disclosure - Unix [10096] total: 10:
- Base64 Disclosure [10094] total: 10:
- Information Disclosure - Suspicious Comments [10027] total: 2:
- Modern Web Application [10109] total: 3:
- Non-Storable Content [10049] total: 1:
- Re-examine Cache-control Directives [10015] total: 8:
- Sec-Fetch-Dest Header is Missing [90005] total: 3:
- Sec-Fetch-Mode Header is Missing [90005] total: 3:
- Sec-Fetch-Site Header is Missing [90005] total: 3:
- Sec-Fetch-User Header is Missing [90005] total: 3:
- Storable and Cacheable Content [10049] total: 1:
- Storable but Non-Cacheable Content [10049] total: 8:

View the following link to download the report. RunnerID:9332187603

This issue has been automatically marked as stale because it has not had recent activity. :calendar: It will be closed automatically in one week if no further activity occurs.

Site: https://cdnjs.cloudflare.com
Site: https://preview.owasp-juice.shop New Alerts
- Missing Anti-clickjacking Header [10020] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117-pA&sid=ocIXSH-Y9RuBEVOWAADs
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117-Xh&sid=vN77plrFvCx0M7P_AADr
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117_Xs&sid=ltxTNPyHNHexfiRpAADv
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117tQq&sid=Y-xt1lnr83CbOLmGAADJ
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117uKM&sid=SHHAB9acMnH7qBuKAADN
  - ..
- Session ID in URL Rewrite [3] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117tQs&sid=Y-xt1lnr83CbOLmGAADJ
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117uKO&sid=SHHAB9acMnH7qBuKAADN
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117vOp&sid=vm4cAiNAAveAxxuJAADS
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117wBt&sid=4hSfXZL48CqDpKU3AADW
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=websocket&sid=4hSfXZL48CqDpKU3AADW
  - ..
- Private IP Disclosure [2] total: 1:
  - https://preview.owasp-juice.shop/rest/admin/application-configuration
- X-Content-Type-Options Header Missing [10021] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117tNO
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117tQs&sid=Y-xt1lnr83CbOLmGAADJ
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117uHI
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117uKO&sid=SHHAB9acMnH7qBuKAADN
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=P117vEW
  - ..
  Ignored Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 8:
- Cross-Domain Misconfiguration [10098] total: 10:
- Cross-Domain JavaScript Source File Inclusion [10017] total: 6:
- Dangerous JS Functions [10110] total: 2:
- Deprecated Feature Policy Header Set [10063] total: 7:
- Permissions Policy Header Not Set [10063] total: 2:
- Strict-Transport-Security Header Not Set [10035] total: 10:
- Timestamp Disclosure - Unix [10096] total: 10:
- Base64 Disclosure [10094] total: 11:
- Information Disclosure - Suspicious Comments [10027] total: 2:
- Modern Web Application [10109] total: 3:
- Non-Storable Content [10049] total: 1:
- Re-examine Cache-control Directives [10015] total: 9:
- Sec-Fetch-Dest Header is Missing [90005] total: 3:
- Sec-Fetch-Mode Header is Missing [90005] total: 3:
- Sec-Fetch-Site Header is Missing [90005] total: 3:
- Sec-Fetch-User Header is Missing [90005] total: 3:
- Storable and Cacheable Content [10049] total: 1:
- Storable but Non-Cacheable Content [10049] total: 8:

View the following link to download the report. RunnerID:9627331002

PixeeSandbox / juice-shop-defectdojo

ZAP Scan Baseline Report #3