ZAP Scan Baseline Report

PixeeSandbox / juice-shop2

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

https://owasp-juice.shop

MIT License

0 stars 0 forks source link

ZAP Scan Baseline Report #2

Closed github-actions[bot] closed 3 weeks ago

github-actions[bot] commented 4 months ago

Site: https://cdnjs.cloudflare.com
Site: https://preview.owasp-juice.shop New Alerts
- Missing Anti-clickjacking Header [10020] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer-54&sid=JQNtZFDNfkP6a1yuAAPW
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer-JI&sid=pFirg4D2VX_063k_AAPY
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozer-wY&sid=YN7VDZrFM1G1nAjaAAPl
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=OzersGb&sid=JEScbRqSXETGTdu9AAOW
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=OzertBm&sid=_Fy91WhGlZlTBBbtAAOi
  - ..
- Session ID in URL Rewrite [3] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=OzersGd&sid=JEScbRqSXETGTdu9AAOW
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=OzertBo&sid=_Fy91WhGlZlTBBbtAAOi
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozeru8n&sid=MQK0yG1nH0etHbvIAAOt
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=OzervLS&sid=USEYRqhWBELhlJLFAAO2
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=websocket&sid=_Fy91WhGlZlTBBbtAAOi
  - ..
- Private IP Disclosure [2] total: 1:
  - https://preview.owasp-juice.shop/rest/admin/application-configuration
- X-Content-Type-Options Header Missing [10021] total: 12:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozers7-
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=OzersGd&sid=JEScbRqSXETGTdu9AAOW
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozert6E
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=Ozert_-
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=OzertBo&sid=_Fy91WhGlZlTBBbtAAOi
  - ..
  Ignored Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 8:
- Cross-Domain Misconfiguration [10098] total: 10:
- Cross-Domain JavaScript Source File Inclusion [10017] total: 6:
- Dangerous JS Functions [10110] total: 2:
- Deprecated Feature Policy Header Set [10063] total: 7:
- Permissions Policy Header Not Set [10063] total: 1:
- Strict-Transport-Security Header Not Set [10035] total: 11:
- Timestamp Disclosure - Unix [10096] total: 10:
- Base64 Disclosure [10094] total: 11:
- Information Disclosure - Suspicious Comments [10027] total: 2:
- Modern Web Application [10109] total: 3:
- Non-Storable Content [10049] total: 1:
- Re-examine Cache-control Directives [10015] total: 10:
- Sec-Fetch-Dest Header is Missing [90005] total: 3:
- Sec-Fetch-Mode Header is Missing [90005] total: 3:
- Sec-Fetch-Site Header is Missing [90005] total: 3:
- Sec-Fetch-User Header is Missing [90005] total: 3:
- Storable and Cacheable Content [10049] total: 1:
- Storable but Non-Cacheable Content [10049] total: 9:

View the following link to download the report. RunnerID:9045510104

github-actions[bot] commented 4 months ago

Site: https://cdnjs.cloudflare.com
Site: https://preview.owasp-juice.shop New Alerts
- Application Error Disclosure [90022] total: 1:
  - https://preview.owasp-juice.shop/socket.io/?EIO=4&transport=polling&t=O-Cv7eX&sid=E8PkI9IlVWx1dioiAAJt

View the following link to download the report. RunnerID:9141714833

github-actions[bot] commented 4 months ago

Site: https://cdnjs.cloudflare.com
Site: https://preview.owasp-juice.shop Resolved Alerts
- Application Error Disclosure [90022] total: 1:

View the following link to download the report. RunnerID:9237285093

github-actions[bot] commented 3 months ago