ZAP Scan Baseline Report - Githubissues

TroyWitthoeft / dast-test

0 stars 0 forks source link

ZAP Scan Baseline Report #16

Open github-actions[bot] opened 1 year ago

github-actions[bot] commented 1 year ago

Site: https://beta.glsauto.com New Alerts
- Absence of Anti-CSRF Tokens [10202] total: 2:
  - https://beta.glsauto.com/contact.html
  - https://beta.glsauto.com/contact.html?usertype=Dealer
- CSP: Wildcard Directive [10055] total: 3:
- CSP: script-src unsafe-inline [10055] total: 3:
- CSP: style-src unsafe-inline [10055] total: 3:
- Sub Resource Integrity Attribute Missing [90003] total: 8:
- Cross-Domain JavaScript Source File Inclusion [10017] total: 11:
- Permissions Policy Header Not Set [10063] total: 1:
  - https://beta.glsauto.com/api/contact-us
- Strict-Transport-Security Header Not Set [10035] total: 1:
  - https://beta.glsauto.com/api/contact-us
- Timestamp Disclosure - Unix [10096] total: 4:
- Content Security Policy (CSP) Report-Only Header Found [10038] total: 10:
- Information Disclosure - Sensitive Information in URL [10024] total: 1:
  - https://beta.glsauto.com/contact.html?usertype=Dealer
- Information Disclosure - Suspicious Comments [10027] total: 2:
  - https://beta.glsauto.com/contact.html
  - https://beta.glsauto.com/contact.html?usertype=Dealer
- Modern Web Application [10109] total: 1:
  - https://beta.glsauto.com/customers.html
- Re-examine Cache-control Directives [10015] total: 11:
- Storable and Cacheable Content [10049] total: 11:
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 5:

View the following link to download the report. RunnerID:4094862696

github-actions[bot] commented 1 year ago

Site: https://stg.fuel.glsauto.com New Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 2:
  - https://stg.fuel.glsauto.com/
  - https://stg.fuel.glsauto.com/sitemap.xml
- Missing Anti-clickjacking Header [10020] total: 2:
  - https://stg.fuel.glsauto.com/
  - https://stg.fuel.glsauto.com/sitemap.xml
- Permissions Policy Header Not Set [10063] total: 3:
- Information Disclosure - Suspicious Comments [10027] total: 1:
  - https://stg.fuel.glsauto.com/static/js/main.446ed2a5.js
- Modern Web Application [10109] total: 2:
  - https://stg.fuel.glsauto.com/
  - https://stg.fuel.glsauto.com/sitemap.xml
- Re-examine Cache-control Directives [10015] total: 4:
- Storable but Non-Cacheable Content [10049] total: 7:

View the following link to download the report. RunnerID:4154594158