QA Certification Mgmt API ZAP Scan

[github-actions[bot]]

• Site: https://api.epa.gov New Alerts

  • Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec) [10035] total: 12:
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/export?facilityId=1.2&unitIds=unitIds&stackPipeIds=stackPipeIds&testSummaryIds=testSummaryIds&qaCertificationEventIds=qaCertificationEventIds&testTypeCodes=7DAY&qaTestExtensionExemptionIds=qaTestExtensionExemptionIds&beginDate=beginDate&endDate=endDate
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/id
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/testSumId/linearities
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/testSumId/linearities/id
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/testSumId/linearities/linSumId/injections
    • ..
  • A Client Error response code was returned by the server [100000] total: 192:
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/workspace/locations/locId/qa-certification-events/id
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/workspace/locations/locId/test-extension-exemptions/id
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/workspace/locations/locId/test-summary/id
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/workspace/locations/locId/test-summary/testSumId/air-emission-testings/id
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/workspace/locations/locId/test-summary/testSumId/appendix-e-correlation-test-summaries/appECorrTestSumId/appendix-e-correlation-test-runs/appECorrTestRunId/appendix-e-heat-input-from-gases/id
    • ..
  • Non-Storable Content [10049] total: 11:
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/export?facilityId=1.2&unitIds=unitIds&stackPipeIds=stackPipeIds&testSummaryIds=testSummaryIds&qaCertificationEventIds=qaCertificationEventIds&testTypeCodes=7DAY&qaTestExtensionExemptionIds=qaTestExtensionExemptionIds&beginDate=beginDate&endDate=endDate
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/id
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/testSumId/linearities
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/testSumId/linearities/id
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/testSumId/linearities/linSumId/injections
    • ..
  • Retrieved from Cache [10050] total: 12:
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/export?facilityId=1.2&unitIds=unitIds&stackPipeIds=stackPipeIds&testSummaryIds=testSummaryIds&qaCertificationEventIds=qaCertificationEventIds&testTypeCodes=7DAY&qaTestExtensionExemptionIds=qaTestExtensionExemptionIds&beginDate=beginDate&endDate=endDate
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/id
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/testSumId/linearities
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/testSumId/linearities/id
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary/testSumId/linearities/linSumId/injections
    • ..

• Site: https://api-easey-dev.app.cloud.gov New Alerts

  • Unexpected Content-Type was returned [100001] total: 4:
    • https://api-easey-dev.app.cloud.gov/winscp.ini
    • https://api-easey-dev.app.cloud.gov/WS_FTP.ini
    • https://api-easey-dev.app.cloud.gov?aaa=bbb
    • https://api-easey-dev.app.cloud.gov?class.module.classLoader.DefaultAssertionStatus=nonsense
  • A Client Error response code was returned by the server [100000] total: 67:
    • https://api-easey-dev.app.cloud.gov
    • https://api-easey-dev.app.cloud.gov/
    • https://api-easey-dev.app.cloud.gov/._darcs
    • https://api-easey-dev.app.cloud.gov/.bzr
    • https://api-easey-dev.app.cloud.gov/.DS_Store
    • ..
  • Non-Storable Content [10049] total: 1:
    • https://api-easey-dev.app.cloud.gov/qa-certification-mgmt/swagger-json

View the following link to download the report. RunnerID:5560918494

[github-actions[bot]]

• Site: https://api.epa.gov New Alerts

  • Sec-Fetch-Dest Header is Missing [90005] total: 2:
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/export?facilityId=1.2&unitIds=unitIds&stackPipeIds=stackPipeIds&testSummaryIds=testSummaryIds&qaCertificationEventIds=qaCertificationEventIds&testTypeCodes=7DAY&qaTestExtensionExemptionIds=qaTestExtensionExemptionIds&beginDate=beginDate&endDate=endDate&reportedValuesOnly=true
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary?testTypeCodes=7DAY&systemTypeCodes=CO2&beginDate=beginDate&endDate=endDate
  • Sec-Fetch-Mode Header is Missing [90005] total: 2:
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/export?facilityId=1.2&unitIds=unitIds&stackPipeIds=stackPipeIds&testSummaryIds=testSummaryIds&qaCertificationEventIds=qaCertificationEventIds&testTypeCodes=7DAY&qaTestExtensionExemptionIds=qaTestExtensionExemptionIds&beginDate=beginDate&endDate=endDate&reportedValuesOnly=true
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary?testTypeCodes=7DAY&systemTypeCodes=CO2&beginDate=beginDate&endDate=endDate
  • Sec-Fetch-Site Header is Missing [90005] total: 2:
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/export?facilityId=1.2&unitIds=unitIds&stackPipeIds=stackPipeIds&testSummaryIds=testSummaryIds&qaCertificationEventIds=qaCertificationEventIds&testTypeCodes=7DAY&qaTestExtensionExemptionIds=qaTestExtensionExemptionIds&beginDate=beginDate&endDate=endDate&reportedValuesOnly=true
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary?testTypeCodes=7DAY&systemTypeCodes=CO2&beginDate=beginDate&endDate=endDate
  • Sec-Fetch-User Header is Missing [90005] total: 2:
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/export?facilityId=1.2&unitIds=unitIds&stackPipeIds=stackPipeIds&testSummaryIds=testSummaryIds&qaCertificationEventIds=qaCertificationEventIds&testTypeCodes=7DAY&qaTestExtensionExemptionIds=qaTestExtensionExemptionIds&beginDate=beginDate&endDate=endDate&reportedValuesOnly=true
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/locations/locId/test-summary?testTypeCodes=7DAY&systemTypeCodes=CO2&beginDate=beginDate&endDate=endDate

• Site: https://api-easey-dev.app.cloud.gov New Alerts

  • Sec-Fetch-Dest Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/qa-certification-mgmt/swagger-json
  • Sec-Fetch-Mode Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/qa-certification-mgmt/swagger-json
  • Sec-Fetch-Site Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/qa-certification-mgmt/swagger-json
  • Sec-Fetch-User Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/qa-certification-mgmt/swagger-json

View the following link to download the report. RunnerID:5629322174

[github-actions[bot]]

• Site: https://api.epa.gov New Alerts

  • Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 1:
    • https://api.epa.gov/easey/dev/qa-certification-mgmt/file-upload

• Site: https://api-easey-dev.app.cloud.gov Resolved Alerts

  • Sec-Fetch-Dest Header is Missing [90005] total: 1:
  • Sec-Fetch-Mode Header is Missing [90005] total: 1:
  • Sec-Fetch-Site Header is Missing [90005] total: 1:
  • Sec-Fetch-User Header is Missing [90005] total: 1:

View the following link to download the report. RunnerID:5839914973

[github-actions[bot]]

• Site: https://api.epa.gov Resolved Alerts

  • Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 1:

• Site: https://api-easey-dev.app.cloud.gov New Alerts

  • Sec-Fetch-Dest Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/qa-certification-mgmt/swagger-json
  • Sec-Fetch-Mode Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/qa-certification-mgmt/swagger-json
  • Sec-Fetch-Site Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/qa-certification-mgmt/swagger-json
  • Sec-Fetch-User Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/qa-certification-mgmt/swagger-json

View the following link to download the report. RunnerID:5909990201