ZAP Full Scan Report - Githubissues

aknot242 / devsecops-poc

3 stars 4 forks source link

ZAP Full Scan Report #4

Closed github-actions[bot] closed 3 years ago

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc.westus2.azurecontainer.io New Alerts
- User Agent Fuzzer [10104] total: 20:
- Anti-CSRF Tokens Check [20012] total: 3:
- Information Disclosure - Suspicious Comments [10027] total: 2:
  - http://edgar-devsecopspoc.westus2.azurecontainer.io/lib/jquery/dist/jquery.min.js
  - http://edgar-devsecopspoc.westus2.azurecontainer.io/lib/bootstrap/dist/js/bootstrap.bundle.min.js
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 1:
  - http://edgar-devsecopspoc.westus2.azurecontainer.io/?SearchString=ZAP
- Absence of Anti-CSRF Tokens [10202] total: 2:
  - http://edgar-devsecopspoc.westus2.azurecontainer.io/
  - http://edgar-devsecopspoc.westus2.azurecontainer.io/?SearchString=ZAP
- Hidden File Found [40035] total: 1:
  - http://edgar-devsecopspoc.westus2.azurecontainer.io/.svn/entries
- Modern Web Application [10109] total: 1:
  - http://edgar-devsecopspoc.westus2.azurecontainer.io/lib/jquery/dist/jquery.min.js
  Ignored Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 3:
- Vulnerable JS Library [10003] total: 1:
- X-Content-Type-Options Header Missing [10021] total: 8:
- X-Frame-Options Header Not Set [10020] total: 3:

View the following link to download the report. RunnerID:969601653

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc.westus2.azurecontainer.io New Alerts
- Cross Site Scripting (Reflected) [40012] total: 1:
  - http://edgar-devsecopspoc.westus2.azurecontainer.io/?SearchString=%22%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E
  Resolved Alerts
- User Agent Fuzzer [10104] total: 20:
- Anti-CSRF Tokens Check [20012] total: 3:
- Hidden File Found [40035] total: 1:
  
  Ignored Alerts
- Absence of Anti-CSRF Tokens [10202] total: 2:

View the following link to download the report. RunnerID:969636130

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc.westus2.azurecontainer.io New Alerts
- User Agent Fuzzer [10104] total: 20:
- Hidden File Found [40035] total: 1:
  - http://edgar-devsecopspoc.westus2.azurecontainer.io/.svn/entries
  Resolved Alerts
- Cross Site Scripting (Reflected) [40012] total: 1:

View the following link to download the report. RunnerID:970054824

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc.westus2.azurecontainer.io New Alerts
- Proxy Disclosure [40025] total: 1:
  - http://edgar-devsecopspoc.westus2.azurecontainer.io/lib
  Resolved Alerts
- Hidden File Found [40035] total: 1:

View the following link to download the report. RunnerID:971754991

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc.westus2.azurecontainer.io Resolved Alerts
- Proxy Disclosure [40025] total: 1:

View the following link to download the report. RunnerID:971805088

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc-staging.westus2.azurecontainer.io New Alerts
- User Agent Fuzzer [10104] total: 20:
- Source Code Disclosure - File Inclusion [43] total: 1:
  - http://edgar-devsecopspoc-staging.westus2.azurecontainer.io/js/site.js?v=D4TFpxvZBRwxBiTkpn2L_q-zBuyBxK-Rvd7M1cA7jP4
- Information Disclosure - Suspicious Comments [10027] total: 2:
  - http://edgar-devsecopspoc-staging.westus2.azurecontainer.io/lib/bootstrap/dist/js/bootstrap.bundle.min.js
  - http://edgar-devsecopspoc-staging.westus2.azurecontainer.io/lib/jquery/dist/jquery.min.js
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 1:
  - http://edgar-devsecopspoc-staging.westus2.azurecontainer.io/?SearchString=ZAP
- Modern Web Application [10109] total: 1:
  - http://edgar-devsecopspoc-staging.westus2.azurecontainer.io/lib/jquery/dist/jquery.min.js
  Ignored Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 3:
- X-Frame-Options Header Not Set [10020] total: 3:
- X-Content-Type-Options Header Missing [10021] total: 8:
- Absence of Anti-CSRF Tokens [10202] total: 2:
- Vulnerable JS Library [10003] total: 1:

View the following link to download the report. RunnerID:1024055599

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc-staging.westus2.azurecontainer.io Resolved Alerts
- Source Code Disclosure - File Inclusion [43] total: 1:

View the following link to download the report. RunnerID:1024099543

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc-staging.westus2.azurecontainer.io Resolved Alerts
- User Agent Fuzzer [10104] total: 20:

View the following link to download the report. RunnerID:1024297585

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc-staging.westus2.azurecontainer.io New Alerts
- Cross Site Scripting (Reflected) [40012] total: 1:
  - http://edgar-devsecopspoc-staging.westus2.azurecontainer.io/?SearchString=%22%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E

View the following link to download the report. RunnerID:1024341449

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc-staging.westus2.azurecontainer.io Resolved Alerts
- Cross Site Scripting (Reflected) [40012] total: 1:

View the following link to download the report. RunnerID:1024862337