ZAP Full Scan Report - Githubissues

aknot242 / devsecops-poc

3 stars 4 forks source link

ZAP Full Scan Report #5

Closed github-actions[bot] closed 3 years ago

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc-staging.westus2.azurecontainer.io New Alerts
- Information Disclosure - Suspicious Comments [10027] total: 2:
  - http://edgar-devsecopspoc-staging.westus2.azurecontainer.io/lib/bootstrap/dist/js/bootstrap.bundle.min.js
  - http://edgar-devsecopspoc-staging.westus2.azurecontainer.io/lib/jquery/dist/jquery.min.js
- Modern Web Application [10109] total: 1:
  - http://edgar-devsecopspoc-staging.westus2.azurecontainer.io/lib/jquery/dist/jquery.min.js
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 1:
  - http://edgar-devsecopspoc-staging.westus2.azurecontainer.io/?SearchString=ZAP
  Ignored Alerts
- X-Frame-Options Header Not Set [10020] total: 3:
- X-Content-Type-Options Header Missing [10021] total: 8:
- Content Security Policy (CSP) Header Not Set [10038] total: 3:
- Absence of Anti-CSRF Tokens [10202] total: 2:
- Vulnerable JS Library [10003] total: 1:

View the following link to download the report. RunnerID:1025093143

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc-staging.westus2.azurecontainer.io New Alerts
- CSP: Wildcard Directive [10055] total: 3:

View the following link to download the report. RunnerID:1025148331

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc-staging.westus2.azurecontainer.io Ignored Alerts
- CSP: script-src unsafe-inline [10055] total: 3:

View the following link to download the report. RunnerID:1025205524

github-actions[bot] commented 3 years ago

Site: http://edgar-devsecopspoc-staging.westus2.azurecontainer.io Resolved Alerts
- Modern Web Application [10109] total: 1:
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 1:

View the following link to download the report. RunnerID:1052787423

github-actions[bot] commented 3 years ago

Site: http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io New Alerts
- Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 10:
- User Agent Fuzzer [10104] total: 20:
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 1:
  - http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io/?SearchString=ZAP
- Information Disclosure - Suspicious Comments [10027] total: 2:
  - http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io/lib/jquery/dist/jquery.min.js
  - http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io/lib/bootstrap/dist/js/bootstrap.bundle.min.js
- Modern Web Application [10109] total: 1:
  - http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io/lib/jquery/dist/jquery.min.js
  Ignored Alerts
- CSP: script-src unsafe-inline [10055] total: 3:
- Absence of Anti-CSRF Tokens [10202] total: 2:
- Vulnerable JS Library [10003] total: 1:

View the following link to download the report. RunnerID:1059967988

github-actions[bot] commented 3 years ago

Site: http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io Ignored Alerts
- Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 10:

View the following link to download the report. RunnerID:1060034632

github-actions[bot] commented 3 years ago

Site: http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io New Alerts
- Cookie Slack Detector [90027] total: 16:
- Timestamp Disclosure - Unix [10096] total: 1:
  - http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io/lib/jquery-validation/dist/jquery.validate.min.js

View the following link to download the report. RunnerID:1068357634

github-actions[bot] commented 3 years ago

Site: http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io New Alerts
- Cross Site Scripting (Reflected) [40012] total: 1:
  - http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io/?SearchString=%22%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E

View the following link to download the report. RunnerID:1071328941

github-actions[bot] commented 3 years ago

Site: http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io New Alerts
- Proxy Disclosure [40025] total: 1:
  - http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io/lib/bootstrap
  Resolved Alerts
- Cross Site Scripting (Reflected) [40012] total: 1:

View the following link to download the report. RunnerID:1071364579

github-actions[bot] commented 3 years ago

Site: http://devsecops-poc-stage.28d5d6771fc84adba80b.westus2.aksapp.io Resolved Alerts
- Proxy Disclosure [40025] total: 1:

View the following link to download the report. RunnerID:1071394150