ZAP Scan Baseline Report - Githubissues

bcgov / moh-gis

Apache License 2.0

0 stars 0 forks source link

ZAP Scan Baseline Report #37

Open github-actions[bot] opened 10 hours ago

github-actions[bot] commented 10 hours ago

Site: https://hscis.hlth.gov.bc.ca New Alerts
- PII Disclosure [10062] total: 2:
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
- Absence of Anti-CSRF Tokens [10202] total: 2:
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
- CSP: Wildcard Directive [10055] total: 3:
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca/robots.txt
  - https://hscis.hlth.gov.bc.ca/sitemap.xml
- CSP: script-src unsafe-inline [10055] total: 4:
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca/robots.txt
  - https://hscis.hlth.gov.bc.ca/sitemap.xml
- CSP: style-src unsafe-inline [10055] total: 4:
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca/robots.txt
  - https://hscis.hlth.gov.bc.ca/sitemap.xml
- Multiple X-Frame-Options Header Entries [10020] total: 2:
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
- Cookie No HttpOnly Flag [10010] total: 7:
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca/home.xhtml
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/fonts.css.xhtml
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/layout.css.xhtml
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/normalize.css.xhtml
  - ..
- Cookie Without Secure Flag [10011] total: 7:
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca/home.xhtml
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/fonts.css.xhtml
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/headers.css.xhtml
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/layout.css.xhtml
  - ..
- Cookie with SameSite Attribute None [10054] total: 1:
  - https://hscis.hlth.gov.bc.ca
- Cookie without SameSite Attribute [10054] total: 7:
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/layout.css.xhtml
  - ..
- Dangerous JS Functions [10110] total: 2:
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/components.js.xhtml?e=12.0.0&ln=primefaces&v=12.0.0
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/core.js.xhtml?e=12.0.0&ln=primefaces&v=12.0.0
- Permissions Policy Header Not Set [10063] total: 8:
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/faces.js.xhtml?ln=jakarta.faces
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/jquery/jquery.js.xhtml?e=12.0.0&ln=primefaces&v=12.0.0
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/js/common.js.xhtml
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
  - ..
- Information Disclosure - Suspicious Comments [10027] total: 13:
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/components.js.xhtml?e=12.0.0&ln=primefaces&v=12.0.0
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/components.js.xhtml?e=12.0.0&ln=primefaces&v=12.0.0
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/components.js.xhtml?e=12.0.0&ln=primefaces&v=12.0.0
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/components.js.xhtml?e=12.0.0&ln=primefaces&v=12.0.0
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/core.js.xhtml?e=12.0.0&ln=primefaces&v=12.0.0
  - ..
- Modern Web Application [10109] total: 5:
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
  - https://hscis.hlth.gov.bc.ca/robots.txt
  - https://hscis.hlth.gov.bc.ca/sitemap.xml
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
- Non-Storable Content [10049] total: 3:
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca/home.xhtml
- Re-examine Cache-control Directives [10015] total: 3:
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
  - https://hscis.hlth.gov.bc.ca/sessionExpired.xhtml
- Session Management Response Identified [10112] total: 2:
  - https://hscis.hlth.gov.bc.ca
  - https://hscis.hlth.gov.bc.ca
- Storable and Cacheable Content [10049] total: 9:
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/fonts.css.xhtml
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/headers.css.xhtml
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/labels.css.xhtml
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/layout.css.xhtml
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/css/normalize.css.xhtml
  - ..
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 11:
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
  - https://hscis.hlth.gov.bc.ca/pageNotFound.xhtml
  - ..
- Vulnerable JS Library [10003] total: 1:
  - https://hscis.hlth.gov.bc.ca/jakarta.faces.resource/jquery/jquery.js.xhtml?e=12.0.0&ln=primefaces&v=12.0.0

View the following link to download the report. RunnerID:12073628033

github-actions[bot] commented 3 hours ago

Site: https://hamis.hlth.gov.bc.ca New Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 3:
- Permissions Policy Header Not Set [10063] total: 3:
- Non-Storable Content [10049] total: 3:

View the following link to download the report. RunnerID:12077149263