ZAP API Scan Report - Githubissues

github-actions[bot] commented 2 years ago

Site: https://aus5.mozilla.org New Alerts
- Unexpected Content-Type was returned [100001] total: 1:
  - https://aus5.mozilla.org/update/3/SystemAddons/99.0/20220330194208/Linux_x86_64-gcc3/null/release-cck-ubuntu/Linux%205.13.0-44-generic%20(GTK%203.24.20%2Clibpulse%20not-available)/canonical/1.0/update.xml
Site: https://firefox-settings-attachments.cdn.mozilla.net New Alerts
- Unexpected Content-Type was returned [100001] total: 1381:
Site: https://raw.githubusercontent.com New Alerts
- Unexpected Content-Type was returned [100001] total: 3:
Site: https://avatars.githubusercontent.com New Alerts
- Unexpected Content-Type was returned [100001] total: 12:
Site: https://camo.githubusercontent.com New Alerts
- Unexpected Content-Type was returned [100001] total: 31:
- A Client Error response code was returned by the server [100000] total: 2:
  - https://camo.githubusercontent.com/05a23ec5fcad99b5d77623403831282b1f208b4cc626f5d745706143f0c8f9f8/68747470733a2f2f696d616765732e6d6963726f6261646765722e636f6d2f6261646765732f76657273696f6e2f626b696d6d696e6963682f6a756963652d73686f702e737667
  - https://camo.githubusercontent.com/67ffe65708e7bf822c5edcc730bed79cfc61cbb8a036d361f140648626df950a/68747470733a2f2f696d616765732e6d6963726f6261646765722e636f6d2f6261646765732f696d6167652f626b696d6d696e6963682f6a756963652d73686f702e737667
Site: https://github.githubassets.com New Alerts
- Unexpected Content-Type was returned [100001] total: 43:
Site: https://github.com New Alerts
- Unexpected Content-Type was returned [100001] total: 2:
  - https://github.com/bkimminich/juice-shop
  - https://github.com/juice-shop/juice-shop
Site: https://content-signature-2.cdn.mozilla.net New Alerts
- Unexpected Content-Type was returned [100001] total: 4:
Site: https://fonts.googleapis.com New Alerts
- Unexpected Content-Type was returned [100001] total: 1:
  - https://fonts.googleapis.com/icon?family=Material+Icons
Site: http://cdnjs.cloudflare.com New Alerts
- Unexpected Content-Type was returned [100001] total: 3:
Site: http://cdnjs.cloudflare.com New Alerts
- Unexpected Content-Type was returned [100001] total: 3:
Site: http://owasp-juice-shop-228.herokuapp.com New Alerts
- Sub Resource Integrity Attribute Missing [90003] total: 1:
  - http://owasp-juice-shop-228.herokuapp.com
- Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 1:
  - http://owasp-juice-shop-228.herokuapp.com
- Unexpected Content-Type was returned [100001] total: 295:
  Ignored Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 1:
- Cross-Domain Misconfiguration [10098] total: 1:
- Cross-Domain JavaScript Source File Inclusion [10017] total: 2:
- Permissions Policy Header Not Set [10063] total: 1:
- Modern Web Application [10109] total: 1:
- Storable but Non-Cacheable Content [10049] total: 1:

View the following link to download the report. RunnerID:2429304621

github-actions[bot] commented 2 years ago

Site: http://owasp-juice-shop-228.herokuapp.com Ignored Alerts
- Sub Resource Integrity Attribute Missing [90003] total: 1:
- Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 1:

View the following link to download the report. RunnerID:2434902127

github-actions[bot] commented 2 years ago

Site: http://82.151.108.69 New Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 6:
- Sub Resource Integrity Attribute Missing [90003] total: 6:
- A Server Error response code was returned by the server [100000] total: 2:
  - http://82.151.108.69/api/PostPenalty/PostPenalty?LicensePlatePhoto=test_file.txt&appVersion=appVersion
  - http://82.151.108.69/api/PostPhotos?appVersion=appVersion
- Permissions Policy Header Not Set [10063] total: 6:
- Timestamp Disclosure - Unix [10096] total: 1:
  - http://82.151.108.69/api/InitialInfo/Version
- Unexpected Content-Type was returned [100001] total: 684:
- X-Content-Type-Options Header Missing [10021] total: 7:
- A Client Error response code was returned by the server [100000] total: 1186:
- Base64 Disclosure [10094] total: 6:
- Information Disclosure - Sensitive Information in URL [10024] total: 6:
- Non-Storable Content [10049] total: 7:
- Storable and Cacheable Content [10049] total: 1:
  - http://82.151.108.69/swagger/v1/swagger.json
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 6:

View the following link to download the report. RunnerID:2452998028

github-actions[bot] commented 2 years ago

Site: http://82.151.108.69 Ignored Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 6:
- Sub Resource Integrity Attribute Missing [90003] total: 6:
- Permissions Policy Header Not Set [10063] total: 6:
- Timestamp Disclosure - Unix [10096] total: 1:
- X-Content-Type-Options Header Missing [10021] total: 7:
- Base64 Disclosure [10094] total: 6:
- Information Disclosure - Sensitive Information in URL [10024] total: 6:
- Non-Storable Content [10049] total: 7:
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 6:

View the following link to download the report. RunnerID:2453727781

hitchhaker / juice-shop

ZAP API Scan Report #25