ZAP API Scan Report

[github-actions[bot]]

• Site: https://einv.cleartax.in New Alerts

  • CSP: Meta Policy Invalid Directive [10055] total: 1:
    • https://einv.cleartax.in
  • CSP: Wildcard Directive [10055] total: 2:
    • https://einv.cleartax.in
    • https://einv.cleartax.in
  • CSP: script-src unsafe-eval [10055] total: 1:
    • https://einv.cleartax.in
  • CSP: script-src unsafe-inline [10055] total: 2:
    • https://einv.cleartax.in
    • https://einv.cleartax.in
  • CSP: style-src unsafe-inline [10055] total: 2:
    • https://einv.cleartax.in
    • https://einv.cleartax.in
  • Sub Resource Integrity Attribute Missing [90003] total: 12:
    • https://einv.cleartax.in
    • https://einv.cleartax.in
    • https://einv.cleartax.in
    • https://einv.cleartax.in
    • https://einv.cleartax.in
    • ..
  • CSP: Notices [10055] total: 2:
    • https://einv.cleartax.in
    • https://einv.cleartax.in
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 1:
    • https://einv.cleartax.in
  • Permissions Policy Header Not Set [10063] total: 1:
    • https://einv.cleartax.in
  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 1:
    • https://einv.cleartax.in
  • Unexpected Content-Type was returned [100001] total: 9:
    • https://einv.cleartax.in
    • https://einv.cleartax.in/
    • https://einv.cleartax.in/1108421448297354517
    • https://einv.cleartax.in/1786005525329691244
    • https://einv.cleartax.in/actuator/health
    • ..
  • A Client Error response code was returned by the server [100000] total: 3:
    • https://einv.cleartax.in/latest/meta-data/
    • https://einv.cleartax.in?aaa=bbb
    • https://einv.cleartax.in?class.module.classLoader.DefaultAssertionStatus=nonsense
  • Base64 Disclosure [10094] total: 1:
    • https://einv.cleartax.in
  • CSP: Header & Meta [10055] total: 1:
    • https://einv.cleartax.in
  • Information Disclosure - Suspicious Comments [10027] total: 1:
    • https://einv.cleartax.in
  • Modern Web Application [10109] total: 1:
    • https://einv.cleartax.in
  • Sec-Fetch-Dest Header is Missing [90005] total: 1:
    • https://einv.cleartax.in
  • Sec-Fetch-Mode Header is Missing [90005] total: 1:
    • https://einv.cleartax.in
  • Sec-Fetch-Site Header is Missing [90005] total: 1:
    • https://einv.cleartax.in
  • Sec-Fetch-User Header is Missing [90005] total: 1:
    • https://einv.cleartax.in
  • Storable but Non-Cacheable Content [10049] total: 1:
    • https://einv.cleartax.in

• Site: https://app.clear.in New Alerts

  • CSP: Meta Policy Invalid Directive [10055] total: 1:
    • https://app.clear.in/einvoicing/
  • CSP: Wildcard Directive [10055] total: 2:
    • https://app.clear.in/einvoicing/
    • https://app.clear.in/einvoicing/
  • CSP: script-src unsafe-eval [10055] total: 1:
    • https://app.clear.in/einvoicing/
  • CSP: script-src unsafe-inline [10055] total: 2:
    • https://app.clear.in/einvoicing/
    • https://app.clear.in/einvoicing/
  • CSP: style-src unsafe-inline [10055] total: 2:
    • https://app.clear.in/einvoicing/
    • https://app.clear.in/einvoicing/
  • Sub Resource Integrity Attribute Missing [90003] total: 12:
    • https://app.clear.in/einvoicing/
    • https://app.clear.in/einvoicing/
    • https://app.clear.in/einvoicing/
    • https://app.clear.in/einvoicing/
    • https://app.clear.in/einvoicing/
    • ..
  • CSP: Notices [10055] total: 2:
    • https://app.clear.in/einvoicing/
    • https://app.clear.in/einvoicing/
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 1:
    • https://app.clear.in/einvoicing/
  • Permissions Policy Header Not Set [10063] total: 1:
    • https://app.clear.in/einvoicing/
  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 1:
    • https://app.clear.in/einvoicing/
  • Unexpected Content-Type was returned [100001] total: 1:
    • https://app.clear.in/einvoicing/
  • Base64 Disclosure [10094] total: 1:
    • https://app.clear.in/einvoicing/
  • CSP: Header & Meta [10055] total: 1:
    • https://app.clear.in/einvoicing/
  • Information Disclosure - Suspicious Comments [10027] total: 1:
    • https://app.clear.in/einvoicing/
  • Modern Web Application [10109] total: 1:
    • https://app.clear.in/einvoicing/
  • Storable but Non-Cacheable Content [10049] total: 1:
    • https://app.clear.in/einvoicing/

• Site: http://app.clear.in New Alerts

  • CSP: Wildcard Directive [10055] total: 1:
    • http://app.clear.in/einvoicing/
  • CSP: script-src unsafe-inline [10055] total: 1:
    • http://app.clear.in/einvoicing/
  • CSP: style-src unsafe-inline [10055] total: 1:
    • http://app.clear.in/einvoicing/
  • CSP: Notices [10055] total: 1:
    • http://app.clear.in/einvoicing/
  • Unexpected Content-Type was returned [100001] total: 1:
    • http://app.clear.in/einvoicing/
  • Base64 Disclosure [10094] total: 1:
    • http://app.clear.in/einvoicing/
  • Sec-Fetch-Dest Header is Missing [90005] total: 1:
    • http://app.clear.in/einvoicing/
  • Sec-Fetch-Mode Header is Missing [90005] total: 1:
    • http://app.clear.in/einvoicing/
  • Sec-Fetch-Site Header is Missing [90005] total: 1:
    • http://app.clear.in/einvoicing/
  • Sec-Fetch-User Header is Missing [90005] total: 1:
    • http://app.clear.in/einvoicing/
  • Storable and Cacheable Content [10049] total: 1:
    • http://app.clear.in/einvoicing/

View the following link to download the report. RunnerID:7958699670