ZAP Scan Baseline Report - Githubissues

marcel-haag / security-c4po

Security-C4PO is an open-source web-application for managing and documenting penetration tests. This tool allows a security tester to keep track of the testing progress according to the OWASP Testing Guide. This application aims to make the offical Testing Guide more actionable to work with.

http://security.c4po.dev/

Apache License 2.0

4 stars 1 forks source link

ZAP Scan Baseline Report #211

Open github-actions[bot] opened 11 months ago

github-actions[bot] commented 11 months ago

Site: https://security.c4po.dev New Alerts
- CSP: Wildcard Directive [10055] total: 2:
  - https://security.c4po.dev/sitemap.xml
  - https://security.c4po.dev/sitemap.xml
- CSP: style-src unsafe-inline [10055] total: 1:
  - https://security.c4po.dev/sitemap.xml
- Content Security Policy (CSP) Header Not Set [10038] total: 2:
  - https://security.c4po.dev
  - https://security.c4po.dev/
- Cross-Domain Misconfiguration [10098] total: 11:
  - https://security.c4po.dev
  - https://security.c4po.dev/
  - https://security.c4po.dev/assets/BugBountyPlatforms/owasp.png
  - https://security.c4po.dev/assets/C4PO/favicon_corporateDX.ico
  - https://security.c4po.dev/assets/C4PO/faviconDX.ico
  - ..
- Missing Anti-clickjacking Header [10020] total: 2:
  - https://security.c4po.dev
  - https://security.c4po.dev/
- Source Code Disclosure - PHP [10099] total: 1:
  - https://security.c4po.dev/assets/C4PO/Report/juice-shop-penetration-testing-report-c4po.pdf
- Permissions Policy Header Not Set [10063] total: 4:
  - https://security.c4po.dev
  - https://security.c4po.dev/
  - https://security.c4po.dev/assets/js/lazyload/17.8.3/lazyload.min.js
  - https://security.c4po.dev/sitemap.xml
- Strict-Transport-Security Header Not Set [10035] total: 11:
  - https://security.c4po.dev
  - https://security.c4po.dev/assets/BugBountyPlatforms/hackerone.png
  - https://security.c4po.dev/assets/BugBountyPlatforms/owasp.png
  - https://security.c4po.dev/assets/C4PO/favicon_corporateDX.ico
  - https://security.c4po.dev/assets/C4PO/faviconDX.ico
  - ..
- X-Content-Type-Options Header Missing [10021] total: 11:
  - https://security.c4po.dev
  - https://security.c4po.dev/assets/BugBountyPlatforms/hackerone.png
  - https://security.c4po.dev/assets/BugBountyPlatforms/openbugbounty.png
  - https://security.c4po.dev/assets/BugBountyPlatforms/owasp.png
  - https://security.c4po.dev/assets/C4PO/favicon_corporateDX.ico
  - ..
- Base64 Disclosure [10094] total: 3:
  - https://security.c4po.dev
  - https://security.c4po.dev/
  - https://security.c4po.dev/sitemap.xml
- CSP: Header & Meta [10055] total: 1:
  - https://security.c4po.dev/sitemap.xml
- Information Disclosure - Suspicious Comments [10027] total: 2:
  - https://security.c4po.dev
  - https://security.c4po.dev/
- Modern Web Application [10109] total: 2:
  - https://security.c4po.dev
  - https://security.c4po.dev/
- Re-examine Cache-control Directives [10015] total: 4:
  - https://security.c4po.dev
  - https://security.c4po.dev/
  - https://security.c4po.dev/robots.txt
  - https://security.c4po.dev/site.webmanifest
- Retrieved from Cache [10050] total: 11:
  - https://security.c4po.dev
  - https://security.c4po.dev/assets/BugBountyPlatforms/hackerone.png
  - https://security.c4po.dev/assets/BugBountyPlatforms/owasp.png
  - https://security.c4po.dev/assets/C4PO/favicon_corporateDX.ico
  - https://security.c4po.dev/assets/C4PO/faviconDX.ico
  - ..
- Sec-Fetch-Dest Header is Missing [90005] total: 2:
  - https://security.c4po.dev
  - https://security.c4po.dev/robots.txt
- Sec-Fetch-Mode Header is Missing [90005] total: 2:
  - https://security.c4po.dev
  - https://security.c4po.dev/robots.txt
- Sec-Fetch-Site Header is Missing [90005] total: 2:
  - https://security.c4po.dev
  - https://security.c4po.dev/robots.txt
- Sec-Fetch-User Header is Missing [90005] total: 2:
  - https://security.c4po.dev
  - https://security.c4po.dev/robots.txt
- Storable and Cacheable Content [10049] total: 11:
  - https://security.c4po.dev
  - https://security.c4po.dev/assets/BugBountyPlatforms/hackerone.png
  - https://security.c4po.dev/assets/BugBountyPlatforms/owasp.png
  - https://security.c4po.dev/assets/C4PO/favicon_corporateDX.ico
  - https://security.c4po.dev/assets/C4PO/faviconDX.ico
  - ..

View the following link to download the report. RunnerID:7160100420