ZAP Scan Baseline Report - Githubissues

pavankalyanvarikolu / wwa

https://wwa-eight.vercel.app

0 stars 0 forks source link

ZAP Scan Baseline Report #10

Open github-actions[bot] opened 3 months ago

github-actions[bot] commented 3 months ago

Site: https://www.google.com New Alerts
- PII Disclosure [10062] total: 12:
  - https://www.google.com/forms/about/
  - https://www.google.com/intl/af/forms/about/
  - https://www.google.com/intl/ca/forms/about/
  - https://www.google.com/intl/cs/forms/about/
  - https://www.google.com/intl/da/forms/about/
  - ..
- Absence of Anti-CSRF Tokens [10202] total: 12:
  - https://www.google.com/
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- CSP: Wildcard Directive [10055] total: 3:
  - https://www.google.com/m/
  - https://www.google.com/search
  - https://www.google.com/setprefs
- CSP: script-src unsafe-eval [10055] total: 3:
  - https://www.google.com/m/
  - https://www.google.com/search
  - https://www.google.com/setprefs
- CSP: style-src unsafe-inline [10055] total: 3:
  - https://www.google.com/m/
  - https://www.google.com/search
  - https://www.google.com/setprefs
- Content Security Policy (CSP) Header Not Set [10038] total: 6:
  - https://www.google.com/
  - https://www.google.com/?hl
  - https://www.google.com/?hl=*
  - https://www.google.com/index.html
  - https://www.google.com/sdch
  - ..
- Cross-Domain Misconfiguration [10098] total: 1:
  - https://www.google.com/maps/api/staticmap
- Missing Anti-clickjacking Header [10020] total: 12:
  - https://www.google.com/intl/am/gmail/about/
  - https://www.google.com/intl/am/gmail/about/policy/
  - https://www.google.com/intl/ar/gmail/about/
  - https://www.google.com/intl/ar/gmail/about/policy/
  - https://www.google.com/intl/bg/gmail/about/
  - ..
- Source Code Disclosure - SQL [10099] total: 2:
  - https://www.google.com/intl/en_uk/business/articles/how-to-make-changes-to-your-business-profile/
  - https://www.google.com/nonprofits/resources/how-to-guide/be-productive-and-collaborative/
- Sub Resource Integrity Attribute Missing [90003] total: 23:
  - https://www.google.com/search/about/
  - https://www.google.com/search/about/
  - https://www.google.com/search/about/
  - https://www.google.com/search/about/
  - https://www.google.com/search/about/
  - ..
- CSP: Notices [10055] total: 3:
  - https://www.google.com/m/
  - https://www.google.com/search
  - https://www.google.com/setprefs
- Cookie No HttpOnly Flag [10010] total: 11:
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - https://www.google.com/?hl
  - ..
- Cookie with SameSite Attribute None [10054] total: 11:
  - https://www.google.com/
  - https://www.google.com/
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - https://www.google.com/?hl
  - ..
- Cross-Domain JavaScript Source File Inclusion [10017] total: 12:
  - https://www.google.com/about/careers/applications/
  - https://www.google.com/about/careers/applications/teams/
  - https://www.google.com/imgres
  - https://www.google.com/maps/reserve
  - https://www.google.com/maps/reserve
  - ..
- Dangerous JS Functions [10110] total: 11:
  - https://www.google.com/maps
  - https://www.google.com/maps/
  - https://www.google.com/maps/dir/
  - https://www.google.com/maps/search/
  - https://www.google.com/maps?*file
  - ..
- Full Path Disclosure [110009] total: 12:
  - https://www.google.com/ads/plan/action_plan
  - https://www.google.com/ads/plan/api/
  - https://www.google.com/ads/search
  - https://www.google.com/intl/ar_ae/admob/
  - https://www.google.com/intl/ar_ae/admob/analyze.html
  - ..
- Permissions Policy Header Not Set [10063] total: 12:
  - https://www.google.com/default
  - https://www.google.com/jsky
  - https://www.google.com/jsky/
  - https://www.google.com/jsky/search
  - https://www.google.com/m/finance
  - ..
- Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 12:
  - https://www.google.com/bkshp?*q
  - https://www.google.com/books/about
  - https://www.google.com/books?*buy
  - https://www.google.com/books?*jscmd
  - https://www.google.com/books?*jtp
  - ..
- Strict-Transport-Security Header Not Set [10035] total: 12:
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - https://www.google.com/?hl
  - https://www.google.com/?hl=*
  - ..
- Timestamp Disclosure - Unix [10096] total: 46:
  - https://www.google.com/
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - https://www.google.com/about/careers/applications/jobs/results/$
  - https://www.google.com/about/careers/applications/jobs/results/$
  - https://www.google.com/about/careers/applications/jobs/results/$
  - ..
- X-Content-Type-Options Header Missing [10021] total: 11:
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - https://www.google.com/?hl
  - ..
- Base64 Disclosure [10094] total: 11:
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - https://www.google.com/?hl
  - ..
- Content Security Policy (CSP) Report-Only Header Found [10038] total: 4:
  - https://www.google.com/
  - https://www.google.com/?hl
  - https://www.google.com/?hl=*
  - https://www.google.com/index.html
- Information Disclosure - Sensitive Information in URL [10024] total: 1:
  - https://www.google.com/citations?user
- Information Disclosure - Suspicious Comments [10027] total: 12:
  - https://www.google.com/
  - https://www.google.com/
  - https://www.google.com/
  - https://www.google.com/
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Loosely Scoped Cookie [90033] total: 12:
  - https://www.google.com/
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Modern Web Application [10109] total: 12:
  - https://www.google.com/about/careers/applications/teams/
  - https://www.google.com/imgres
  - https://www.google.com/maps
  - https://www.google.com/maps/
  - https://www.google.com/maps/dir/
  - ..
- Non-Storable Content [10049] total: 8:
  - https://www.google.com/
  - https://www.google.com/?hl=*
  - https://www.google.com/groups
  - https://www.google.com/index.html
  - https://www.google.com/robots.txt
  - ..
- Re-examine Cache-control Directives [10015] total: 11:
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - https://www.google.com/?hl
  - ..
- Retrieved from Cache [10050] total: 12:
  - https://www.google.com/alerts/
  - https://www.google.com/alerts/manage
  - https://www.google.com/books/
  - https://www.google.com/books/about
  - https://www.google.com/calendar/about/
  - ..
- Sec-Fetch-Dest Header is Missing [90005] total: 3:
  - https://www.google.com/robots.txt
  - https://www.google.com/search/about
  - https://www.google.com/sitemap.xml
- Sec-Fetch-Mode Header is Missing [90005] total: 3:
  - https://www.google.com/robots.txt
  - https://www.google.com/search/about
  - https://www.google.com/sitemap.xml
- Sec-Fetch-Site Header is Missing [90005] total: 3:
  - https://www.google.com/robots.txt
  - https://www.google.com/search/about
  - https://www.google.com/sitemap.xml
- Sec-Fetch-User Header is Missing [90005] total: 3:
  - https://www.google.com/robots.txt
  - https://www.google.com/search/about
  - https://www.google.com/sitemap.xml
- Session Management Response Identified [10112] total: 12:
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - https://www.google.com/?hl
  - ..
- Storable and Cacheable Content [10049] total: 3:
  - https://www.google.com/sdch
  - https://www.google.com/search/howsearchworks
  - https://www.google.com/search/static
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 11:
  - https://www.google.com/advanced_search?fg=1&hl=en
  - https://www.google.com/advanced_search?fg=1&hl=en
  - https://www.google.com/preferences?fg=1&hl=en
  - https://www.google.com/preferences?fg=1&hl=en
  - https://www.google.com/url?bl=79Y_&opi=89978449&rct=j&sa=t&source=webhp&url=https://about.google/%3Ffg%3D1%26utm_source%3Dgoogle-US%26utm_medium%3Dreferral%26utm_campaign%3Dhp-header&ved=0ahUKEwj17KXRuZeFAxUnLkQIHdBcCWsQkNQCCAI
  - ..

View the following link to download the report. RunnerID:8471000109

github-actions[bot] commented 3 months ago

Site: http://44.201.198.241:9090 New Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 2:
  - http://44.201.198.241:9090
  - http://44.201.198.241:9090/graph
- Missing Anti-clickjacking Header [10020] total: 2:
  - http://44.201.198.241:9090
  - http://44.201.198.241:9090/graph
- Dangerous JS Functions [10110] total: 1:
  - http://44.201.198.241:9090/static/js/main.7cb5d3cf.js
- Permissions Policy Header Not Set [10063] total: 3:
- X-Content-Type-Options Header Missing [10021] total: 6:
- Base64 Disclosure [10094] total: 2:
  - http://44.201.198.241:9090/static/css/main.132f8bd2.css
  - http://44.201.198.241:9090/static/js/main.7cb5d3cf.js
- Information Disclosure - Suspicious Comments [10027] total: 1:
  - http://44.201.198.241:9090/static/js/main.7cb5d3cf.js
- Modern Web Application [10109] total: 2:
  - http://44.201.198.241:9090
  - http://44.201.198.241:9090/graph
- Non-Storable Content [10049] total: 1:
  - http://44.201.198.241:9090
- Sec-Fetch-Dest Header is Missing [90005] total: 2:
  - http://44.201.198.241:9090
  - http://44.201.198.241:9090/robots.txt
- Sec-Fetch-Mode Header is Missing [90005] total: 2:
  - http://44.201.198.241:9090
  - http://44.201.198.241:9090/robots.txt
- Sec-Fetch-Site Header is Missing [90005] total: 2:
  - http://44.201.198.241:9090
  - http://44.201.198.241:9090/robots.txt
- Sec-Fetch-User Header is Missing [90005] total: 2:
  - http://44.201.198.241:9090
  - http://44.201.198.241:9090/robots.txt
- Storable and Cacheable Content [10049] total: 8:

View the following link to download the report. RunnerID:8473838619

github-actions[bot] commented 3 months ago

Site: http://3.83.42.138:3000 New Alerts
- CSP: Wildcard Directive [10055] total: 2:
  - http://3.83.42.138:3000/robots.txt
  - http://3.83.42.138:3000/sitemap.xml
- Content Security Policy (CSP) Header Not Set [10038] total: 1:
  - http://3.83.42.138:3000
- Cross-Domain Misconfiguration [10098] total: 5:
- Missing Anti-clickjacking Header [10020] total: 1:
  - http://3.83.42.138:3000
- Sub Resource Integrity Attribute Missing [90003] total: 1:
  - http://3.83.42.138:3000
- Permissions Policy Header Not Set [10063] total: 4:
- Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 5:
- Timestamp Disclosure - Unix [10096] total: 1:
  - http://3.83.42.138:3000/static/js/bundle.js
- X-Content-Type-Options Header Missing [10021] total: 3:
- Base64 Disclosure [10094] total: 2:
  - http://3.83.42.138:3000
  - http://3.83.42.138:3000/static/js/bundle.js
- Information Disclosure - Suspicious Comments [10027] total: 13:
- Modern Web Application [10109] total: 1:
  - http://3.83.42.138:3000
- Sec-Fetch-Dest Header is Missing [90005] total: 3:
- Sec-Fetch-Mode Header is Missing [90005] total: 3:
- Sec-Fetch-Site Header is Missing [90005] total: 3:
- Sec-Fetch-User Header is Missing [90005] total: 3:
- Storable and Cacheable Content [10049] total: 4:
- Storable but Non-Cacheable Content [10049] total: 1:
  - http://3.83.42.138:3000/favicon.ico

View the following link to download the report. RunnerID:8474046987