ZAP Scan Baseline Report - Githubissues

ramaciotti86 / github_pipeline

Test project to configure pipeline in Github

0 stars 0 forks source link

ZAP Scan Baseline Report #2

Open github-actions[bot] opened 3 years ago

github-actions[bot] commented 3 years ago

Site: https://sistema-cond-dev.busqueseguro.com.br New Alerts
- Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 8:
- Strict-Transport-Security Header Not Set [10035] total: 8:
- X-Frame-Options Header Not Set [10020] total: 2:
  - https://sistema-cond-dev.busqueseguro.com.br/
  - https://sistema-cond-dev.busqueseguro.com.br/sitemap.xml
- Incomplete or No Cache-control and Pragma HTTP Header Set [10015] total: 5:
- Modern Web Application [10109] total: 2:
  - https://sistema-cond-dev.busqueseguro.com.br/
  - https://sistema-cond-dev.busqueseguro.com.br/sitemap.xml
- X-Content-Type-Options Header Missing [10021] total: 8:
- Content Security Policy (CSP) Header Not Set [10038] total: 2:
  - https://sistema-cond-dev.busqueseguro.com.br/sitemap.xml
  - https://sistema-cond-dev.busqueseguro.com.br/
- Timestamp Disclosure - Unix [10096] total: 2:
  - https://sistema-cond-dev.busqueseguro.com.br/favicon.png
  - https://sistema-cond-dev.busqueseguro.com.br/static/css/main.62dd9735.chunk.css
- Information Disclosure - Suspicious Comments [10027] total: 1:
  - https://sistema-cond-dev.busqueseguro.com.br/static/js/main.fedc1224.chunk.js

View the following link to download the report. RunnerID:545218424

github-actions[bot] commented 3 years ago

Site: http://www.google.com
Site: https://www.google.com New Alerts
- PII Disclosure [10062] total: 4:
  - https://www.google.com/finance/quote/.INX:INDEXSP
  - https://www.google.com/finance/quote/.DJI:INDEXDJX
  - https://www.google.com/finance/quote/RUT:INDEXRUSSELL
  - https://www.google.com/finance/quote/VIX:INDEXCBOE
- Retrieved from Cache [10050] total: 8:
  - https://www.google.com/intl/en/about/products
  - https://www.google.com/favicon.ico
  - https://www.google.com/scholar
  - https://www.google.com/maps/_/ss/k=maps.m.SqjjlKkpOYg.L.F4.O/m=sc2,per,mo,lp,ti,ds,stx,bom,b/am=biAD/ct=zgms/d=1/rs=ACT90oEWoN0Zo9ejyycFmJwwRQG4ZDeqnw
  - https://www.google.com/maps/_/js/k=maps.m.en.v-MsFrDox58.es5.O/m=sc2,per,mo,lp,ti,ds,stx,bom,b/am=biAD/rt=j/d=1/rs=ACT90oH10K5L_HEqiZXwLy-ZHgRAOrDsdg
  - ..
- Strict-Transport-Security Header Not Set [10035] total: 12:
  - https://www.google.com/xml
  - https://www.google.com/m/finance
  - https://www.google.com/groups
  - https://www.google.com/default
  - https://www.google.com/search/static
  - ..
- Loosely Scoped Cookie [90033] total: 12:
  - https://www.google.com/?hl
  - https://www.google.com/?hl=*
  - https://www.google.com/search
  - https://www.google.com/index.html
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Information Disclosure - Suspicious Comments [10027] total: 12:
  - https://www.google.com/
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?pt1=true$
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/imgres
  - ..
- Cookie Without SameSite Attribute [10054] total: 9:
  - https://www.google.com/?hl
  - https://www.google.com/?hl
  - https://www.google.com/search
  - https://www.google.com/index.html
  - https://www.google.com/index.html
  - ..
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 11:
  - https://www.google.com/search?btnK=Google+Search&ei=VtofYIL8DYfI0PEPg4COiAo&iflsig=AINFCbYAAAAAYB_oZuNuPuKtRC0JrrqfC2fSkIu4yqnk&q=ZAP&source=hp
  - https://www.google.com/preferences?hl=en
  - https://www.google.com/imghp?hl=en&ogbl&tab=wi
  - https://www.google.com/search?btnK=Google+Search&ei=VtofYN7-KKLG0PEPxrawkAw&iflsig=AINFCbYAAAAAYB_oZuNuPuKtRC0JrrqfC2fSkIu4yqnk&q=ZAP&source=hp
  - https://www.google.com/search?btnK=Google+Search&ei=VtofYN7-KKLG0PEPxrawkAw&iflsig=AINFCbYAAAAAYB_oZuNuPuKtRC0JrrqfC2fSkIu4yqnk&q=ZAP&source=hp
  - ..
- Reverse Tabnabbing [10108] total: 12:
  - https://www.google.com/?hl
  - https://www.google.com/
  - https://www.google.com/preferences
  - https://www.google.com/?hl=*
  - https://www.google.com/m
  - ..
- Cross-Domain JavaScript Source File Inclusion [10017] total: 15:
  - https://www.google.com/imgres
  - https://www.google.com/calendar/about/
  - https://www.google.com/search/about/
  - https://www.google.com/finance
  - https://www.google.com/maps/reserve/partners
  - ..
- Timestamp Disclosure - Unix [10096] total: 14:
  - https://www.google.com/
  - https://www.google.com/
  - https://www.google.com/
  - https://www.google.com/
  - https://www.google.com/
  - ..
- Content Security Policy (CSP) Header Not Set [10038] total: 11:
  - https://www.google.com/index.html
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - https://www.google.com/u/
  - https://www.google.com/?hl
  - https://www.google.com/?hl=*
  - ..
- Cookie No HttpOnly Flag [10010] total: 11:
  - https://www.google.com/search
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?pt1=true$
  - ..
- X-Content-Type-Options Header Missing [10021] total: 11:
  - https://www.google.com/?pt1=true$
  - https://www.google.com/preferences
  - https://www.google.com/wml
  - https://www.google.com/?hl
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 12:
  - https://www.google.com/books?*buy
  - https://www.google.com/books?*output
  - https://www.google.com/books?*jtp
  - https://www.google.com/books?*zoom
  - https://www.google.com/books?*q=editions:
  - ..
- Modern Web Application [10109] total: 12:
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/index.html
  - https://www.google.com/m
  - https://www.google.com/?hl
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Absence of Anti-CSRF Tokens [10202] total: 12:
  - https://www.google.com/wml
  - https://www.google.com/?hl
  - https://www.google.com/m
  - https://www.google.com/
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- CSP: Wildcard Directive [10055] total: 10:
  - https://www.google.com/calendar/
  - https://www.google.com/s2/search/social
  - https://www.google.com/gwt/
  - https://www.google.com/s2/profiles/me
  - https://www.google.com/imgres
  - ..
- X-Frame-Options Header Not Set [10020] total: 12:
  - https://www.google.com/calendar/about/
  - https://www.google.com/intl/en/policies/privacy/
  - https://www.google.com/url?q=http://www.google.com/intl/en/policies/privacy/&sa=D&usg=AFQjCNErF9JLA7vFeb656m_wkdx1SemOhw&ust=1481323482380000
  - https://www.google.com/intl/en/policies/terms/
  - https://www.google.com/url?q=http://www.google.com/accounts/TOS&sa=D&usg=AFQjCNE4HvURZtmhaQ-l8RiR9s0wJlTkaw&ust=1481323482379000
  - ..
- Open Redirect [10028] total: 12:
  - https://www.google.com/url?ct=3&id=19022662&q=https://www.youtube.com/watch%3Fv%3DvcsSc2iksC0&sa=X&source=hpp&usg=AFQjCNGBoOOHbmnDe18N52JuMZjL65hXTw&ved=0ahUKEwjP547L4NfuAhX1GDQIHclaDCcQ8IcBCBA
  - https://www.google.com/url?ct=3&id=19022662&q=https://www.youtube.com/watch%3Fv%3DvcsSc2iksC0&sa=X&source=hpp&usg=AFQjCNGBoOOHbmnDe18N52JuMZjL65hXTw&ved=0ahUKEwiv79_K4NfuAhVFHzQIHR8VBP8Q8IcBCBA
  - https://www.google.com/url?ct=3&id=19022662&q=https://www.youtube.com/watch%3Fv%3DvcsSc2iksC0&sa=X&source=hpp&usg=AFQjCNGBoOOHbmnDe18N52JuMZjL65hXTw&ved=0ahUKEwi5wJDL4NfuAhUlJzQIHRbpBLkQ8IcBCBA
  - https://www.google.com/url?ct=3&id=19022662&q=https://www.youtube.com/watch%3Fv%3DvcsSc2iksC0&sa=X&source=hpp&usg=AFQjCNGBoOOHbmnDe18N52JuMZjL65hXTw&ved=0ahUKEwi-5_HK4NfuAhVYIjQIHSd4AZwQ8IcBCBA
  - https://www.google.com/url?ct=3&id=19022662&q=https://www.youtube.com/watch%3Fv%3DvcsSc2iksC0&sa=X&source=hpp&usg=AFQjCNGBoOOHbmnDe18N52JuMZjL65hXTw&ved=0ahUKEwi2h9XK4NfuAhVRMH0KHRVGDFkQ8IcBCBA
  - ..
- Incomplete or No Cache-control and Pragma HTTP Header Set [10015] total: 11:
  - https://www.google.com/imgres
  - https://www.google.com/?hl
  - https://www.google.com/?pt1=true$
  - https://www.google.com/index.html
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Cross-Domain Misconfiguration [10098] total: 3:
  - https://www.google.com/maps/_/js/k=maps.m.en.v-MsFrDox58.es5.O/m=sc2,per,mo,lp,ti,ds,stx,bom,b/am=biAD/rt=j/d=1/rs=ACT90oH10K5L_HEqiZXwLy-ZHgRAOrDsdg
  - https://www.google.com/maps/api/staticmap
  - https://www.google.com/maps/_/ss/k=maps.m.SqjjlKkpOYg.L.F4.O/m=sc2,per,mo,lp,ti,ds,stx,bom,b/am=biAD/ct=zgms/d=1/rs=ACT90oEWoN0Zo9ejyycFmJwwRQG4ZDeqnw
- WSDL File Detection [90030] total: 1:
  - https://www.google.com/sitemap.xml
- Cookie Without Secure Flag [10011] total: 2:
  - https://www.google.com/search
  - https://www.google.com/
- Charset Mismatch (Header Versus Meta Content-Type Charset) [90011] total: 1:
  - https://www.google.com/
- Information Disclosure - Sensitive Information in URL [10024] total: 1:
  - https://www.google.com/citations?user
- Secure Pages Include Mixed Content [10040] total: 3:
  - https://www.google.com/search?q=zap+meaning&sa=X&ved=2ahUKEwjdvefN4NfuAhUUOn0KHaNrDjYQ1QIoAHoECBIQAQ
  - https://www.google.com/search?q=zap+meaning&sa=X&ved=2ahUKEwjAz5jP4NfuAhV9FTQIHT4zBdkQ1QIoAHoECBIQAQ
  - https://www.google.com/search?q=zap+meaning&sa=X&ved=2ahUKEwiMx6rP4NfuAhWmJTQIHQuXDqMQ1QIoAHoECBIQAQ
- CSP: Notices [10055] total: 2:
  - https://www.google.com/gwt/
  - https://www.google.com/imgres

View the following link to download the report. RunnerID:545261100