ZAP Scan Baseline Report - Githubissues

sr-pakwai / zap-pipeline-test

Spike on OWASP Zap using Github Action to test on server to develop DevSecOps pipeline

0 stars 0 forks source link

ZAP Scan Baseline Report #5

Open github-actions[bot] opened 1 year ago

github-actions[bot] commented 1 year ago

Site: https://www.google.com New Alerts
- PII Disclosure [10062] total: 1:
  - https://www.google.com/local/dealership/6532168995117065061/cars/2GNAXKEV3N6138234?sa=X&ved=2ahUKEwjp7umOwdX8AhUI2cgKHda6Aq0Qir0HegQIABAg
- Absence of Anti-CSRF Tokens [10202] total: 11:
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- CSP: Wildcard Directive [10055] total: 3:
  - https://www.google.com/m/
  - https://www.google.com/preferences
  - https://www.google.com/search
- CSP: script-src unsafe-eval [10055] total: 3:
  - https://www.google.com/m/
  - https://www.google.com/preferences
  - https://www.google.com/search
- CSP: style-src unsafe-inline [10055] total: 3:
  - https://www.google.com/m/
  - https://www.google.com/preferences
  - https://www.google.com/search
- Content Security Policy (CSP) Header Not Set [10038] total: 11:
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Cross-Domain Misconfiguration [10098] total: 3:
  - https://www.google.com/maps/_/js/k=maps.m.en.VQfsK7SSQUI.2019.O/m=sc2,per,mo,lp,ti,ds,stx,bom,b/am=G5AjIA/rt=j/d=1/rs=ACT90oGEWfKLEnZJnihkFDN_HjS7nMwuNw
  - https://www.google.com/maps/_/ss/k=maps.m.rwF4kGy8Mj8.L.F4.O/m=sc2,per,mo,lp,ti,ds,stx,bom,b/am=G5AjIA/d=1/rs=ACT90oEU5bK9_Y3eld-Ve23Kw5bJnnEERw
  - https://www.google.com/maps/api/staticmap
- Missing Anti-clickjacking Header [10020] total: 12:
  - https://www.google.com/chrome/
  - https://www.google.com/landing/signout.html
  - https://www.google.com/movies/about/
  - https://www.google.com/policies/privacy/
  - https://www.google.com/policies/terms/
  - ..
- Reverse Tabnabbing [10108] total: 12:
  - https://www.google.com/local/dealership/18437863374783135957/cars/1FM5K8D8XJGC40398?sa=X&ved=2ahUKEwjp7umOwdX8AhUI2cgKHda6Aq0Qir0HegQIABAa
  - https://www.google.com/local/dealership/18437863374783135957/cars/1FT7W2BN4NEG31071?sa=X&ved=2ahUKEwjp7umOwdX8AhUI2cgKHda6Aq0Qir0HegQIABAS
  - https://www.google.com/local/dealership/18437863374783135957/cars/1FTEW1EP2NKE70056?sa=X&ved=2ahUKEwjp7umOwdX8AhUI2cgKHda6Aq0Qir0HegQIABAZ
  - https://www.google.com/local/dealership/6532168995117065061/cars/1C4RJEAG8LC338925?sa=X&ved=2ahUKEwjp7umOwdX8AhUI2cgKHda6Aq0Qir0HegQIABAW
  - https://www.google.com/local/dealership/6532168995117065061/cars/2FMGK5D86KBA32373?sa=X&ved=2ahUKEwjp7umOwdX8AhUI2cgKHda6Aq0Qir0HegQIABAQ
  - ..
- Sub Resource Integrity Attribute Missing [90003] total: 24:
  - https://www.google.com/history/optout?fg=1&hl=en
  - https://www.google.com/imgres
  - https://www.google.com/maps/reserve
  - https://www.google.com/maps/reserve
  - https://www.google.com/maps/reserve
  - ..
- Application Error Disclosure [90022] total: 1:
  - https://www.google.com/fbx
- CSP: Notices [10055] total: 3:
  - https://www.google.com/m/
  - https://www.google.com/preferences
  - https://www.google.com/search
- Cookie No HttpOnly Flag [10010] total: 11:
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Cookie with SameSite Attribute None [10054] total: 10:
  - https://www.google.com
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Cross-Domain JavaScript Source File Inclusion [10017] total: 14:
  - https://www.google.com/history/optout?fg=1&hl=en
  - https://www.google.com/imgres
  - https://www.google.com/local/cars
  - https://www.google.com/maps/reserve
  - https://www.google.com/maps/reserve
  - ..
- Dangerous JS Functions [10110] total: 11:
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Permissions Policy Header Not Set [10063] total: 11:
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Secure Pages Include Mixed Content [10040] total: 1:
  - https://www.google.com/search?q=Zap+word&sa=X&ved=2ahUKEwjzw6iPwdX8AhWbFFkFHco-AQwQ1QJ6BAhPEAE
- Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 12:
  - https://www.google.com/bkshp?*q
  - https://www.google.com/books/about
  - https://www.google.com/books?*buy
  - https://www.google.com/books?*jscmd
  - https://www.google.com/books?*jtp
  - ..
- Strict-Transport-Security Header Not Set [10035] total: 12:
  - https://www.google.com/default
  - https://www.google.com/groups
  - https://www.google.com/imgres
  - https://www.google.com/imode/
  - https://www.google.com/m/finance
  - ..
- Timestamp Disclosure - Unix [10096] total: 14:
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?hl=*
  - https://www.google.com/imghp?hl=en&ogbl
  - https://www.google.com/imgres
  - https://www.google.com/maps/api/js
  - ..
- X-Content-Type-Options Header Missing [10021] total: 11:
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Information Disclosure - Sensitive Information in URL [10024] total: 1:
  - https://www.google.com/citations?user
- Information Disclosure - Suspicious Comments [10027] total: 15:
  - https://www.google.com
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - ..
- Loosely Scoped Cookie [90033] total: 12:
  - https://www.google.com
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - ..
- Modern Web Application [10109] total: 12:
  - https://www.google.com
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - ..
- Non-Storable Content [10049] total: 8:
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/groups
  - https://www.google.com/index.html
  - https://www.google.com/robots.txt
  - ..
- Re-examine Cache-control Directives [10015] total: 11:
  - https://www.google.com
  - https://www.google.com/
  - https://www.google.com/?&gws_rd=ssl&hl=
  - https://www.google.com/?gws_rd=ssl$
  - https://www.google.com/?gws_rd=ssl$&hl=*
  - ..
- Retrieved from Cache [10050] total: 2:
  - https://www.google.com/calendar/about/
  - https://www.google.com/favicon.ico
- Storable and Cacheable Content [10049] total: 3:
  - https://www.google.com/sdch
  - https://www.google.com/search/howsearchworks
  - https://www.google.com/search/static
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 10:
  - https://www.google.com/advanced_search?fg=1&hl=en
  - https://www.google.com/advanced_search?fg=1&hl=en
  - https://www.google.com/history/optout?fg=1&hl=en
  - https://www.google.com/history/optout?fg=1&hl=en
  - https://www.google.com/history/optout?fg=1&hl=en
  - ..

View the following link to download the report. RunnerID:3965264603

github-actions[bot] commented 1 year ago

Site: https://www.zaproxy.org New Alerts
- Timestamp Disclosure - Unix [10096] total: 1:
  - https://www.zaproxy.org/cdn-cgi/styles/cf.errors.css

View the following link to download the report. RunnerID:4320339382