Updated Web App Scanning Plugins from Tenable https://www.tenable.com/plugins/feeds?sort=updated&type=was Get the latest plugin updates from Tenable Tue, 17 Mar 2026 09:38:48 GMT https://validator.w3.org/feed/docs/rss2.html Tenable Plugins Updated Web App Scanning Plugins from Tenable https://www.tenable.com/themes/custom/tenable/img/favicons/apple-touch-icon.png https://www.tenable.com/plugins/feeds?sort=updated&type=was Copyright 2026 Tenable, Inc. All rights reserved. <![CDATA[HTTP Request Smuggling]]> https://www.tenable.com/plugins/was/114223 https://www.tenable.com/plugins/was/114223 Tue, 10 Mar 2026 00:00:00 GMT Web App Scanning Plugin ID 114223 with High Severity

Synopsis

HTTP Request Smuggling

Description

Modern web applications are often deployed with a chain of HTTP servers which ensure the transmission of the HTTP traffic from users to the service. Typical deployments include the usage of a front-end server, usually a load balancer or a reverse proxy, which will then transmit the requests to one or more back-end servers.

HTTP request smuggling occurs when the front-end server and the back-end server show discrepancies in the way they process HTTP requests `content-length` and `transfer-encoding` headers. A remote and unauthenticated attacker can leverage this class of vulnerability to bypass access controls or gain access to sensitive data, or to compromise offer users traffic without interaction.

Solution

If possible, only use HTTP/2 protocol and ensure that HTTP downgrading is disabled. Ensure that the parsing of HTTP requests is consistent on the whole HTTP transmission chain and that all the intermediate software used are up-to-date.

Read more at https://www.tenable.com/plugins/was/114223

]]> <![CDATA[Kentico CMS 9.x < 10.0.52 / 11.0.x < 11.0.48 / 12.0.x < 12.0.15 Remote Code Execution]]> https://www.tenable.com/plugins/was/98997 https://www.tenable.com/plugins/was/98997 Thu, 05 Mar 2026 00:00:00 GMT Web App Scanning Plugin ID 98997 with Critical Severity

Synopsis

Kentico CMS 9.x < 10.0.52 / 11.0.x < 11.0.48 / 12.0.x < 12.0.15 Remote Code Execution

Description

Kentico CMS is a common ASP.NET Content Management System (CMS) used for building websites and online stores.

Kentico CMS versions 9 to 10.0.51, 11.0.0 to 11.0.47 and 12.0.0 to 12.0.14 perform unsafe .NET Objects deserialization through the /CMSPages/Staging/SyncServer.asmx/ProcessSynchronizationTaskData URI, allowing unauthenticated attackers to do remote code execution on the target application.

Solution

Upgrade at least to version 12.0.15 for versions 12.0.x, version 11.0.48 for versions 11.0.x and version 10.0.52 for versions 10.0.x and 9.x. An immediate workaround is to set X.509 authentication on the Staging service authentication, as described by the vendor.

Read more at https://www.tenable.com/plugins/was/98997

]]> <![CDATA[Kentico CMS < 9.0.51 Cross-Site Scripting]]> https://www.tenable.com/plugins/was/98996 https://www.tenable.com/plugins/was/98996 Thu, 05 Mar 2026 00:00:00 GMT Web App Scanning Plugin ID 98996 with Medium Severity

Synopsis

Kentico CMS < 9.0.51 Cross-Site Scripting

Description

Kentico CMS is a common ASP.NET Content Management System (CMS) used for building websites and online stores.

Kentico CMS versions before 9.0.51 allow remote attackers to inject arbitrary javascript or HTML content via the CMSBodyClass cookie variable.

Solution

Upgrade at least to patched version 9.0.51.

Read more at https://www.tenable.com/plugins/was/98996

]]> <![CDATA[Kentico CMS 8.2.x < 8.2.41 Open Redirect]]> https://www.tenable.com/plugins/was/98995 https://www.tenable.com/plugins/was/98995 Thu, 05 Mar 2026 00:00:00 GMT Web App Scanning Plugin ID 98995 with Medium Severity

Synopsis

Kentico CMS 8.2.x < 8.2.41 Open Redirect

Description

Kentico CMS is a common ASP.NET Content Management System (CMS) used for building websites and online stores.

Kentico CMS versions 8.2.x before 8.2.41 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter.

Solution

Upgrade at least to patched version 8.2.41.

Read more at https://www.tenable.com/plugins/was/98995

]]> <![CDATA[Kentico CMS < 9.0.51 / 10.x < 10.0.48 Access Control Bypass]]> https://www.tenable.com/plugins/was/98994 https://www.tenable.com/plugins/was/98994 Thu, 05 Mar 2026 00:00:00 GMT Web App Scanning Plugin ID 98994 with Critical Severity

Synopsis

Kentico CMS < 9.0.51 / 10.x < 10.0.48 Access Control Bypass

Description

Kentico CMS is a common ASP.NET Content Management System (CMS) used for building websites and online stores.

Kentico CMS versions before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to gain Global Administrator access by visiting CMSInstall/install.aspx and then browsing the CMS Administration Dashboard.

Solution

Upgrade to patched versions 9.0.51 or 10.0.48. An immediate fix is to restrict access to the /CMSInstall/install.aspx page in the web.config file.

Read more at https://www.tenable.com/plugins/was/98994

]]> <![CDATA[SQL Injection]]> https://www.tenable.com/plugins/was/98115 https://www.tenable.com/plugins/was/98115 Thu, 05 Mar 2026 00:00:00 GMT Web App Scanning Plugin ID 98115 with High Severity

Synopsis

SQL Injection

Description

Due to the requirement for dynamic content of today's web applications, many rely on a database backend to store data that will be called upon and processed by the web application (or other programs). Web applications retrieve data from the database by using Structured Query Language (SQL) queries.

To meet demands of many developers, database servers (such as MSSQL, MySQL, Oracle etc.) have additional built-in functionality that can allow extensive control of the database and interaction with the host operating system itself.

An SQL injection occurs when a value originating from the client's request is used within a SQL query without prior sanitisation. This could allow cyber-criminals to execute arbitrary SQL code and steal data or use the additional functionality of the database server to take control of more server components.

The successful exploitation of a SQL injection can be devastating to an organisation and is one of the most commonly exploited web application vulnerabilities.

This injection was detected as scanner was able to cause the server to respond to the request with a database related error.

Solution

The only proven method to prevent against SQL injection attacks while still maintaining full application functionality is to use parameterized queries (also known as prepared statements). When utilising this method of querying the database, any value supplied by the client will be handled as a string value rather than part of the SQL query.
Additionally, when utilising parameterized queries, the database engine will automatically check to make sure the string being used matches that of the column. For example, the database engine will check that the user supplied input is an integer if the database column is configured to contain integers.

Read more at https://www.tenable.com/plugins/was/98115

]]> <![CDATA[Third-Party Service Secret Disclosure]]> https://www.tenable.com/plugins/was/115062 https://www.tenable.com/plugins/was/115062 Thu, 05 Mar 2026 00:00:00 GMT Web App Scanning Plugin ID 115062 with High Severity

Synopsis

Third-Party Service Secret Disclosure

Description

Most of the web applications rely on various public services to provide features to their users. In secure designs, consuming these private or cloud services will require authentication like API and private keys, username and password based credentials and similar sensitive data.

Developers sometimes hard code such data in various places of their applications, without realizing that it could become publicly available in client-side JavaScript or, for example, HTML comments. By leveraging these sensitive information, a remote and unauthenticated attacker could gain access to an external AI service used by the web application and the organization.

Solution

Remove the secret exposure by identifying the root cause of the issue (for example manual data insertion in the code, environment variables being bundled in front-end JavaScript). Rotate the secrets to avoid further reuse in case it has been previously retrieved by a malicious actor.

Read more at https://www.tenable.com/plugins/was/115062

]]> <![CDATA[MCP Server Detected]]> https://www.tenable.com/plugins/was/114790 https://www.tenable.com/plugins/was/114790 Thu, 05 Mar 2026 00:00:00 GMT Web App Scanning Plugin ID 114790 with Info Severity

Synopsis

MCP Server Detected

Description

This is an informational notice that the scanner was able to detect a Model Context Protocol (MCP) HTTP server (using SSE or Streamable-HTTP transport mode) on the target server.

Solution

Read more at https://www.tenable.com/plugins/was/114790

]]> <![CDATA[Password Submitted Using GET Method]]> https://www.tenable.com/plugins/was/98146 https://www.tenable.com/plugins/was/98146 Tue, 17 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 98146 with Medium Severity

Synopsis

Password Submitted Using GET Method

Description

The scanner was able to detect that the application uses the HTTP GET method to transmit a password, the information of a URL can be stored in various places (web server, proxy, ...) and can be transmitted to a third party via the Referer header which also increases the chances of interception by an attacker.

Solution

For password submission and in general any form that transmits sensitive information, it is necessary to use the HTTP POST method.

Read more at https://www.tenable.com/plugins/was/98146

]]> <![CDATA[Ivanti Endpoint Manager Mobile < 12.8.0.0 Remote Code Execution]]> https://www.tenable.com/plugins/was/115128 https://www.tenable.com/plugins/was/115128 Tue, 17 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 115128 with Critical Severity

Synopsis

Ivanti Endpoint Manager Mobile < 12.8.0.0 Remote Code Execution

Description

Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.8.0.0 are affected by a vulnerability allowing an unauthenticated remote attacker to execute arbitrary code on the affected system through a specially crafted request.

Solution

Upgrade to Ivanti Endpoint Manager Mobile version 12.8.0.0 or later.

Read more at https://www.tenable.com/plugins/was/115128

]]> <![CDATA[Object-Relational Mapping (ORM) Leak]]> https://www.tenable.com/plugins/was/115010 https://www.tenable.com/plugins/was/115010 Tue, 17 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 115010 with High Severity

Synopsis

Object-Relational Mapping (ORM) Leak

Description

An Object-Relational Mapping (ORM) Leak vulnerability occurs when an application does not properly control how user-provided data is passed to the ORM. An attacker can exploit this by manipulating input parameters to query fields that are not intended to be exposed. This can lead to the disclosure of sensitive information from the database, such as user credentials, personal information, or other confidential data. In some cases, it could also allow an attacker to perform unauthorized data modification operations.

Solution

Ensure that user-controllable input is never directly used to construct ORM queries. Implement a strict whitelist of allowed fields and operators for filtering and searching. Validate and sanitize all input to prevent malicious query modifications.

Read more at https://www.tenable.com/plugins/was/115010

]]> <![CDATA[Web Application Firewall Detected]]> https://www.tenable.com/plugins/was/98008 https://www.tenable.com/plugins/was/98008 Wed, 11 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 98008 with Info Severity

Synopsis

Web Application Firewall Detected

Description

A Web Application Firewall (WAF) has been detected during the scan. A WAF is designed to help protecting web applications by monitoring and filtering HTTP(S) traffic through a set of rules in order to prevent the most common attacks.

The identified WAF may have blocked several requests during the vulnerability assessment or have declined access to some resources of the web application during the scan (blocked URLs have been provided in the plugin attachments).

It is recommended to scan the web application by ensuring that the traffic coming from the scanner is allowed by the WAF in order to get the most accurate coverage of the target application vulnerabilities. If needed, the Tenable WAS documentation defines the scanners IP ranges to be allowed in the WAF configuration.

Solution

Read more at https://www.tenable.com/plugins/was/98008

]]> <![CDATA[AI Service Secret Disclosure]]> https://www.tenable.com/plugins/was/115063 https://www.tenable.com/plugins/was/115063 Wed, 11 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 115063 with High Severity

Synopsis

AI Service Secret Disclosure

Description

Most of the web applications rely on various public services to provide features to their users. In secure designs, consuming these private or cloud services will require authentication like API and private keys, username and password based credentials and similar sensitive data.

Developers sometimes hard code such data in various places of their applications, without realizing that it could become publicly available in client-side JavaScript or, for example, HTML comments. By leveraging these sensitive information, a remote and unauthenticated attacker could gain access to an external AI service used by the web application and the organization.

Solution

Remove the secret exposure by identifying the root cause of the issue (for example manual data insertion in the code, environment variables being bundled in front-end JavaScript). Rotate the secrets to avoid further reuse in case it has been previously retrieved by a malicious actor.

Read more at https://www.tenable.com/plugins/was/115063

]]> <![CDATA[Mura/Masa CMS SQL Injection]]> https://www.tenable.com/plugins/was/114450 https://www.tenable.com/plugins/was/114450 Wed, 11 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 114450 with Critical Severity

Synopsis

Mura/Masa CMS SQL Injection

Description

Mura and Masa CMS (Open-source fork) suffer from a SQL injection vulnerability on the JSON API. By crafting a specific HTTP request, a remote and unauthenticated attacker can exploit the vulnerability to gain access to the database and perform arbitrary operations.

Solution

Upgrade Masa CMS to versions 7.2.8, 7.3.13, 7.4.6 or later. Upgrade Mura CMS to latest version and reach out vendor support to confirm vulnerability fix as there is currenty no public information available.

Read more at https://www.tenable.com/plugins/was/114450

]]> <![CDATA[Generic Secret Disclosure]]> https://www.tenable.com/plugins/was/114129 https://www.tenable.com/plugins/was/114129 Wed, 11 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 114129 with High Severity

Synopsis

Generic Secret Disclosure

Description

Most of the web applications rely on various public services to provide features to their users. In secure designs, consuming these private services will require authentication like API and private keys, username and password based credentials and similar sensitive data.

Developers sometimes hard code such data in various places of their applications, without realizing that it could become publicly available in client-side JavaScript or, for example, HTML comments. By leveraging these sensitive information, a remote and unauthenticated attacker could gain privileged access to critical services used by the web application and the organization or to conduct password spraying attacks.

Solution

Remove the secret exposure by identifying the root cause of the issue (for example manual data insertion in the code, environment variables being bundled in front-end JavaScript). Rotate the secrets to avoid further reuse in case it has been previously retrieved by a malicious actor.

Read more at https://www.tenable.com/plugins/was/114129

]]> <![CDATA[Package Dependencies Detected]]> https://www.tenable.com/plugins/was/113158 https://www.tenable.com/plugins/was/113158 Wed, 11 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 113158 with Medium Severity

Synopsis

Package Dependencies Detected

Description

Programming languages are often used along with package management tools designed to help developers manages the code dependencies when building their web applications (for example : Composer for PHP, NPM for NodeJS, PIP for Python...). These tools usually work by requesting public code repositories in order to fetch the dependencies and help installing and using specific versions in the project.

When package configuration files are exposed, an attacker could use it to infer the software components used in the target application and to try conduct further attacks.

Solution

Ensure that the package management tool files are not deployed with the application or, at least, is not exposed in a web server directory by setting proper permissions on it. Review the software components used in the application to ensure that they are expected and that they come from trusted distribution sources.

Read more at https://www.tenable.com/plugins/was/113158

]]> <![CDATA[JSON Web Token None Hashing Algorithm]]> https://www.tenable.com/plugins/was/112703 https://www.tenable.com/plugins/was/112703 Wed, 11 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 112703 with High Severity

Synopsis

JSON Web Token None Hashing Algorithm

Description

JSON Web Tokens can be signed to protect against data tampering. By using an asymmetric or a symmetric signing algorithm, the application computes a signature of the token data which will be verified during token decoding to ensure its integrity.

JSON Web Tokens can be configured by an application with the 'none' algorithm and an empty signature, leaving the data unsigned and mutable without any verification. In addition, some libraries used to handle JSON Web Tokens may also have a bad implementation of this algorithm, leading to the tokens set with the 'none' algorithm being verified even when they are originally created with a signature.

Depending on the token usage, attackers could leverage this vulnerability to forge valid tokens and impersonate other users, or gain further privileges.

Solution

Applications configured to create JSON Web Tokens with the 'none' algorithm should be updated to use a supported signing algorithm with a strong secret or private key. If an unsigned token has been verified by the application despite having been created with a signature, ensure that the library used to handle JSON Web Tokens does not automatically verify tokens with the 'none' algorithm.

Read more at https://www.tenable.com/plugins/was/112703

]]> <![CDATA[JSON Web Token Detected]]> https://www.tenable.com/plugins/was/112686 https://www.tenable.com/plugins/was/112686 Wed, 11 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 112686 with Info Severity

Synopsis

JSON Web Token Detected

Description

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a data structure for securely transmitting claims between parties as a JSON object. A JSON Web Token can be instantiated as a JSON Web Signature (JWS) or a JSON Web Encryption (JWE) depending on the application security considerations.

JSON Web Signature based tokens are the most commonly used in API implementations and are built with three base64 URL encoded parts separated by periods :

- JSON Object Signing and Encryption (JOSE) header : describes at least the algorithm used for signing or encryption (alg) and the type (typ) of the content being processed. For JSON Web Tokens, the type will usually be set to 'JWT'.

- Payload : JSON object containing the claims to share. Claims can be of three classes : registered (from the specification), public or private and their names must be unique inside the claims set.

- Signature : computed by using the specific algorithm in header and a secret or a private key. This ensures the integrity of the JSON Web Token.

The scanner detected the presence of a JSON Web Signature based token containing the information provided in the output.

Solution

Read more at https://www.tenable.com/plugins/was/112686

]]> <![CDATA[Publicly writable directory]]> https://www.tenable.com/plugins/was/98099 https://www.tenable.com/plugins/was/98099 Fri, 06 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 98099 with High Severity

Synopsis

Publicly writable directory

Description

There are various methods in which a file (or files) may be uploaded to a webserver. One method that can be used is the HTTP `PUT` method. The `PUT` method is mainly used during development of applications and allows developers to upload (or put) files on the server within the web root.

By nature of the design, the `PUT` method typically does not provide any filtering and therefore allows sever side executable code (PHP, ASP, etc) to be uploaded to the server.

Cyber-criminals will search for servers supporting the `PUT` method with the intention of modifying existing pages, or uploading web shells to take control of the server.

Scanner has discovered that the affected path allows clients to use the `PUT` method. During this test, scanner has `PUT` a file on the server within the web root and successfully performed a `GET` request to its location and verified the contents.

Solution

Where possible the HTTP `PUT` method should be globally disabled. This can typically be done with a simple configuration change on the server. The steps to disable the `PUT` method will differ depending on the type of server being used (IIS, Apache, etc.).
For cases where the `PUT` method is required to meet application functionality, such as REST style web services, strict limitations should be implemented to ensure that only secure (SSL/TLS enabled) and authorised clients are permitted to use the `PUT` method.
Additionally, the server's file system permissions should also enforce strict limitations.

Read more at https://www.tenable.com/plugins/was/98099

]]> <![CDATA[Versa Concerto 11.4.x < 12.1.2 Authentication Bypass]]> https://www.tenable.com/plugins/was/115121 https://www.tenable.com/plugins/was/115121 Tue, 03 Feb 2026 00:00:00 GMT Web App Scanning Plugin ID 115121 with Critical Severity

Synopsis

Versa Concerto 11.4.x < 12.1.2 Authentication Bypass

Description

Versa Concerto version 11.4.x prior to 12.1.2 is affected by an authentication bypass vulnerability. An unauthenticated remote attacker can exploit this vulnerability to gain unauthorized access to the internal Actuator endpoint.

Solution

Upgrade to Versa Concerto version 12.1.2 or later.

Read more at https://www.tenable.com/plugins/was/115121

]]> <![CDATA[PHP Unsupported Version]]> https://www.tenable.com/plugins/was/98230 https://www.tenable.com/plugins/was/98230 Wed, 28 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 98230 with Critical Severity

Synopsis

PHP Unsupported Version

Description

The installation of PHP detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

Solution

Upgrade to a supported version of PHP.

Read more at https://www.tenable.com/plugins/was/98230

]]> <![CDATA[Cookie Without Secure Flag Detected]]> https://www.tenable.com/plugins/was/98064 https://www.tenable.com/plugins/was/98064 Wed, 28 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 98064 with Low Severity

Synopsis

Cookie Without Secure Flag Detected

Description

When the `secure` flag is set on a cookie, the browser will prevent it from being sent over a clear text channel (HTTP) and only allow it to be sent when an encrypted channel is used (HTTPS).

The scanner discovered that a cookie was set by the server without the secure flag being set. Although the initial setting of this cookie was via an HTTPS connection, any HTTP link to the same server will result in the cookie being sent in clear text.

Note that if the cookie does not contain sensitive information, the risk of this vulnerability is mitigated.

Solution

If the cookie contains sensitive information, then the server should ensure that the cookie has the `secure` flag set.

Read more at https://www.tenable.com/plugins/was/98064

]]> <![CDATA[Cookie Without HttpOnly Flag Detected]]> https://www.tenable.com/plugins/was/98063 https://www.tenable.com/plugins/was/98063 Wed, 28 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 98063 with Low Severity

Synopsis

Cookie Without HttpOnly Flag Detected

Description

The HttpOnly flag assists in the prevention of client side-scripts (such as JavaScript) from accessing and using the cookie.

This can help prevent XSS attacks from targeting the cookies holding the client's session token (setting the HttpOnly flag does not prevent, nor safeguard against XSS vulnerabilities themselves).

Solution

The initial step to remedy this would be to determine whether any client-side scripts (such as JavaScript) need to access the cookie and if not, set the HttpOnly flag.
It should be noted that some older browsers are not compatible with the HttpOnly flag; therefore, setting this flag will not protect those clients against this form of attack.

Read more at https://www.tenable.com/plugins/was/98063

]]> <![CDATA[Cookie Set For Parent Domain]]> https://www.tenable.com/plugins/was/98062 https://www.tenable.com/plugins/was/98062 Wed, 28 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 98062 with Info Severity

Synopsis

Cookie Set For Parent Domain

Description

HTTP by itself is a stateless protocol. Therefore the server is unable to determine which requests are performed by which client, and which clients are authenticated or unauthenticated.

The use of HTTP cookies within the headers, allows a web server to identify each individual client and can therefore determine which clients hold valid authentication, from those that do not. These are known as session cookies.

When a cookie is set by the server (sent the header of an HTTP response) there are several flags that can be set to configure the properties of the cookie and how it is to be handled by the browser.

One of these flags represents the host, or domain. for which the cookie can be used.

When the cookie is set for the parent domain, rather than the host, this could indicate that the same cookie could be used to access other hosts within that domain. While there are many legitimate reasons for this, it could also be misconfiguration expanding the possible surface of attacks.

Solution

The first step to remediation is to identify the context in which the cookie is being set and determine if it is required by the whole domain, or just the specific host being tested.
If it is only required by the host, then the domain flag should be set as such.
Depending on the framework being used, the configuration of this flag will be modified in different ways.

Read more at https://www.tenable.com/plugins/was/98062

]]> <![CDATA[Cookie Without SameSite Flag Detected]]> https://www.tenable.com/plugins/was/115540 https://www.tenable.com/plugins/was/115540 Wed, 28 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 115540 with Low Severity

Synopsis

Cookie Without SameSite Flag Detected

Description

SameSite is an attribute which can be set on a cookie to instruct the web browser if this cookie can be sent along with cross-site requests to help prevent Cross-Site Request Forgery (CSRF) attacks.

The attribute has three possible values :

 - Strict : the cookie will only be sent in a first-party context, thus preventing cross-site requests initiated from third-party websites to include it.

 - Lax : the cookie is allowed to be sent in GET cross-site requests initiated by the top-level navigation from third-party websites. For example, following an hypertext link from the external website will make the request include the cookie.

 - None : the cookie is explicitly set to be sent by the browser in any context.

The scanner identified the lack of SameSite attribute on cookies set by the application or a misconfiguration.

Solution

Web browsers default behavior may differ when processing cookies in a cross-site context, making the final decision to send the cookie in this context unpredictable. The SameSite attribute should be set in every cookie to enforce the expected result by developers. When using the 'None' attribute value, ensure that the cookie is also set with the 'Secure' flag.

Read more at https://www.tenable.com/plugins/was/115540

]]> <![CDATA[Zimbra Collaboration 10.0.x < 10.0.18 / 10.1.x < 10.1.13 Local File Inclusion]]> https://www.tenable.com/plugins/was/115122 https://www.tenable.com/plugins/was/115122 Wed, 28 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 115122 with High Severity

Synopsis

Zimbra Collaboration 10.0.x < 10.0.18 / 10.1.x < 10.1.13 Local File Inclusion

Description

Zimbra Collaboration versions prior to 10.0.18 and 10.1.13 are vulnerable to Local File Inclusion (LFI) in the Webmail Classic UI due to improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can exploit this vulnerability by crafting requests to the /h/rest endpoint, which can lead to the inclusion of arbitrary files from the WebRoot directory.

Solution

Upgrade to Zimbra 10.0.18 or 10.1.13 or later.

Read more at https://www.tenable.com/plugins/was/115122

]]> <![CDATA[PHP 8.5.x < 8.5.1 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/115088 https://www.tenable.com/plugins/was/115088 Wed, 28 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 115088 with High Severity

Synopsis

PHP 8.5.x < 8.5.1 Multiple Vulnerabilities

Description

According to its self-reported version number, the version of PHP installed on the remote host is 8.2.x prior to 8.2.30, 8.3.x prior to 8.3.29, 8.4.x prior to 8.4.16, or 8.5.x prior to 8.5.1. It is, therefore, affected by multiple vulnerabilities:

 - Information leak of memory in getimagesize. (CVE-2025-14177)

 - Heap buffer overflow in array_merge(). (CVE-2025-14178)

 - PDO quoting result null dereference. (CVE-2025-14180)

 - Unbounded recursion and stack consumption. (CVE-2025-67899) Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to PHP version 8.5.1 or later.

Read more at https://www.tenable.com/plugins/was/115088

]]> <![CDATA[Livewire 3.x < 3.6.4 Remote Code Execution]]> https://www.tenable.com/plugins/was/115113 https://www.tenable.com/plugins/was/115113 Mon, 19 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 115113 with Critical Severity

Synopsis

Livewire 3.x < 3.6.4 Remote Code Execution

Description

Livewire is a full-stack framework for Laravel that makes building dynamic interfaces simple, without leaving the comfort of Laravel.

A remote code execution vulnerability exists in Livewire versions prior to 3.6.4 due to improper handling of serialized data during the component hydration process. An attacker can exploit this vulnerability by sending a specially crafted request containing malicious serialized data to the server, which is then deserialized and executed, allowing the attacker to execute arbitrary code on the server.

Note: Depending on the identified version of Livewire, the plugin indicates that the website is **potentially** vulnerable if it uses version 3.6.3 (vulnerable) or 3.6.4 (patched).

Solution

Upgrade to Livewire version 3.6.4 or later.

Read more at https://www.tenable.com/plugins/was/115113

]]> <![CDATA[XML Injection]]> https://www.tenable.com/plugins/was/114116 https://www.tenable.com/plugins/was/114116 Mon, 19 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 114116 with High Severity

Synopsis

XML Injection

Description

An XML Injection is when an attacker tries to inject an XML documents to the application. If the XML parser fails to contextually validate data, then the test will yield a positive result.

This attack may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts.

Solution

Since a specific value is used to build the XML document, it is necessary to apply strict filtering. Also, the XML processor should be configured to use a local static DTD and disallow any declared DTD included in the XML document.

Read more at https://www.tenable.com/plugins/was/114116

]]> <![CDATA[Google Cloud Platform Detected]]> https://www.tenable.com/plugins/was/114200 https://www.tenable.com/plugins/was/114200 Thu, 15 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 114200 with Info Severity

Synopsis

Google Cloud Platform Detected

Description

This is an informational notice that the scanner was able to detect that the target application is using an Google Cloud cloud service.

Solution

Read more at https://www.tenable.com/plugins/was/114200

]]> <![CDATA[Drupal Unsupported Version]]> https://www.tenable.com/plugins/was/98228 https://www.tenable.com/plugins/was/98228 Mon, 05 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 98228 with Critical Severity

Synopsis

Drupal Unsupported Version

Description

The installation of Drupal detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

Solution

Upgrade to a supported version of Drupal.

Read more at https://www.tenable.com/plugins/was/98228

]]> <![CDATA[MediaWiki Status Module Information Disclosure]]> https://www.tenable.com/plugins/was/114064 https://www.tenable.com/plugins/was/114064 Mon, 05 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 114064 with Medium Severity

Synopsis

MediaWiki Status Module Information Disclosure

Description

The instance of MediaWiki running on the remote host allows access to API URLs associated with the SiteInfo module. The SiteInfo api endpoint reports information about the server components, how the web server is configured and its usage, and it may prove useful to an attacker seeking to attack the server or host.

Solution

Reconfigure MediaWiki to restrict access to the API SiteInfo endpoint by IP address, or disable the SiteInfo module itself.

Read more at https://www.tenable.com/plugins/was/114064

]]> <![CDATA[Disclosed Hong Kong Identity Number]]> https://www.tenable.com/plugins/was/113943 https://www.tenable.com/plugins/was/113943 Mon, 05 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 113943 with Medium Severity

Synopsis

Disclosed Hong Kong Identity Number

Description

A Hong Kong Identity Number (HKID number) is a personally identifiable number that is allocated during the issuance of a Honk Kong Identity Card. A stolen or leaked HKID number can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an HKID number located within the response of the affected page

Solution

Initially, examine the Identified HKID number within the response should be checked to ensure its validity, as it is possible that it has been detected on data with no relation to a real HKID number due to the wide variety of data formats present within HTML content. If the response does contain a valid HKID number, then all efforts should be taken to remove or further protect this information. This can be achieved by removing the HKID number altogether, or by masking the number so that only a few digits are present within the response. (eg. _*****123*****_).

Read more at https://www.tenable.com/plugins/was/113943

]]> <![CDATA[Spring Framework < 5.2.20 / 5.3.x < 5.3.18 Remote Code Execution (Spring4Shell)]]> https://www.tenable.com/plugins/was/113217 https://www.tenable.com/plugins/was/113217 Mon, 05 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 113217 with Critical Severity

Synopsis

Spring Framework < 5.2.20 / 5.3.x < 5.3.18 Remote Code Execution (Spring4Shell)

Description

Spring MVC and Spring WebFlux applications, when packaged as a traditional WAR file, running on JDK version 9 and higher in an Apache Tomcat servlet container and exposing one or more endpoints with DataBinder enabled, suffer from a Remote Code Execution (RCE) vulnerability.

By crafting a specific HTTP request, an attacker could leverage the vulnerability to compromise the target by, for example, hosting a web shell on the target application.

Solution

Depending on the current application version branch, update at least to Spring Framework 5.2.20 or 5.3.18. Due to its dependency to Spring Framework, Spring Boot should also be updated at least to versions 2.5.12 or 2.6.6. The Apache Tomcat team has released versions 10.0.20, 9.0.62, and 8.5.78 all of which close the attack vector on Tomcat's side.

Read more at https://www.tenable.com/plugins/was/113217

]]> <![CDATA[Microsoft IIS Unsupported Version]]> https://www.tenable.com/plugins/was/113029 https://www.tenable.com/plugins/was/113029 Mon, 05 Jan 2026 00:00:00 GMT Web App Scanning Plugin ID 113029 with Critical Severity

Synopsis

Microsoft IIS Unsupported Version

Description

The installation of Microsoft Internet Information Services (IIS) detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

Solution

Upgrade to a supported version of Microsoft IIS.

Read more at https://www.tenable.com/plugins/was/113029

]]> <![CDATA[Environment Configuration File Detected]]> https://www.tenable.com/plugins/was/98538 https://www.tenable.com/plugins/was/98538 Wed, 17 Dec 2025 00:00:00 GMT Web App Scanning Plugin ID 98538 with High Severity

Synopsis

Environment Configuration File Detected

Description

An environment configuration file (.env) has been detected on the web application by the scanner. It may be possible for an attacker to view sensitive information (database login and password or API keys for example) and then conduct further attacks.

Solution

Remove .env file or restrict access.

Read more at https://www.tenable.com/plugins/was/98538

]]> <![CDATA[Database Connection String Disclosure]]> https://www.tenable.com/plugins/was/114276 https://www.tenable.com/plugins/was/114276 Wed, 17 Dec 2025 00:00:00 GMT Web App Scanning Plugin ID 114276 with High Severity

Synopsis

Database Connection String Disclosure

Description

Most of the web applications rely on a database to provide features to their users. In secure designs, consuming these private or cloud databases will require authentication like username and password based credentials.

Developers sometimes hard code such data in various places of their applications, without realizing that it could become publicly available in client-side JavaScript or, for example, HTML comments. By leveraging these sensitive information, a remote and unauthenticated attacker could gain privileged access to critical services used by the web application and the organization.

Solution

Remove the database connection string exposure by identifying the root cause of the issue (for example manual data insertion in the code, environment variables being bundled in front-end JavaScript). Rotate the secrets to avoid further reuse in case it has been previously retrieved by a malicious actor.

Read more at https://www.tenable.com/plugins/was/114276

]]> <![CDATA[Drupal User Enumeration]]> https://www.tenable.com/plugins/was/98209 https://www.tenable.com/plugins/was/98209 Thu, 11 Dec 2025 00:00:00 GMT Web App Scanning Plugin ID 98209 with Medium Severity

Synopsis

Drupal User Enumeration

Description

In some default Drupal installations there are methods which may allow attackers to enumerate a authors username. This information may then be used in brute-force or dictionary attacks against the login form in order to guess passwords.

Solution

Block requests to sensitive user information at the server using .htaccess file or WAF for example. You should block or redirect all requests made to '/user/reset/'.

Read more at https://www.tenable.com/plugins/was/98209

]]> <![CDATA[React Server Components 19.0 / 19.1.0 / 19.1.1 / 19.2.0 Remote Code Execution (React2Shell)]]> https://www.tenable.com/plugins/was/115069 https://www.tenable.com/plugins/was/115069 Thu, 11 Dec 2025 00:00:00 GMT Web App Scanning Plugin ID 115069 with Critical Severity

Synopsis

React Server Components 19.0 / 19.1.0 / 19.1.1 / 19.2.0 Remote Code Execution (React2Shell)

Description

React Server Components react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0, 19.1.0, 19.1.1, and 19.2.0 are vulnerable to an Unauthenticated Remote Code Execution. An attacker can exploit a flaw in how React decodes payloads sent to React Server Function endpoints through specially crafted requests.

Solution

Upgrade the React Server Components to 19.0.1 or 19.1.2 or 19.2.1 or later.

Read more at https://www.tenable.com/plugins/was/115069

]]> <![CDATA[Citrix NetScaler Gateway / ADC Memory Disclosure]]> https://www.tenable.com/plugins/was/114907 https://www.tenable.com/plugins/was/114907 Thu, 11 Dec 2025 00:00:00 GMT Web App Scanning Plugin ID 114907 with Critical Severity

Synopsis

Citrix NetScaler Gateway / ADC Memory Disclosure

Description

Citrix NetScaler Gateway / ADC versions 14.1.x < 14.1-43.56, 13.1.x < 13.1-58.32, 13.1.x-FIPS < 13.1-37.235-FIPS and NDcPP, 12.1.x-FIPS < 12.1-55.328-FIPS, 12.1.x and 13.0.x are affected by a memory disclosure vulnerability. This issue could allow a remote and unauthenticated attacker to access sensitive information without authorization.

Solution

Upgrade to version 14.1-43.56, 13.1-58.32, 13.1-37.235-FIPS, 12.1-55.328-FIPS or later.

Read more at https://www.tenable.com/plugins/was/114907

]]> <![CDATA[Basic Authentication Bruteforced]]> https://www.tenable.com/plugins/was/113067 https://www.tenable.com/plugins/was/113067 Thu, 11 Dec 2025 00:00:00 GMT Web App Scanning Plugin ID 113067 with High Severity

Synopsis

Basic Authentication Bruteforced

Description

The scanner successfully authenticated on the target web application by using weak credentials in the request basic authentication HTTP header.

Solution

The application should not be configured with accounts using default or predictable credentials. A complex password policy should be defined and enforced on every account available in the application to prevent attackers from guessing it and have unauthorized access to the application.

Read more at https://www.tenable.com/plugins/was/113067

]]> <![CDATA[AWS Credentials Disclosure (deprecated)]]> https://www.tenable.com/plugins/was/113164 https://www.tenable.com/plugins/was/113164 Mon, 08 Dec 2025 00:00:00 GMT Web App Scanning Plugin ID 113164 with Medium Severity

Synopsis

AWS Credentials Disclosure (deprecated)

Description

Amazon Web Services (AWS) is a public cloud provider offering different hosting services for their customers. Amazon Web Services can be accessed through programmatic calls to their API by authenticating with access keys, which are a combination of both an access key ID and a secret access key. Temporary security credentials, which rely on an additional security token, can also be issued to grant users access to AWS resources for a short period of time.

By using leaked AWS credentials or abusing credentials with misconfigured permissions, an attacker could try to gain access to sensitive information on the AWS account or perform arbitrary modification on the AWS resources.

Solution

Ensure that the detected AWS credentials are expected to be available to users, and that the permissions are defined according to their purpose and to AWS security best practices.

Read more at https://www.tenable.com/plugins/was/113164

]]> <![CDATA[Google Cloud Service Account Private Key Disclosure (deprecated)]]> https://www.tenable.com/plugins/was/113150 https://www.tenable.com/plugins/was/113150 Mon, 08 Dec 2025 00:00:00 GMT Web App Scanning Plugin ID 113150 with High Severity

Synopsis

Google Cloud Service Account Private Key Disclosure (deprecated)

Description

Google Cloud resources access control is managed through the Identify and Access Management (IAM) feature which helps defining the different roles and permissions available to authenticated principals. Principals include Google accounts for end users and service accounts which purpose is to be used by applications and compute workloads.

Service accounts rely on RSA key pairs for authentication against Google Cloud APIs and access the resources, which, when exposed, could be used by an attacker to gain access to sensitive information or to perform arbitrary modification on the related cloud resources.

Solution

Ensure that storage accounts keys are not stored with the application (for its own usage or because it was included in the deployment chain) and are not publicly available. If possible, force the keys to be frequently rotated with an expiry time and ensure that leaked keys are revoked and reset.

Read more at https://www.tenable.com/plugins/was/113150

]]> <![CDATA[Cross-Site Request Forgery]]> https://www.tenable.com/plugins/was/98112 https://www.tenable.com/plugins/was/98112 Thu, 04 Dec 2025 00:00:00 GMT Web App Scanning Plugin ID 98112 with Medium Severity

Synopsis

Cross-Site Request Forgery

Description

Cross Site Request Forgery (CSRF) occurs when an authenticated user is tricked into clicking on a link which would automatically submit a request without the user's consent.

This can be made possible when the request does not include an anti-CSRF token, generated each time the request is visited and passed when the request is submitted, and which can be used by the web application backend to verify that the request originates from a legitimate user.

Exploiting requests vulnerable to Cross-Site Request Forgery requires different factors:

- The request must perform a sensitive action.

- The victim must have an active session.

- The attacker must make the victim click on a link to send the request without their consent.

Scanner detected a request, available only to authenticated users, where all parameters within are known or predictable. The request may therefore be vulnerable to CSRF attacks.

Manual verification may be required to check whether the submission will then perform a sensitive action, such as reset a password, modify user profiles, post content on a forum, etc.

Solution

Update the application by adding support of anti-CSRF tokens in any sensitive form available in an authenticated session.
Most web frameworks provide either built-in solutions or have plugins that can be used to easily add these tokens to any form. Check the references for possible solutions provided for the most known frameworks.

Read more at https://www.tenable.com/plugins/was/98112

]]> <![CDATA[User Enumeration]]> https://www.tenable.com/plugins/was/114947 https://www.tenable.com/plugins/was/114947 Mon, 24 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 114947 with Medium Severity

Synopsis

User Enumeration

Description

The scanner has detected a potential user enumeration vulnerability in the web application. This vulnerability allows an attacker to determine valid usernames by observing the application's responses.

Solution

Ensure that user enumeration vulnerabilities are mitigated by implementing proper authentication mechanisms and generic error messages, rate limiting, and other techniques to prevent attackers from determining valid usernames.

Read more at https://www.tenable.com/plugins/was/114947

]]> <![CDATA[Microsoft Access Database Detected]]> https://www.tenable.com/plugins/was/113448 https://www.tenable.com/plugins/was/113448 Mon, 24 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 113448 with Medium Severity

Synopsis

Microsoft Access Database Detected

Description

A Microsoft Access Database file has been detected on the target host. This may expose privileged information or configurations to a malicious actor.

Solution

Restrict access to the Microsoft Access database file or remove it.

Read more at https://www.tenable.com/plugins/was/113448

]]> <![CDATA[Apache 2.4.10 < 2.4.44 Source Code Disclosure]]> https://www.tenable.com/plugins/was/113058 https://www.tenable.com/plugins/was/113058 Mon, 24 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 113058 with High Severity

Synopsis

Apache 2.4.10 < 2.4.44 Source Code Disclosure

Description

Due to a lack of control over an Apache error when using php-cgi and ModSecurity, it is possible for an attacker to obtain the source code of requested page in the error response via a specially crafted request containing the Content-Length header with an incorrect value.

Solution

Upgrade to Apache version 2.4.45 or later.

Read more at https://www.tenable.com/plugins/was/113058

]]> <![CDATA[Fortinet FortiWeb Authentication Bypass]]> https://www.tenable.com/plugins/was/115040 https://www.tenable.com/plugins/was/115040 Mon, 17 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 115040 with Critical Severity

Synopsis

Fortinet FortiWeb Authentication Bypass

Description

Fortinet FortiWeb versions 7.0.x < 7.0.12, 7.2.x < 7.2.12, 7.4.x < 7.4.10, 7.6.x < 7.6.5, 8.0.x < 8.0.2 suffer from an authentication bypass vulnerability. By crafting a specific request, a remote and unauthenticated attacker can create a new user account and compromise the affected system.

Solution

Upgrade to FortiWeb version 7.0.12, 7.2.12, 7.4.10, 7.6.5, 8.0.2 or later.

Read more at https://www.tenable.com/plugins/was/115040

]]> <![CDATA[Lucee Unset Credentials]]> https://www.tenable.com/plugins/was/115029 https://www.tenable.com/plugins/was/115029 Mon, 17 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 115029 with Critical Severity

Synopsis

Lucee Unset Credentials

Description

Lucee web application server may be configured with no credentials. If an attacker setup the default accounts, they could gain unauthorized access to the application and perform arbitrary actions on it.

Solution

The application should not be configured with accounts using default or predictable credentials. A complex password policy should be defined and enforced on every account available in the application to prevent attackers from guessing it and have unauthorized access to the application.

Read more at https://www.tenable.com/plugins/was/115029

]]> <![CDATA[Lucee Administration Panel Login Form Detected]]> https://www.tenable.com/plugins/was/115027 https://www.tenable.com/plugins/was/115027 Mon, 17 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 115027 with Medium Severity

Synopsis

Lucee Administration Panel Login Form Detected

Description

Lucee Administration Panel has been detected on the target web application.

This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality.

Solution

Restrict access to administrative functionality using a .htaccess file, limiting access to known IP Addresses.

Read more at https://www.tenable.com/plugins/was/115027

]]> <![CDATA[External Backend API Detected]]> https://www.tenable.com/plugins/was/114128 https://www.tenable.com/plugins/was/114128 Mon, 17 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 114128 with Info Severity

Synopsis

External Backend API Detected

Description

Modern web applications often rely on a third party service as a backend when they are built with a micro-service architecture or using a third party SaaS service. In such deployments, it is recommended to perform additional scans directly against these backend hosts (with the consent and approval of their respective owners and hosting companies) to ensure a wide coverage of the web applications services in use.

Solution

Read more at https://www.tenable.com/plugins/was/114128

]]> <![CDATA[Symfony Secret Fragments Remote Code Execution]]> https://www.tenable.com/plugins/was/112685 https://www.tenable.com/plugins/was/112685 Mon, 17 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 112685 with Critical Severity

Synopsis

Symfony Secret Fragments Remote Code Execution

Description

The Symfony framework or Symfony based projects uses a secret that is used for its cryptographic operations such as the creation of cookies or anti-CSRF tokens.

A feature (not enabled by default) allows to execute arbitrary PHP code via a GET parameter.

If this secret is exposed, through a vulnerability or due to the use of a weak/default secret, then an attacker will be able to abuse this feature to forge a URL with arbitrary PHP code, allowing remote code execution on the machine.

Solution

It is necessary to make sure that the APP_SECRET variable of your Symfony project has no default value, that it is random and sufficiently robust.

Read more at https://www.tenable.com/plugins/was/112685

]]> <![CDATA[Drupal 8.0.x < 10.3.13 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/114607 https://www.tenable.com/plugins/was/114607 Thu, 13 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 114607 with High Severity

Synopsis

Drupal 8.0.x < 10.3.13 Multiple Vulnerabilities

Description

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

 - Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability (XSS).

 - Bulk operations allow authorized users to modify several nodes at once from the Content page (/admin/content). A site builder can also add bulk operations to other pages using Views.

 - Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Arbitrary File Inclusion. Techniques exist to escalate this attack to Remote Code Execution. It is not directly exploitable.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Drupal version 10.3.13 or latest.

Read more at https://www.tenable.com/plugins/was/114607

]]> <![CDATA[Drupal 10.4.x < 10.4.3 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/114606 https://www.tenable.com/plugins/was/114606 Thu, 13 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 114606 with High Severity

Synopsis

Drupal 10.4.x < 10.4.3 Multiple Vulnerabilities

Description

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

 - Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability (XSS).

 - Bulk operations allow authorized users to modify several nodes at once from the Content page (/admin/content). A site builder can also add bulk operations to other pages using Views.

 - Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Arbitrary File Inclusion. Techniques exist to escalate this attack to Remote Code Execution. It is not directly exploitable.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Drupal version 10.4.3 or latest.

Read more at https://www.tenable.com/plugins/was/114606

]]> <![CDATA[Drupal 11.0.x < 11.0.12 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/114605 https://www.tenable.com/plugins/was/114605 Thu, 13 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 114605 with High Severity

Synopsis

Drupal 11.0.x < 11.0.12 Multiple Vulnerabilities

Description

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

 - Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability (XSS).

 - Bulk operations allow authorized users to modify several nodes at once from the Content page (/admin/content). A site builder can also add bulk operations to other pages using Views.

 - Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Arbitrary File Inclusion. Techniques exist to escalate this attack to Remote Code Execution. It is not directly exploitable.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Drupal version 11.0.12 or latest.

Read more at https://www.tenable.com/plugins/was/114605

]]> <![CDATA[Drupal 11.1.x < 11.1.3 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/114604 https://www.tenable.com/plugins/was/114604 Thu, 13 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 114604 with High Severity

Synopsis

Drupal 11.1.x < 11.1.3 Multiple Vulnerabilities

Description

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

 - Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability (XSS).

 - Bulk operations allow authorized users to modify several nodes at once from the Content page (/admin/content). A site builder can also add bulk operations to other pages using Views.

 - Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Arbitrary File Inclusion. Techniques exist to escalate this attack to Remote Code Execution. It is not directly exploitable.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Drupal version 11.1.3 or latest.

Read more at https://www.tenable.com/plugins/was/114604

]]> <![CDATA[Request URL Override]]> https://www.tenable.com/plugins/was/114262 https://www.tenable.com/plugins/was/114262 Mon, 10 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 114262 with Medium Severity

Synopsis

Request URL Override

Description

Web application components can sometimes rely on request HTTP headers like 'X-Original-URL' or 'X-Rewrite-URL' to override the original path of this request. Attackers can leverage this vulnerability to conduct further attacks in order to bypass restrictions or conduct cache poisonning attacks.

Solution

If the application uses a known vulnerable component, update it to a fixed version or later. Otherwise, review the application logic to ensure that HTTP headers like 'X-Original-URL' or 'X-Rewrite-URL' are not trusted and used in its routing logic

Read more at https://www.tenable.com/plugins/was/114262

]]> <![CDATA[Cross-Site Request Forgery Token Validation Bypass]]> https://www.tenable.com/plugins/was/113900 https://www.tenable.com/plugins/was/113900 Mon, 10 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 113900 with Medium Severity

Synopsis

Cross-Site Request Forgery Token Validation Bypass

Description

Cross-Site Request Forgery (CSRF) vulnerabilities remediation usually rely on the usage of CSRF tokens which are sensitive and unpredictable values shared between the web application sever and the clients. When performing sensitive or privileged actions (like submitting some forms for example), CSRF tokens are sent in the HTTP client request and validated by the server. Some web applications may fail to properly validate the CSRF tokens, leaving them still vulnerable to Cross-Site Request Forgery (CSRF) attacks.

Solution

Ensure that the CSRF tokens used by the web application are properly validated and that the CSRF tokens value cannot be predicted. Most web frameworks provide either built-in solutions or have plugins that can be used to easily add these tokens to any form. Check the references for possible solutions provided for the most known frameworks.

Read more at https://www.tenable.com/plugins/was/113900

]]> <![CDATA[.DS_Store File Detected]]> https://www.tenable.com/plugins/was/98646 https://www.tenable.com/plugins/was/98646 Tue, 04 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 98646 with Medium Severity

Synopsis

.DS_Store File Detected

Description

The web server on the remote host allows read access to a OSX .DS_Store file. This potential flaw can be used to access content from the web server that might otherwise be private.

Solution

Remove the .DS_Store file.

Read more at https://www.tenable.com/plugins/was/98646

]]> <![CDATA[Error Message]]> https://www.tenable.com/plugins/was/98611 https://www.tenable.com/plugins/was/98611 Tue, 04 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 98611 with Info Severity

Synopsis

Error Message

Description

An error or warning message has been found on the remote web server. It may be possible for an attacker to view sensitive information and conduct further attacks.

Solution

Disable all notice, warning and error displaying. Configure the application to log such messages in a file.

Read more at https://www.tenable.com/plugins/was/98611

]]> <![CDATA[Scan Information]]> https://www.tenable.com/plugins/was/98000 https://www.tenable.com/plugins/was/98000 Tue, 04 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 98000 with Info Severity

Synopsis

Scan Information

Description

Provides scan information and statistics of plugins run.

Solution

Read more at https://www.tenable.com/plugins/was/98000

]]> <![CDATA[Custom HTTP Header Detected]]> https://www.tenable.com/plugins/was/115006 https://www.tenable.com/plugins/was/115006 Tue, 04 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 115006 with Info Severity

Synopsis

Custom HTTP Header Detected

Description

This is an informational notice that the scanner was able to detect custom HTTP headers in the target application's responses.

Solution

Read more at https://www.tenable.com/plugins/was/115006

]]> <![CDATA[Bootstrap 4.x <= 4.6.2 Cross-Site Scripting]]> https://www.tenable.com/plugins/was/114899 https://www.tenable.com/plugins/was/114899 Tue, 04 Nov 2025 00:00:00 GMT Web App Scanning Plugin ID 114899 with Medium Severity

Synopsis

Bootstrap 4.x <= 4.6.2 Cross-Site Scripting

Description

According to its self-reported version number, Bootstrap is 4.x prior 4.6.2 . Therefore, it may be affected by a Cross-Site Scripting (XSS) vulnerability within the Carousel component.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Bootstrap version 5.0 or later.

Read more at https://www.tenable.com/plugins/was/114899

]]> <![CDATA[Subdomain Takeover]]> https://www.tenable.com/plugins/was/114146 https://www.tenable.com/plugins/was/114146 Tue, 21 Oct 2025 00:00:00 GMT Web App Scanning Plugin ID 114146 with Medium Severity

Synopsis

Subdomain Takeover

Description

Deploying web applications often require developers or system administrators to configure DNS records to target a third party service. Most common scenarios include to either configure a canonical name record (CNAME) or to declare specific name server records (NS) to delegate a specific DNS zone management.

A subdomain takeover vulnerability exists when an attacker can gain control over a subdomain or even an entire zone of the target domain depending on the configuration. By exploiting this vulnerability, the attacker can then provide content which could looks legit to any customer or user of the target domain name and conduct further attacks.

The plugin currently supports the following services: - Agile CRM - Aha! - Anima - AnnounceKit - Atlassian BitBucket - AWS S3 Bucket - CampaignMonitor - Canny - Clever Cloud - Digital Ocean - Frontify - Gemfury - Getresponse - Ghost - GitHub Pages - Hatena Blog - Help Juice - Help Scout - Helprace - JetBrains - LaunchRock - Meteor - Ngrok - Pantheon - Pingdom - Proposify - Readme.io - Readthedocs - Shopify - Short.io - Smartjobboard - Strikingly - Surge - SurveySparrow - Uberflip - Uptimerobot - WordPress - Wix - Worksites - Zendesk

Solution

As a first step, remove the DNS record from your DNS zone. Review the web application provisioning process to ensure that DNS records are created only when the target service is up and running as expected. When deprovisioning a service, first remove the DNS record before deactivating the service on the third party service.

Read more at https://www.tenable.com/plugins/was/114146

]]> <![CDATA[HTTP to HTTPS Redirect Not Enabled]]> https://www.tenable.com/plugins/was/112544 https://www.tenable.com/plugins/was/112544 Tue, 21 Oct 2025 00:00:00 GMT Web App Scanning Plugin ID 112544 with Medium Severity

Synopsis

HTTP to HTTPS Redirect Not Enabled

Description

HTTPS is enabled on the website however HTTP requests are not redirected to HTTPS. Communications are not encrypted if users doesn't explicitly access to HTTPS version of the website.

Note: This plugin does not handle customs ports, and therefore only performs checks when a scan is run on standard ports (80/443).

Solution

Enable HTTP to HTTPS redirect for all requests. Besides redirects if HTTP Strict Transport Security (HSTS) is not implemented it's highly recommended to enable it.

Read more at https://www.tenable.com/plugins/was/112544

]]> <![CDATA[Netdisco Unauthenticated Access]]> https://www.tenable.com/plugins/was/115002 https://www.tenable.com/plugins/was/115002 Tue, 07 Oct 2025 00:00:00 GMT Web App Scanning Plugin ID 115002 with Medium Severity

Synopsis

Netdisco Unauthenticated Access

Description

Netdisco is a web-based network management tool. When accessible without authentication, an attacker can gain unauthorized access to the Netdisco interface, potentially leading to information disclosure or further exploitation of the system.

Solution

Authentication should be enforced to prevent unauthorized access to the Netdisco interface.

Read more at https://www.tenable.com/plugins/was/115002

]]> <![CDATA[Microsoft SharePoint Remote Code Execution]]> https://www.tenable.com/plugins/was/114923 https://www.tenable.com/plugins/was/114923 Tue, 07 Oct 2025 00:00:00 GMT Web App Scanning Plugin ID 114923 with Critical Severity

Synopsis

Microsoft SharePoint Remote Code Execution

Description

Microsoft SharePoint Server Subscription Edition < 16.0.18526.20508 or 2016 < 16.0.5513.1001 or 2019 < 16.0.10417.20037 is affected by a vulnerability that allows an unauthenticated attacker to execute arbitrary code through insecure deserialization.

Solution

Upgrade to Microsoft Server Subscription Edition build 16.0.18526.20508 or SharePoint Server 2016 build 16.0.5513.1001 or 2019 build 16.0.10417.20037 or later.

Read more at https://www.tenable.com/plugins/was/114923

]]> <![CDATA[Joomla! User Registration Form Detected]]> https://www.tenable.com/plugins/was/98205 https://www.tenable.com/plugins/was/98205 Fri, 26 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 98205 with Info Severity

Synopsis

Joomla! User Registration Form Detected

Description

This is an informational plugin to inform the user that the scanner has detected a publicly accessible Joomla User Registration Form on the target application.

This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack

Solution

Restrict access to Registration Forms using a .htaccess file, limiting access to known IP Addresses.

Read more at https://www.tenable.com/plugins/was/98205

]]> <![CDATA[WordPress User Registration Form Detected]]> https://www.tenable.com/plugins/was/98202 https://www.tenable.com/plugins/was/98202 Fri, 26 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 98202 with Info Severity

Synopsis

WordPress User Registration Form Detected

Description

This is an informational plugin to inform the user that the scanner has detected a publicly accessible WordPress User Registration Form on the target application.

This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack

Solution

Restrict access to Registration Forms using a .htaccess file, limiting access to known IP Addresses.

Read more at https://www.tenable.com/plugins/was/98202

]]> <![CDATA[Drupal User Registration Form Detected]]> https://www.tenable.com/plugins/was/98201 https://www.tenable.com/plugins/was/98201 Fri, 26 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 98201 with Info Severity

Synopsis

Drupal User Registration Form Detected

Description

This is an informational plugin to inform the user that the scanner has detected a publicly accessible Drupal User Registration Form on the target application.

This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack

Solution

Restrict access using a .htaccess file, limiting access to known IP Addresses.

Read more at https://www.tenable.com/plugins/was/98201

]]> <![CDATA[Mixed Resource Detection]]> https://www.tenable.com/plugins/was/98091 https://www.tenable.com/plugins/was/98091 Fri, 19 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 98091 with Medium Severity

Synopsis

Mixed Resource Detection

Description

Scanner discovered that the affected site is utilising both HTTP and HTTPS. While the HTML code is served over HTTPS, the server is also serving resources over an unencrypted channel, which can lead to the compromise of data, while providing a false sense of security to the user.

Solution

All pages and/or resources on the affected site should be secured equally, utilising the latest and most secure encryption protocols. These include SSL version 3.0 and TLS version 1.2.
While TLS 1.2 is the latest and the most preferred protocol, not all browsers will support this encryption method. Therefore, the more common SSL is included. Older protocols such as SSL version 2, and weak ciphers (< 128 bit) should also be disabled.

Read more at https://www.tenable.com/plugins/was/98091

]]> <![CDATA[Cross-Site WebSocket Hijacking]]> https://www.tenable.com/plugins/was/114502 https://www.tenable.com/plugins/was/114502 Fri, 19 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 114502 with High Severity

Synopsis

Cross-Site WebSocket Hijacking

Description

HTML5 WebSockets allow developers to create bi-directionnal communication channels between clients (usually web browsers) and servers. To initialize the communication, the WebSocket protocol requires a handshake performed with the HTTP protocol to ugprade the communication. When a web application only leverage on the client cookies to authenticate its users, a remote and unauthenticated could initiate a WebSocket handhsake from a malicious page to force the victim to authenticate against the target, therefore gaining access to the WebSocket traffic exchanged between the victim user and the target web application.

Solution

Ensure that the WebSocket handshake is protected against CSRF attacks, by implementing an anti-CSRF protection mechanism and validating that the request 'Origin' is properly validated.

Read more at https://www.tenable.com/plugins/was/114502

]]> <![CDATA[Insecure Redirect Chain]]> https://www.tenable.com/plugins/was/113219 https://www.tenable.com/plugins/was/113219 Fri, 12 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 113219 with Medium Severity

Synopsis

Insecure Redirect Chain

Description

The scanner encountered one or more insecure redirects during the application crawl which means the redirection chain is not fully done with HTTPS. During an insecure redirection anyone could establish a man-in-the-middle attack against the remote host.

Solution

It is necessary to perform redirects only to HTTPS sites. It is also recommended to add HTTP Strict Transport Security (HSTS) on the final URL.

Read more at https://www.tenable.com/plugins/was/113219

]]> <![CDATA[Source Code Passive Disclosure]]> https://www.tenable.com/plugins/was/98779 https://www.tenable.com/plugins/was/98779 Wed, 03 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 98779 with Medium Severity

Synopsis

Source Code Passive Disclosure

Description

Scanner has detected server-side source code within the server's response.

A modern web application will be reliant on several different programming languages. These languages can be broken up in two flavours. These are client-side languages (such as those that run in the browser -- like JavaScript) and server-side languages (which are executed by the server -- like ASP, PHP, JSP, etc.) to form the dynamic pages (client-side code) that are then sent to the client.

Because all server side code should be executed by the server, it should never be seen by the client, however in some scenarios it is possible that the server has a misconfiguration or the server side code has syntax errors, and therefore is not executed by the server but is instead sent to the client. As the server-side source code often contains sensitive information, such as database connection strings or details into the application workflow, this can be extremely risky.

Cyber-criminals will attempt to discover pages that either accidentally or forcefully allow the server-side source code to be disclosed, to assist in discovering further vulnerabilities or sensitive information.

Solution

It is important that the server does not deliver server side code to the client, and the server misconfiguration or server code should be changed to prevent this.

Read more at https://www.tenable.com/plugins/was/98779

]]> <![CDATA[Response Splitting]]> https://www.tenable.com/plugins/was/98101 https://www.tenable.com/plugins/was/98101 Wed, 03 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 98101 with Medium Severity

Synopsis

Response Splitting

Description

HTTP response splitting occurs when untrusted data is inserted into the response headers without any sanitisation.

If successful, this allows cyber-criminals to essentially split the HTTP response in two.

This is abused by cyber-criminals injecting CR (Carriage Return -- `/r`) and LF (Line Feed -- `\n`) characters which will then form the split. If the CR or LF characters are not processed by the server then it cannot be exploited.

Along with these characters, cyber-criminals can then construct their own arbitrary response headers and body which would then form the second response. The second response is entirely under their control, allowing for a number of other attacks.

Solution

It is recommended that untrusted data is never used to form the contents of the response header.
Where any untrusted source is required to be used in the response headers, it is important to ensure that any hazardous characters (`/r`, `/n` and potentially others) are sanitised prior to being used.
This is especially important when setting cookie values, redirecting, etc..

Read more at https://www.tenable.com/plugins/was/98101

]]> <![CDATA[Unvalidated Redirection]]> https://www.tenable.com/plugins/was/98054 https://www.tenable.com/plugins/was/98054 Wed, 03 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 98054 with Medium Severity

Synopsis

Unvalidated Redirection

Description

Web applications occasionally use parameter values to store the address of the page to which the client will be redirected -- for example: `yoursite.com/page.asp?redirect=www.yoursite.com/404.asp`

An unvalidated redirect occurs when the client is able to modify the affected parameter value in the request and thus control the location of the redirection. For example, the following URL `yoursite.com/page.asp?redirect=www.anothersite.com` will redirect to `www.anothersite.com`.

There are several ways a redirection can occur:

1) A response with a 3xx status code will tell the browser to redirect to the URL in the "Location" header

2) A response with a "Refresh" header tells the browser to reload the page after a set interval (which can be 0). The header can take an arbitrary URL parameter to load

3) The HTML tag can take a "http-equiv" attribute which can be used instead of an HTTP response header. Using this, a "Refresh" can be simulated

4) Javascript is used to redirect the browser to an arbitrary URL

Cyber-criminals will abuse these vulnerabilities in social engineering attacks to get users to unknowingly visit malicious web sites.

The scanner has discovered that the server does not validate the parameter value prior to redirecting the client to the injected value.

Solution

The application should ensure that the supplied value for a redirect is permitted. This can be achieved by performing whitelisting on the parameter value.
The whitelist should contain a list of pages or sites that the application is permitted to redirect users to. If the supplied value does not match any value in the whitelist then the server should redirect to a standard error page.

Read more at https://www.tenable.com/plugins/was/98054

]]> <![CDATA[GraphQL Query Length Not Limited]]> https://www.tenable.com/plugins/was/114867 https://www.tenable.com/plugins/was/114867 Wed, 03 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 114867 with Medium Severity

Synopsis

GraphQL Query Length Not Limited

Description

GraphQL is an open-source query and manipulation language for APIs. When a GraphQL API does not enforce limits on query length or complexity, attackers can submit extremely large and complex queries that consume excessive server resources, potentially causing denial of service conditions.

Solution

Implement query length limitations, depth restrictions, and complexity analysis on all GraphQL endpoints to prevent resource exhaustion attacks.

Read more at https://www.tenable.com/plugins/was/114867

]]> <![CDATA[Content Security Policy Missing 'Report-To']]> https://www.tenable.com/plugins/was/114796 https://www.tenable.com/plugins/was/114796 Wed, 03 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 114796 with Low Severity

Synopsis

Content Security Policy Missing 'Report-To'

Description

Content Security Policy (CSP) is a web security standard that helps to mitigate attacks like cross-site scripting (XSS), clickjacking or mixed content issues. CSP provides mechanisms to websites to restrict content that browsers will be allowed to load.

The 'report-to' directive allows websites to specify a reporting endpoint where browsers can send CSP violation reports. This helps administrators monitor policy violations and fine-tune their security policies.

While a Content Security Policy has been detected on this host, it is missing the 'report-to' directive, which means potential violations won't be reported automatically. This reduces visibility into security events that could help identify and remediate issues.

Solution

Add the 'report-to' directive to your existing Content Security Policy header.

Read more at https://www.tenable.com/plugins/was/114796

]]> <![CDATA[PHP Development Server < 7.4.22 Source Disclosure]]> https://www.tenable.com/plugins/was/114232 https://www.tenable.com/plugins/was/114232 Wed, 03 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 114232 with Medium Severity

Synopsis

PHP Development Server < 7.4.22 Source Disclosure

Description

In PHP versions pior to 7.4.22, when the integrated web server is used, an attacker can with a specially forged request, obtain the source code due to an improper handling of multiple requests in quick succession, leading to the server treating requested files as static files instead of executing scripts.

Solution

Upgrade to PHP version 7.4.22 or later.

Read more at https://www.tenable.com/plugins/was/114232

]]> <![CDATA[OPcache UI Detected]]> https://www.tenable.com/plugins/was/113059 https://www.tenable.com/plugins/was/113059 Wed, 03 Sep 2025 00:00:00 GMT Web App Scanning Plugin ID 113059 with Medium Severity

Synopsis

OPcache UI Detected

Description

A PHP OPcache information page has been detected, potentially including server statistics, settings and cached files, software versions and providing real-time updates for the information. This information may then assist in the compromise of the web application.

Solution

Remove the affected file(s).

Read more at https://www.tenable.com/plugins/was/113059

]]> <![CDATA[Authentication Check Pattern Found in Unauthenticated Browser]]> https://www.tenable.com/plugins/was/114247 https://www.tenable.com/plugins/was/114247 Fri, 29 Aug 2025 00:00:00 GMT Web App Scanning Plugin ID 114247 with Info Severity

Synopsis

Authentication Check Pattern Found in Unauthenticated Browser

Description

This is an informational notice that the scanner was able to find the authentication check pattern using an unauthenticated browser. This indicates that the scanner cannot validate if authentication was successful.

Solution

Read more at https://www.tenable.com/plugins/was/114247

]]> <![CDATA[Moodle 4.3.x < 4.3.10 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/114699 https://www.tenable.com/plugins/was/114699 Thu, 31 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 114699 with Critical Severity

Synopsis

Moodle 4.3.x < 4.3.10 Multiple Vulnerabilities

Description

According to its self-reported version, the Moodle install hosted on the remote host is prior to 4.1.16 or 4.3.x prior to 4.3.10 or 4.4.x prior to 4.4.6 or 4.5.x prior to 4.5.2. It is, therefore, affected by multiple vulnerabilities.

- An SQL injection risk was identified in the module list filter within course search.

- Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.

- Insufficient capability checks made it possible to disable badges a user does not have permission to access.

- The upstream RequireJS library was upgraded, which included a security fix.

- The question bank filter required additional sanitizing to prevent a reflected XSS risk.

- Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.

- The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.

- Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.

- Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.

- Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Moodle version 4.3.10 or later.

Read more at https://www.tenable.com/plugins/was/114699

]]> <![CDATA[OpenAPI Permissive Input Validation]]> https://www.tenable.com/plugins/was/113258 https://www.tenable.com/plugins/was/113258 Mon, 28 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 113258 with Medium Severity

Synopsis

OpenAPI Permissive Input Validation

Description

OpenAPI specification is an API description format for REST APIs. An OpenAPI file is written in YAML or JSON and describes all the API properties like the available endpoints with the related operations or the authentication methods.

The `Schema` object allows the definition of input and output data types which can be objects or primitives and arrays. When some data types properties are missing on objects specified in the definition file, the API implementation could potentially allow malicious input formats, leaving it open to multiple vulnerabilities like Denial of Service (DoS) or Remote Code Execution (RCE).

The scanner analyzed an OpenAPI definition file and detected the lack of properties on some data types.

Solution

Ensure that the missing properties are declared in the OpenAPI definition file according to the file specification and that the API backend enforces the validation of these properties on the inputs.

Read more at https://www.tenable.com/plugins/was/113258

]]> <![CDATA[Bootstrap Unsupported Version]]> https://www.tenable.com/plugins/was/114902 https://www.tenable.com/plugins/was/114902 Thu, 24 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 114902 with Critical Severity

Synopsis

Bootstrap Unsupported Version

Description

The installation of Boostrap detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

Solution

Upgrade to a supported version of Bootstrap.

Read more at https://www.tenable.com/plugins/was/114902

]]> <![CDATA[Bootstrap 3.2.x <= 3.4.1 Cross-Site Scripting]]> https://www.tenable.com/plugins/was/114901 https://www.tenable.com/plugins/was/114901 Thu, 24 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 114901 with Medium Severity

Synopsis

Bootstrap 3.2.x <= 3.4.1 Cross-Site Scripting

Description

According to its self-reported version number, Bootstrap is 3.2.x prior 3.4.1 . Therefore, it may be affected by a Cross-Site Scripting (XSS) vulnerability within the Carousel component.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Bootstrap version 5.0 or later.

Read more at https://www.tenable.com/plugins/was/114901

]]> <![CDATA[Bootstrap < 4.0.0 Multiples Cross-Site Scripting]]> https://www.tenable.com/plugins/was/114900 https://www.tenable.com/plugins/was/114900 Thu, 24 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 114900 with Medium Severity

Synopsis

Bootstrap < 4.0.0 Multiples Cross-Site Scripting

Description

According to its self-reported version number, Bootstrap is prior to 4.0.0. Therefore, it may be affected by Multiples Cross-Site Scripting (XSS) vulnerability :

- A Cross-Site Scripting (XSS) vulnerability has been identified within the Bootstrap 3 Button component.

- A Cross-Site Scripting (XSS) vulnerability has been identified within the Bootstrap 3 Popover component and Bootstrap 3 Tooltip component, which allows unsanitized HTML to be used.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Bootstrap version 4.0 or later.

Read more at https://www.tenable.com/plugins/was/114900

]]> <![CDATA[Blind XPath Injection (differential analysis)]]> https://www.tenable.com/plugins/was/113310 https://www.tenable.com/plugins/was/113310 Thu, 24 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 113310 with High Severity

Synopsis

Blind XPath Injection (differential analysis)

Description

XML Path Language (XPath) queries are used by web applications for selecting nodes from XML documents. Once selected, the value of these nodes can then be used by the application.

A simple example for the use of XML documents is to store user information. As part of the authentication process, the application will perform an XPath query to confirm the login credentials and retrieve that user's information to use in the following request.

XPath injection occurs where untrusted data is used to build XPath queries.

Cyber-criminals may abuse this injection vulnerability to bypass authentication, query other user's information, or, if the XML document contains privileged user credentials, allow the cyber-criminal to escalate their privileges.

Scanner injected special XPath query characters into the page and based on the responses from the server, has determined that the page is vulnerable to XPath injection.

This injection was detected as scanner was able to inject specific XPath queries, that if vulnerable, result in the responses for each injection being different. This is known as a blind XPath injection vulnerability.

Solution

The preferred way to protect against XPath injection is to utilise parameterized (also known as prepared) XPath queries. When utilising this method of querying the XML document any value supplied by the client will be handled as a string rather than part of the XPath query.
An alternative to parameterized queries it to use precompiled XPath queries. Precompiled XPath queries are not generated dynamically and will therefor never process user supplied input as XPath.

Read more at https://www.tenable.com/plugins/was/113310

]]> <![CDATA[Well-Known URIs Detected]]> https://www.tenable.com/plugins/was/114029 https://www.tenable.com/plugins/was/114029 Fri, 18 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 114029 with Info Severity

Synopsis

Well-Known URIs Detected

Description

Well-known URIs are used to store site-wide metadata and to make it available for some web-based protocols which require the discovery of a policy or retrieve specific information about a given host. These URIs use the `/.well-known` path prefix and are standardized to avoid collisions.

Solution

Read more at https://www.tenable.com/plugins/was/114029

]]> <![CDATA[DOM-based Cross-Site Scripting (XSS)]]> https://www.tenable.com/plugins/was/98109 https://www.tenable.com/plugins/was/98109 Thu, 10 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 98109 with Medium Severity

Synopsis

DOM-based Cross-Site Scripting (XSS)

Description

Client-side scripts are used extensively by modern web applications. They perform from simple functions (such as the formatting of text) up to full manipulation of client-side data and Operating System interaction.

Unlike traditional Cross-Site Scripting (XSS), where the client is able to inject scripts into a request and have the server return the script to the client, DOM XSS does not require that a request be sent to the server and may be abused entirely within the loaded page.

This occurs when elements of the DOM (known as the sources) are able to be manipulated to contain untrusted data, which the client-side scripts (known as the sinks) use or execute an unsafe way.

Scanner has discovered that by inserting an HTML element into the page's DOM inputs (sources), it was possible to then have the HTML element rendered as part of the page by the sink.

Solution

Client-side document rewriting, redirection, or other sensitive action, using untrusted data, should be avoided wherever possible, as these may not be inspected by server side filtering.
To remedy DOM XSS vulnerabilities where these sensitive document actions must be used, it is essential to:
1. Ensure any untrusted data is treated as text, as opposed to being interpreted as code or mark-up within the page. 2. Escape untrusted data prior to being used within the page. Escaping methods will vary depending on where the untrusted data is being used. (See references for details.) 3. Use `document.createElement`, `element.setAttribute`, `element.appendChild`, etc. to build dynamic interfaces as opposed to HTML rendering methods such as `document.write`, `document.writeIn`, `element.innerHTML`, or `element.outerHTML `etc.

Read more at https://www.tenable.com/plugins/was/98109

]]> <![CDATA[MCP Server SSE DNS Rebinding]]> https://www.tenable.com/plugins/was/114885 https://www.tenable.com/plugins/was/114885 Thu, 03 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 114885 with Medium Severity

Synopsis

MCP Server SSE DNS Rebinding

Description

ModelContextProtocol (MCP) servers using SSE (Server-Sent Events) transport mode are prone to DNS rebinding attacks when they do not enforce strict verification of both the 'Origin' and 'Host' headers. This vulnerability allows an attacker to bypass same-origin policies, potentially leading to unauthorized access to sensitive data or actions on behalf of the user in the context of the vulnerable MCP server.

This detection is included in the AI and LLM category.

Solution

Ensure that the MCP server enforces both the 'Origin' and the 'Host' header validation to prevent DNS rebinding attacks. This can be achieved by implementing strict validation rules for incoming requests, ensuring that the 'Host' header matches the expected domain and that the 'Origin' header is from a trusted source.

Read more at https://www.tenable.com/plugins/was/114885

]]> <![CDATA[SimpleHelp Detected]]> https://www.tenable.com/plugins/was/114655 https://www.tenable.com/plugins/was/114655 Thu, 03 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 114655 with Info Severity

Synopsis

SimpleHelp Detected

Description

This is an informational notice that the scanner was able to detect a SimpleHelp instance on the target server.

Note that this detection is included in the Remote Access Tools category.

Solution

Read more at https://www.tenable.com/plugins/was/114655

]]> <![CDATA[BackupBuddy Plugin for WordPress < 8.7.5 Arbitrary File Read]]> https://www.tenable.com/plugins/was/113369 https://www.tenable.com/plugins/was/113369 Thu, 03 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 113369 with High Severity

Synopsis

BackupBuddy Plugin for WordPress < 8.7.5 Arbitrary File Read

Description

The WordPress BackupBuddy Plugin installed on the remote host is affected by an arbitrary file read vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to BackupBuddy Plugin for WordPress 8.7.5 or latest.

Read more at https://www.tenable.com/plugins/was/113369

]]> <![CDATA[Server-Side Request Forgery]]> https://www.tenable.com/plugins/was/112439 https://www.tenable.com/plugins/was/112439 Thu, 03 Jul 2025 00:00:00 GMT Web App Scanning Plugin ID 112439 with High Severity

Synopsis

Server-Side Request Forgery

Description

Web applications often rely on network requests to query external resources and retrieve data in order to process it.

A Server-Side Request Forgery (SSRF) vulnerability exists when an attacker is able to control these outbound requests and send it to a resource he owns, to the localhost itself, or to a private host in the target application internal network.

By injecting a specific request and using various protocols (like HTTPS or Gopher for example), the attacker can leverage this vulnerability to try gaining access to sensitive data, performing unauthorized modifications or getting remote code execution in the target environment.

Depending on the web application configuration, the vulnerability may be of three types:

 - Blind : the application executes the malicious request but does not return any response to the attacker. The exploitation is difficult as the attacker has to only rely on his own knowledge of the target to conduct his attack.

 - Half-blind : the malicious request is executed and the response is partially returned to the the attacker. For example, the application may return different error messages related to the status of the outbound request. The exploitation remains difficult, however the attacker can gather information to help conducting his attack further.

 - Non-blind : The application returns the full content of the response to the malicious request. The exploitation is easier and generally makes the impact of this vulnerability more critical.

The scanner has been able to detect a Server-Side Request Forgery vulnerability by injecting a crafted request in the target application which performed an external request and returned a partial or full response.

Solution

The mitigation mainly depends on the application purpose and design but it is generally recommended to apply the defense in depth principle and enforce controls at both application and network layers.
In the application, inputs are processed by a parser which can be abused in various cases. It is recommended to avoid allowing the user to send full URLs to the application and to validate hostnames or IP addresses against a whitelist, if applicable, prior performing the request. Otherwise, using a blacklist is a solution to prevent requests to the localhost and all the assets of the internal infrastructure. As applications sometimes use a library such as libcurl for performing the requests, ensure that the component is up-to-date to avoid exploitation of a security vulnerability in the parser itself.
At the network layer, an approach is to implement network segregation to control and limit traffic between the hosts of the infrastructure and use security services like firewalls or web proxies to enforce the network restrictions.

Read more at https://www.tenable.com/plugins/was/112439

]]> <![CDATA[Flowise Chatflow Detected]]> https://www.tenable.com/plugins/was/114313 https://www.tenable.com/plugins/was/114313 Thu, 26 Jun 2025 00:00:00 GMT Web App Scanning Plugin ID 114313 with Info Severity

Synopsis

Flowise Chatflow Detected

Description

This is an informational plugin to inform the user that the scanner has detected the use of a Flowise Chatflow. This detection is included in the AI and LLM category.

Solution

Read more at https://www.tenable.com/plugins/was/114313

]]> <![CDATA[Microsoft Exchange Autodiscover V2 User Enumeration]]> https://www.tenable.com/plugins/was/114590 https://www.tenable.com/plugins/was/114590 Tue, 24 Jun 2025 00:00:00 GMT Web App Scanning Plugin ID 114590 with Medium Severity

Synopsis

Microsoft Exchange Autodiscover V2 User Enumeration

Description

On-Premise installation of Microsoft Exchange is prone to a user enumeration through the ActiveSync protocol using the AutodiscoverV2 endpoint.

Solution

If the Autodiscover feature is not required for external access, restrict access to internal networks only via network filtering or IIS rules, or disable ActiveSync if not required.

Read more at https://www.tenable.com/plugins/was/114590

]]> <![CDATA[Microsoft Exchange Server Autodiscover Cross-Site Scripting]]> https://www.tenable.com/plugins/was/113057 https://www.tenable.com/plugins/was/113057 Tue, 24 Jun 2025 00:00:00 GMT Web App Scanning Plugin ID 113057 with Medium Severity

Synopsis

Microsoft Exchange Server Autodiscover Cross-Site Scripting

Description

Microsoft Exchange Server versions 2019 before cumulative update 11, 2016 before cumulative update 22 and 2013 before cumulative update 23 are affected by a cross-site scripting vulnerability through the `autodiscover/autodiscover.json` endpoint. By crafting a specific URL, an attacker could target any Exchange user and try conducting phishing attacks or performing arbitrary modification on the target application.

Solution

Apply cumulative update 11 for Exchange Server 2019, cumulative update 22 for Exchange Server 2016 and cumulative update 23 for Exchange Server 2013 as described on Microsoft website.

Read more at https://www.tenable.com/plugins/was/113057

]]> <![CDATA[MCP Server Unauthenticated Access]]> https://www.tenable.com/plugins/was/114791 https://www.tenable.com/plugins/was/114791 Wed, 18 Jun 2025 00:00:00 GMT Web App Scanning Plugin ID 114791 with Info Severity

Synopsis

MCP Server Unauthenticated Access

Description

This is an informational notice that the scanner was able to detect a Model Context Protocol (MCP) server available without authentication on the target server. When available, the plugin provides the list of tools, prompts and resources in the attachments.

Solution

Ensure that the unauthenticated access avability to this MCP server is expected and does not expose sensitive information.

Read more at https://www.tenable.com/plugins/was/114791

]]> <![CDATA[Backup File]]> https://www.tenable.com/plugins/was/98074 https://www.tenable.com/plugins/was/98074 Tue, 17 Jun 2025 00:00:00 GMT Web App Scanning Plugin ID 98074 with Medium Severity

Synopsis

Backup File

Description

A common practice when administering web applications is to create a copy/backup of a particular file or directory prior to making any modification to the file. Another common practice is to add an extension or change the name of the original file to signify that it is a backup (examples include `.bak`, `.orig`, `.backup`, etc.).

During the initial recon stages of an attack, cyber-criminals will attempt to locate backup files by adding common extensions onto files already discovered on the webserver. By analysing the response headers from the server they are able to determine if the backup file exists. These backup files can then assist in the compromise of the web application.

By utilising the same method, the scanner was able to discover a possible backup file.

Solution

Do not keep obsolete versions of files under the virtual web server root. If the detected file(s) contained sensitive information like credentials or private api keys, ensure that they have been rotated and are no longer active.

Read more at https://www.tenable.com/plugins/was/98074

]]> <![CDATA[Spring Boot Actuator Detected]]> https://www.tenable.com/plugins/was/113195 https://www.tenable.com/plugins/was/113195 Tue, 17 Jun 2025 00:00:00 GMT Web App Scanning Plugin ID 113195 with Info Severity

Synopsis

Spring Boot Actuator Detected

Description

This is an informational notice that the scanner was able to detect an accessible Spring Actuator. Actuator endpoints let you monitor and interact with your application. Spring Boot includes a number of built-in endpoints and lets you add your own. For example, the 'health' endpoint provides basic application health information.

Solution

Disable unnecessary endpoints and do not make sensitive endpoints externally accessible, limiting access to known IP Addresses.

Read more at https://www.tenable.com/plugins/was/113195

]]> <![CDATA[Apache Tomcat 9.0.0.M1 < 9.0.10 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/112290 https://www.tenable.com/plugins/was/112290 Tue, 17 Jun 2025 00:00:00 GMT Web App Scanning Plugin ID 112290 with Critical Severity

Synopsis

Apache Tomcat 9.0.0.M1 < 9.0.10 Multiple Vulnerabilities

Description

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.10. It is, therefore, affected by multiple vulnerabilities :

 - A flaw exists in WebSocket client because host name verification is missing

 - A flaw exists in NIO/NIO2 connectors due to a mishandling of close that can lead to reuse of user sessions

 - A flaw exists in CORS filter due to insecure defaults

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Apache Tomcat version 9.0.10 or later.

Read more at https://www.tenable.com/plugins/was/112290

]]> <![CDATA[Citrix Netscaler 14.1.x < 14.1-25.53 Information Disclosure]]> https://www.tenable.com/plugins/was/114784 https://www.tenable.com/plugins/was/114784 Fri, 06 Jun 2025 00:00:00 GMT Web App Scanning Plugin ID 114784 with Critical Severity

Synopsis

Citrix Netscaler 14.1.x < 14.1-25.53 Information Disclosure

Description

Citrix Netscaler version 14.1.x prior to 14.1-25.53 is affected by an information disclosure vulnerability. An unauthenticated remote attacker can exploit this vulnerability to gain access to sensitive information, including the Citrix Netscaler management console and SDX SVM.

Solution

Upgrade to Citrix Netscaler version 14.1-25.53 or later.

Read more at https://www.tenable.com/plugins/was/114784

]]> <![CDATA[Advanced Custom Fields Pro for WordPress 6.0.x < 6.1.6 Cross-Site Scripting]]> https://www.tenable.com/plugins/was/113908 https://www.tenable.com/plugins/was/113908 Wed, 04 Jun 2025 00:00:00 GMT Web App Scanning Plugin ID 113908 with Medium Severity

Synopsis

Advanced Custom Fields Pro for WordPress 6.0.x < 6.1.6 Cross-Site Scripting

Description

The WordPress Advanced Custom Fields Pro Plugin installed on the remote host is affected by a Cross-Site Scripting.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Advanced Custom Fields Pro for WordPress 6.1.6 or latest.

Read more at https://www.tenable.com/plugins/was/113908

]]> <![CDATA[Advanced Custom Fields for WordPress 6.0.x < 6.1.6 Cross-Site Scripting]]> https://www.tenable.com/plugins/was/113906 https://www.tenable.com/plugins/was/113906 Wed, 04 Jun 2025 00:00:00 GMT Web App Scanning Plugin ID 113906 with Medium Severity

Synopsis

Advanced Custom Fields for WordPress 6.0.x < 6.1.6 Cross-Site Scripting

Description

The WordPress Advanced Custom Fields Plugin installed on the remote host is affected by a Cross-Site Scripting.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Advanced Custom Fields for WordPress 6.1.6 or latest

Read more at https://www.tenable.com/plugins/was/113906

]]> <![CDATA[GraphQL Interface Detected]]> https://www.tenable.com/plugins/was/112907 https://www.tenable.com/plugins/was/112907 Wed, 04 Jun 2025 00:00:00 GMT Web App Scanning Plugin ID 112907 with Info Severity

Synopsis

GraphQL Interface Detected

Description

GraphQL is an open-source query and manipulation language for APIs and a server-side runtime built to handle these queries on the application dataset. Some web applications provide a friendly user interface to help developers building GraphQL queries and get the results.

The scanner detected the presence of one or more GraphQL interfaces.

Solution

Read more at https://www.tenable.com/plugins/was/112907

]]> <![CDATA[FortiOS 7.0.x < 7.0.13 / 7.2.x < 7.2.6 / 7.4.x < 7.4.2 Remote Code Execution]]> https://www.tenable.com/plugins/was/114795 https://www.tenable.com/plugins/was/114795 Tue, 27 May 2025 00:00:00 GMT Web App Scanning Plugin ID 114795 with Critical Severity

Synopsis

FortiOS 7.0.x < 7.0.13 / 7.2.x < 7.2.6 / 7.4.x < 7.4.2 Remote Code Execution

Description

FortiOS version 6.0.x prior to 6.0.16 or 6.2.x prior to 6.2.15 or 6.4.x prior to 6.4.14 or 7.0.x prior to 7.0.13 or 7.2.x prior to 7.2.6 or 7.4.x prior to 7.4.2 and FortiProxy version 7.0.x prior to 7.0.14 or 7.2.x prior to 7.2.8 or 7.4.x prior to 7.4.2 are affected by a vulnerability allowing allows a remote attacker to execute arbitrary code or command through a specially crafted request.

Solution

Upgrade to FortiOS 6.0.17, 6.2.15, 6.4.14, 7.0.13, 7.2.6, 7.4.2 or later.

Read more at https://www.tenable.com/plugins/was/114795

]]> <![CDATA[Form-based File Upload]]> https://www.tenable.com/plugins/was/98080 https://www.tenable.com/plugins/was/98080 Thu, 22 May 2025 00:00:00 GMT Web App Scanning Plugin ID 98080 with Info Severity

Synopsis

Form-based File Upload

Description

The design of many web applications require that users be able to upload files that will either be stored or processed by the receiving web server.

Scanner has flagged this not as a vulnerability, but as a prompt for the penetration tester to conduct further manual testing on the file upload function.

An insecure form-based file upload could allow a cyber-criminal a means to abuse and successfully exploit the server directly, and/or any third party that may later access the file. This can occur through uploading a file containing server side-code (such as PHP) that is then executed when requested by the client.

Solution

The identified page should at a minimum:
1. Whitelist permitted file types and block all others. This should be conducted on the MIME type of the file rather than its extension. 2. As the file is uploaded, and prior to being handled (written to the disk) by the server, the filename should be stripped of all control, special, or Unicode characters. 3. Ensure that the upload is conducted via the HTTP `POST` method rather than `GET` or `PUT`. 4. Ensure that the file is written to a directory that does not hold any execute permission and that all files within that directory inherit the same permissions. 5. Scan (if possible) with an up-to-date virus scanner before being stored. 6. Ensure that the application handles files as per the host operating system. For example, the length of the file name is appropriate, there is adequate space to store the file, protection against overwriting other files etc.

Read more at https://www.tenable.com/plugins/was/98080

]]> <![CDATA[Flask Weak Secret Key]]> https://www.tenable.com/plugins/was/114434 https://www.tenable.com/plugins/was/114434 Thu, 22 May 2025 00:00:00 GMT Web App Scanning Plugin ID 114434 with High Severity

Synopsis

Flask Weak Secret Key

Description

Flask applications use an application key to encrypt and sign various data, including session cookies and other sensitive information.

When a weak or easily guessable application key is used, it compromises the security of the entire application. Attackers can potentially decrypt sensitive data, forge valid session cookies, or even execute remote code in some scenarios.

Solution

The secret key used to sign the cookies in the application must be stronger (long and random) to prevent it from being retrieved with a bruteforce attack.

Read more at https://www.tenable.com/plugins/was/114434

]]> <![CDATA[Web Cache Poisoning Denial of Service]]> https://www.tenable.com/plugins/was/114006 https://www.tenable.com/plugins/was/114006 Thu, 22 May 2025 00:00:00 GMT Web App Scanning Plugin ID 114006 with High Severity

Synopsis

Web Cache Poisoning Denial of Service

Description

A caching system has been detected on the application and is vulnerable to web cache poisoning. By manipulating specific unkeyed inputs (headers or cookies that are not included when generating the cache key) it was possible to force the caching system to cache a response that contains user-controlled input. If a response is cached in a shared web cache, such as those commonly found in proxy servers, then all users of that cache will continue to receive the malicious content until the cache entry is purged. In this case, the affected resource will be unreachable, which, depending on the resource, can cause a DoS (Denial Of Service).

Note that the scanner performs a safe check that does not affect website visitors but only the scanner itself.

Solution

Disable caching for the affected input or pages. If both the affected input and caching behavior are required, configure the cache to ensure that the input is included in the cache key.

Read more at https://www.tenable.com/plugins/was/114006

]]> <![CDATA[Missing 'Content-Type' Header]]> https://www.tenable.com/plugins/was/98648 https://www.tenable.com/plugins/was/98648 Fri, 16 May 2025 00:00:00 GMT Web App Scanning Plugin ID 98648 with Low Severity

Synopsis

Missing 'Content-Type' Header

Description

The Content-Type header allows clients to find an appropriate way to render data, omission of this header can facilitate MIME sniffing attacks.

Solution

Configure your web server to include an 'Content-Type' header with a correct Content-Type defined therein.

Read more at https://www.tenable.com/plugins/was/98648

]]> <![CDATA[Host Header Injection]]> https://www.tenable.com/plugins/was/98623 https://www.tenable.com/plugins/was/98623 Fri, 16 May 2025 00:00:00 GMT Web App Scanning Plugin ID 98623 with Medium Severity

Synopsis

Host Header Injection

Description

When creating URI for links in web applications, developers often resort to the HTTP Host header available in HTTP request sent by client side. A remote attacker can exploit this by sending a fake header with a domain name under his control allowing him to poison web-cache or password reset emails for example.

Solution

Web application should not trust Host and X-Forwarded-Host and should use a secure SERVER_NAME instead of these headers.

Read more at https://www.tenable.com/plugins/was/98623

]]> <![CDATA[Missing HTTP Strict Transport Security Policy]]> https://www.tenable.com/plugins/was/98056 https://www.tenable.com/plugins/was/98056 Fri, 16 May 2025 00:00:00 GMT Web App Scanning Plugin ID 98056 with Medium Severity

Synopsis

Missing HTTP Strict Transport Security Policy

Description

The HTTP protocol by itself is clear text, meaning that any data that is transmitted via HTTP can be captured and the contents viewed. To keep data private and prevent it from being intercepted, HTTP is often tunnelled through either Secure Sockets Layer (SSL) or Transport Layer Security (TLS). When either of these encryption standards are used, it is referred to as HTTPS.

HTTP Strict Transport Security (HSTS) is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. This will be enforced by the browser even if the user requests a HTTP resource on the same server.

Cyber-criminals will often attempt to compromise sensitive information passed from the client to the server using HTTP. This can be conducted via various Man-in-The-Middle (MiTM) attacks or through network packet captures.

Scanner discovered that the affected application is using HTTPS however does not use the HSTS header.

Solution

Depending on the framework being used the implementation methods will vary, however it is advised that the `Strict-Transport-Security` header be configured on the server.
One of the options for this header is `max-age`, which is a representation (in milliseconds) determining the time in which the client's browser will adhere to the header policy.
Depending on the environment and the application this time period could be from as low as minutes to as long as days.

Read more at https://www.tenable.com/plugins/was/98056

]]> <![CDATA[SOAP API Detected]]> https://www.tenable.com/plugins/was/114166 https://www.tenable.com/plugins/was/114166 Fri, 16 May 2025 00:00:00 GMT Web App Scanning Plugin ID 114166 with Info Severity

Synopsis

SOAP API Detected

Description

This is an informational notice that the scanner was able to detect a SOAP API.

Solution

Read more at https://www.tenable.com/plugins/was/114166

]]> <![CDATA[Web Services Description Language (WSDL) File Detected]]> https://www.tenable.com/plugins/was/113973 https://www.tenable.com/plugins/was/113973 Fri, 16 May 2025 00:00:00 GMT Web App Scanning Plugin ID 113973 with Info Severity

Synopsis

Web Services Description Language (WSDL) File Detected

Description

A Web Services Description Language (WSDL) file has been detected on this url.

Solution

Read more at https://www.tenable.com/plugins/was/113973

]]> <![CDATA[Atlassian Bitbucket Remote Code Execution]]> https://www.tenable.com/plugins/was/113373 https://www.tenable.com/plugins/was/113373 Fri, 16 May 2025 00:00:00 GMT Web App Scanning Plugin ID 113373 with High Severity

Synopsis

Atlassian Bitbucket Remote Code Execution

Description

The Atlassian Bitbucket application running on the remote host is affected by a critical command injection vulnerability. A remote attacker with unauthenticated to a public Bitbucket repository, or authenticated access to a private repository can send a malicious HTTP request leading to arbitrary code execution.

Solution

Upgrade to version 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2, 8.3.1 or later.

Read more at https://www.tenable.com/plugins/was/113373

]]> <![CDATA[Username Disclosure]]> https://www.tenable.com/plugins/was/114615 https://www.tenable.com/plugins/was/114615 Tue, 29 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 114615 with Low Severity

Synopsis

Username Disclosure

Description

Web Applications can sometimes expose web applications users in various places such as HTML comments, JavaScript code or API requests. By leveraging this information, an attacker can gather information and build further attacks against the target application.

Solution

Avoid disclosing usernames in your application content.

Read more at https://www.tenable.com/plugins/was/114615

]]> <![CDATA[Polyfill Detected]]> https://www.tenable.com/plugins/was/114357 https://www.tenable.com/plugins/was/114357 Tue, 29 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 114357 with Medium Severity

Synopsis

Polyfill Detected

Description

The `polyfill.js` file is a popular open-source library to ensure old browsers compatibility when evaluating JavaScript code. Starting February 2024, the domain `polyfill.io` and the related GitHub account have been purchased by a malicious threat actor to inject malwares in all web applications relying on, at least, the `cdn.polyfill.io` domain. The `polyfill.js` file cannot be trusted anymore as the malicious code could have been redistributed on other CDNs or locally copied in various plugins.

Solution

Remove the detected file(s) immediately from the web application if they are embedded in it, and ensure that the script is not loaded from any untrusted external source. Some vendors have already put some mitigations in place to rewrite content using the malicious `polyfill.io` domain or to serve a safe version of the library.

Read more at https://www.tenable.com/plugins/was/114357

]]> <![CDATA[Local File Inclusion]]> https://www.tenable.com/plugins/was/98125 https://www.tenable.com/plugins/was/98125 Thu, 17 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 98125 with High Severity

Synopsis

Local File Inclusion

Description

Web applications occasionally use parameter values to store the location of a file which will later be required by the server.

An example of this is often seen in error pages, where the actual file path for the error page is stored in a parameter value -- for example `example.com/error.php?page=404.php`.

A file inclusion occurs when the parameter value (ie. path to file) can be substituted with the path of another resource on the same server, effectively allowing the displaying of arbitrary, and possibly restricted/sensitive, files.

Scanner discovered that it was possible to substitute a parameter value with another resource and have the server return the contents of the resource to the client within the response.

Solution

It is recommended that untrusted data is never used to form a file location to be included.
To validate data, the application should ensure that the supplied value for a file is permitted. This can be achieved by performing whitelisting on the parameter value, by matching it against a list of permitted files. If the supplied value does not match any value in the whitelist, then the server should redirect to a standard error page.
In some scenarios, where dynamic content is being requested, it may not be possible to perform validation against a list of trusted resources, therefore the list must also become dynamic (updated as the files change), or perform filtering to remove extraneous user input (such as semicolons, periods etc.) and only permit `a-z0-9`.
It is also advised that sensitive files are not stored within the web root and that the user permissions enforced by the directory are correct.

Read more at https://www.tenable.com/plugins/was/98125

]]> <![CDATA[Operating System Command Injection]]> https://www.tenable.com/plugins/was/98123 https://www.tenable.com/plugins/was/98123 Thu, 17 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 98123 with Critical Severity

Synopsis

Operating System Command Injection

Description

OS command injection occurs when user supplied input is used to form a command to be executed by the operating system.

Scanner was able to inject specific Operating System commands and have the output from that command contained within the server response. This indicates that input is not being sanitized properly.

Solution

It is recommended that untrusted data is never used to form a command to be executed by the OS.
To validate data, the application should ensure that the supplied value contains only the characters that are required to perform the required action.

Read more at https://www.tenable.com/plugins/was/98123

]]> <![CDATA[Path Traversal]]> https://www.tenable.com/plugins/was/98100 https://www.tenable.com/plugins/was/98100 Thu, 17 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 98100 with High Severity

Synopsis

Path Traversal

Description

Web applications occasionally use parameter values to store the location of a file which will later be required by the server.

An example of this is often seen in error pages, where the actual file path for the error page is stored in a parameter value -- for example `example.com/error.php?page=404.php`.

A path traversal occurs when the parameter value (ie. path to file being called by the server) can be substituted with the relative path of another resource which is located outside of the applications working directory. The server then loads the resource and includes its contents in the response to the client.

Cyber-criminals will abuse this vulnerability to view files that should otherwise not be accessible.

A very common example of this, on *nix servers, is gaining access to the `/etc/passwd` file in order to retrieve a list of server users. This attack would look like: `yoursite.com/error.php?page=../../../../etc/passwd`

As path traversal is based on the relative path, the payload must first traverse to the file system's root directory, hence the string of `../../../../`.

Scanner discovered that it was possible to substitute a parameter value with a relative path to a common operating system file and have the contents of the file included in the response.

Solution

It is recommended that untrusted data is never used to form a file location to be included.
To validate data, the application should ensure that the supplied value for a file is permitted. This can be achieved by performing whitelisting on the parameter value, by matching it against a list of permitted files. If the supplied value does not match any value in the whitelist, then the server should redirect to a standard error page.
In some scenarios, where dynamic content is being requested, it may not be possible to perform validation against a list of trusted resources, therefore the list must also become dynamic (updated as the files change), or perform filtering to remove extraneous user input (such as semicolons, periods etc.) and only permit `a-z0-9`.
It is also advised that sensitive files are not stored within the web root and that the user permissions enforced by the directory are correct.

Read more at https://www.tenable.com/plugins/was/98100

]]> <![CDATA[Jenkins < 2.442 / < LTS 2.426.3 Arbitrary File Read]]> https://www.tenable.com/plugins/was/114168 https://www.tenable.com/plugins/was/114168 Thu, 17 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 114168 with Critical Severity

Synopsis

Jenkins < 2.442 / < LTS 2.426.3 Arbitrary File Read

Description

A vulnerability exists in Jenkins < 2.442, < LTS 2.426.3 allowing an unauthenticated attacker to read arbitrary files via a specially crafted request and which in certain cases can lead to a Remote Code Execution.

Solution

Upgrade to Jenkins version 2.442, LTS 2.426.3 or later.

Read more at https://www.tenable.com/plugins/was/114168

]]> <![CDATA[Server-Side Inclusion Injection]]> https://www.tenable.com/plugins/was/113634 https://www.tenable.com/plugins/was/113634 Thu, 17 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 113634 with High Severity

Synopsis

Server-Side Inclusion Injection

Description

A Server-Side Include Injection vulnerability exists when an application embeds and evaluates unsafe user-controlled server-side include directives.

By injecting a specific payload an attacker can leverage this vulnerability to conduct a remote code execution.

Solution

Developers should avoid embedding user inputs into pages that are processed for SSI directives. If the application still requires this type of inputs, the expression syntax related to the framework being used should be sanitized prior processing it.

Read more at https://www.tenable.com/plugins/was/113634

]]> <![CDATA[Rails < 4.2.11.3 / 5.x < 5.0.1 Remote Code Execution]]> https://www.tenable.com/plugins/was/112720 https://www.tenable.com/plugins/was/112720 Thu, 17 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 112720 with High Severity

Synopsis

Rails < 4.2.11.3 / 5.x < 5.0.1 Remote Code Execution

Description

There is a code injection vulnerability in versions of Rails prior to 4.2.11.3 and 5.x prior to 5.0.1 that would allow an attacker who controlled the "locals" argument of a "render" call to perform a Remote Code Execution.

Solution

Upgrade Rails to 4.2.11.2, 5.0.1 or later.

Read more at https://www.tenable.com/plugins/was/112720

]]> <![CDATA[Oracle WebLogic 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.3.0 Remote Code Execution]]> https://www.tenable.com/plugins/was/112706 https://www.tenable.com/plugins/was/112706 Thu, 17 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 112706 with Critical Severity

Synopsis

Oracle WebLogic 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.3.0 Remote Code Execution

Description

A vulnerability in Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0 & 12.2.1.3.0 allows an unauthenticated attacker with HTTP access to the service to obtain arbitrary code execution due to an insecure deserialization.

Oracle proposes the associated patches on its site to fix the vulnerability.

Solution

Apply the security patches available on Oracle's website.

Read more at https://www.tenable.com/plugins/was/112706

]]> <![CDATA[Oracle WebLogic 10.3.6.0.0 / 12.1.3.0.0 Remote Code Execution]]> https://www.tenable.com/plugins/was/112704 https://www.tenable.com/plugins/was/112704 Thu, 17 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 112704 with Critical Severity

Synopsis

Oracle WebLogic 10.3.6.0.0 / 12.1.3.0.0 Remote Code Execution

Description

A vulnerability in Oracle WebLogic Server 10.3.6.0.0 & 12.1.3.0.0 allows an unauthenticated attacker with HTTP access to the service to obtain arbitrary code execution due to an insecure deserialization.

Oracle proposes the associated patches on its site to fix the vulnerability.

Solution

Apply the security patches available on Oracle's website.

Read more at https://www.tenable.com/plugins/was/112704

]]> <![CDATA[Oracle WebLogic Server Administration Console Detected]]> https://www.tenable.com/plugins/was/112545 https://www.tenable.com/plugins/was/112545 Thu, 17 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 112545 with Medium Severity

Synopsis

Oracle WebLogic Server Administration Console Detected

Description

Oracle WebLogic Server administration console has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality.

Solution

Restrict or disable access to administration console.

Read more at https://www.tenable.com/plugins/was/112545

]]> <![CDATA[Oracle WebLogic WSAT Remote Code Execution]]> https://www.tenable.com/plugins/was/112524 https://www.tenable.com/plugins/was/112524 Thu, 17 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 112524 with Critical Severity

Synopsis

Oracle WebLogic WSAT Remote Code Execution

Description

The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the WSAT endpoint due to unsafe deserialization of XML encoded Java objects. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context of the WebLogic server.

Solution

Apply the Oracle Critical Patch Update from October 2017. If the WSAT component is not applied in the WLS cluster, an immediate and temporary workaround is to delete it and restart the WebLogic domain controller service.

Read more at https://www.tenable.com/plugins/was/112524

]]> <![CDATA[Langflow < 1.3.0 Unauthenticated Remote Code Execution]]> https://www.tenable.com/plugins/was/114668 https://www.tenable.com/plugins/was/114668 Thu, 10 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 114668 with Critical Severity

Synopsis

Langflow < 1.3.0 Unauthenticated Remote Code Execution

Description

Langflow is vulnerable to an attack allowing an unauthenticated attacker to execute arbitrary code via a specially forged request on the '/api/v1/validate/code' endpoint. This detection is included in the AI and LLM category.

Solution

Upgrade to Langflow version 1.3.0 or later.

Read more at https://www.tenable.com/plugins/was/114668

]]> <![CDATA[WordPress Plugins Detected]]> https://www.tenable.com/plugins/was/113452 https://www.tenable.com/plugins/was/113452 Thu, 10 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 113452 with Info Severity

Synopsis

WordPress Plugins Detected

Description

This is an informational notice that the scanner was able to detect one or more installed WordPress plugins.

Solution

Read more at https://www.tenable.com/plugins/was/113452

]]> <![CDATA[Next.js 13.0.x < 13.5.9 Authorization Bypass]]> https://www.tenable.com/plugins/was/114681 https://www.tenable.com/plugins/was/114681 Fri, 04 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 114681 with Critical Severity

Synopsis

Next.js 13.0.x < 13.5.9 Authorization Bypass

Description

The version of Next.js installed on the remote host is 11.1.4 prior to 12.3.5, 13.0.x prior to 13.5.9, 14.x prior to 14.2.25 or 15.x prior to 15.2.3. It is, therefore, affected by Authorization Bypass if the authorization check occurs in middleware.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

Solution

Upgrade to Next.js version 13.5.9 or later.

Read more at https://www.tenable.com/plugins/was/114681

]]> <![CDATA[Ollama Multiples Vulnerabilities]]> https://www.tenable.com/plugins/was/114575 https://www.tenable.com/plugins/was/114575 Fri, 04 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 114575 with High Severity

Synopsis

Ollama Multiples Vulnerabilities

Description

According to the self-reported version in its response header, the version of Ollama hosted on the remote is, affected by a Multiples Vulnerabilities :

- File existence disclosure through the api. When calling the CreateModel route with a path parameter that does not exist - A Denial Of Service through a Division By Zero

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Restricting access to Ollama.

Read more at https://www.tenable.com/plugins/was/114575

]]> <![CDATA[Disclosed US Social Security Number]]> https://www.tenable.com/plugins/was/98920 https://www.tenable.com/plugins/was/98920 Thu, 03 Apr 2025 00:00:00 GMT Web App Scanning Plugin ID 98920 with Medium Severity

Synopsis

Disclosed US Social Security Number

Description

The US Social Security Number (SSN) is a personally identifiable number that is issued to its citizens. A stolen or leaked SSN can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an SSN located within the response of the affected page

Solution

Initially, the SSN within the response should be checked to ensure its validity, as it is possible that the regular expression has matched on a similar number with no relation to a real SSN. If the response does contain a valid SSN, then all efforts should be taken to remove or further protect this information. This can be achieved by removing the SSN altogether, or by masking the number so that only the last few digits are present within the response. (eg. _**********123_).

Read more at https://www.tenable.com/plugins/was/98920

]]> <![CDATA[Docker Compose Configuration Detected]]> https://www.tenable.com/plugins/was/113168 https://www.tenable.com/plugins/was/113168 Fri, 28 Mar 2025 00:00:00 GMT Web App Scanning Plugin ID 113168 with Medium Severity

Synopsis

Docker Compose Configuration Detected

Description

Docker Compose is a tool designed to help developers defining and running multi-container Docker applications. By defining a configuration file named `docker-compose.yml` in their application project directory, developers can define the different services used by the application with their configurations.

By accessing an exposed `docker-compose.yml` file, an attacker could leverage the vulnerability to gain unauthorized access to sensitive information.

Solution

Ensure that the `docker-compose.yml` file is not deployed with the application or, at least, is not exposed in a web server directory by setting proper permissions on it. If sensitive information like credentials are leaked in the exposed file, they should be revoked and reset on the affected assets.

Read more at https://www.tenable.com/plugins/was/113168

]]> <![CDATA[Dockerfile Detected]]> https://www.tenable.com/plugins/was/113123 https://www.tenable.com/plugins/was/113123 Fri, 28 Mar 2025 00:00:00 GMT Web App Scanning Plugin ID 113123 with Medium Severity

Synopsis

Dockerfile Detected

Description

Docker is one of the most popular platform using virtualization at the operating system level to deliver software in packages called containers. To take advantage of cloud based infrastructures, developers often build their applications on top of the microservices architecture pattern with one or multiple Docker containers, helping them to quickly build and deploy it to various environments.

Docker containers are based on a `Dockerfile` file describing the different steps to build the application and containing sometimes hardcoded secrets or other sensitive information. By accessing an exposed `Dockerfile`, an attacker could leverage the vulnerability to gain unauthorized access to one or multiple web application components.

Solution

Ensure that the `Dockerfile` file is not deployed with the application or, at least, is not exposed in a web server directory by setting proper permissions on it. Note that application secrets should not be directly defined in the `Dockerfile` file and should instead rely on Docker secrets management best practices.

Read more at https://www.tenable.com/plugins/was/113123

]]> <![CDATA[SSL/TLS Certificate Common Name Mismatch]]> https://www.tenable.com/plugins/was/112541 https://www.tenable.com/plugins/was/112541 Fri, 28 Mar 2025 00:00:00 GMT Web App Scanning Plugin ID 112541 with Medium Severity

Synopsis

SSL/TLS Certificate Common Name Mismatch

Description

The remote server presents a SSL/TLS certificate for which the Common Name and the Subject Alternative Name don't match the server's hostname.

Solution

Purchase or generate a new SSL/TLS certificate with the right Common Name or Subject Alternative Name to replace the existing one.

Read more at https://www.tenable.com/plugins/was/112541

]]> <![CDATA[External Broken Resources Detected]]> https://www.tenable.com/plugins/was/114386 https://www.tenable.com/plugins/was/114386 Mon, 24 Mar 2025 00:00:00 GMT Web App Scanning Plugin ID 114386 with Low Severity

Synopsis

External Broken Resources Detected

Description

Web applications heavily rely on external resources such as JavaScript files, Cascading Style Sheets (CSS) or images. When an application uses links which targets external resources which do not exist, an attacker could try gaining control over this resource to inject code in the target web application or get application users traffic on their malicious servers.

Solution

Review broken resources and remove them from the target application. Before referencing external resources in a web application, ensure that the target resource exist and that the behavior is expected.

Read more at https://www.tenable.com/plugins/was/114386

]]> <![CDATA[Blind SQL Injection (differential analysis)]]> https://www.tenable.com/plugins/was/98117 https://www.tenable.com/plugins/was/98117 Tue, 18 Mar 2025 00:00:00 GMT Web App Scanning Plugin ID 98117 with High Severity

Synopsis

Blind SQL Injection (differential analysis)

Description

Due to the requirement for dynamic content of today's web applications, many rely on a database backend to store data that will be called upon and processed by the web application (or other programs). Web applications retrieve data from the database by using Structured Query Language (SQL) queries.

To meet demands of many developers, database servers (such as MSSQL, MySQL, Oracle etc.) have additional built-in functionality that can allow extensive control of the database and interaction with the host operating system itself.

An SQL injection occurs when a value originating from the client's request is used within a SQL query without prior sanitisation. This could allow cyber-criminals to execute arbitrary SQL code and steal data or use the additional functionality of the database server to take control of more server components.

The successful exploitation of a SQL injection can be devastating to an organisation and is one of the most commonly exploited web application vulnerabilities.

This injection was detected as scanner was able to inject specific SQL queries, that if vulnerable, result in the responses for each injection being different. This is known as a blind SQL injection vulnerability.

Solution

The only proven method to prevent against SQL injection attacks while still maintaining full application functionality is to use parameterized queries (also known as prepared statements). When utilising this method of querying the database, any value supplied by the client will be handled as a string value rather than part of the SQL query.
Additionally, when utilising parameterized queries, the database engine will automatically check to make sure the string being used matches that of the column. For example, the database engine will check that the user supplied input is an integer if the database column is configured to contain integers.

Read more at https://www.tenable.com/plugins/was/98117

]]> <![CDATA[Docker Public Registry Detected]]> https://www.tenable.com/plugins/was/114621 https://www.tenable.com/plugins/was/114621 Tue, 18 Mar 2025 00:00:00 GMT Web App Scanning Plugin ID 114621 with Info Severity

Synopsis

Docker Public Registry Detected

Description

This is an informational notice that the scanner was able to detect a public Docker registry instance.

Solution

Ensure that the public permissions applied on the detected registry are expected.

Read more at https://www.tenable.com/plugins/was/114621

]]> <![CDATA[Apache OFBiz < 18.12.11 Server-Side Request Forgery]]> https://www.tenable.com/plugins/was/114400 https://www.tenable.com/plugins/was/114400 Tue, 18 Mar 2025 00:00:00 GMT Web App Scanning Plugin ID 114400 with High Severity

Synopsis

Apache OFBiz < 18.12.11 Server-Side Request Forgery

Description

Apache OFBiz versions prior to 18.12.11 suffers from a vulnerability allowing an unauthenticated attacker to perform a Server-Side Request Forgery via a specially forged request.

Solution

Upgrade to Apache OFBiz version 18.12.11 or later.

Read more at https://www.tenable.com/plugins/was/114400

]]> <![CDATA[Cross-Site Scripting (XSS)]]> https://www.tenable.com/plugins/was/98104 https://www.tenable.com/plugins/was/98104 Tue, 11 Mar 2025 00:00:00 GMT Web App Scanning Plugin ID 98104 with Medium Severity

Synopsis

Cross-Site Scripting (XSS)

Description

Client-side scripts are used extensively by modern web applications. They perform from simple functions (such as the formatting of text) up to full manipulation of client-side data and Operating System interaction.

Cross Site Scripting (XSS) allows clients to inject scripts into a request and have the server return the script to the client in the response. This occurs because the application is taking untrusted data (in this example, from the client) and reusing it without performing any validation or sanitisation.

If the injected script is returned immediately this is known as reflected XSS. If the injected script is stored by the server and returned to any client visiting the affected page, then this is known as persistent XSS (also stored XSS).

Scanner has discovered that it is possible to insert script content directly into HTML element content.

Solution

To remedy XSS vulnerabilities, it is important to never use untrusted or unfiltered data within the code of a HTML page.
Untrusted data can originate not only form the client but potentially a third party or previously uploaded file etc.
Filtering of untrusted data typically involves converting special characters to their HTML entity encoded counterparts (however, other methods do exist, see references). These special characters include:
* `&` * `<` * `>` * `'` * `'` * `/`
An example of HTML entity encoding is converting `<` to `<`.
Although it is possible to filter untrusted input, there are five locations within an HTML page where untrusted input (even if it has been filtered) should never be placed:
1. Directly in a script. 2. Inside an HTML comment. 3. In an attribute name. 4. In a tag name. 5. Directly in CSS.
Each of these locations have their own form of escaping and filtering.
_Because many browsers attempt to implement XSS protection, any manual verification of this finding should be conducted using multiple different browsers and browser versions._

Read more at https://www.tenable.com/plugins/was/98104

]]> <![CDATA[CraftCMS < 4.13.2 / 5.x < 5.5.2 Remote Code Execution]]> https://www.tenable.com/plugins/was/114614 https://www.tenable.com/plugins/was/114614 Tue, 11 Mar 2025 00:00:00 GMT Web App Scanning Plugin ID 114614 with Critical Severity

Synopsis

CraftCMS < 4.13.2 / 5.x < 5.5.2 Remote Code Execution

Description

The version of CraftCMS installed on the remote host is vulnerable to a Remote Code Execution (RCE) via a specially forged request when the register_argc_argv php option is enabled.

Solution

Upgrade to CraftCMS version 4.13.2, 5.5.2 or later.

Read more at https://www.tenable.com/plugins/was/114614

]]> <![CDATA[XML External Entity]]> https://www.tenable.com/plugins/was/98113 https://www.tenable.com/plugins/was/98113 Tue, 25 Feb 2025 00:00:00 GMT Web App Scanning Plugin ID 98113 with Critical Severity

Synopsis

XML External Entity

Description

An XML External Entity attack is a type of attack against an application that parses XML input.

This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.

This attack may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts.

Solution

Since the whole XML document is communicated from an untrusted client, it's not usually possible to selectively validate or escape tainted data within the system identifier in the DTD.
Therefore, the XML processor should be configured to use a local static DTD and disallow any declared DTD included in the XML document.

Read more at https://www.tenable.com/plugins/was/98113

]]> <![CDATA[CAPTCHA Detection]]> https://www.tenable.com/plugins/was/98083 https://www.tenable.com/plugins/was/98083 Tue, 25 Feb 2025 00:00:00 GMT Web App Scanning Plugin ID 98083 with Info Severity

Synopsis

CAPTCHA Detection

Description

Detects any known CAPTCHA products being used on a page.

Solution

Read more at https://www.tenable.com/plugins/was/98083

]]> <![CDATA[AngularJS Unsupported Version]]> https://www.tenable.com/plugins/was/113078 https://www.tenable.com/plugins/was/113078 Mon, 24 Feb 2025 00:00:00 GMT Web App Scanning Plugin ID 113078 with High Severity

Synopsis

AngularJS Unsupported Version

Description

The installation of AngularJS detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

Solution

Migrate to a supported version of Angular.

Read more at https://www.tenable.com/plugins/was/113078

]]> <![CDATA[Out-of-Date MediaElement.Js Detected]]> https://www.tenable.com/plugins/was/113034 https://www.tenable.com/plugins/was/113034 Wed, 12 Feb 2025 00:00:00 GMT Web App Scanning Plugin ID 113034 with Info Severity

Synopsis

Out-of-Date MediaElement.Js Detected

Description

An out-of-date version of MediaElement.Js has been detected. An outdated version could have vulnerabilities or missing security features.

Solution

Upgrade to the latest version of MediaElement.Js.

Read more at https://www.tenable.com/plugins/was/113034

]]> <![CDATA[Out-of-Date JQuery UI Detected]]> https://www.tenable.com/plugins/was/113031 https://www.tenable.com/plugins/was/113031 Wed, 12 Feb 2025 00:00:00 GMT Web App Scanning Plugin ID 113031 with Info Severity

Synopsis

Out-of-Date JQuery UI Detected

Description

An out-of-date version of JQuery UI has been detected. An outdated version could have vulnerabilities or missing security features.

Solution

Upgrade to the latest version of JQuery UI.

Read more at https://www.tenable.com/plugins/was/113031

]]> <![CDATA[NoSQL Injection Authentication Bypass]]> https://www.tenable.com/plugins/was/113337 https://www.tenable.com/plugins/was/113337 Wed, 29 Jan 2025 00:00:00 GMT Web App Scanning Plugin ID 113337 with High Severity

Synopsis

NoSQL Injection Authentication Bypass

Description

A NoSQL injection occurs when a value originating from the client's request is used within a NoSQL call without prior sanitisation.

This can allow cyber-criminals to execute arbitrary NoSQL code and thus steal data, or use the additional functionality of the database server to take control of further server components.

Scanner discovered that the affected page and parameter are vulnerable. This injection was detected as scanner was able to discover known error messages within the server's response.

Solution

The most effective remediation against NoSQL injection attacks is to ensure that NoSQL API calls are not constructed via string concatenation that includes unsanitized data.
Sanitization is best achieved using existing escaping libraries.

Read more at https://www.tenable.com/plugins/was/113337

]]> <![CDATA[MySQLjs SQL Injection Authentication Bypass]]> https://www.tenable.com/plugins/was/113162 https://www.tenable.com/plugins/was/113162 Wed, 29 Jan 2025 00:00:00 GMT Web App Scanning Plugin ID 113162 with High Severity

Synopsis

MySQLjs SQL Injection Authentication Bypass

Description

An SQL injection occurs when a value originating from the client's request is used within a SQL query without prior sanitisation. Typically, query escape functions or placeholders are known to prevent SQL injections. However, mysqljs/mysql is known to have different escape methods over different value types, and it could eventually cause unexpected behaviors when the attacker passes the parameter with a different value type.

This injection was detected as scanner was able to bypass the authentication mechanism and access an authenticated page.

Solution

Add stringifyObjects option when calling createConnection, or adding a type control before the SQL query is executed.

Read more at https://www.tenable.com/plugins/was/113162

]]> <![CDATA[Blind NoSQL Injection (differential analysis)]]> https://www.tenable.com/plugins/was/98119 https://www.tenable.com/plugins/was/98119 Mon, 20 Jan 2025 00:00:00 GMT Web App Scanning Plugin ID 98119 with High Severity

Synopsis

Blind NoSQL Injection (differential analysis)

Description

A NoSQL injection occurs when a value originating from the client's request is used within a NoSQL call without prior sanitisation.

This can allow cyber-criminals to execute arbitrary NoSQL code and thus steal data, or use the additional functionality of the database server to take control of further server components.

Scanner discovered that the affected page and parameter are vulnerable. This injection was detected as scanner was able to inject specific NoSQL queries that if vulnerable result in the responses for each injection being different. This is known as a blind NoSQL injection vulnerability.

Solution

The most effective remediation against NoSQL injection attacks is to ensure that NoSQL API calls are not constructed via string concatenation that includes unsanitized data.
Sanitization is best achieved using existing escaping libraries.

Read more at https://www.tenable.com/plugins/was/98119

]]> <![CDATA[Common Administration Interfaces Detection]]> https://www.tenable.com/plugins/was/98070 https://www.tenable.com/plugins/was/98070 Fri, 17 Jan 2025 00:00:00 GMT Web App Scanning Plugin ID 98070 with Info Severity

Synopsis

Common Administration Interfaces Detection

Description

Scanner detected a common administration interface.

Solution

Access to administration interfaces should be restricted to trusted IP addresses only.

Read more at https://www.tenable.com/plugins/was/98070

]]> <![CDATA[LayerSlider Plugin for WordPress 7.9.11 < 7.10.1 SQL Injection]]> https://www.tenable.com/plugins/was/114258 https://www.tenable.com/plugins/was/114258 Fri, 17 Jan 2025 00:00:00 GMT Web App Scanning Plugin ID 114258 with High Severity

Synopsis

LayerSlider Plugin for WordPress 7.9.11 < 7.10.1 SQL Injection

Description

The WordPress LayerSlider Plugin installed on the remote host is affected by an SQL Injection.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to LayerSlider Plugin for WordPress 7.10.1 or latest.

Read more at https://www.tenable.com/plugins/was/114258

]]> <![CDATA[Missing 'X-XSS-Protection' Header (deprecated)]]> https://www.tenable.com/plugins/was/112526 https://www.tenable.com/plugins/was/112526 Fri, 17 Jan 2025 00:00:00 GMT Web App Scanning Plugin ID 112526 with Info Severity

Synopsis

Missing 'X-XSS-Protection' Header (deprecated)

Description

The HTTP 'X-XSS-Protection' response header is a feature of old browsers that allows websites to control their XSS auditors.\n\nThe server is not configured to return a 'X-XSS-Protection' header which means that any pages on this website could be at risk of a Cross-Site Scripting (XSS) attack. This URL is flagged as a specific example.\n\nHowever, this header is deprecated by modern browsers, if legacy browsers support is not needed, it is recommended to use Content-Security-Policy without allowing unsafe-inline scripts instead.

Solution

Configure your web server to include an 'X-XSS-Protection' header with a value of '1; mode=block' on all pages.

Read more at https://www.tenable.com/plugins/was/112526

]]> <![CDATA[Common Files Detection]]> https://www.tenable.com/plugins/was/98071 https://www.tenable.com/plugins/was/98071 Thu, 09 Jan 2025 00:00:00 GMT Web App Scanning Plugin ID 98071 with Info Severity

Synopsis

Common Files Detection

Description

Scanner has detected common sensitive files on the remote web server.

Web applications are often made up of multiple files and directories. It is possible that over time some files may become unreferenced (unused) by the web application and forgotten about by the administrator or developer. Because web applications are built using common frameworks, they contain common files that can be discovered (independent of server).

During the initial reconnaissance stages of an attack, cyber-criminals will attempt to locate unreferenced files in the hope that the file will assist in further compromise of the web application. To achieve this, they will make thousands of requests using word lists containing common filenames. The response headers from the server will then indicate if the file exists.

Solution

If files are unreferenced, then they should be removed from the web root and/or the application directory.
Preventing access without authentication may also be an option and can stop a client from being able to view the contents of a file; however, it is still likely that the directory structure will be able to be discovered.
Using obscure file names is implementing 'security through obscurity' and is not a recommended option.

Read more at https://www.tenable.com/plugins/was/98071

]]> <![CDATA[Apache Struts < 6.4.0 Unrestricted File Upload (S2-067)]]> https://www.tenable.com/plugins/was/114549 https://www.tenable.com/plugins/was/114549 Tue, 07 Jan 2025 00:00:00 GMT Web App Scanning Plugin ID 114549 with Critical Severity

Synopsis

Apache Struts < 6.4.0 Unrestricted File Upload (S2-067)

Description

Apache Struts versions prior to 6.4.0 are vulnerable to an upload logic flaw allowing an attacker to manipulate file upload parameters to enable path traversal and under some circumstances this can lead to a remote code execution.

Solution

Refer to the S2-067 vendor advisory for mitigation options.

Read more at https://www.tenable.com/plugins/was/114549

]]> <![CDATA[DOM-based Cross-Site Scripting (XSS) in attribute context]]> https://www.tenable.com/plugins/was/98110 https://www.tenable.com/plugins/was/98110 Mon, 23 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 98110 with Medium Severity

Synopsis

DOM-based Cross-Site Scripting (XSS) in attribute context

Description

Client-side scripts are used extensively by modern web applications. They perform from simple functions (such as the formatting of text) up to full manipulation of client-side data and Operating System interaction.

Unlike traditional Cross-Site Scripting (XSS), where the client is able to inject scripts into a request and have the server return the script to the client, DOM XSS does not require that a request be sent to the server and may be abused entirely within the loaded page.

This occurs when elements of the DOM (known as the sources) are able to be manipulated to contain untrusted data, which the client-side scripts (known as the sinks) use or execute an unsafe way.

Scanner has discovered that by modifying the affected DOM source, it is possible to insert and execute JavaScript code.

Solution

Client-side document rewriting, redirection, or other sensitive action, using untrusted data, should be avoided wherever possible, as these may not be inspected by server side filtering.
To remedy DOM XSS vulnerabilities where these sensitive document actions must be used, it is essential to:
1. Ensure any untrusted data is treated as text, as opposed to being interpreted as code or mark-up within the page. 2. Escape untrusted data prior to being used within the page. Escaping methods will vary depending on where the untrusted data is being used. (See references for details.) 3. Use `document.createElement`, `element.setAttribute`, `element.appendChild`, etc. to build dynamic interfaces as opposed to HTML rendering methods such as `document.write`, `document.writeIn`, `element.innerHTML`, or `element.outerHTML `etc.

Read more at https://www.tenable.com/plugins/was/98110

]]> <![CDATA[Cross-Site Scripting (XSS) in path]]> https://www.tenable.com/plugins/was/98107 https://www.tenable.com/plugins/was/98107 Mon, 23 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 98107 with Medium Severity

Synopsis

Cross-Site Scripting (XSS) in path

Description

Client-side scripts are used extensively by modern web applications. They perform from simple functions (such as the formatting of text) up to full manipulation of client-side data and Operating System interaction.

Cross Site Scripting (XSS) allows clients to inject scripts into a request and have the server return the script to the client in the response. This occurs because the application is taking untrusted data (in this example, from the client) and reusing it without performing any validation or sanitisation.

If the injected script is returned immediately this is known as reflected XSS. If the injected script is stored by the server and returned to any client visiting the affected page, then this is known as persistent XSS (also stored XSS).

Scanner has discovered that it is possible to insert script content directly into the requested PATH and have it returned in the server's response. For example `HTTP://yoursite.com/INJECTION_HERE/`, where `INJECTION_HERE` represents the location where the scanner payload was injected.

Solution

To remedy XSS vulnerabilities, it is important to never use untrusted or unfiltered data within the code of a HTML page.
Untrusted data can originate not only form the client but potentially a third party or previously uploaded file etc.
Filtering of untrusted data typically involves converting special characters to their HTML entity encoded counterparts (however, other methods do exist, see references). These special characters include:
* `&` * `<` * `>` * `'` * `'` * `/`
An example of HTML entity encoding is converting `<` to `<`.
Although it is possible to filter untrusted input, there are five locations within an HTML page where untrusted input (even if it has been filtered) should never be placed:
1. Directly in a script. 2. Inside an HTML comment. 3. In an attribute name. 4. In a tag name. 5. Directly in CSS.
Each of these locations have their own form of escaping and filtering.
_Because many browsers attempt to implement XSS protection, any manual verification of this finding should be conducted using multiple different browsers and browser versions._

Read more at https://www.tenable.com/plugins/was/98107

]]> <![CDATA[Apache Struts 2.1.6 < 2.3.34 / 2.5 < 2.5.13 Remote Code Execution (S2-052)]]> https://www.tenable.com/plugins/was/112763 https://www.tenable.com/plugins/was/112763 Thu, 19 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 112763 with High Severity

Synopsis

Apache Struts 2.1.6 < 2.3.34 / 2.5 < 2.5.13 Remote Code Execution (S2-052)

Description

The REST Plugin in Apache Struts 2.1.6 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Solution

Refer to the S2-052 vendor advisory for mitigation options.

Read more at https://www.tenable.com/plugins/was/112763

]]> <![CDATA[Apache Struts 2 < 2.3.33 Remote Code Execution (S2-048)]]> https://www.tenable.com/plugins/was/112762 https://www.tenable.com/plugins/was/112762 Thu, 19 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 112762 with Critical Severity

Synopsis

Apache Struts 2 < 2.3.33 Remote Code Execution (S2-048)

Description

The Struts 1 plugin in Apache Struts 2 < 2.3.33 might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage class.

Solution

Refer to the S2-048 vendor advisory for mitigation options.

Read more at https://www.tenable.com/plugins/was/112762

]]> <![CDATA[Apache Struts 2 Demo Application Detected]]> https://www.tenable.com/plugins/was/112760 https://www.tenable.com/plugins/was/112760 Thu, 19 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 112760 with Low Severity

Synopsis

Apache Struts 2 Demo Application Detected

Description

The scanner has detected a publicly accessible Apache Struts 2 default demo application.

Known and unknown vulnerabilities could be more easily exploited via this kind of application.

Solution

Delete the demo application or restrict access using a .htaccess file, limiting access to known IP Addresses.

Read more at https://www.tenable.com/plugins/was/112760

]]> <![CDATA[Apache Struts 2 < 2.3.29 DevMode Remote Code Execution]]> https://www.tenable.com/plugins/was/112742 https://www.tenable.com/plugins/was/112742 Thu, 19 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 112742 with Critical Severity

Synopsis

Apache Struts 2 < 2.3.29 DevMode Remote Code Execution

Description

Apache Struts 2 installed on the remote host is configured to operate in development mode (DevMode) and is in a version less than or equal to 2.3.29. While this environment can help speed up development of web applications, it is possible to abuse this mode to run arbitrary commands on the server.

Solution

Upgrade to Apache Struts 2 2.3.29 or later.

Read more at https://www.tenable.com/plugins/was/112742

]]> <![CDATA[Apache Struts 2.x < 2.3.15.1 Remote Code Execution (S2-016)]]> https://www.tenable.com/plugins/was/112741 https://www.tenable.com/plugins/was/112741 Thu, 19 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 112741 with Critical Severity

Synopsis

Apache Struts 2.x < 2.3.15.1 Remote Code Execution (S2-016)

Description

Apache Struts 2.x to 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted 'action:', 'redirect:', or 'redirectAction:' prefix.

This mechanism was intended to help with attaching navigational information to buttons within forms.

Solution

Upgrade to Apache Struts 2 2.3.15.1 or later.

Read more at https://www.tenable.com/plugins/was/112741

]]> <![CDATA[Apache Struts 2.0.4 < 2.3.35 / 2.5.x < 2.5.17 Remote Code Execution (S2-057)]]> https://www.tenable.com/plugins/was/112727 https://www.tenable.com/plugins/was/112727 Thu, 19 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 112727 with High Severity

Synopsis

Apache Struts 2.0.4 < 2.3.35 / 2.5.x < 2.5.17 Remote Code Execution (S2-057)

Description

Apache Struts versions 2 2.0.4 to 2.3.34 and 2.5.x to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then :

- results are used with no namespace and in same time

- its upper package have no or wildcard namespace

Or similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Solution

Upgrade to Apache Struts 2 2.3.35, 2.5.17 or later.

Read more at https://www.tenable.com/plugins/was/112727

]]> <![CDATA[Apache Struts 2.3.5 < 2.3.32 / 2.5.x < 2.5.10.1 Remote Code Execution (S2-045 / S2-046)]]> https://www.tenable.com/plugins/was/112726 https://www.tenable.com/plugins/was/112726 Thu, 19 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 112726 with Critical Severity

Synopsis

Apache Struts 2.3.5 < 2.3.32 / 2.5.x < 2.5.10.1 Remote Code Execution (S2-045 / S2-046)

Description

The Jakarta Multipart parser in Apache Struts 2 2.3.5 to 2.3.31 and 2.5.x to 2.5.10 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Solution

Upgrade to Apache Struts 2 2.3.32, 2.5.10.1 or later.

Read more at https://www.tenable.com/plugins/was/112726

]]> <![CDATA[Client-Side Prototype Pollution]]> https://www.tenable.com/plugins/was/112719 https://www.tenable.com/plugins/was/112719 Thu, 19 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 112719 with High Severity

Synopsis

Client-Side Prototype Pollution

Description

Prototype-based programming languages rely on the process of defining objects used as prototypes to be then extended or cloned in order to create new objects. Once instantiated, these objects will inherit from the properties and methods of their prototype.

JavaScript is one of the most common prototype-based language in modern web applications, on both server-side and client-side components. Nearly all the JavaScript objects are instances of Object, making them inherit from the properties and methods of the Object prototype.

A client-side prototype pollution vulnerability exists when an attacker is able to modify the properties of the Object prototype in the context of the web browser, exposing the application users to further issues like Cross-Site Scripting or Denial of Service attacks.

Solution

The inputs should be properly sanitized to prevent the Object prototype from being modified when trying to leverage on the properties like prototype or constructor during some operations (like merging or cloning objects). JavaScript objects can also be explicitly instantiated without a prototype by using the Object.create(null) constructor. Finally, prefer using a Map object as a key and value storage as it will not contain the Objects prototype keys, thus preventing the pollution to occur.

Read more at https://www.tenable.com/plugins/was/112719

]]> <![CDATA[CyberPanel < 2.3.8 Remote Command Execution]]> https://www.tenable.com/plugins/was/114469 https://www.tenable.com/plugins/was/114469 Tue, 10 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 114469 with Critical Severity

Synopsis

CyberPanel < 2.3.8 Remote Command Execution

Description

CyberPanel version prior to 2.3.8 are affected by a vulnerability allowing an unauthenticated attacker to execute commands on the remote machine via a specially forged request.

Solution

Update to CyberPanel version 2.3.8 or latest.

Read more at https://www.tenable.com/plugins/was/114469

]]> <![CDATA[Private IP Address Disclosure]]> https://www.tenable.com/plugins/was/98077 https://www.tenable.com/plugins/was/98077 Tue, 03 Dec 2024 00:00:00 GMT Web App Scanning Plugin ID 98077 with Info Severity

Synopsis

Private IP Address Disclosure

Description

Private, or non-routable, IP addresses are generally used within a home or company network and are typically unknown to anyone outside of that network.

Cyber-criminals will attempt to identify the private IP address range being used by their victim, to aid in collecting further information that could then lead to a possible compromise.

Scanner discovered that the affected page returned a RFC 1918 compliant private IP address and therefore could be revealing sensitive information.

This finding typically requires manual verification to ensure the context is correct, as any private IP address within the HTML body will trigger it.

Solution

Identifying the context in which the affected page displays a Private IP address is necessary.
If the page is publicly accessible and displays the Private IP of the affected server (or supporting infrastructure), then measures should be put in place to ensure that the IP address is removed from any response.

Read more at https://www.tenable.com/plugins/was/98077

]]> <![CDATA[Insecure Cross-Domain Policy (allow-http-request-headers-from)]]> https://www.tenable.com/plugins/was/98068 https://www.tenable.com/plugins/was/98068 Tue, 26 Nov 2024 00:00:00 GMT Web App Scanning Plugin ID 98068 with Low Severity

Synopsis

Insecure Cross-Domain Policy (allow-http-request-headers-from)

Description

The browser security model normally prevents web content from one domain from accessing data from another domain. This is commonly known as the "same origin policy".

URL policy files grant cross-domain permissions for reading data. They permit operations that are not permitted by default. The URL policy file for Silverlight is located, by default, in the root directory of the target server, with the name `crossdomain.xml` (for example, at `www.example.com/crossdomain.xml`).

When a domain is specified in `crossdomain.xml`, the site declares that it is willing to allow the operators of any servers in that domain to obtain any document on the server where the policy file resides.

The `crossdomain.xml` file deployed on this website opens the server to all domains (use of a single asterisk "*" as a pure wildcard is supported).

Solution

Carefully evaluate which sites will be allowed to make cross-domain calls.
Consider network topology and any authentication mechanisms that will be affected by the configuration or implementation of the cross-domain policy.

Read more at https://www.tenable.com/plugins/was/98068

]]> <![CDATA[Insecure Cross-Domain Policy (allow-access-from)]]> https://www.tenable.com/plugins/was/98067 https://www.tenable.com/plugins/was/98067 Tue, 26 Nov 2024 00:00:00 GMT Web App Scanning Plugin ID 98067 with Low Severity

Synopsis

Insecure Cross-Domain Policy (allow-access-from)

Description

The browser security model normally prevents web content from one domain from accessing data from another domain. This is commonly known as the "same origin policy".

URL policy files grant cross-domain permissions for reading data. They permit operations that are not permitted by default. The URL policy file for Silverlight is located, by default, in the root directory of the target server, with the name `crossdomain.xml` (for example, at `www.example.com/crossdomain.xml`).

When a domain is specified in `crossdomain.xml`, the site declares that it is willing to allow the operators of any servers in that domain to obtain any document on the server where the policy file resides.

The `crossdomain.xml` file deployed on this website opens the server to all domains (use of a single asterisk "*" as a pure wildcard is supported).

Solution

Carefully evaluate which sites will be allowed to make cross-domain calls.
Consider network topology and any authentication mechanisms that will be affected by the configuration or implementation of the cross-domain policy.

Read more at https://www.tenable.com/plugins/was/98067

]]> <![CDATA[Virtual Hosts Detected]]> https://www.tenable.com/plugins/was/114503 https://www.tenable.com/plugins/was/114503 Tue, 26 Nov 2024 00:00:00 GMT Web App Scanning Plugin ID 114503 with Info Severity

Synopsis

Virtual Hosts Detected

Description

This is an informational plugin to inform the user that the scanner detected the presence of one or multiple virtual hosts on the target server.

Solution

Review all the detected virtual hosts to ensure they are expected to be externally reachable.

Read more at https://www.tenable.com/plugins/was/114503

]]> <![CDATA[Symfony < 5.4.46 / 6.x < 6.4.14 / 7.x < 7.1.7 Improper Input Handling]]> https://www.tenable.com/plugins/was/114497 https://www.tenable.com/plugins/was/114497 Wed, 20 Nov 2024 00:00:00 GMT Web App Scanning Plugin ID 114497 with High Severity

Synopsis

Symfony < 5.4.46 / 6.x < 6.4.14 / 7.x < 7.1.7 Improper Input Handling

Description

Symfony versions prior to 5.4.46 or 6.x prior to 6.4.14 or 7.x prior to 7.1.7 is vulnerable when the register_argc_argv php directive is set to 'on' and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request.

Note that since the vulnerable Symfony component is embedded in Laravel, the plugin is likely to detect a vulnerable Laravel instance.

Solution

Upgrade to Symfony version 5.4.46 or 6.4.14 or 7.1.7 or later.

Read more at https://www.tenable.com/plugins/was/114497

]]> <![CDATA[Node-config Configuration File Detected]]> https://www.tenable.com/plugins/was/114143 https://www.tenable.com/plugins/was/114143 Wed, 20 Nov 2024 00:00:00 GMT Web App Scanning Plugin ID 114143 with Medium Severity

Synopsis

Node-config Configuration File Detected

Description

Node-config is a Node.js module providing hierarchical configurations to help with web applications deployments. By defining one or more configuration files in their application project 'config' directory or in a custom location, developers can define various configuration variables to be used in the different application environments.

By accessing an exposed configuration file, an attacker could leverage the vulnerability to gain unauthorized access to sensitive information.

Solution

Ensure that the file(s) found are not deployed with the application or, at least, is not exposed in a web server directory by setting proper permissions on it. If sensitive information like credentials are leaked in the exposed file, they should be revoked and reset on the affected assets.

Read more at https://www.tenable.com/plugins/was/114143

]]> <![CDATA[GraphQL Cross-Site Request Forgery]]> https://www.tenable.com/plugins/was/112920 https://www.tenable.com/plugins/was/112920 Thu, 14 Nov 2024 00:00:00 GMT Web App Scanning Plugin ID 112920 with Medium Severity

Synopsis

GraphQL Cross-Site Request Forgery

Description

GraphQL is an open-source query and manipulation language for APIs and a server-side runtime built to handle these queries on the application dataset. GraphQL servers often allow other `Content-Type` header values than `application/json`, and GET based requests for both queries and mutations. By leveraging this, an attacker could achieve a Cross-Site Request Forgery (CSRF) attack and make an authenticated user perform arbitrary actions on the target GraphQL endpoint.

Solution

The application should be updated to provide at least anti-CSRF tokens management on GraphQL endpoints and set the `SameSite` attribute to `Lax` on authentication cookies. Avoid using GET method in requests performing changing operations on the target application.

Read more at https://www.tenable.com/plugins/was/112920

]]> <![CDATA[ASP.NET DEBUG Method Enabled]]> https://www.tenable.com/plugins/was/112353 https://www.tenable.com/plugins/was/112353 Thu, 14 Nov 2024 00:00:00 GMT Web App Scanning Plugin ID 112353 with Medium Severity

Synopsis

ASP.NET DEBUG Method Enabled

Description

It is possible to send debug statements to the remote ASP scripts via the http DEBUG method. A remote, unauthenticated attacker may leverage this to alter the runtime of the remote scripts.

Solution

Make sure that DEBUG statements are disabled or only usable by authenticated users.

Read more at https://www.tenable.com/plugins/was/112353

]]> <![CDATA[Path Relative Stylesheet Import]]> https://www.tenable.com/plugins/was/114466 https://www.tenable.com/plugins/was/114466 Fri, 08 Nov 2024 00:00:00 GMT Web App Scanning Plugin ID 114466 with Info Severity

Synopsis

Path Relative Stylesheet Import

Description

A Path Relative Style Sheet Import occurs when the application imports a style sheet via a relative URL and uses user input in the file name. This vulnerability mainly affects older browsers such as Internet Explorer and allows an attacker to exploit the way the browser handles stylesheet imports in order to perform CSS Injection.

Solution

It is preferable not to use path-related URLs in stylesheet imports, and also to use the 'X-Content-Type-Options: nosnif' and 'X-Frame-Options: deny' headers.

Read more at https://www.tenable.com/plugins/was/114466

]]> <![CDATA[HTML Comments Detected]]> https://www.tenable.com/plugins/was/113897 https://www.tenable.com/plugins/was/113897 Fri, 08 Nov 2024 00:00:00 GMT Web App Scanning Plugin ID 113897 with Info Severity

Synopsis

HTML Comments Detected

Description

HTML comments are often used by developers to include information related to the application inline, which are ignored by a clients browser during rendering. These comments may include sensitive information such as SQL queries, credentials or internal IP for example.

Solution

Review the HTML comments identified on the page for any information leakage, and remove any sensitive information identified.

Read more at https://www.tenable.com/plugins/was/113897

]]> <![CDATA[SonarQube Public Projects Detected]]> https://www.tenable.com/plugins/was/114468 https://www.tenable.com/plugins/was/114468 Tue, 05 Nov 2024 00:00:00 GMT Web App Scanning Plugin ID 114468 with Info Severity

Synopsis

SonarQube Public Projects Detected

Description

A SonarQube Public Projects response have been detected on the target web application. These response may contain sensitive information which could assist an attack to conduct further attacks.

Solution

Restrict access to the public projects endpoint or remove it.

Read more at https://www.tenable.com/plugins/was/114468

]]> <![CDATA[WooCommerce Payments Plugin for WordPress 4.8.x < 4.8.2 Authentication Bypass]]> https://www.tenable.com/plugins/was/114040 https://www.tenable.com/plugins/was/114040 Mon, 21 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 114040 with Critical Severity

Synopsis

WooCommerce Payments Plugin for WordPress 4.8.x < 4.8.2 Authentication Bypass

Description

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WooCommerce Payments Plugin for WordPress 4.8.2 or latest.

Read more at https://www.tenable.com/plugins/was/114040

]]> <![CDATA[WooCommerce Payments Plugin for WordPress 4.9.x < 4.9.1 Authentication Bypass]]> https://www.tenable.com/plugins/was/114039 https://www.tenable.com/plugins/was/114039 Mon, 21 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 114039 with Critical Severity

Synopsis

WooCommerce Payments Plugin for WordPress 4.9.x < 4.9.1 Authentication Bypass

Description

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WooCommerce Payments Plugin for WordPress 4.9.1 or latest.

Read more at https://www.tenable.com/plugins/was/114039

]]> <![CDATA[WooCommerce Payments Plugin for WordPress 5.0.x < 5.0.4 Authentication Bypass]]> https://www.tenable.com/plugins/was/114038 https://www.tenable.com/plugins/was/114038 Mon, 21 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 114038 with Critical Severity

Synopsis

WooCommerce Payments Plugin for WordPress 5.0.x < 5.0.4 Authentication Bypass

Description

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WooCommerce Payments Plugin for WordPress 5.0.4 or latest.

Read more at https://www.tenable.com/plugins/was/114038

]]> <![CDATA[WooCommerce Payments Plugin for WordPress 5.1.x < 5.1.3 Authentication Bypass]]> https://www.tenable.com/plugins/was/114037 https://www.tenable.com/plugins/was/114037 Mon, 21 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 114037 with Critical Severity

Synopsis

WooCommerce Payments Plugin for WordPress 5.1.x < 5.1.3 Authentication Bypass

Description

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WooCommerce Payments Plugin for WordPress 5.1.3 or latest.

Read more at https://www.tenable.com/plugins/was/114037

]]> <![CDATA[WooCommerce Payments Plugin for WordPress 5.2.x < 5.2.2 Authentication Bypass]]> https://www.tenable.com/plugins/was/114036 https://www.tenable.com/plugins/was/114036 Mon, 21 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 114036 with Critical Severity

Synopsis

WooCommerce Payments Plugin for WordPress 5.2.x < 5.2.2 Authentication Bypass

Description

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WooCommerce Payments Plugin for WordPress 5.2.2 or latest.

Read more at https://www.tenable.com/plugins/was/114036

]]> <![CDATA[WooCommerce Payments Plugin for WordPress 5.3.x < 5.3.1 Authentication Bypass]]> https://www.tenable.com/plugins/was/114035 https://www.tenable.com/plugins/was/114035 Mon, 21 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 114035 with Critical Severity

Synopsis

WooCommerce Payments Plugin for WordPress 5.3.x < 5.3.1 Authentication Bypass

Description

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WooCommerce Payments Plugin for WordPress 5.3.1 or latest.

Read more at https://www.tenable.com/plugins/was/114035

]]> <![CDATA[WooCommerce Payments Plugin for WordPress 5.4.x < 5.4.1 Authentication Bypass]]> https://www.tenable.com/plugins/was/114034 https://www.tenable.com/plugins/was/114034 Mon, 21 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 114034 with Critical Severity

Synopsis

WooCommerce Payments Plugin for WordPress 5.4.x < 5.4.1 Authentication Bypass

Description

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WooCommerce Payments Plugin for WordPress 5.4.1 or latest.

Read more at https://www.tenable.com/plugins/was/114034

]]> <![CDATA[WooCommerce Payments Plugin for WordPress 5.5.x < 5.5.2 Authentication Bypass]]> https://www.tenable.com/plugins/was/114033 https://www.tenable.com/plugins/was/114033 Mon, 21 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 114033 with Critical Severity

Synopsis

WooCommerce Payments Plugin for WordPress 5.5.x < 5.5.2 Authentication Bypass

Description

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WooCommerce Payments Plugin for WordPress 5.5.2 or latest.

Read more at https://www.tenable.com/plugins/was/114033

]]> <![CDATA[WooCommerce Payments Plugin for WordPress 6.2.x < 6.2.2 Authentication Bypass]]> https://www.tenable.com/plugins/was/114032 https://www.tenable.com/plugins/was/114032 Mon, 21 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 114032 with Critical Severity

Synopsis

WooCommerce Payments Plugin for WordPress 6.2.x < 6.2.2 Authentication Bypass

Description

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WooCommerce Payments Plugin for WordPress 6.2.2 or latest.

Read more at https://www.tenable.com/plugins/was/114032

]]> <![CDATA[WooCommerce Payments Plugin for WordPress 6.3.x < 6.3.2 Authentication Bypass]]> https://www.tenable.com/plugins/was/114031 https://www.tenable.com/plugins/was/114031 Mon, 21 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 114031 with Critical Severity

Synopsis

WooCommerce Payments Plugin for WordPress 6.3.x < 6.3.2 Authentication Bypass

Description

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WooCommerce Payments Plugin for WordPress 6.3.2 or latest.

Read more at https://www.tenable.com/plugins/was/114031

]]> <![CDATA[WooCommerce Payments Plugin for WordPress 5.6.x < 5.6.2 Authentication Bypass]]> https://www.tenable.com/plugins/was/113838 https://www.tenable.com/plugins/was/113838 Mon, 21 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 113838 with Critical Severity

Synopsis

WooCommerce Payments Plugin for WordPress 5.6.x < 5.6.2 Authentication Bypass

Description

The WooCommerce Payments Plugin installed on the remote host is affected by an authentication bypass vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WooCommerce Payments Plugin for WordPress 5.6.2 or latest.

Read more at https://www.tenable.com/plugins/was/113838

]]> <![CDATA[Express.js Cookie-Session Weak Secret Key]]> https://www.tenable.com/plugins/was/114439 https://www.tenable.com/plugins/was/114439 Thu, 03 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 114439 with High Severity

Synopsis

Express.js Cookie-Session Weak Secret Key

Description

Express.js applications with Cookie-Session use an application key to encrypt and sign various data, including session cookies and other sensitive information. This key is typically stored in an environment variable and is used for multiple security-critical operations.

When a weak or easily guessable application key is used, it compromises the security of the entire application. Attackers can potentially decrypt sensitive data, forge valid session cookies, or even execute remote code in some scenarios.

Solution

The secret key used to sign the cookies in the application must be stronger (long and random) to prevent it from being retrieved with a bruteforce attack.

Read more at https://www.tenable.com/plugins/was/114439

]]> <![CDATA[Performance Telemetry]]> https://www.tenable.com/plugins/was/113393 https://www.tenable.com/plugins/was/113393 Thu, 03 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 113393 with Info Severity

Synopsis

Performance Telemetry

Description

This finding provides information to assist in scan performance tuning.

Solution

Read more at https://www.tenable.com/plugins/was/113393

]]> <![CDATA[Full Path Disclosure]]> https://www.tenable.com/plugins/was/112550 https://www.tenable.com/plugins/was/112550 Thu, 03 Oct 2024 00:00:00 GMT Web App Scanning Plugin ID 112550 with Info Severity

Synopsis

Full Path Disclosure

Description

The remote web server contains an application which is affected by a path disclosure issue. It may be possible for an attacker to view full path names and conduct further attacks.

Solution

Disable all notice, warning and error displaying.

Read more at https://www.tenable.com/plugins/was/112550

]]> <![CDATA[Unrestricted File Upload]]> https://www.tenable.com/plugins/was/114283 https://www.tenable.com/plugins/was/114283 Thu, 26 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114283 with High Severity

Synopsis

Unrestricted File Upload

Description

Unrestricted file upload vulnerability occurs when the application suffers from a lack of validation of files being uploaded to its filesystem. When an attacker is able to upload files not matching the application expectations in terms of names, type, content or size, it could lead to various issues such as arbitrary files overwrite, denial of service or even remote code execution.

Note that this plugin requires the 'File Upload' assessment option enabled in the scan configuration.

Solution

Ensure that all controls apply on the file being uploaded : - Implement an allowlist of the accepted file extensions and ensure that it cannot be bypassed. - Ensure that the permissions applied on the uploaded file are set to the strict minimum and prevents execution. - Ensure that the filename does not contain any substring that could be used by the function writing the file as a directory traversal pattern. - Rename the uploaded files to avoid overwriting local system files. - Ensure that the file size is acceptable and not too big, to avoid service disruption due to disk space consumption or overbilling when using cloud services.

Read more at https://www.tenable.com/plugins/was/114283

]]> <![CDATA[Ivanti EPM RecordGoodApp SQL Injection]]> https://www.tenable.com/plugins/was/114433 https://www.tenable.com/plugins/was/114433 Tue, 24 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114433 with High Severity

Synopsis

Ivanti EPM RecordGoodApp SQL Injection

Description

Ivanti Endpoint Manager (EPM) versions 2022 SU5 and below suffer from a SQL Injection vulnerability. By exploiting this vulnerability, a remote and unauthenticated attacker can achieve Remote Code Execution (RCE) on the affected system.

Solution

Apply the security hotfix provided by Ivanti for version 2022 SU5 or upgrade to latest version which already includes the fix.

Read more at https://www.tenable.com/plugins/was/114433

]]> <![CDATA[Nginx < 1.2.9 ngx_http_proxy_module.c Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/98951 https://www.tenable.com/plugins/was/98951 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 98951 with Critical Severity

Synopsis

Nginx < 1.2.9 ngx_http_proxy_module.c Multiple Vulnerabilities

Description

According to its Server response header, the installed version of nginx is greater than or equal to 1.1.4 and prior to 1.2.9, or greater than or equal to 1.3.0 and prior to 1.4.1. It is, therefore, affected by multiple vulnerabilities :

 - A stack-based buffer overflow in 'ngx_http_parse.c' may allow a remote attacker to execute arbitrary code or trigger a denial of service condition via a specially crafted HTTP request. This vulnerability only affects versions greater than or equal to 1.3.9 and less than 1.4.1. (CVE-2013-2028)

 - A memory disclosure vulnerability in 'ngx_http_parse.c' affects servers that use 'proxy_pass' to untrusted upstream servers. This issue can be triggered by a remote attacker via a specially crafted HTTP request. Failed attempts may result in a denial of service condition. (CVE-2013-2070)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to nginx 1.2.9 or later.

Read more at https://www.tenable.com/plugins/was/98951

]]> <![CDATA[Nginx < 1.4.1 ngx_http_proxy_module.c Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/98950 https://www.tenable.com/plugins/was/98950 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 98950 with Critical Severity

Synopsis

Nginx < 1.4.1 ngx_http_proxy_module.c Multiple Vulnerabilities

Description

According to its Server response header, the installed version of nginx is greater than or equal to 1.1.4 and prior to 1.2.9, or greater than or equal to 1.3.0 and prior to 1.4.1. It is, therefore, affected by multiple vulnerabilities :

 - A stack-based buffer overflow in 'ngx_http_parse.c' may allow a remote attacker to execute arbitrary code or trigger a denial of service condition via a specially crafted HTTP request. This vulnerability only affects versions greater than or equal to 1.3.9 and less than 1.4.1. (CVE-2013-2028)

 - A memory disclosure vulnerability in 'ngx_http_parse.c' affects servers that use 'proxy_pass' to untrusted upstream servers. This issue can be triggered by a remote attacker via a specially crafted HTTP request. Failed attempts may result in a denial of service condition. (CVE-2013-2070)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to nginx 1.4.1 or later.

Read more at https://www.tenable.com/plugins/was/98950

]]> <![CDATA[Atlassian Confluence 8.6.x < 8.9.1 Cross-Site Scripting]]> https://www.tenable.com/plugins/was/114379 https://www.tenable.com/plugins/was/114379 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114379 with High Severity

Synopsis

Atlassian Confluence 8.6.x < 8.9.1 Cross-Site Scripting

Description

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.22, 7.20.x prior to 8.5.9 or 8.6.x prior to 8.9.1. It is, therefore, affected by a stored Cross-Site Scripting (XSS) vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Atlassian Confluence version 8.9.1 or later.

Read more at https://www.tenable.com/plugins/was/114379

]]> <![CDATA[Atlassian Confluence 7.20.x < 8.5.9 Cross-Site Scripting]]> https://www.tenable.com/plugins/was/114378 https://www.tenable.com/plugins/was/114378 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114378 with High Severity

Synopsis

Atlassian Confluence 7.20.x < 8.5.9 Cross-Site Scripting

Description

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.22, 7.20.x prior to 8.5.9 or 8.6.x prior to 8.9.1. It is, therefore, affected by a stored Cross-Site Scripting (XSS) vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Atlassian Confluence version 8.5.9 or later.

Read more at https://www.tenable.com/plugins/was/114378

]]> <![CDATA[Atlassian Confluence < 7.19.22 Cross-Site Scripting]]> https://www.tenable.com/plugins/was/114377 https://www.tenable.com/plugins/was/114377 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114377 with High Severity

Synopsis

Atlassian Confluence < 7.19.22 Cross-Site Scripting

Description

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.22, 7.20.x prior to 8.5.9 or 8.6.x prior to 8.9.1. It is, therefore, affected by a stored Cross-Site Scripting (XSS) vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Atlassian Confluence version 7.19.22 or later.

Read more at https://www.tenable.com/plugins/was/114377

]]> <![CDATA[Joomla! 3.x < 3.10.16 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/114375 https://www.tenable.com/plugins/was/114375 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114375 with Medium Severity

Synopsis

Joomla! 3.x < 3.10.16 Multiple Vulnerabilities

Description

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.10.16, 4.x prior to 4.4.6 or 5.x prior to 5.1.2. It is, therefore, affected by multiple vulnerabilities.

 - Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field. (CVE-2024-21729)

 - The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector. (CVE-2024-21730)

 - Improper handling of input could lead to an XSS vector in the StringHelper::truncate method. (CVE-2024-21731)

 - The wrapper extensions do not correctly validate inputs, leading to XSS vectors. (CVE-2024-26279)

 - The Custom Fields component not correctly filter inputs, leading to a XSS vector. (CVE-2024-26278)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Joomla! version 3.10.16 or latest.

Read more at https://www.tenable.com/plugins/was/114375

]]> <![CDATA[Joomla! 4.x < 4.4.6 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/114374 https://www.tenable.com/plugins/was/114374 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114374 with Medium Severity

Synopsis

Joomla! 4.x < 4.4.6 Multiple Vulnerabilities

Description

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.10.16, 4.x prior to 4.4.6 or 5.x prior to 5.1.2. It is, therefore, affected by multiple vulnerabilities.

 - Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field. (CVE-2024-21729)

 - The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector. (CVE-2024-21730)

 - Improper handling of input could lead to an XSS vector in the StringHelper::truncate method. (CVE-2024-21731)

 - The wrapper extensions do not correctly validate inputs, leading to XSS vectors. (CVE-2024-26279)

 - The Custom Fields component not correctly filter inputs, leading to a XSS vector. (CVE-2024-26278)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Joomla! version 4.4.6 or latest.

Read more at https://www.tenable.com/plugins/was/114374

]]> <![CDATA[Joomla! 5.x < 5.1.2 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/114373 https://www.tenable.com/plugins/was/114373 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114373 with Medium Severity

Synopsis

Joomla! 5.x < 5.1.2 Multiple Vulnerabilities

Description

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.10.16, 4.x prior to 4.4.6 or 5.x prior to 5.1.2. It is, therefore, affected by multiple vulnerabilities.

 - Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field. (CVE-2024-21729)

 - The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector. (CVE-2024-21730)

 - Improper handling of input could lead to an XSS vector in the StringHelper::truncate method. (CVE-2024-21731)

 - The wrapper extensions do not correctly validate inputs, leading to XSS vectors. (CVE-2024-26279)

 - The Custom Fields component not correctly filter inputs, leading to a XSS vector. (CVE-2024-26278)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Joomla! version 5.1.2 or latest.

Read more at https://www.tenable.com/plugins/was/114373

]]> <![CDATA[Atlassian Confluence 8.6.x < 8.8.1 Path Traversal]]> https://www.tenable.com/plugins/was/114240 https://www.tenable.com/plugins/was/114240 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114240 with High Severity

Synopsis

Atlassian Confluence 8.6.x < 8.8.1 Path Traversal

Description

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.20, 7.20.x prior to 8.5.7 or 8.6.x prior to 8.8.1 It is, therefore, affected by a path traversal vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Atlassian Confluence version 8.8.1 or later.

Read more at https://www.tenable.com/plugins/was/114240

]]> <![CDATA[Atlassian Confluence 7.20.x < 8.5.7 Path Traversal]]> https://www.tenable.com/plugins/was/114239 https://www.tenable.com/plugins/was/114239 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114239 with High Severity

Synopsis

Atlassian Confluence 7.20.x < 8.5.7 Path Traversal

Description

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.20, 7.20.x prior to 8.5.7 or 8.6.x prior to 8.8.1 It is, therefore, affected by a path traversal vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Atlassian Confluence version 8.5.7 or later.

Read more at https://www.tenable.com/plugins/was/114239

]]> <![CDATA[Atlassian Confluence < 7.19.20 Path Traversal]]> https://www.tenable.com/plugins/was/114238 https://www.tenable.com/plugins/was/114238 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114238 with High Severity

Synopsis

Atlassian Confluence < 7.19.20 Path Traversal

Description

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.20, 7.20.x prior to 8.5.7 or 8.6.x prior to 8.8.1 It is, therefore, affected by a path traversal vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Atlassian Confluence version 7.19.20 or later.

Read more at https://www.tenable.com/plugins/was/114238

]]> <![CDATA[Atlassian Confluence 7.20.x < 8.5.5 Cross-Site Scripting]]> https://www.tenable.com/plugins/was/114222 https://www.tenable.com/plugins/was/114222 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114222 with High Severity

Synopsis

Atlassian Confluence 7.20.x < 8.5.5 Cross-Site Scripting

Description

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.18, 7.20.x prior to 8.5.5 or 8.7.x prior to 8.7.2. It is, therefore, affected by a stored Cross-Site Scripting (XSS) vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Atlassian Confluence version 8.5.5 or later.

Read more at https://www.tenable.com/plugins/was/114222

]]> <![CDATA[Atlassian Confluence 8.7.x < 8.7.2 Cross-Site Scripting]]> https://www.tenable.com/plugins/was/114221 https://www.tenable.com/plugins/was/114221 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114221 with High Severity

Synopsis

Atlassian Confluence 8.7.x < 8.7.2 Cross-Site Scripting

Description

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.18, 7.20.x prior to 8.5.5 or 8.7.x prior to 8.7.2. It is, therefore, affected by a stored Cross-Site Scripting (XSS) vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Atlassian Confluence version 8.7.2 or later.

Read more at https://www.tenable.com/plugins/was/114221

]]> <![CDATA[Atlassian Confluence < 7.19.18 Cross-Site Scripting]]> https://www.tenable.com/plugins/was/114220 https://www.tenable.com/plugins/was/114220 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 114220 with High Severity

Synopsis

Atlassian Confluence < 7.19.18 Cross-Site Scripting

Description

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.18, 7.20.x prior to 8.5.5 or 8.7.x prior to 8.7.2. It is, therefore, affected by a stored Cross-Site Scripting (XSS) vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Atlassian Confluence version 7.19.18 or later.

Read more at https://www.tenable.com/plugins/was/114220

]]> <![CDATA[Nginx 1.23.x < 1.23.2 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/113421 https://www.tenable.com/plugins/was/113421 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 113421 with Critical Severity

Synopsis

Nginx 1.23.x < 1.23.2 Multiple Vulnerabilities

Description

According to its Server response header, the installed version of nginx is prior to 1.22.1 or 1.23.x prior to 1.23.2. It is, therefore, affected by two security issues which might allow an attacker to cause a worker process crash or worker process memory disclosure by using a specially crafted mp4 file.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to nginx version 1.23.2 or later.

Read more at https://www.tenable.com/plugins/was/113421

]]> <![CDATA[Nginx < 1.22.1 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/113420 https://www.tenable.com/plugins/was/113420 Fri, 06 Sep 2024 00:00:00 GMT Web App Scanning Plugin ID 113420 with Critical Severity

Synopsis

Nginx < 1.22.1 Multiple Vulnerabilities

Description

According to its Server response header, the installed version of nginx is prior to 1.22.1 or 1.23.x prior to 1.23.2. It is, therefore, affected by two security issues which might allow an attacker to cause a worker process crash or worker process memory disclosure by using a specially crafted mp4 file.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to nginx version 1.22.1 or later.

Read more at https://www.tenable.com/plugins/was/113420

]]> <![CDATA[XPath Injection]]> https://www.tenable.com/plugins/was/98114 https://www.tenable.com/plugins/was/98114 Mon, 12 Aug 2024 00:00:00 GMT Web App Scanning Plugin ID 98114 with High Severity

Synopsis

XPath Injection

Description

XML Path Language (XPath) queries are used by web applications for selecting nodes from XML documents. Once selected, the value of these nodes can then be used by the application.

A simple example for the use of XML documents is to store user information. As part of the authentication process, the application will perform an XPath query to confirm the login credentials and retrieve that user's information to use in the following request.

XPath injection occurs where untrusted data is used to build XPath queries.

Cyber-criminals may abuse this injection vulnerability to bypass authentication, query other user's information, or, if the XML document contains privileged user credentials, allow the cyber-criminal to escalate their privileges.

Scanner injected special XPath query characters into the page and based on the responses from the server, has determined that the page is vulnerable to XPath injection.

Solution

The preferred way to protect against XPath injection is to utilise parameterized (also known as prepared) XPath queries. When utilising this method of querying the XML document any value supplied by the client will be handled as a string rather than part of the XPath query.
An alternative to parameterized queries it to use precompiled XPath queries. Precompiled XPath queries are not generated dynamically and will therefor never process user supplied input as XPath.

Read more at https://www.tenable.com/plugins/was/98114

]]> <![CDATA[Directory Listing]]> https://www.tenable.com/plugins/was/98084 https://www.tenable.com/plugins/was/98084 Mon, 12 Aug 2024 00:00:00 GMT Web App Scanning Plugin ID 98084 with Medium Severity

Synopsis

Directory Listing

Description

Web servers permitting directory listing are typically used for sharing files.

Directory listing allows the client to view a simple list of all the files and folders hosted on the web server. The client is then able to traverse each directory and download the files.

Cyber-criminals will utilise the presence of directory listing to discover sensitive files, download protected content, or even just learn how the web application is strurctured.

Scanner discovered that the affected page permits directory listing.

Solution

Unless the web server is being utilised to share static and non-sensitive files, enabling directory listing is considered a poor security practice
This can typically be done with a simple configuration change on the server. The steps to disable the directory listing will differ depending on the type of server being used (IIS, Apache, etc.). If directory listing is required, and permitted, then steps should be taken to ensure that the risk of such a configuration is reduced.
These can include:
1. Requiring authentication to access affected pages. 2. Adding the affected path to the `robots.txt` file to prevent the directory contents being searchable via search engines. 3. Ensuring that sensitive files are not stored within the web or document root. 4. Removing any files that are not required for the application to function.

Read more at https://www.tenable.com/plugins/was/98084

]]> <![CDATA[Out-of-Date Backbone JS Framework Detected]]> https://www.tenable.com/plugins/was/113037 https://www.tenable.com/plugins/was/113037 Tue, 06 Aug 2024 00:00:00 GMT Web App Scanning Plugin ID 113037 with Info Severity

Synopsis

Out-of-Date Backbone JS Framework Detected

Description

An out-of-date version of Backbone JS Framework has been detected. An outdated version could have vulnerabilities or missing security features.

Solution

Upgrade to the latest version of Backbone JS Framework.

Read more at https://www.tenable.com/plugins/was/113037

]]> <![CDATA[Out-of-Date Underscore.js Detected]]> https://www.tenable.com/plugins/was/113033 https://www.tenable.com/plugins/was/113033 Tue, 06 Aug 2024 00:00:00 GMT Web App Scanning Plugin ID 113033 with Info Severity

Synopsis

Out-of-Date Underscore.js Detected

Description

An out-of-date version of Underscore.js has been detected. An outdated version could have vulnerabilities or missing security features.

Solution

Upgrade to the latest version of Underscore.js.

Read more at https://www.tenable.com/plugins/was/113033

]]> <![CDATA[Out-of-Date Modernizr Detected]]> https://www.tenable.com/plugins/was/113032 https://www.tenable.com/plugins/was/113032 Tue, 06 Aug 2024 00:00:00 GMT Web App Scanning Plugin ID 113032 with Info Severity

Synopsis

Out-of-Date Modernizr Detected

Description

An out-of-date version of Modernizr has been detected. An outdated version could have vulnerabilities or missing security features.

Solution

Upgrade to the latest version of Modernizr.

Read more at https://www.tenable.com/plugins/was/113032

]]> <![CDATA[Out-of-Date Bootstrap Detected]]> https://www.tenable.com/plugins/was/113030 https://www.tenable.com/plugins/was/113030 Tue, 06 Aug 2024 00:00:00 GMT Web App Scanning Plugin ID 113030 with Info Severity

Synopsis

Out-of-Date Bootstrap Detected

Description

An out-of-date version of Bootstrap has been detected. An outdated version could have vulnerabilities or missing security features.

Solution

Upgrade to the latest version of Bootstrap.

Read more at https://www.tenable.com/plugins/was/113030

]]> <![CDATA[GeoServer SQL Injection]]> https://www.tenable.com/plugins/was/113959 https://www.tenable.com/plugins/was/113959 Thu, 01 Aug 2024 00:00:00 GMT Web App Scanning Plugin ID 113959 with Critical Severity

Synopsis

GeoServer SQL Injection

Description

The GeoServer instance installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization through an OGC Common Query Language query.

Solution

Apply the appropriate patch according to the vendor advisory or disable the PostGIS Datastore encode functions and enable the PostGIS DataStore preparedStatements setting.

Read more at https://www.tenable.com/plugins/was/113959

]]> <![CDATA[Missing 'Content-Type' Charset]]> https://www.tenable.com/plugins/was/114382 https://www.tenable.com/plugins/was/114382 Mon, 29 Jul 2024 00:00:00 GMT Web App Scanning Plugin ID 114382 with Low Severity

Synopsis

Missing 'Content-Type' Charset

Description

The Content-Type header allows clients to find an appropriate way to render data, omission of the charset can lead to various behaviour like a Cross-Site Scripting abusing the browser's auto-detection mechanism.

Solution

Configure your web server to include an 'Content-Type' header with a charset defined therein.

Read more at https://www.tenable.com/plugins/was/114382

]]> <![CDATA[Apache Hugegraph 1.0.0 < 1.3.0 Remote Command Execution]]> https://www.tenable.com/plugins/was/114381 https://www.tenable.com/plugins/was/114381 Mon, 29 Jul 2024 00:00:00 GMT Web App Scanning Plugin ID 114381 with Critical Severity

Synopsis

Apache Hugegraph 1.0.0 < 1.3.0 Remote Command Execution

Description

Apache Hugegraph versions 1.0.0 prior to 1.3.0 is affected by a vulnerability allowing an unauthenticated attacker to execute remote commands via a specially forged request.

Solution

Update to Apache Hugegraph version 1.3.0 or latest.

Read more at https://www.tenable.com/plugins/was/114381

]]> <![CDATA[Web Cache Poisoning]]> https://www.tenable.com/plugins/was/113338 https://www.tenable.com/plugins/was/113338 Mon, 29 Jul 2024 00:00:00 GMT Web App Scanning Plugin ID 113338 with High Severity

Synopsis

Web Cache Poisoning

Description

A caching system has been detected on the application and is vulnerable to web cache poisoning. By manipulating specific unkeyed inputs (headers or cookies that are not included when generating the cache key) it was possible to force the caching system to cache a response that contains user-controlled input. If a response is cached in a shared web cache, such as those commonly found in proxy servers, then all users of that cache will continue to receive the malicious content until the cache entry is purged.

Solution

Disable caching for the affected input or pages. If both the affected input and caching behavior are required, configure the cache to ensure that the input is included in the cache key.

Read more at https://www.tenable.com/plugins/was/113338

]]> <![CDATA[Apache 2.4.60 Source Code Disclosure]]> https://www.tenable.com/plugins/was/114363 https://www.tenable.com/plugins/was/114363 Mon, 22 Jul 2024 00:00:00 GMT Web App Scanning Plugin ID 114363 with Medium Severity

Synopsis

Apache 2.4.60 Source Code Disclosure

Description

According to its banner, the version of Apache running on the remote host is 2.4.60. It is, therefore, affected by a source code disclosure with handlers configured via AddType.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Apache version 2.4.61 or later.

Read more at https://www.tenable.com/plugins/was/114363

]]> <![CDATA[Apache 2.4.x < 2.4.60 Multiple Vulnerabilities]]> https://www.tenable.com/plugins/was/114360 https://www.tenable.com/plugins/was/114360 Mon, 22 Jul 2024 00:00:00 GMT Web App Scanning Plugin ID 114360 with Critical Severity

Synopsis

Apache 2.4.x < 2.4.60 Multiple Vulnerabilities

Description

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.60. It is, therefore, affected by multiple vulnerabilities:

 - Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. (CVE-2024-36387)

 - SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content. (CVE-2024-38472)

 - Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. (CVE-2024-38473)

 - Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. (CVE-2024-38474)

 - Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. (CVE-2024-38475)

 - Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. (CVE-2024-38476)

 - Null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. (CVE-2024-38477)

 - Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. (CVE-2024-39573)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Apache version 2.4.60 or later.

Read more at https://www.tenable.com/plugins/was/114360

]]> <![CDATA[Adobe Commerce / Magento XML External Entity Injection (CosmicSting)]]> https://www.tenable.com/plugins/was/114325 https://www.tenable.com/plugins/was/114325 Thu, 18 Jul 2024 00:00:00 GMT Web App Scanning Plugin ID 114325 with Critical Severity

Synopsis

Adobe Commerce / Magento XML External Entity Injection (CosmicSting)

Description

Adobe Magento Open Source / Commerce versions 2.4.7 < 2.4.7-p1, 2.4.6 < 2.4.6-p6, 2.4.5 < 2.4.5-p8, 2.4.4 < 2.4.4-p9 and earlier suffer from an XML External Entity (XXE) vulnerability. By exploiting this vulnerability and crafting a malicious XML document, a remote and unauthenticated attacker could achieve Remote Code Execution (RCE) on the vulnerable Magento instance.

Solution

Update Adobe Magento Open Source / Commerce to versions 2.4.4-p9, 2.4.5-p8, 2.4.6-p6, 2.4.7-p1 or later. Adobe Commerce could also be updated to 2.3.7-p4-ext-8, 2.4.0-ext-8, 2.4.1-ext-8, 2.4.2-ext-8, 2.4.3-ext-8 or later.

Read more at https://www.tenable.com/plugins/was/114325

]]> <![CDATA[Magento Administration Panel Login Form Bruteforced]]> https://www.tenable.com/plugins/was/113117 https://www.tenable.com/plugins/was/113117 Thu, 18 Jul 2024 00:00:00 GMT Web App Scanning Plugin ID 113117 with High Severity

Synopsis

Magento Administration Panel Login Form Bruteforced

Description

The scanner successfully authenticated on the Magento administration panel by using weak or predictable credentials.

Solution

The Magento administration panel interface should not be configured with accounts using default or predictable credentials. A complex password policy should be defined and enforced on every account to prevent attackers from guessing it and gain unauthorized access.

Read more at https://www.tenable.com/plugins/was/113117

]]> <![CDATA[JSON Web Token Weak Secret]]> https://www.tenable.com/plugins/was/112697 https://www.tenable.com/plugins/was/112697 Mon, 01 Jul 2024 00:00:00 GMT Web App Scanning Plugin ID 112697 with High Severity

Synopsis

JSON Web Token Weak Secret

Description

JSON Web Tokens can be signed to protect against data tampering. By using an asymmetric or a symmetric signing algorithm, the application computes a signature of the token data which will be verified during token decoding to ensure its integrity. When using a symmetric algorithm, the signature is created from the chosen HMAC function along with a secret key.

Using weak keys makes it vulnerable to bruteforce attacks, allowing tokens to be manipulated and signed on behalf of the application. Depending on the token usage, attackers could leverage this vulnerability to forge valid tokens and impersonate other users, or gain further privileges.

Solution

The secret key used to sign the JSON Web Tokens in the application must be stronger (long and random) to prevent it from being retrieved with a bruteforce attack. Note that the JSON Web Algorithms standard (RFC 7518) defines the minimum key length to be equal to the size (in bits) of the hash function used with the HMAC algorithm.

Read more at https://www.tenable.com/plugins/was/112697

]]> <![CDATA[Misconfiguration in LIMIT directive of .htaccess file]]> https://www.tenable.com/plugins/was/98095 https://www.tenable.com/plugins/was/98095 Mon, 10 Jun 2024 00:00:00 GMT Web App Scanning Plugin ID 98095 with Medium Severity

Synopsis

Misconfiguration in LIMIT directive of .htaccess file

Description

There are a number of HTTP methods that can be used on a webserver (for example `OPTIONS`, `HEAD`, `GET`, `POST`, `PUT`, `DELETE `etc.). Each of these methods perform a different function, and each has an associated level of risk when their use is permitted on the webserver.

The `` directive within Apache's `.htaccess` file allows administrators to define which of the methods they would like to block. However, as this is a blacklisting approach, it is inevitable that a server administrator may accidentally miss adding certain HTTP methods to be blocked, thus increasing the level of risk to the application and/or server.

Solution

The preferred configuration is to prevent the use of unauthorised HTTP methods by utilising the `` directive.
This directive uses a whitelisting approach to permit HTTP methods while blocking all others not listed in the directive, and will therefor block any method tampering attempts.
Most commonly, the only HTTP methods required for most scenarios are `GET` and `POST`. An example of permitting these HTTP methods is: ` require valid-user `

Read more at https://www.tenable.com/plugins/was/98095

]]> <![CDATA[HTTP Verb Tampering]]> https://www.tenable.com/plugins/was/113211 https://www.tenable.com/plugins/was/113211 Mon, 10 Jun 2024 00:00:00 GMT Web App Scanning Plugin ID 113211 with Medium Severity

Synopsis

HTTP Verb Tampering

Description

HTTP Verb Tampering is an attack that bypasses an authentication or control system that is based on the HTTP Verb. Sometimes, Web Server authentication mechanisms use verb-based authentication with access controls. Such security mechanisms include access control rules for requests with specific HTTP methods. Due to the HTTP specification that includes request methods other than the standard GET and POST requests, a standards compliant web server may respond to these alternative methods in ways not anticipated by developers. So if an application restricts only GET requests it might still be possible to access the page using a POST, PUT, PATCH or other method.

Solution

Block all HTTP verb instead of using a blocklist of HTTP verbs.

Read more at https://www.tenable.com/plugins/was/113211

]]> <![CDATA[Wordpress Administration Panel Login Form Bruteforced]]> https://www.tenable.com/plugins/was/113136 https://www.tenable.com/plugins/was/113136 Fri, 31 May 2024 00:00:00 GMT Web App Scanning Plugin ID 113136 with High Severity

Synopsis

Wordpress Administration Panel Login Form Bruteforced

Description

The scanner successfully authenticated on the Wordpress administration panel by using weak or predictable credentials.

Solution

The Wordpress administration panel interface should not be configured with accounts using default or predictable credentials. A complex password policy should be defined and enforced on every account to prevent attackers from guessing it and gain unauthorized access.

Read more at https://www.tenable.com/plugins/was/113136

]]> <![CDATA[F5 BIG-IP Next Central Manager SQL Injection]]> https://www.tenable.com/plugins/was/114281 https://www.tenable.com/plugins/was/114281 Mon, 27 May 2024 00:00:00 GMT Web App Scanning Plugin ID 114281 with High Severity

Synopsis

F5 BIG-IP Next Central Manager SQL Injection

Description

F5 BIG-IP Next Central Manager version 20.0.1 < 20.2.0 is affected by a SQL Injection. An unauthenticated, remote attacker can exploit this to bypass authentication or extract information such as user hashes.

Solution

Upgrade to F5 BIG-IP Next Central Manager version 20.2.0 or later.

Read more at https://www.tenable.com/plugins/was/114281

]]> <![CDATA[Strapi < 4.8.0 Private Fields Sensitive Information Disclosure]]> https://www.tenable.com/plugins/was/114108 https://www.tenable.com/plugins/was/114108 Mon, 27 May 2024 00:00:00 GMT Web App Scanning Plugin ID 114108 with Medium Severity

Synopsis

Strapi < 4.8.0 Private Fields Sensitive Information Disclosure

Description

Strapi is a popular open-source headless Content Management System (CMS) written in Node.js. Strapi versions before 4.8.0 suffer from an information disclosure vulnerability through collections private fields. By manipulating public collections query filters, a remote and unauthenticated attacker can infer sensitive information like encrypted password or password reset tokens by analyzing response discrepancies. Upon successful exploitation, the attacker can gain administrative access to the Strapi administration panel.

Solution

Upgrade Strapi to version 4.8.0 or later.

Read more at https://www.tenable.com/plugins/was/114108

]]> <![CDATA[Strapi Cognito Provider Authentication Bypass]]> https://www.tenable.com/plugins/was/114041 https://www.tenable.com/plugins/was/114041 Mon, 27 May 2024 00:00:00 GMT Web App Scanning Plugin ID 114041 with High Severity

Synopsis

Strapi Cognito Provider Authentication Bypass

Description

Strapi is a popular open-source headless CMS built with Node.js. Strapi versions after 3.2.0 and before 4.6.0 suffer from a lack of validation of JWT tokens sent through the AWS Cognito authentication provider during the OAuth flow.

By forging a custom JWT token with any signature, a remote and unauthenticated attacker can impersonate any user who use AWS Cognito to authenticate against the target application.

Solution

Upgrade to Strapi version 4.6.0 or latest.

Read more at https://www.tenable.com/plugins/was/114041

]]> <![CDATA[OpenAPI Import Failed]]> https://www.tenable.com/plugins/was/112570 https://www.tenable.com/plugins/was/112570 Mon, 27 May 2024 00:00:00 GMT Web App Scanning Plugin ID 112570 with Info Severity

Synopsis

OpenAPI Import Failed

Description

OpenAPI file could not be imported and cannot be used during the scan.

Solution

Read more at https://www.tenable.com/plugins/was/112570

]]> <![CDATA[OpenAPI Import Success]]> https://www.tenable.com/plugins/was/112569 https://www.tenable.com/plugins/was/112569 Mon, 27 May 2024 00:00:00 GMT Web App Scanning Plugin ID 112569 with Info Severity

Synopsis

OpenAPI Import Success

Description

OpenAPI file was successfully imported and can be used during the scan.

Solution

Read more at https://www.tenable.com/plugins/was/112569

]]> <![CDATA[Open Proxy]]> https://www.tenable.com/plugins/was/114237 https://www.tenable.com/plugins/was/114237 Thu, 16 May 2024 00:00:00 GMT Web App Scanning Plugin ID 114237 with High Severity

Synopsis

Open Proxy

Description

Web applications often rely on proxy server to route requests to the right web service. An Open Proxy vulnerabilities occurs when a web server is configured to act as forward proxy, allowing anyone to use it to relay web traffic. This setup can may allow an attacker to use the proxy server to make requests to an external or internal server.\n\nThe corse issue arises because the proxy does not authenticate its users, thereby offering no control over who users the server's resources or for what purpose.

Solution

Modify the proxy server configuration to disallow third-party requests or implement access control.

Read more at https://www.tenable.com/plugins/was/114237

]]> <![CDATA[Apache mod_negotiation Alternative Filename Disclosure]]> https://www.tenable.com/plugins/was/113165 https://www.tenable.com/plugins/was/113165 Thu, 16 May 2024 00:00:00 GMT Web App Scanning Plugin ID 113165 with Medium Severity

Synopsis

Apache mod_negotiation Alternative Filename Disclosure

Description

Apache web server configured with mod_negotiation and Multiviews enabled may, on receipt of a crafted invalid request with a extension-less filename return a pseudo directory listing of matching resources with known mime types. This feature may be abused by attackers to discover hidden resources on a server without resort to brute-force methods. The scanner has detected files on the server using this technique.

Solution

If files are not required, then they should be removed from the web root and/or the application directory or restricted by additional access controls. The removal of Multiviews in the Apache config could be used to avoid disclosing the presence of these files using this method but should not be considered a complete solution as it may only hinder an attacker discovering them.

Read more at https://www.tenable.com/plugins/was/113165

]]> <![CDATA[Target Information]]> https://www.tenable.com/plugins/was/98136 https://www.tenable.com/plugins/was/98136 Fri, 26 Apr 2024 00:00:00 GMT Web App Scanning Plugin ID 98136 with Info Severity

Synopsis

Target Information

Description

Publishes the target information of the starting url as evaluated by the scan.

Solution

Read more at https://www.tenable.com/plugins/was/98136

]]> <![CDATA[CrushFTP < 10.7.1 / 11.x < 11.1.0 VFS Sandbox Escape]]> https://www.tenable.com/plugins/was/114273 https://www.tenable.com/plugins/was/114273 Wed, 24 Apr 2024 00:00:00 GMT Web App Scanning Plugin ID 114273 with Critical Severity

Synopsis

CrushFTP < 10.7.1 / 11.x < 11.1.0 VFS Sandbox Escape

Description

CrushFTP versions prior to 10.7.1 and 11.x < 11.1.0 are vulnerable to a "VFS Sandbox Escape" allowing a remote attacker with low privileges to read files from the file system outside the sandbox.

Solution

Upgrade to CrushFTP version 10.7.1 or 11.1.0 or later.

Read more at https://www.tenable.com/plugins/was/114273

]]> <![CDATA[Permissive HTTP Strict Transport Security Policy Detected]]> https://www.tenable.com/plugins/was/98715 https://www.tenable.com/plugins/was/98715 Mon, 22 Apr 2024 00:00:00 GMT Web App Scanning Plugin ID 98715 with Low Severity

Synopsis

Permissive HTTP Strict Transport Security Policy Detected

Description

HTTP Strict Transport Security (HSTS) is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS.

The detected HSTS policy doesn't have long max-age value which is a representation (in milliseconds) determining the time in which the client's browser will adhere to the header policy or it doesn't cover subdomains via includeSubDomains directive.

Solution

The max-age must be set at least to 31536000 seconds (1 year) and includeSubDomains directive must be specified.

Read more at https://www.tenable.com/plugins/was/98715

]]> <![CDATA[Permissive Content Security Policy Detected]]> https://www.tenable.com/plugins/was/112554 https://www.tenable.com/plugins/was/112554 Mon, 22 Apr 2024 00:00:00 GMT Web App Scanning Plugin ID 112554 with Low Severity

Synopsis

Permissive Content Security Policy Detected

Description

Content Security Policy (CSP) is a web security standard that helps to mitigate attacks like cross-site scripting (XSS), clickjacking or mixed content issues. CSP provides mechanisms to websites to restrict content that browsers will be allowed to load.

One or several permissive directives have been detected. See output for more details.

Solution

Content Security Policies are designed to have control over where resources on a website can be loaded from. Implementing a policy depends on the application type (web applications, APIs...) and the directives have to be specified according to this.

For web applications, The following directive configurations can usually be applied to restrict the policy:
- 'frame-ancestors' should be set to 'none' to avoid rendering of page in ,