Acunetix 360 On-Demand

New Features

• Clicking on the scheduled scan icon in the scan summary screen now redirects you to the Recent Scans page with a filtered view, improving navigation and access to relevant scan details

• Implemented an integration that automatically retrieves the latest Container security results from Mend when a DAST scan is initiated

Improvements

• Fixed an issue on the 2FA page where the code text field was not automatically focused upon page load
• Introduces a configurable retention period for HTTP log files, allowing Root users to specify the number of days before log
• Implemented a restriction to prevent the modification of the Vulnerability Signature Type
• Enhanced the UI to highlight the menu when API Hub specifications are linked to a scan profile, making it easier for users to identify associated profiles
• Updated Chromium from version 121 to version 131 for enhanced performance and compatibility
• Enhanced detection accuracy for Weak Ciphers Enabled by analyzing false positives
• Administrators can now assign Agent Groups to Teams for greater control over agents and the teams that can use them. Learn more.

Resolved issues

• Corrected OTP configuration attachment to personas, ensuring separate secrets and preventing shared changes
• Resolved issue where the internal agent service stopped after being disabled in the UI. The service now remains active even when the agent is disabled from the web application
• Updated the SharedAssemblyInfo file to reflect the correct copyright details
• Fixed an issue where a disabled scan was inadvertently running, leading to an outage
• Fixed a bug where users were unable to update the website name longer than 40 characters
• Fixed an issue where the Invicti REST API did not return errors when importing an invalid definition file
• Resolved the “Internal Server Error” encountered on the Invicti scans/report API endpoint after enabling the “Prevent any sensitive information showing within the product” setting
• Fixed an issue where the issue state was inadvertently removed when a user, without permission to update the state, added a note to the issue
• Fixed an issue where the “Notification Settings” hyperlink in notification emails was redirecting incorrectly
• Resolved the issue where the Agent Verifier was encountering errors when using certificates in a Linux environment
• Fixed an issue where duplicate tickets were being created in ServiceNow due to integration error
• Fixed an issue where the severity trend chart was not rendering correctly on the individual website dashboard
• Node.js v6 has reached its End of Life (EOL), and support for this version has been removed from Azure Pipelines
• Resolved a coverage issue where the login page reappeared during scans

This update includes changes to the internal agents. The internal scan agent’s current version is 24.12.1. The internal authentication verifier agent’s current version is 24.12.1.

New feature

• A connector for Mend SCA now available

Improvements

• Added new paths to forced browsing
• Updated the vulnerability template for the Internal Server Error vulnerability
• Improved Insecure HTTP Usage detection
• Improved retry operations to prevent JSONSerializer errors following archiving failures
• Removed support email addresses from the product
• Removed cancelled and failed scans after 90 days

Fixes

• Fixed an issue in Mulesoft integration where child organizations were not syncing properly
• Fixed an issue with ServiceNow integrations causing authentication errors by suspending the affected integrations
• Fixed an issue where JSON responses were incorrectly formatted
• Fixed an issue where scans failed with a “Failed – Agent is unavailable” error at the end of the scan
• Fixed an issue where Invicti detected vulnerabilities in multiple parameters of the same URL but didn’t report them due to the vulnerability family mechanism

This update includes changes to the internal agents. The internal scan agent’s current version is 24.11.0. The internal authentication verifier agent’s current version is 24.11.0.

New Features

• API Discovery now supports working with RAML specs from Mulesoft Anypoint Exchange

New Security Checks

• Added a check for applications performing certificate name validation to prevent reading invalid memory addresses (CVE-2024-6119)

Improvements

• Updated the AuthVerificationService from .NET 6.0 to .NET 8.0

Fixes

• Fixed an issue with missing links in imported files that were sent from the API Inventory to the agent
• Fixed an issue where target names longer than 40 characters were not being truncated as expected on the Create New Target page
• Fixed an issue where the “Download HTTP Request Logs” button triggered an error while a scan was in progress
• Fixed an issue where user names containing the character “ä” could not be added
• Fixed an issue with the scan data retention period for raw scan files that was not working as expected
• Fixed missing scan completed notifications with report attachments
• Fixed an issue where adding more than one name to a Notification’s Excluded Recipients would remove the other users from all other notifications
• Fixed an issue where the verifier agent could not read or apply custom proxy settings from the appsettings.json file
• Fixed an issue where uploading a .proto file caused a “No links found in the file” error
• Fixed missing request/response details for some out-of-band vulnerabilities

This update includes changes to the internal agents. The internal scan agent’s current version is 24.10.0. The internal authentication verifier agent’s current version is 24.10.0.

New Features

• API Security: Added integration with Azure API Management to fetch Swagger2 and OpenAPI3 specification files → Learn more

New Security Checks

• Updated detection for ActiveMQ – Remote Code Execution (CVE-2023-46604) and TorchServe Management API SSRF (CVE-2023-43654)

Improvements

• Database optimizations
• Changed scanning without a duration limit to a customer support request-only option
• Reporting improvements for the “Unknown Option Used In Referrer-Policy” vulnerability
• Improved the behavior of the ‘Recent Scans’ button group on the global dashboard when using the mobile view

Fixes

• Fixed a timeout bug in zero-configuration API discovery
• Fixed some wording inconsistencies and other minor improvements to the user interface
• Removal of sitemap data when a scan is canceled, failed, or aborted
• Resolved an issue in the General Settings page configuration
• Resolved an issue with user sessions not timing out in compliance with the specified configuration
• Fixed a false positive issue with Boolean Based MongoDB Injection detection
• Out-of-date version for Boolean Based MongoDB Injection is now reported correctly
• Fixed missing API validation for Scan Profile updates, which caused data conflicts during website deletion.

This update includes changes to the internal agents. The internal scan agent’s current version is 24.9.0. The internal authentication verifier agent’s current version is 24.9.0.

New Security Checks

• Adjusted the severity of SSLv3 and TLS 1.0 vulnerabilities to reflect their security risks
• Added support for CSP frame-ancestors
• Added detection for CVE-2024-6297, affecting several WordPress plugins

Improvements

• Pre-request script now works in DOM as well
• The Azure Extension now retries connections, preventing pipeline failures

Fixes

• Remediated a high vulnerability issue on the Agent Dotnet dependency package
• Fixed an issue that was preventing the selection of configuration items during ServiceNow integration setup
• Fixed an issue with updating targets using the target group ID
• Fixed an issue where the Auth Verifier heartbeat was showing an hour behind due to daylight saving time adjustments
• Fixed an error that was occurring when editing Report Policies
• Fixed an issue with a REST API endpoint returning alternating severity data for TLS 1.0 vulnerabilities
• Resolved an issue with a pre-request script that was affecting crawling functionality