Changelogs

Acunetix Standard & Premium

RSS Feed

v11.0.163541031 - 19 Dec 2016

Copy Link Copy Link
Version 11 (build 11.0.163541031) - 19th December 2016

New Features

  • Acunetix Enterprise users can now generate their API key to be used for the Acunetix API (contact sales@acunetix.com for more information on the API)
  • Selenium IDE files are now supported as Import files in Acunetix v11
  • The Acunetix Login Sequence Recorder can now edit login sequence files.

New Vulnerability Tests

Improvements

  • The Acunetix UI will show a message when the license is not activated.
  • The Login Sequence Recorder will make use of the proxy settings configured for the Target.
  • Better handling of cookies.

Bug Fixes

  • Fixed reports generated for targets that have not been scanned
  • Fixed allowance of empty Import Files to be uploaded for a Target
  • Some information returned by AcuSensor was not reflected in the vulnerability details
  • Fixed false positive in the ASP.NET debug mode check
  • Various minor updates and fixes

v11.0.163221044 - 17 Nov 2016

Copy Link Copy Link
Version 11 (build 11.0.163221044) - 17th November 2016

New Features

  • New web-based user interface
  • Targets are now stored in Acunetix with their individual settings, and can be easily re-scanned.
  • Targets can be classified by their Business Criticality
  • Reports are stored in the central interface
  • Users can choose between “Target reports”, “Scan reports” or “All vulnerabilities reports”
  • Role-based multi-user system, allowing users to be assigned the security scanning of specific targets.
  • All vulnerabilities for all the targets are now shown in one list which can be easily filtered.
  • Export vulnerabilities to F5 BIG-IP ASM and Fortinet FortiWeb Web Application Firewalls directly from within Acunetix
  • Acunetix now supports sending vulnerabilities to these Issue trackers: Github, JIRA and Microsoft Team Foundation Service (TFS)
  • Documentation is now inbuilt into the new interface
  • New Dashboard, providing an instant overview of the security status of your assets.

Improvements

v10.5.20160520 - 20 May 2016

Copy Link Copy Link
Update v10.5.20160520 - 20th May 2016

Bug Fixes

  • Fixed minor bugs reported

v10.5.20160504 - 05 May 2016

Copy Link Copy Link
Build v10.5.20160504 - 5th May 2016

Improvements

  • Updated the PCI DSS compliance report for PCI DSS 3.2
  • Updated the NIST Special Publication 800-53 – Recommended Security Controls for Federal Information Systems compliance report to comply with revision 4 of the publication

Bug Fixes

  • Fixed a bug that could result in remote code execution

v10.5.20160427 - 27 Apr 2016

Copy Link Copy Link
Build v10.5.20160427 - 27th April 2016

New Features

  • New version of .NET AcuSensor (requires removal of the sensors installed in the web applications – check this blog post for more info)
  • Implemented a test looking for JSP source code disclosure via SOH (start of header)
  • Added a script for parsing specific Java error messages to improve crawling coverage and discover new content.

Improvements

  • Improved backup config files discovery
  • Request cookies will now be automatically processed from proxy log requests and used during a scan
  • The Crawler now processes untrusted URLs even if they do not belong to the host being scanned.

Bug Fixes

  • Fixed a number of false positives in the SQL injection vulnerability checks
  • Limit AST parsing to files smaller than 1Mb
  • Fixed an SQL injection vulnerability in the reporter.

v10.5.20160302 - 02 Mar 2016

Copy Link Copy Link
Update v10.5.20160302 - 2nd March 2016

New Features

v10.5.20160215 - 16 Feb 2016

Copy Link Copy Link
Build v10.5.20160215 - 16th February 2016

New Features

Improvements

  • Improved Blind and Error-based SQL injection tests
  • Improved XSS tests
  • Big improvements to the XXE (XML External Entity) tests
  • Improved static crawling by parsing of JavaScript event handler parameters.
  • Improve Email header injection test based on the paper from http://www.mbsd.jp/Whitepaper/smtpi.pdf

 

v10.0.20151125 - 26 Nov 2015

Copy Link Copy Link
Build v10.0.20151125 - 26th November 2015

New Features

  • Added a test looking for insecure CORS configurations.
  • Added a test looking for CVE-2014-7829 – Arbitrary file existence disclosure in Action Pack.
  • Added a test looking for Rails application running in development mode.
  • Added a test looking for CVE-2015-7808 vBulletin 5 PreAuth RCE.
  • Added a test looking for Insecure DNS records
  • Added a test looking for Spring Boot Actuator
  • Added a test looking for Tornado Debug mode
  • Added a test looking for Pyramid Debug mode
  • Implemented PHP object deserialization of user-supplied data
  • Added a test looking for older versions of the ZeroClipboard SWF library that are vulnerable to a cross-site scripting vulnerability.

Improvements

  • Updated WordPress plugins and WordPress core checks.
  • Improved tests for possible sensitive directories and sensitive files.
  • Improved Apache Axis audit script.
  • Added a test for Java object deserialization of user-supplied data
  • Various improvements for XSS detection.
  • Improved HTML structural parser and added allow to robots.txt parser
  • Added support for WADL files when served using content-type application/vnd.sun.wadl+xml

Bug Fixes

  • Fixed crash cause during auto session detection.
  • Security fix for privilege escalation reported by security researcher Daniele Linguaglossa

 

1 … 16 17 18 … 26