Acunetix Standard & Premium

Improvements

• Improved the description for all the vulnerability checks in Scanning Profiles

New Features

• Added a new test looking for development configuration files such as Vagrantfile, Gemfile, Rakefile and others
• Added a test for Insecure response with wildcard ‘*’ in Access-Control-Allow-Origin
• Added detection of Cross Site Scripting (XSS) in the mobile-touch event handlers
• Added a test for CVE-2015-5956 – Typo3 Core sanitizeLocalUrl() Non-Persistent Cross-Site Scripting
• Added a test looking for CVE-2015-5603: HipChat for JIRA plugin – Velocity Template Injection
• Added a test looking for vulnerable project dependencies by analyzing the contents of composer.lock
• Added a test for CVE-2015-5161 – XML eXternal Entity Injection (XXE) on PHP FPM (FastCGI Process Manager), affecting various versions of Zend Framework and ZendXML
• Added a test for CVE-2014-0114 – Class Loader Manipulation via Request Parameters affecting Apache Struts 1
• Added a test for CVE-2015-4670: Directory Traversal to Remote Code Execution in AjaxControlToolkit
• Added a test looking for sensitive files such as .mysql_history, .bash_history and others. Acunetix will verify the contents of these files to reduce false positives caused by custom 404s.

Improvements

• Updated database of WordPress core and plugin vulnerabilities.
• Added more checks for vulnerable JavaScript libraries.
• Improved WADL parsing to support more representation types.

Bug Fixes

• Fixed some false positives in JavaScript libraries audit.
• Fixed a false positive in File Inclusion script.
• Fixed an issue causing JSON and XML inputs not being checked for XSS.
• Fixed SSL audit bug that is triggered when server_name extension was not sent to the server during SSL negotiation.

New Features

• New Login Sequence Recorder which supports Single-Sign-On (SSO) and OAuth-based authentication.
• Database of 1200 WordPress-specific vulnerabilities, including checks for WordPress core and popular WordPress plugins.
• Improved scanning of Java / J2EE web applications
• Improved scanning of Restful Web Services, including parsing of WADL files
• Improved scanning of web applications implemented in Ruby on Rails
• Detection of XML External Entity (XXE) via REST APIs
• Crawling a website can now be pre-seeded using HAR files and exports from Fiddler, Burp, Selenium and the Acunetix Sniffer
• Introduced the detection of links to websites known to host malware or used for phishing
• Improved support for WSDL-based web services by introducing support for xsd:include, xsd:import and wsdl:import

Improvements

• Improved TLS support
• Introduced support for HTTP pipelining
• Minor bug fixes

New Features

• Added a check for Open Flash Chart ‘ofc_upload_image.php’ Remote PHP Code Execution Vulnerability which affects various web applications including WordPress plugins, Joomla! components, piwik, and others
• Added a test for Joomla! v3.2.2 SQL Injection vulnerability
• Added a script which checks for various known Drupal vulnerabilities (in Drupal modules and Drupal core)
• Added a test for SFTP/FTP credentials exposure. Various SFTP/FTP clients are storing connection credentials in plain text files (such as sftp-config.json, recentservers.xml, etc.) that are later uploaded on the web server
• Added a test for “Same Site” Scripting
• Added a test for Parallels Plesk SSO (Single sign-on) XXE (XML External Entity) and XSS (Cross-Site Scripting) vulnerabilities
• Added a test for systems running PHP versions < 5.5.12, 5.4.28 (multiple vulnerabilities fixed in these versions including the Heartbleed bug affecting PHP)
• Added a test looking if the Elasticsearch service is accessible
• Added a test for Elasticsearch remote code execution
• Added a test for nginx SPDY heap buffer overflow (CVE-2014-0133)
• Added a test for Adobe ColdFusion 9 Administrative Login Bypass
• Added a test for multiple vulnerabilities affecting Ioncube loader-wizard.php file
• Added a test looking for Apache Roller OGNL Injectio
• Added a test for Apache Tomcat JK Web Server Connector security bypass.
• Added a test looking for XSS vulnerabilities in GWT Google Web Toolkit – CVE-2012-4563, CVE-2012-5920, CVE-2013-4204
• Added detection of PHP framework CodeIgniter
• Added a test that checks for server-side redirects from http:// to file://
• Added a test looking for weak encryption keys in CodeIgniter-based web applications
• Added a test looking for insecure Django strip_tags implementation
• Added a test for JBoss Seam 2.3.1 Remoting Vulnerabilities
• Added detection and a check for the latest version of Typo3 web application
• Added a test looking for Adobe Cold Fusion directory traversal and information disclosure (CVE-2013-3336)
• Added the following Cross Domain Data Hijacking vulnerability checks:
  • Through file uploads,
  • Through unsafe JSONP callback
  • Through control over the top of the response page
• Added a test looking for Database connection strings information disclosure
• Added a test for CodeIgniter <= 2.1.3 xss_clean() Filter Bypass
• Added an alert for WordPress username enumeration
• Added a test for ExtJS charts.swf XSS (distributed with Typo3)
• Added a test for Ruby on Rails directory traversal (CVE-2014-0130)
• Added a test for WordPress plugin All In One SEO Pack security vulnerabilities.

Improvements

• Improved PHP version detection and OS detection
• Improve existing ColdFusion checks
• Improved SQL injection detection and added better error messages for IDM DB2 databases
• Improved XXE testing, introduced more test-cases as per this document
• Implemented server-name extension for TLS.

Bug Fixes

• Fixed issue were links originating from XHR are invalidated
• Fixed issues when inserting data in the reporting database
• Fixed issue with Invalid report dates when Microsoft Access is used for the Reporting database
• Web service editor didn’t used updated proxy settings
• HTTP editor – alert boxes not loading on Windows Server 2003 caused by Internet Explorer security restrictions
• Corrected CVE classification
• Fixed issue affecting some cases of crawl results from previous versions whereby the input method was not loaded properly
• Fixed crawler crash when sitemap file is invalid
• Apache_CN_Discover_New_Files.script script was double encoding URIs got from Apache
• Fixed various issues caused when the scan is paused.