Changelogs

Acunetix Standard & Premium

RSS Feed

v9.0.20131023 - 23 Oct 2013

Copy Link Copy Link
Build v9.0.20131023 - 23rd October 2013

New Features

  • Introduced the detection of additional DOM XSS vulnerabilities which can be injected in the HTTP GET parameters.
  • Implemented the option to auto-save scan results after the scan is completed. This can be configured from Configuration->Application Settings->Saved scan results. This node also includes the Database settings, which are used for the reporting database.

Improvements

  • Reduced number of requests made by PerFolder scripts by making some optimizations in the scripts.
  • Improved Readme_Files script to reduce some false positives originating from sites using a custom 404 page

Bug Fixes

  • Affected file was sometimes set incorrectly for DOM XSS vulnerabilities.
  • Fixed an issue causing the scan to check for possible sensitive files/folders when AcuSensor is enabled, and thus such files would already be known.
  • Saving scan results to reporting database and loading of saved scans sometimes caused WVS to crash
  • The Edit Request Variables option in the HTTP editor was not visible
  • Fixed Out of memory crash in AcuSensor for PHP when “mbstring.func_overload” is enabled.
  • Fixed memory leak affecting large websites

v9.0.20131023 - 23 Oct 2013

Copy Link Copy Link
Build v9.0.20131023 - 23rd October 2013

New Features

  • Introduced the detection of additional DOM XSS vulnerabilities which can be injected in the HTTP GET parameters.
  • Implemented the option to auto-save scan results after the scan is completed. This can be configured from Configuration->Application Settings->Saved scan results. This node also includes the Database settings, which are used for the reporting database.

Improvements

  • Reduced number of requests made by PerFolder scripts by making some optimizations in the scripts.
  • Improved Readme_Files script to reduce some false positives originating from sites using a custom 404 page

Bug Fixes

  • Affected file was sometimes set incorrectly for DOM XSS vulnerabilities.
  • Fixed an issue causing the scan to check for possible sensitive files/folders when AcuSensor is enabled, and thus such files would already be known.
  • Saving scan results to reporting database and loading of saved scans sometimes caused WVS to crash
  • The Edit Request Variables option in the HTTP editor was not visible
  • Fixed Out of memory crash in AcuSensor for PHP when “mbstring.func_overload” is enabled.
  • Fixed memory leak affecting large websites

v9.0.20131009 - 10 Oct 2013

Copy Link Copy Link
Build v9.0.20131009 - 10th October 2013

New Features

  • Added a test looking for ReadMe documentation files. The information contained in these files could help an attacker identify the web application being used and sometimes the version of the application. It’s recommended to remove these files from production systems
  • Added a test for HTML injection vulnerabilities
  • Added a test for weak passwords in Joomla! Administrative interface
  • Added a test for weak passwords in the Django Administrative interface
  • Added a test for WordPress PHP Object Injection affecting versions lower than 3.6.1

Improvements

  • Various updates in DeepScan resulting in improved site coverage
  • Update in the way that the HTTP Editor detects the host header from the URL
  • Acunetix now displays a warning if the user closes the application during a scan
  • The Port scanner timeout connection can be configured in milliseconds, allowing for further fine-tuning of the timeout

Bug Fixes

  • Fixed a crash in the user interface when certain components where updated from different threads
  • Base64 tool has been updated to ignore CRLF
  • Fixed issue causing the CSRF checks to never finish in some cases
  • Fixed issue causing the Reporter to invalidate the default report in some cases when the settings were changed
  • Fixed issue causing the default report button was not working in welcome screen
  • Fixed crawler stall when maximum number of pages reached
  • Fixed various memory leaks in crawler
  • Various updates to the Scanning Profiles

v9.0.20130904 - 05 Sep 2013

Copy Link Copy Link
Build v9.0.20130904 - 5th September 2013

New Features

Improvements

  • Improved DeepScan to provide better coverage.
  • Improved SQL injection detection for HSQLDB databases.
  • Improved XSS detection.
  • Added ability to select/unselect all items in a folder when using the option “after crawling let me choose the files to scan”.

Bug Fixes

  • Fixed custom 404 browser navigation bug
  • Filenames encoded as UTF-8 are now properly displayed.

v9.0.20130814 - 15 Aug 2013

Copy Link Copy Link
Build v9.0.20130814 - 15th August 2013 - NEW VERSION

New Features

  • FULL support for HTML5
  • Introduced DeepScan Technology which enhances crawling of JavaScript based web sites, including AJAX and Single Page Applications (SPA). DeepScan is powered by WebKit.
  • Improved support for mobile friendly web sites
    • Improved ability to crawl such sites
    • User is given option to scan mobile friendly version of website
  • Drastically increased the detection of DOM-based XSS
  • Launched Acunetix AcuMonitor used to detect vulnerabilities that can only be detected using an intermediate server. The use of AcuMonitor requires registration.
  • Detection of Blind XSS using AcuMonitor
  • Detection of Server Side Request Forgery (SSRF) using AcuMonitor
  • Detection of Host Header Attacks using AcuMonitor
  • Detection of Email Header Injection using AcuMonitor
  • Detection of XML External Entity (XXE) using AcuMonitor
  • New parameter: /SaveCrawlerData. This new parameter can be used to save the crawler data following a scan from command line.
  • At the end of a scan, the command line output includes scan statistics showing the number of files detected, number of requests, average response and other data which is shown in the main application.
  • Introduced http://testhtml5.vulnweb.com – a new HTML 5 test site which hosts various HTML5 specific vulnerabilities

Improvements

  • Blind SQL Injection script has been revamped and now provides better detection and significantly reduces false positives
  • Crawler has been updated to support 303 and 307 HTTP Redirection Status codes
  • Updated HTML Authentication Auditing script
  • When a vulnerability is identified, Acunetix will stop checking for variations of the vulnerability. This decreases the scan time, and prevents reporting the same vulnerability multiple times on the same input field.
  • HTTP Authentication now allows saving of websites with underscore in the domain names
  • Backup file script has been updated to not display large binary files in HTTP editor.

Bug Fixes

  • Fixed non-responsive user interface caused when saving scan results.
  • Fixed issue where some scans incorrectly reported the alert ‘Password type input with auto-complete enabled’ multiple times incorrectly.
  • Some scans used to run the perServer scripts twice, thus taking longer and reporting the same vulnerability twice.
  • Scheduler sometimes reported an ‘Unknown State’ when a scan is cancelled.
  • Various other bug fixes

v8.0.20130619 - 19 Jun 2013

Copy Link Copy Link
Build v8.0.20130619 - 19th June 2013

New Features

Improvements

  • Reduced false positives in XSS detection
  • Improvements to Web Server Default Welcome Page script
  • Reduced false positives reported by Blind SQL Injection
  • Improvements in the detection of Sensitive Directories
  • Added patterns for Python error messages and stack traces in the Text Search script.

Bug Fixes

  • Fixed an issue in PHP AcuSensor
  • In some situations, the Login Sequence Recorder misidentified connections to HTTPs sites when working through the Acunetix Web Vulnerability Scanner proxy
  • Fixed crash in the crawler when external JavaScript files where processed from a site with AcuSensor enabled
  • Fixed a false positive in Microsoft IIS Tilde Directory Enumeration
  • Fixed issues where scheduled scans with recursion are not rescheduled if they cannot start because of scan restrictions
  • Fixed a bug with Amazon S3 Public Buckets audit KB items being reported multiple times

v8.0.20130416 - 18 Apr 2013

Copy Link Copy Link
Build v8.0.20130416 - 18th April 2013

New Features

  • Added a test that enumerates valid WordPress usernames using various techniques.
  • Added a test for weak WordPress passwords for the usernames identified during the scan.
  • Added a test that identifies common WordPress plugins. For each plugin identified, Acunetix WVS will try to enumerate the plugin name, short description, installed version and latest version of the plugin. This information is shown in a Knowledge Base item.
  • Added a test that identifies Amazon S3 public buckets.
  • Added a test for the security hotfix for ColdFusion 10, 9.0.2, 9.0.1 and 9.0 for Windows, Macintosh and UNIX (Adobe Vulnerability ID: APSB13-10; CVE-2013-1387, CVE-2013-1388)
  • Added a test looking for Apache Tomcat SessionExample servlet that can allow session manipulation.
  • Added a test for Drupal Views Module Information Disclosure Vulnerability.
  • Added a test for Gallery v3.0.4 Remote Code Execution.
  • Added a test for Jenkins Dashboard (http://jenkins-ci.org/).
  • Added a test for Roundcube Webmail Security updates 0.8.6 and 0.7.3.
  • Added a test for WordPress 3.4.2 Cross Site Request Forgery.
  • Added a test looking for a Cross-Site Scripting vulnerability in older versions of jQuery which affected Drupal amongst others.
  • Added a test looking for SQL Injection in Symphony v2.3.1 (CVE-2013-2599)

Improvements

  • Client Script Analyser: Optimized script source retrieval (modernizr-2.5.3.js)
  • Improved XSS in URI script to test for Apache Tomcat Path Parameters.
  • Improved WordPress Pingback Scanner test.
  • Improved Blind SQL Injection script.
  • Improved Crossdomain_XML script.
  • Improved Directory Traversal script.
  • Improved Error_Message script.
  • Improved URL redirection script.
  • Improved XSS testing script.
  • The amount of input schemes has been reduced for known applications, improving the scan performance for such web applications.

Bug Fixes

  • Fixed an issue which caused false positives to occasionally show up in the report for Scheduled Scans.
  • Better handling for META http-equiv=”refresh” tags by the Crawler.
  • Fixed an issue in error_messages_helpers.inc script.
  • Fixed a minor bug in the Scheduler UI (Bug ID: 364)
  • North and South Korea are now correctly identified in the Product Activation Wizard.
  • Scans were sporadically entering a loop when scanning certain sites using a login sequence and the CSRF check was enabled.
  • WebApps scripts were being invoked even though they were excluded in the scanning profile

v8.0.20130308 - 08 Mar 2013

Copy Link Copy Link
Build v8.0.20130308 - 8th March 2013

New Functionality

  • Added a test for Kayako Fusion v4.51.1891 – Multiple Web Vulnerabilities
  • Added various tests for Apache Tomcat
  • Added a test for CKEditor 4.0.1 Cross-Site Scripting vulnerability
  • Added a test for Moveable Type 4.x Unauthenticated Remote Command Execution
  • Implemented detection of Virtual Hosts on the target server
  • Implemented jQuery 1.9 support
  • Added a test for subversion 1.7 (.svn) repositories
  • Added a test for Parallels Plesk SQL Injection Vulnerability (CVE-2012-1557).
  • Implemented some tests looking for various Unicode transformation issues such as Best-Fit Mappings, Overlong byte sequences and Ill-Formed Sub-sequences
  • Added header input schemes for folders
  • Added identification of file names in input scheme parameter values. Any file names detected are subsequently crawled

Improvements

  • Various improvements to XSS tests
  • Improved Possible_Sensitive_Directories script
  • Improved jQuery attr() support
  • Improved Virtual Host Directory Listing test
  • The report of 404 – Page Not Found now instructs users to checks the Referrers tab for a list of pages linking to the broken link

Bug Fixes

  • Fixed a crash that occurs infrequently when configuring a scheduled scan
  • Fixed various minor issues in the scan scheduler

v8.0.20130205 - 05 Feb 2013

Copy Link Copy Link
Build v8.0.20130205 - 5th February 2013

New Features

  • New 14 day Evaluation version will replace the Free Edition. Evaluating users can now perform full scans of the Acunetix test websites and of their websites. The Evaluation version has the following limitations:
    • The vulnerability details are only shown when scanning Acunetix test websites
    • Results cannot be saved
    • Reports are disabled
    • Scheduled scans are disabled

Improvements

  • Changed prioritisation of TLS protocol over SSLv3. This provides better support for IIS 7.5 web servers, which previously refused connections from Acunetix Web Vulnerability Scanner.

Bug Fixes

  • Fixed crash that occurs when the Scan Wizard is used while the Login Sequence Recorder is running
  • Fixed crash in Session Manager
1 … 19 20 21 … 27