Acunetix Standard & Premium

New Security Checks

• Complex security check for Timthumb (detects WordPress installations and checks for vulnerable plugins and themes
• Includes bruteforcing capabilites to look for plugins/themes that contain the Timthumb script
• Security check for Sun/Oracle GlassFish Server Authentication Bypass (same check includes some additional checks for GlassFish)

Updates

• Updated Firefox plugin to support Firefox 5

Bug Fix

• Fixed an enumeration problem while parsing a WSDL with inputs that have a lot of possible values.

Bug Fixes

• Fixed where the Acusensor Technology files were updated incorrectly.
• Fixed Access Violation when scan is stopped.
• Fixed user interface incorrect behaviour.

New features

• Acunetix WVS will parse SVN repositories file structure and crawl it automatically

New security checks

• ClientAccessPolicy.xml and CrossDomain.xml security checks
• Git repository security checks
• Check if htaccess file is readable
• Nginx PHP Code Execution via FastCGI
• Nginx buffer underflow vulnerability
• Nginx PHP FastCGI Code Execution File Upload.

Improvement

• Improved Cross-site scripting checks.

Bug fixes

• Maximum directory depth value was not working properly
• HTTP limitations were not respected from scripts
• When scanning a domain with subdomains, in some cases multiple scans were created for the same subdomain
• Properly handling of situations when a file redirects to itself from http to https.

New features

• New type of XSS test introduced (parameter was set to javascript:…)

Bug fixes

• Fixed: Scanner crash when scanning https sites with client certificates.
• Fixed: A number of particular checks were not performed when scanning from crawl results.
• Fixed: Login Sequence Recorder: different user agent string was sent with XHR.
• Fixed: Reports were not sent as attachments when scanning a list of URLs from the Scheduler.
• Fixed: Fixed incorrect error message popup in scheduler “there is already a queue starting a that time when the queues were of different type”
• Fixed: Crawler MaximumVariationCount was being ignored in the scanner settings.
• Fixed: eval() security check moved from scanner to crawler.
• Fixed: Aborting of analysis while executing events in CSA engine not always working.
• Fixed: CSA engine “Worker already executing” exception.
• Fixed: In XML or AVDL export CDATA content is no longer encoded.

New feature

• Acunetix WVS automatically checks for
  

  DOM XSS vulnerabilities

Bug fixes

• Fixed: Get First URL Only option not working correctly because it was still importing links from CSA engine
• Fixed: “User credentials sent in clear text” was not being reported by crawler in certain circumstances
• Fixed: Port was being specified in host header even if default ports were being used.