Severity Critical High Medium Low Informational Vulnerability Categories Abuse Of Functionality Acumonitor Arbitrary File Creation Arbitrary File Read Arbitrary File Write Authentication Bypass BOLA Bruteforce Possible Buffer Overflow CSRF CSTI Code Execution Configuration Crlf Injection Deepscan Default Credentials Denial-of-service Dev Files Directory Listing Directory Traversal Eli Injection Error Handling File Inclusion Http Parameter Pollution Http Response Splitting Information Disclosure Insecure Admin Access Insecure Deserialization Internal Ip Disclosure Known Vulnerabilitie Known Vulnerabilities Ldap Injection Malware Missing Update Path Traversal Privilege Escalation Remote Code Execution SSRF SSTI Sensitive Data Not Over Ssl Server Side Template Injection Session Fixation Source Code Disclosure Sql Injection Test Files Unauthenticated File Upload Url Redirection Weak Credentials Weak Crypto XFS XSS XXE Xpath Injection Vulnerability Name CVE CWE CWE Severity .htaccess File Detected Informational Access-Control-Allow-Origin header with wildcard (*) value Informational Active Mixed Content over HTTPS Medium Adobe ColdFusion 9 administrative login bypass High Adobe Experience Manager Information Disclosure via Apache Sling v2.3.6 vulnerability Medium Adobe Experience Manager Misconfiguration High An Unsafe Content Security Policy (CSP) Directive in Use Informational Apache Airflow Experimental API Auth Bypass CVE-2020-13927 High Apache Axis2 administration console weak password High Apache Cassandra Unauthorized Access Vulnerability Medium Apache configured to run as proxy Medium Apache Geronimo default administrative credentials High Apache JServ protocol service Medium Apache Kafka Unauthorized Access Vulnerability Medium Apache mod_negotiation filename bruteforcing Low Apache perl-status enabled Medium Apache Proxy HTTP CONNECT method enabled Medium Apache REST RCE CVE-2018-11770 High Apache Roller OGNL injection High Apache Server-Info Detected Medium Apache Server-Status Detected Medium Apache Solr endpoint Low Apache solr service exposed High Apache Spark Master Unauthorized Access Vulnerability High Apache Spark Web UI Unauthorized Access Vulnerability Medium Apache stronghold-info enabled Low Apache stronghold-status enabled Low Apache Tapestry weak secret key High Apache Tomcat examples directory vulnerabilities Medium Apache Tomcat insecure default administrative password High Apache Tomcat version older than 6.0.35 High Apache Tomcat version older than 6.0.36 High Apache Tomcat version older than 7.0.21 High Apache Tomcat version older than 7.0.23 High Apache Tomcat version older than 7.0.28 High Apache Tomcat version older than 7.0.30 High Apache Tomcat version older than 7.0.32 Medium Apache ZooKeeper Unauthorized Access Vulnerability Medium Arbitrary File Read on Nuxt.js Development Server Low ASP.NET: Failure To Require SSL For Authentication Cookies Medium ASP.NET application-level tracing enabled Medium ASP.NET ASPX debugging enabled Medium ASP.NET connection strings stored in plaintext High ASP.NET cookieless authentication enabled Medium ASP.NET Cookieless session state enabled Medium ASP.NET cookies accessible from client-side scripts Medium ASP.NET Core Development Mode enabled Medium ASP.NET CustomErrors Is Disabled Medium ASP.NET debugging enabled Low ASP.NET Deny missing from authorization rule on location Medium ASP.NET diagnostic page Medium ASP.NET error message Low ASP.NET event validation disabled Medium ASP.NET expired session IDs are not regenerated Medium ASP.NET forms authentication using inadequate protection Medium ASP.NET header checking is disabled in web.config Medium ASP.NET login credentials stored in plain text Medium ASP.NET potential HTTP Verb Tampering Medium ASP.NET ValidateRequest Is Globally Disabled Medium ASP.NET viewstate encryption disabled Medium ASP.NET ViewStateUserKey Is Not Set Low ASP.NET WCF metadata enabled for behavior Medium ASP.NET WCF replay attacks are not detected Medium ASP.NET WCF service include exception details Medium Atlassian Jira insecure REST permissions High Atlassian JIRA Servicedesk misconfiguration Medium Axis development mode enabled in WEB-INF/server-config.wsdd Medium Axis system configuration listing enabled in WEB-INF/server-config.wsdd Medium BottlePy weak secret key High Broken Link Hijacking Low Case-Insensitive Routing Bypass in Express.js Application High Chrome Logger information disclosure Medium Clickjacking: CSP frame-ancestors missing Low Code Execution via WebDav High CodeIgniter development mode enabled Medium CodeIgniter session decoding vulnerability High CodeIgniter weak encryption key High ColdFusion administrator login page publicly available Low ColdFusion RDS Service enabled Low Consul API publicly exposed High Content-Security-Policy-Report-Only Cannot Be Declared Between META Tags Informational Content-Security-Policy-Report-Only Cannot Be Declared Without report-uri Directive Informational Content Security Policy (CSP) Contains Out of Scope report-uri Domain Informational Content Security Policy (CSP) Keywords Not Used Within Single Quotes Informational Content Security Policy (CSP) Nonce Value Not Used Within Single Quotes Informational Content Security Policy (CSP) Nonce Without Matching Script Block Informational Content Security Policy (CSP) Not Implemented Informational Content Security Policy (CSP) report-uri Uses HTTP Informational Content Security Policy Misconfiguration Informational Cookie signed with weak secret key Medium Cookies Not Marked as HttpOnly Low Cookies Not Marked as Secure Low Cookies with missing, inconsistent or contradictory properties Low Cookies with Secure flag set over insecure connection Informational Core dump file High CouchDB REST API publicly accessible High Craft CMS Development Mode enabled Medium CRIME SSL/TLS attack Medium Custom Error Pages Are Not Configured in WEB-INF/web.xml Medium data: Used in a Content Security Policy (CSP) Directive Informational default-src Used in Content Security Policy (CSP) Informational Delve Debugger Unauthorized Access Vulnerability High Deprecated Header Instruction Used to Implement Content Security Policy (CSP) Informational Devise weak password High Directory listings Medium Django Debug Toolbar Medium Django weak secret key Medium Docker Engine API is accessible without authentication High Docker Registry API is accessible without authentication High Drupal configuration file weak file permissions Medium Drupal trusted_host_patterns setting not configured Medium Elasticsearch service accessible High Elmah.axd / Errorlog.axd Detected High Error page path disclosure Low Error page web server version disclosure Informational Express cookie-session weak secret key Medium Express Development Mode enabled Medium Express express-session weak secret key Informational Firebase database accessible without authentication Medium Flask weak secret key Medium Frontpage authors.pwd available Medium FrontPage Identified Low Gitlab open user registration Medium Gitlab user disclosure Low GlassFish admin console weak credentials High GoCD information disclosure (CVE-2021-43287) High Go web application binary disclosure Medium Grails database console Medium GraphiQL Explorer/Playground Enabled Medium GraphQL Alias Overloading Allowed: Potential Denial of Service Vulnerability Medium GraphQL Array-based Query Batching Allowed: Potential Batching Attack Vulnerability Medium GraphQL Circular-Query via Introspection Allowed: Potential DoS Vulnerability Medium GraphQL Field Suggestions Enabled Medium GraphQL Introspection Query Enabled Medium GraphQL Non-JSON Mutations over GET: Potential CSRF Vulnerability Medium GraphQL Non-JSON Queries over GET: Potential CSRF Vulnerability Medium GraphQL Non-JSON Queries over POST: Potential CSRF Vulnerability Medium GraphQL Unauthenticated Mutation Detected Medium GraphQL Unhandled Error Leakage Medium H2 console publicly accessible Low Hadoop cluster web interface Medium Hadoop YARN ResourceManager publicly accessible High Harbor Unauthorized Access Vulnerability High Hostile subdomain takeover Medium HTTP header reflected in cached response Medium Httpoxy vulnerability Medium HTTP Strict Transport Security (HSTS) Errors and Warnings Informational HTTP Strict Transport Security (HSTS) Policy Not Enabled Medium HTTP verb tampering via POST High IBM WebSphere administration console weak password High IIS extended unicode directory traversal vulnerability High Incorrect Content Security Policy (CSP) Implementation Informational InfluxDB Unauthorized Access Vulnerability Medium Insecure crossdomain.xml policy Medium Insecure Protocol Detected in Content Security Policy (CSP) Informational Insecure Referrer Policy Informational Insecure Transportation Security Protocol Supported (SSLv2) High Insecure Transportation Security Protocol Supported (SSLv3) High Insecure Transportation Security Protocol Supported (TLS 1.0) High Insecure Transportation Security Protocol Supported (TLS 1.1) Informational Internet Information Server returns IP address in HTTP header (Content-Location) Low Invalid Content Security Policy (CSP) Directive Identified in meta Elements Informational Invalid SSL Certificate Medium JAAS authentication bypass High Java Debug Wire Protocol remote code execution High Java Management Extensions (JMX/RMI) service detected Medium JavaMelody publicly accessible Medium JBoss BSHDeployer MBean High JBoss HttpAdaptor JMXInvokerServlet High JBoss JMX Console Unrestricted Access High JBoss JMX management console High JBoss ServerInfo MBean High JBoss Server MBean High JBoss Web Console JMX Invoker High Jenkins Git Plugin missing permission check (CVE-2022-36883) High Jenkins open people list Low Jenkins open user registration Medium Jenkins weak password High Jetpack 2.9.3: Critical Security Update High Jetty ConcatServlet Information Disclosure (CVE-2021-28169) Medium Jetty Information Disclosure (CVE-2021-34429) Medium JIRA Security Advisory 2013-02-21 High Joomla! 3.2.1 sql injection High Joomla! Core Security Bypass High Joomla 1.5 end of life High Joomla Debug Console enabled Medium Joomla J!Dump extension enabled Medium JSF ViewState client side storage Medium Jupyter Notebook publicly accessible High JWT Signature Bypass via None Algorithm High Kentico Staging API Authentication Bypass Critical Kentico Staging API publicly accessible Low Laravel debug mode enabled Medium Laravel debug mode enabled (AcuSensor) Medium Laravel Health Monitor open Medium Laravel Horizon open Medium Laravel LogViewer open Medium Laravel Terminal open High Lucee Stacktrace Information Disclosure Medium Lucee Unset Admin Password Critical Magento Cacheleak High Magento Config File Disclosure Medium MediaWiki remote code execution High Memcached Unauthorized Access Vulnerability Medium Method Tampering High Microsoft Frontpage configuration information Informational Microsoft IIS5 NTLM and Basic authentication bypass High Microsoft IIS WebDAV authentication bypass High Misconfigured Access-Control-Allow-Origin Header Medium Missing Content-Type Header Low Missing object-src in CSP Declaration Informational Mojolicious weak secret key Medium MovableType remote code execution High Multiple Content Security Policy (CSP) Implementation Detected Informational Multiple vulnerabilities fixed in PHP versions 5.5.12 and 5.4.28 Medium Multiple vulnerabilities in Ioncube loader-wizard.php High MySQL utf8 4-byte truncation Medium Next.js image Blind SSRF Medium Nginx PHP code execution via FastCGI High nginx SPDY heap buffer overflow High Node.js Debugger Unauthorized Access Vulnerability High Node.js Inspector Unauthorized Access Vulnerability High Node.js Running in Development Mode Medium Node.js Web Application does not handle uncaughtException Medium Node.js Web Application does not handle unhandledRejection Medium Nonce Usage Detected in Content Security Policy (CSP) Directive Informational No Script Block Detected with the Hash Value Declared in Content Security Policy (CSP) Informational Nuxt.js Running in Development Mode Low OData feed accessible anonymously Low Open Silverlight Client Access Policy Medium Oracle applications logs publicy available Medium Oracle E-Business Suite Frame Injection (CVE-2017-3528) Medium Oracle E-Business Suite Information Disclosure High Oracle E-Business Suite iStore open user registration Medium Oracle PeopleSoft SSO weak secret key High OSGi Management Console Default Credentials High Overly long session timeout in servlet configuration Medium Padding oracle attack High Passive Mixed Content over HTTPS Low Pentaho API Auth bypass (CVE-2021-31602) High Permissions-Policy header not implemented Informational PHP allow_url_fopen Is Enabled Low PHP allow_url_include enabled Low PHP allow_url_include Is Enabled Low PHP display_errors Is Enabled Low PHP enable_dl enabled Medium PHP errors enabled Medium Phpfastcache phpinfo publicly accessible (CVE-2021-37704) Medium PHP magic_quotes_gpc is disabled High PHP open_basedir Is Not Configured Low PHP open_basedir is not set Low PHP register_globals enabled Medium PHP register_globals Is Enabled Medium PHP session.use_only_cookies Is Disabled Medium PHP session.use_trans_sid enabled Medium Possible Database Name Disclosure Low Pyramid debug mode Medium Pyramid DebugToolbar enabled Medium Python Debugger Unauthorized Access Vulnerability High qdPM Information Disclosure High Rails application running in development mode Medium Reachable SharePoint interface High Redis Unauthorized Access Vulnerability Medium Request Smuggling High RethinkDB administrative interface publicly exposed High Reverse Proxy Detected Informational RoR Database Configuration File Detected High RoR Development Mode enabled Medium Roundcube security updates 0.8.6 and 0.7.3 High Ruby framework weak secret key High Ruby on Rails weak/known secret token High Same site scripting Medium SAP ICF /sap/public/info sensitive information disclosure Medium SAP Knowledge Management and Collaboration (KMC) incorrect permissions High SAP Management Console get user list High SAP Management Console list logfiles High SAP NetWeaver Java AS WD_CHAT information disclosure vulnerability Medium SAP NetWeaver server info information disclosure Medium SAP NetWeaver server info information disclosure BCB Medium SAP weak/predictable user credentials High Scheme URI Detected in Content Security Policy (CSP) Directive Informational Sensitive pages could be cached Low Session cookies scoped to parent domain Low Session ID in URL Low SharePoint exposed web services Medium SharePoint user enumeration High Spring Boot Actuator Medium Spring Boot Actuator v2 Medium Spring Boot Misconfiguration: Actuator endpoint security disabled Medium Spring Boot Misconfiguration: Admin MBean enabled Medium Spring Boot Misconfiguration: All Spring Boot Actuator endpoints are web exposed Medium Spring Boot Misconfiguration: Datasource credentials stored in the properties file Medium Spring Boot Misconfiguration: Developer tools enabled on production Medium Spring Boot Misconfiguration: H2 console enabled Medium Spring Boot Misconfiguration: MongoDB credentials stored in the properties file Medium Spring Boot Misconfiguration: Overly long session timeout Medium Spring Boot Misconfiguration: Spring Boot Actuator shutdown endpoint is web exposed Low Spring Boot Misconfiguration: Unsafe value for session tracking Medium Spring Misconfiguration: HTML Escaping disabled Medium SSL Certificate Is About To Expire Medium Static Nonce Identified in Content Security Policy (CSP) Informational Struts 2 Config Browser plugin enabled Medium Struts 2 development mode High Struts2 Development Mode Enabled High Subresource Integrity (SRI) Not Implemented Informational Symfony debug mode enabled (AcuSensor) Medium Symfony ESI (Edge-Side Includes) enabled Low Symfony running in dev mode Medium Symfony web debug toolbar Medium The DROWN attack (SSLv2 supported) High The FREAK attack Medium The Heartbleed Bug High The POODLE attack (SSLv3 with CBC cipher suites) Medium TLS/SSL (EC)DHE Key Reuse Informational TLS/SSL certificate key size too small Medium TLS/SSL LOGJAM attack Medium TLS/SSL Sweet32 attack Medium TLS/SSL Weak Cipher Suites Medium Tomcat status page Low TorchServe Management API publicly exposed High Tornado debug mode Medium Tornado weak secret key Medium Trace.axd Detected High TRACE Method enabled Low TRACK Method enabled Low Unauthorized Access to a web app installer Medium Unchecked GraphQL Query Length: Potential Denial of Service Vulnerability Medium Unicode Transformation (Best-Fit Mapping) Medium Unprotected Apache NiFi API interface Medium Unprotected Kong Gateway Admin API interface Medium Unprotected phpMyAdmin interface High Unrestricted access to a monitoring system Low Unrestricted access to AnythingLLM API Medium Unrestricted access to Apache HugeGraph Critical Unrestricted access to Caddy API interface High Unrestricted access to Haproxy Data Plane API High Unrestricted access to ImageResizer Diagnotics plugin Low Unrestricted access to Kong Gateway API High Unrestricted access to MLflow Medium Unrestricted access to Prometheus Low Unrestricted access to Prometheus Metrics Low Unsafe value for session tracking in WEB-INF/web.xml Medium Unsupported Hash Detected in Content Security Policy (CSP) Informational Verb tampering via misconfigured security constraint Medium Version Disclosure (IIS) Low ViewState MAC Disabled Medium Virtual Host locations misconfiguration High Vulnerable project dependencies High W3 total cache debug mode Medium Weak Nonce Detected in Content Security Policy (CSP) Declaration Informational Weak password High Weak Secret is Used to Sign JWT High Weak WordPress security key High Web2py weak secret key Medium Webalizer script Medium Web application default/weak credentials High Web Application Firewall Detected Informational Web Cache Deception High Web Cache Poisoning High Web Cache Poisoning DoS Medium Web Cache Poisoning DoS (for javascript) Medium Web Cache Poisoning DoS through HTTP/2 headers Medium Web Cache Poisoning through HTTP/2 pseudo-headers High Web Cache Poisoning via Fat GET Request High Web Cache Poisoning via Host Header High Web Cache Poisoning via JSONP and UTM_ parameter High Web Cache Poisoning via POST Request High Web Cache Poisoning via semicolon query separator High WebDAV Directory Has Write Permissions High WebDAV directory listing Medium WebDAV Enabled Informational WebLogic admin console weak credentials High Webmail weak password High WebPageTest Unauthorized Access Vulnerability Medium Web server default welcome page Informational Wildcard Detected in Domain Portion of Content Security Policy (CSP) Directive Informational Wildcard Detected in Port Portion of Content Security Policy (CSP) Directive Informational Wildcard Detected in Scheme Portion of Content Security Policy (CSP) Directive Informational WordPress admin accessible without HTTP authentication Low WordPress allows editing theme/plugin files Medium WordPress configuration file weak file permissions Medium WordPress default administrator account Low WordPress readme.html file Informational WordPress user registration enabled Informational Xdebug remote code execution via xdebug.remote_connect_back High XML entity injection High XML external entity injection High XML external entity injection (variant) High XML external entity injection and XML injection High XML External Entity Injection via external file High XML external entity injection via File Upload High Yii2 debug toolkit Medium Yii2 Gii extension Medium Yii2 weak secret key Medium Yii debug mode enabled Medium Yii running in dev mode Medium [Possible] AWStats Detected Medium [Possible] Password Transmitted over Query String Medium
