| Absence of Anti-CSRF Tokens |
|
| Anti-CSRF Tokens Check |
|
| Application Error Disclosure |
|
| Authentication Credentials Captured |
|
| Charset Mismatch |
|
| Content Security Policy (CSP) Header Not Set |
|
| Content Security Policy (CSP) Report-Only Header Found |
|
| Content-Type Header Empty |
|
| Content-Type Header Missing |
|
| Cookie No HttpOnly Flag |
|
| Cookie Poisoning |
|
| Cookie with Invalid SameSite Attribute |
|
| Cookie with SameSite Attribute None |
|
| Cookie without SameSite Attribute |
|
| Cookie Without Secure Flag |
|
| CORS Header |
|
| CORS Misconfiguration |
|
| CORS Misconfiguration |
|
| Cross Site Scripting (DOM Based) |
|
| Cross Site Scripting (Persistent) |
|
| Cross Site Scripting (Persistent) - Prime |
|
| Cross Site Scripting (Persistent) - Spider |
|
| Cross Site Scripting (Reflected) |
|
| Cross-Domain JavaScript Source File Inclusion |
|
| Cross-Domain Misconfiguration |
|
| CSP: Failure to Define Directive with No Fallback |
|
| CSP: Header & Meta |
|
| CSP: Malformed Policy (Non-ASCII) |
|
| CSP: Meta Policy Invalid Directive |
|
| CSP: Notices |
|
| CSP: script-src unsafe-eval |
|
| CSP: script-src unsafe-hashes |
|
| CSP: script-src unsafe-inline |
|
| CSP: style-src unsafe-hashes |
|
| CSP: style-src unsafe-inline |
|
| CSP: Wildcard Directive |
|
| CSP: X-Content-Security-Policy |
|
| CSP: X-WebKit-CSP |
|
| Deprecated Feature Policy Header Set |
|
| Directory Browsing |
|
| Directory Browsing |
|
| Exponential Entity Expansion (Billion Laughs Attack) |
|
| Expression Language Injection |
|
| External Redirect |
|
| External Redirect |
|
| External Redirect |
|
| External Redirect |
|
| GET for POST |
|
| HTTP Parameter Override |
|
| HTTP to HTTPS Insecure Transition in Form Post |
|
| HTTPS to HTTP Insecure Transition in Form Post |
|
| In Page Banner Information Leak |
|
| Information Disclosure - Sensitive Information in HTTP Referrer Header |
|
| Information Disclosure - Sensitive Information in URL |
|
| Insecure JSF ViewState |
|
| Insufficient Site Isolation Against Spectre Vulnerability |
|
| Insufficient Site Isolation Against Spectre Vulnerability |
|
| Insufficient Site Isolation Against Spectre Vulnerability |
|
| Loosely Scoped Cookie |
|
| Missing Anti-clickjacking Header |
|
| Modern Web Application |
|
| Multiple X-Frame-Options Header Entries |
|
| Obsolete Content Security Policy (CSP) Header Found |
|
| Open Redirect |
|
| Path Traversal |
|
| Path Traversal |
|
| Path Traversal |
|
| Path Traversal |
|
| Path Traversal |
|
| Permissions Policy Header Not Set |
|
| PII Disclosure |
|
| Private IP Disclosure |
|
| Referer Exposes Session ID |
|
| Remote File Inclusion |
|
| Remote OS Command Injection |
|
| Reverse Tabnabbing |
|
| Script Served From Malicious Domain (polyfill) |
|
| Script Served From Malicious Domain (polyfill) |
|
| Secure Pages Include Mixed Content |
|
| Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) |
|
| Server Leaks its Webserver Application via "Server" HTTP Response Header Field |
|
| Server Leaks Version Information via "Server" HTTP Response Header Field |
|
| Server Side Code Injection - ASP Code Injection |
|
| Server Side Code Injection - PHP Code Injection |
|
| Server Side Include |
|
| Server Side Template Injection |
|
| Session ID in URL Rewrite |
|
| Session ID in URL Rewrite |
|
| SOAP Action Spoofing |
|
| SOAP XML Injection |
|
| Source Code Disclosure - PHP |
|
| SQL Injection |
|
| SQL Injection - Hypersonic SQL |
|
| SQL Injection - MsSQL |
|
| SQL Injection - MySQL |
|
| SQL Injection - Oracle |
|
| SQL Injection - PostgreSQL |
|
| Strict-Transport-Security Defined via META (Non-compliant with Spec) |
|
| Strict-Transport-Security Disabled |
|
| Strict-Transport-Security Header Not Set |
|
| Strict-Transport-Security Header on Plain HTTP Response |
|
| Strict-Transport-Security Malformed Content (Non-compliant with Spec) |
|
| Strict-Transport-Security Max-Age Malformed (Non-compliant with Spec) |
|
| Strict-Transport-Security Missing Max-Age (Non-compliant with Spec) |
|
| Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec) |
|
| Sub Resource Integrity Attribute Missing |
|
| Vulnerable JS Library |
|
| Weak Authentication Method |
|
| WSDL File Detection |
|
| X-ChromeLogger-Data (XCOLD) Header Information Leak |
|
| X-Content-Type-Options Header Missing |
|
| X-Debug-Token Information Leak |
|
| X-Frame-Options Defined via META (Non-compliant with Spec) |
|
| X-Frame-Options Setting Malformed |
|
| XML External Entity Attack |
|
| XPath Injection |
|
| XSLT Injection |
|