diff --git a/alerttags/cwe-215/index.html b/alerttags/cwe-215/index.html new file mode 100644 index 0000000000..cccf3d7a80 --- /dev/null +++ b/alerttags/cwe-215/index.html @@ -0,0 +1,232 @@ + + + + + + + + + + ZAP – CWE-215 + + + + + + + + + + + + + + + +
+
+
+
+
+ + +
+
+ +
+ Download +
+ + +
+ +
+
+ + +
+
+ +

Alert Tag: CWE-215

+ +
+
+
+
+ Alert Tags > + + CWE-215 + +
+ + + + + +

https://cwe.mitre.org/data/definitions/215.html

+ + All of the alerts which use this tag: + + +
+ + + + + + + + + + + + + + + + +
TagLink
Spring Actuator Information Leak
+
+
+ +
+ + + + + + +
+ + diff --git a/alerttags/cwe-215/index.xml b/alerttags/cwe-215/index.xml new file mode 100644 index 0000000000..01cdf1b26f --- /dev/null +++ b/alerttags/cwe-215/index.xml @@ -0,0 +1,18 @@ + + + + CWE-215 on ZAP + /alerttags/cwe-215/ + Recent content in CWE-215 on ZAP + Hugo + en-us + + + Spring Actuator Information Leak + /docs/alerts/40042/ + Mon, 01 Jan 0001 00:00:00 +0000 + /docs/alerts/40042/ + <p>Spring Actuator for Health is enabled and may reveal sensitive information about this application. Spring Actuators can be used for real monitoring purposes, but should be used with caution as to not expose too much information about the application or the infrastructure running it.</p> + + + diff --git a/alerttags/cwe-642/index.html b/alerttags/cwe-642/index.html index 5700997a0d..0114a702c0 100644 --- a/alerttags/cwe-642/index.html +++ b/alerttags/cwe-642/index.html @@ -173,6 +173,12 @@

https://cwe.mitre. + + Insecure JSF ViewState + + + + Old Asp.Net Version in Use diff --git a/alerttags/cwe-642/index.xml b/alerttags/cwe-642/index.xml index 3929438163..0873ab7099 100644 --- a/alerttags/cwe-642/index.xml +++ b/alerttags/cwe-642/index.xml @@ -21,6 +21,13 @@ /docs/alerts/10032-2/ <p>The following emails were found being serialized in the viewstate field:</p> + + Insecure JSF ViewState + /docs/alerts/90001/ + Mon, 01 Jan 0001 00:00:00 +0000 + /docs/alerts/90001/ + <p>The response at the following URL contains a ViewState value that has no cryptographic protections.</p> + Old Asp.Net Version in Use /docs/alerts/10032-3/ diff --git a/alerttags/cwe-643/index.html b/alerttags/cwe-643/index.html new file mode 100644 index 0000000000..835b09194d --- /dev/null +++ b/alerttags/cwe-643/index.html @@ -0,0 +1,232 @@ + + + + + + + + + + ZAP – CWE-643 + + + + + + + + + + + + + + + +
+
+
+
+
+ + +
+
+ +
+ Download +
+ + +
+ +
+
+ + +
+
+ +

Alert Tag: CWE-643

+ +
+
+
+
+ Alert Tags > + + CWE-643 + +
+ + + + + +

https://cwe.mitre.org/data/definitions/643.html

+ + All of the alerts which use this tag: + + +
+ + + + + + + + + + + + + + + + +
TagLink
XPath Injection
+
+
+ +
+ + + + + + +
+ + diff --git a/alerttags/cwe-643/index.xml b/alerttags/cwe-643/index.xml new file mode 100644 index 0000000000..666dbcd310 --- /dev/null +++ b/alerttags/cwe-643/index.xml @@ -0,0 +1,18 @@ + + + + CWE-643 on ZAP + /alerttags/cwe-643/ + Recent content in CWE-643 on ZAP + Hugo + en-us + + + XPath Injection + /docs/alerts/90021/ + Mon, 01 Jan 0001 00:00:00 +0000 + /docs/alerts/90021/ + <p>XPath Injection is an attack technique used to exploit applications that construct XPath (XML Path Language) queries from user-supplied input to query or navigate XML documents. It can be used directly by an application to query an XML document, as part of a larger operation such as applying an XSLT transformation to an XML document, or applying an XQuery to an XML document. The syntax of XPath bears some resemblance to an SQL query, and indeed, it is possible to form SQL-like queries on an XML document using XPath.</p> + + + diff --git a/alerttags/cwe-91/index.html b/alerttags/cwe-91/index.html new file mode 100644 index 0000000000..982e3efed7 --- /dev/null +++ b/alerttags/cwe-91/index.html @@ -0,0 +1,232 @@ + + + + + + + + + + ZAP – CWE-91 + + + + + + + + + + + + + + + +
+
+
+
+
+ + +
+
+ +
+ Download +
+ + +
+ +
+
+ + +
+
+ +

Alert Tag: CWE-91

+ +
+
+
+
+ Alert Tags > + + CWE-91 + +
+ + + + + +

https://cwe.mitre.org/data/definitions/91.html

+ + All of the alerts which use this tag: + + +
+ + + + + + + + + + + + + + + + +
TagLink
XSLT Injection
+
+
+ +
+ + + + + + +
+ + diff --git a/alerttags/cwe-91/index.xml b/alerttags/cwe-91/index.xml new file mode 100644 index 0000000000..7fc3842934 --- /dev/null +++ b/alerttags/cwe-91/index.xml @@ -0,0 +1,18 @@ + + + + CWE-91 on ZAP + /alerttags/cwe-91/ + Recent content in CWE-91 on ZAP + Hugo + en-us + + + XSLT Injection + /docs/alerts/90017/ + Mon, 01 Jan 0001 00:00:00 +0000 + /docs/alerts/90017/ + <p>Injection using XSL transformations may be possible, and may allow an attacker to read system information, read and write files, or execute arbitrary code.</p> + + + diff --git a/alerttags/index.html b/alerttags/index.html index bba80d33fa..01f1a39afd 100644 --- a/alerttags/index.html +++ b/alerttags/index.html @@ -293,6 +293,12 @@

Alert Tags

+ + CWE-215 + https://cwe.mitre.org/data/definitions/215.html + + + CWE-22 https://cwe.mitre.org/data/definitions/22.html @@ -467,6 +473,12 @@

Alert Tags

+ + CWE-643 + https://cwe.mitre.org/data/definitions/643.html + + + CWE-693 https://cwe.mitre.org/data/definitions/693.html @@ -509,6 +521,12 @@

Alert Tags

+ + CWE-91 + https://cwe.mitre.org/data/definitions/91.html + + + CWE-917 https://cwe.mitre.org/data/definitions/917.html diff --git a/alerttags/index.xml b/alerttags/index.xml index 220afb1b3f..6b6a294804 100644 --- a/alerttags/index.xml +++ b/alerttags/index.xml @@ -168,6 +168,13 @@ /alerttags/cwe-209/ + + CWE-215 + /alerttags/cwe-215/ + Mon, 01 Jan 0001 00:00:00 +0000 + /alerttags/cwe-215/ + + CWE-22 /alerttags/cwe-22/ @@ -371,6 +378,13 @@ /alerttags/cwe-642/ + + CWE-643 + /alerttags/cwe-643/ + Mon, 01 Jan 0001 00:00:00 +0000 + /alerttags/cwe-643/ + + CWE-693 /alerttags/cwe-693/ @@ -420,6 +434,13 @@ /alerttags/cwe-829/ + + CWE-91 + /alerttags/cwe-91/ + Mon, 01 Jan 0001 00:00:00 +0000 + /alerttags/cwe-91/ + + CWE-917 /alerttags/cwe-917/ diff --git a/docs/alerts/40042/index.html b/docs/alerts/40042/index.html index ea83981fe9..40bea9760d 100644 --- a/docs/alerts/40042/index.html +++ b/docs/alerts/40042/index.html @@ -208,6 +208,8 @@

Spring Actuator Information Leak

+ CWE-215
+ OWASP_2017_A05
OWASP_2021_A01
diff --git a/docs/alerts/90001/index.html b/docs/alerts/90001/index.html index f9fa74ffe6..42123d77ad 100644 --- a/docs/alerts/90001/index.html +++ b/docs/alerts/90001/index.html @@ -204,6 +204,8 @@

Insecure JSF ViewState

+ CWE-642
+ OWASP_2017_A06
OWASP_2021_A04
@@ -236,7 +238,7 @@

Solution

Other Info

- + JSF ViewState [<input type="hidden" id="javax.faces.viewstate" value="1231"] is insecure.

References