Get a demo
AppSec with Zero Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo

Invicti Enterprise On-Premises 14 Mar 2024 v24.3.0

New features

  • Added the option to remove Request/Response details from the detailed template to avoid the character limit error when sending vulnerabilities
  • Added the option to enable enhanced logging of failed logins
  • Added functionality to the UI for users to obtain logs from failed scans (previously only system administrators were able to do that)
  • ServiceNow Application Vulnerability Response integration is now available in the ServiceNow store

New security checks

  • Added a check for dotCMS (CVE-2022-26352)
  • Added a check for the Ultimate Member WordPress plugin (CVE-2023-3460)
  • Added a new mXSS pattern
  • Added new signatures to detect JWKs
  • Implemented a detection and reporting mechanism for the Backup Migration WordPress plugin (CVE-2023-6553)
  • Added detection for TinyMCE
  • Added detection for ActiveMQ RCE to the OOB RCE Attack Pattern (CVE-2023-46604)

Improvements

  • Improved the recommendations for the Weak Ciphers Enabled vulnerability
  • Improved detection of swagger.json vulnerabilities
  • Updated the “Insecure Transportation Security Protocol Supported (TLS 1.0)” vulnerability to High Severity
  • Implemented support for scanning sites with location permission pop-ups
  • Implemented support for FreshService API V2
  • Revised the labeling of the active vulnerabilities information on the Scan Summary page to provide greater clarity
  • Removed obsolete X-Frame-Options Header security checks
  • Improved ServiceNow Vulnerability Response integration

Fixes

  • Fixed a bug in the cloning report policies functionality
  • Fixed an error that was occurring with the API endpoint: list-scheduled
  • Fixed a bug with the Jira integration
  • Fixed a bug with custom scheduled scans that were not updating the Next Execution Time field correctly
  • Fixed an issue with the HashiCorp Vault integration token validation path
  • Fixed the missing ‘Known Issues’ tab from scan summary issue details
  • Fixed an issue with the severity trend chart on the Dashboard
  • Fixed a problem with importing WDSL files
  • Fixed a bug in the Request/Response tab of Version Disclosure vulnerabilities
  • Corrected an issue in the technical reports where vulnerabilities identified in Korean are now reported in English
  • Changed the ID parameter from ‘optional’ to ‘required’ within the Scan Policy Update API
  • Removed the target URL from the scope control list
  • Resolved a bug in the filtering of vulnerabilities on the Issues page
  • Fixed a bug in the marking of issues as a false positive
  • Resolved an issue where the agent would become unavailable after receiving a 401 error
  • Fixed the issue with uploading a Swagger file into a scan profile
  • Fixed the system to halt subsequent tests if a scan is aborted from Jenkins
  • Upgraded Microsoft.Owin package to version number 4.2.2