v.26.4.2314

Configuration

This page lists 405 vulnerabilities in this category.

Critical: 4 High: 127 Medium: 173 Low: 51 Information: 50

Vulnerability Name

CVE

CWE

Severity

Node.js Web Application does not handle uncaughtException

CWE-248

Medium

Yii running in dev mode

CWE-489

Medium

GraphQL Circular-Query via Introspection Allowed: Potential DoS Vulnerability

CWE-400

Medium

GraphQL Alias Overloading Allowed: Potential Denial of Service Vulnerability

CWE-400

Medium

Insecure crossdomain.xml policy

CWE-942

Medium

Open Silverlight Client Access Policy

CWE-942

Medium

ASP.NET Core Development Mode enabled

CWE-200

Medium

Active Mixed Content over HTTPS

CWE-1428

Medium

Yii debug mode enabled

CWE-489

Medium

GraphQL Non-JSON Queries over GET: Potential CSRF Vulnerability

CWE-352

Medium

WordPress allows editing theme/plugin files

CWE-749

Medium

WordPress configuration file weak file permissions

CWE-732

Medium

Symfony running in dev mode

CWE-489

Medium

Symfony debug mode enabled (Invicti IAST)

CWE-489

Medium

Laravel debug mode enabled (Invicti IAST)

CWE-489

Medium

Drupal trusted_host_patterns setting not configured

Medium

GraphQL Field Suggestions Enabled

CWE-200

Medium

GraphQL Non-JSON Mutations over GET: Potential CSRF Vulnerability

CWE-352

Medium

CodeIgniter development mode enabled

CWE-489

Medium

RoR Development Mode enabled

CWE-200

Medium

ViewStateMac is Not Enabled

CWE-354

Medium

Craft CMS Development Mode enabled

CWE-200

Medium

Unrestricted access to MLflow

CWE-200

Medium

Unrestricted access to AnythingLLM API

CVE-2024-6842

CWE-200

Medium

Next.js image Blind SSRF

CWE-918

Medium

Lucee Stacktrace Information Disclosure

CWE-200

Medium

Node.js Running in Development Mode

CWE-215

Medium

GraphiQL Explorer/Playground Enabled

CWE-200

Medium

GraphQL Unhandled Error Leakage

CWE-209

Medium

GraphQL Unauthenticated Mutation Detected

CWE-306

Medium

GraphQL Array-based Query Batching Allowed: Potential Batching Attack Vulnerability

CWE-770

Medium

GraphQL Non-JSON Queries over POST: Potential CSRF Vulnerability

CWE-352

Medium

Unchecked GraphQL Query Length: Potential Denial of Service Vulnerability

CWE-400

Medium

GraphQL Introspection Query Enabled

CWE-200

Medium

Drupal configuration file weak file permissions

CWE-732

Medium

Verb tampering via misconfigured security constraint

CWE-288

Medium

Node.js Web Application does not handle unhandledRejection

CWE-248

Medium

ASP.NET event validation disabled

CWE-345

Medium

InfluxDB Unauthorized Access Vulnerability

CWE-200

Medium

ASP.NET WCF service include exception details

CWE-209

Medium

ASP.NET WCF metadata enabled for behavior

CWE-200

Medium

ASP.NET WCF replay attacks are not detected

CWE-294

Medium

ASP.NET viewstate encryption disabled

CWE-319

Medium

ASP.NET expired session IDs are not regenerated

CWE-384

Medium

ASP.NET Deny missing from authorization rule on location

CWE-288

Medium

Oracle E-Business Suite iStore open user registration

CVE-2022-21500

CWE-200

Medium

ASP.NET potential HTTP Verb Tampering

CWE-288

Medium

ASP.NET header checking is disabled in web.config

CWE-113

Medium

ASP.NET forms authentication using inadequate protection

CWE-345

Medium

Unauthorized Access to a web app installer

CWE-200

Medium

Unprotected Kong Gateway Admin API interface

CWE-287

Medium

Unprotected Apache NiFi API interface

CWE-287

Medium

Magento Config File Disclosure

CWE-200

Medium

Go web application binary disclosure

CWE-540

Medium

Struts 2 Config Browser plugin enabled

CWE-200

Medium

Spring Boot Misconfiguration: All Spring Boot Actuator endpoints are web exposed

CWE-200

Medium

Spring Boot Misconfiguration: MongoDB credentials stored in the properties file

CWE-312

Medium

Spring Boot Misconfiguration: Datasource credentials stored in the properties file

CWE-312

Medium

Spring Boot Misconfiguration: Unsafe value for session tracking

CWE-598

Medium

Spring Boot Misconfiguration: Overly long session timeout

CWE-613

Medium

Spring Misconfiguration: HTML Escaping disabled

CWE-116

Medium

Spring Boot Misconfiguration: Developer tools enabled on production

CWE-489

Medium

Spring Boot Misconfiguration: Admin MBean enabled

CWE-749

Medium

Web Cache Poisoning DoS

CWE-400

Medium

Spring Boot Misconfiguration: Actuator endpoint security disabled

CWE-749

Medium

Unsafe value for session tracking in WEB-INF/web.xml

CWE-598

Medium

Overly long session timeout in servlet configuration

CWE-613

Medium

Custom Error Pages Are Not Configured in WEB-INF/web.xml

CWE-209

Medium

Axis system configuration listing enabled in WEB-INF/server-config.wsdd

CWE-200

Medium

Axis development mode enabled in WEB-INF/server-config.wsdd

CWE-489

Medium

Web Cache Poisoning DoS (for javascript)

CWE-400

Medium

Apache Spark Web UI Unauthorized Access Vulnerability

CWE-200

Medium

TLS/SSL Sweet32 attack

CVE-2016-6329

CWE-327

Medium

Apache Tomcat examples directory vulnerabilities

Medium

Misconfigured Access-Control-Allow-Origin Header

CWE-942

Medium