v.26.3.2229

Configuration

This page lists 407 vulnerabilities in this category.

Critical: 4 High: 133 Medium: 174 Low: 51 Information: 45

Vulnerability Name

CVE

CWE

Severity

Unprotected Apache NiFi API interface

CWE-287

Medium

Unprotected Kong Gateway Admin API interface

CWE-287

Medium

ASP.NET header checking is disabled in web.config

CWE-16

Medium

Unauthorized Access to a web app installer

CWE-200

Medium

GraphQL Field Suggestions Enabled

CWE-200

Medium

Jetty ConcatServlet Information Disclosure (CVE-2021-28169)

CVE-2021-28169

CWE-200

Medium

Jetty Information Disclosure (CVE-2021-34429)

CVE-2021-28164

CWE-200

Medium

Apache Server-Status Detected

CWE-200

Medium

Apache configured to run as proxy

CWE-441

Medium

Apache Server-Info Detected

CWE-200

Medium

Adobe Experience Manager Information Disclosure via Apache Sling v2.3.6 vulnerability

CVE-2016-0956

CWE-668

Medium

Apache Kafka Unauthorized Access Vulnerability

CWE-200

Medium

Apache ZooKeeper Unauthorized Access Vulnerability

CWE-200

Medium

HTTP header reflected in cached response

CWE-16

Medium

Web Cache Poisoning DoS through HTTP/2 headers

CWE-400

Medium

Atlassian JIRA Servicedesk misconfiguration

CWE-287

Medium

Spring Boot Misconfiguration: H2 console enabled

CWE-16

Medium

Gitlab open user registration

CWE-200

Medium

Jenkins open user registration

CWE-200

Medium

ASP.NET viewstate encryption disabled

CWE-16

Medium

[Possible] AWStats Detected

CWE-538

Medium

Oracle E-Business Suite Frame Injection (CVE-2017-3528)

CVE-2017-3528

CWE-601

Medium

WebPageTest Unauthorized Access Vulnerability

CWE-200

Medium

Pyramid DebugToolbar enabled

CWE-200

Medium

Apache JServ protocol service

CWE-200

Medium

ASP.NET diagnostic page

CWE-200

Medium

Directory listings

CWE-538

Medium

Frontpage authors.pwd available

CWE-538

Medium

Craft CMS Development Mode enabled

CWE-200

Medium

Django Debug Toolbar

CWE-200

Medium

Unrestricted access to MLflow

CWE-200

Medium

ASP.NET expired session IDs are not regenerated

CWE-16

Medium

ASP.NET WCF metadata enabled for behavior

CWE-16

Medium

ASP.NET WCF replay attacks are not detected

CWE-16

Medium

GraphQL Introspection Query Enabled

CWE-200

Medium

Laravel debug mode enabled (Invicti IAST)

CWE-16

Medium

GraphQL Unauthenticated Mutation Detected

CWE-306

Medium

Symfony debug mode enabled (Invicti IAST)

CWE-16

Medium

GraphQL Array-based Query Batching Allowed: Potential Batching Attack Vulnerability

CWE-770

Medium

GraphQL Non-JSON Queries over POST: Potential CSRF Vulnerability

CWE-352

Medium

Symfony running in dev mode

CWE-16

Medium

Unchecked GraphQL Query Length: Potential Denial of Service Vulnerability

CWE-400

Medium

WordPress configuration file weak file permissions

CWE-16

Medium

WordPress allows editing theme/plugin files

CWE-16

Medium

GraphiQL Explorer/Playground Enabled

CWE-200

Medium

Drupal configuration file weak file permissions

CWE-16

Medium

GraphQL Non-JSON Mutations over GET: Potential CSRF Vulnerability

CWE-352

Medium

Webalizer script

CWE-538

Medium

Yii debug mode enabled

CWE-16

Medium

Yii running in dev mode

CWE-16

Medium

Active Mixed Content over HTTPS

CWE-284

Medium

ASP.NET Core Development Mode enabled

CWE-200

Medium

Open Silverlight Client Access Policy

CWE-16

Medium

Insecure crossdomain.xml policy

CWE-284

Medium

GraphQL Non-JSON Queries over GET: Potential CSRF Vulnerability

CWE-352

Medium

GraphQL Alias Overloading Allowed: Potential Denial of Service Vulnerability

CWE-400

Medium

Drupal trusted_host_patterns setting not configured

CWE-16

Medium

CodeIgniter development mode enabled

CWE-16

Medium

GraphQL Circular-Query via Introspection Allowed: Potential DoS Vulnerability

CWE-400

Medium

Unsafe value for session tracking in WEB-INF/web.xml

CWE-16

Medium

ASP.NET WCF service include exception details

CWE-16

Medium

InfluxDB Unauthorized Access Vulnerability

CWE-200

Medium

Magento Config File Disclosure

CWE-200

Medium

Oracle E-Business Suite iStore open user registration

CVE-2022-21500

CWE-200

Medium

Go web application binary disclosure

CWE-540

Medium

Phpfastcache phpinfo publicly accessible (CVE-2021-37704)

CVE-2021-37704

CWE-200

Medium

Axis development mode enabled in WEB-INF/server-config.wsdd

CWE-16

Medium

Axis system configuration listing enabled in WEB-INF/server-config.wsdd

CWE-16

Medium

Custom Error Pages Are Not Configured in WEB-INF/web.xml

CWE-16

Medium

Overly long session timeout in servlet configuration

CWE-16

Medium

Node.js Running in Development Mode

CWE-215

Medium

Verb tampering via misconfigured security constraint

CWE-16

Medium

GraphQL Unhandled Error Leakage

CWE-209

Medium

Spring Boot Misconfiguration: Admin MBean enabled

CWE-16

Medium

Spring Boot Misconfiguration: All Spring Boot Actuator endpoints are web exposed

CWE-16

Medium