v.26.4.2314

Configuration

This page lists 405 vulnerabilities in this category.

Critical: 4 High: 127 Medium: 173 Low: 51 Information: 50

Vulnerability Name

CVE

CWE

Severity

Unicode Transformation (Best-Fit Mapping)

CWE-176

Medium

W3 total cache debug mode

CWE-489

Medium

PHP session.use_trans_sid enabled

CWE-598

Medium

PHP register_globals enabled

CWE-1108

Medium

WebDAV directory listing

CWE-538

Medium

PHP enable_dl enabled

CWE-470

Medium

PHP errors enabled

CWE-209

Medium

CRIME SSL/TLS attack

CVE-2012-4929

CWE-311

Medium

Symfony web debug toolbar

CWE-489

Medium

ViewState MAC Disabled

CWE-642

Medium

PHP register_globals Is Enabled

CWE-1108

Medium

PHP session.use_only_cookies Is Disabled

CWE-598

Medium

ASP.NET ValidateRequest Is Globally Disabled

CWE-707

Medium

ASP.NET application-level tracing enabled

CWE-215

Medium

ASP.NET login credentials stored in plain text

CWE-256

Medium

ASP.NET: Failure To Require SSL For Authentication Cookies

CWE-319

Medium

Apache perl-status enabled

CWE-200

Medium

ASP.NET CustomErrors Is Disabled

CWE-12

Medium

Tornado debug mode

CWE-489

Medium

Apache Cassandra Unauthorized Access Vulnerability

CWE-200

Medium

ASP.NET Cookieless session state enabled

CWE-598

Medium

Redis Unauthorized Access Vulnerability

CWE-200

Medium

Grails database console

CWE-200

Medium

Hadoop cluster web interface

CWE-200

Medium

Hostile subdomain takeover

CWE-346

Medium

Java Management Extensions (JMX/RMI) service detected

CWE-200

Medium

JSF ViewState client side storage

CWE-693

Medium

Memcached Unauthorized Access Vulnerability

CWE-200

Medium

MySQL utf8 4-byte truncation

CWE-176

Medium

Oracle applications logs publicy available

CWE-200

Medium

Pyramid debug mode

CWE-489

Medium

TLS/SSL certificate key size too small

CWE-326

Medium

Spring Boot Actuator v2

CWE-489

Medium

Chrome Logger information disclosure

CWE-200

Medium

SSL Certificate Is About To Expire

CWE-298

Medium

Invalid SSL Certificate

CWE-298

Medium

The FREAK attack

CVE-2015-0204

CWE-327

Medium

TLS/SSL LOGJAM attack

CVE-2015-4000

CWE-326

Medium

TLS/SSL Weak Cipher Suites

CWE-327

Medium

Same site scripting

CWE-350

Medium

SharePoint exposed web services

CWE-200

Medium

Spring Boot Actuator

CWE-489

Medium

ASP.NET cookies accessible from client-side scripts

CWE-1004

Medium

ASP.NET ASPX debugging enabled

CWE-11

Medium

The POODLE attack (SSLv3 with CBC cipher suites)

CVE-2014-3566

CWE-326

Medium

HTTP Strict Transport Security (HSTS) Policy Not Enabled

CWE-1428

Medium

SAP NetWeaver server info information disclosure BCB

CWE-200

Medium

SAP NetWeaver Java AS WD_CHAT information disclosure vulnerability

CWE-200

Medium

Apache Proxy HTTP CONNECT method enabled

CWE-441

Medium

Tornado weak secret key

CWE-693

Medium

Frontpage authors.pwd available

CWE-538

Medium

Cookie signed with weak secret key

CWE-693

Medium

Web2py weak secret key

CWE-693

Medium

Yii2 weak secret key

CWE-693

Medium

Directory listings

CWE-538

Medium

SAP ICF /sap/public/info sensitive information disclosure

CWE-200

Medium

[Possible] AWStats Detected

CWE-538

Medium

Apache Server-Status Detected

CWE-200

Medium

Apache Server-Info Detected

CWE-200

Medium

Apache configured to run as proxy

CWE-441

Medium

Laravel debug mode enabled

CWE-200

Medium

Laravel Health Monitor open

CWE-200

Medium

Laravel Horizon open

CWE-200

Medium

Laravel LogViewer open

CWE-200

Medium

Webalizer script

CWE-538

Medium

SAP NetWeaver server info information disclosure

CWE-200

Medium

[Possible] Password Transmitted over Query String

CWE-200

Medium

Express cookie-session weak secret key

CWE-693

Medium

JavaMelody publicly accessible

CWE-200

Medium

ASP.NET cookieless authentication enabled

CWE-598

Medium

Yii2 debug toolkit

CWE-200

Medium

Yii2 Gii extension

CWE-200

Medium

Firebase database accessible without authentication

CWE-200

Medium

Httpoxy vulnerability

CWE-918

Medium

Django weak secret key

CWE-693

Medium