The remote web server uses the default Lighttpd index page. This page may contain some sensitive data like the server root and installation paths.

This could potentially leak useful information about the server installation to a remote, unauthenticated attacker.

It is possible to send debug statements to the remote ASP scripts via the http DEBUG method. A remote, unauthenticated attacker may leverage this to alter the runtime of the remote scripts.

The ASP.NET web application running in the root directory of the remote web server has application tracing enabled. This allows an unauthenticated, remote attacker to view the last 50 web requests made to the server, including sensitive information like Session ID values and the physical path to the requested file.

The scanner has detected Nginx default index pages on the remote web server.

This could potentially leak useful information about the server installation to a remote, unauthenticated attacker.

The remote server is not configured with a SSL/TLS cipher suite preference list, making the cipher suite selection during the negotiation use the ordered list from the client.

The scanner identified some responses with a status code other than the usual 200 (OK), 301 (Moved Permanently), 302 (Found) and 404 (Not Found) codes. These codes can provide useful insights into the behavior of the web application and identify any unexpected responses to be addressed.

The scanner may have been able to detect several versions of the API for one or more endpoints.

The remote host contains a file named 'robots.txt' that is intended to prevent web 'robots' from visiting certain directories in a website for maintenance or indexing purposes. A malicious user may also be able to use the contents of this file to learn of sensitive documents or directories on the affected site and either retrieve them directly or target them for other attacks.

This plugin displays information about the SSL/TLS versions supported by remote server for HTTPS connection.

This is an informational plugin to inform the user that the scanner has detected a publicly accessible Drupal User Registration Form on the target application.

This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack

This is an informational plugin to inform the user that the scanner has detected a publicly accessible WordPress User Registration Form on the target application.

This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack

This is an informational plugin to inform the user that the scanner has detected a publicly accessible Joomla User Registration Form on the target application.

This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack

Screenshot of the target web page, see attached image. This screenshot should show you the target page we are launching the scan against. If the image is not of the intended target page, please check the provided url in the scan configuration.

The scanner detected one or more HTML object tags. This tag is used to embed multimedia like audio, video, Java applets, ActiveX, PDF and Flash in HTML pages.

Detects any known CAPTCHA products being used on a page.

The design of many web applications require that users be able to upload files that will either be stored or processed by the receiving web server.

Scanner has flagged this not as a vulnerability, but as a prompt for the penetration tester to conduct further manual testing on the file upload function.

An insecure form-based file upload could allow a cyber-criminal a means to abuse and successfully exploit the server directly, and/or any third party that may later access the file. This can occur through uploading a file containing server side-code (such as PHP) that is then executed when requested by the client.

The scanner aborted the scan due to the number of consecutive timeouts received from the web application, to prevent this latter to be completely unresponsive and unable to process normal requests.

ID	Name	Product	Family	Updated	Severity
112360	Lighttpd Default Index Page	Web App Scanning	Component Vulnerability	9/7/2021	medium
112353	ASP.NET DEBUG Method Enabled	Web App Scanning	Component Vulnerability	9/7/2021	medium
112352	Microsoft ASP.NET Application Tracing trace.axd Information Disclosure	Web App Scanning	Component Vulnerability	9/7/2021	medium
112350	Nginx Default Index Page	Web App Scanning	Component Vulnerability	9/7/2021	medium
112599	SSL/TLS Server Cipher Suite Preference Not Detected	Web App Scanning	SSL/TLS	8/25/2021	info
98050	Interesting Response	Web App Scanning	Web Applications	6/14/2021	info
112714	API Versions Detected	Web App Scanning	Web Applications	3/10/2021	info
98705	Robots.txt File Detected	Web App Scanning	Web Servers	12/17/2020	info
112530	SSL/TLS Versions Supported	Web App Scanning	SSL/TLS	10/2/2020	info
98201	Drupal User Registration Form Detected	Web App Scanning	Web Applications	1/3/2019	info
98202	WordPress User Registration Form Detected	Web App Scanning	Web Applications	4/3/2018	info
98205	Joomla! User Registration Form Detected	Web App Scanning	Web Applications	3/21/2018	info
98138	Screenshot	Web App Scanning	General	2/14/2018	info
98092	HTML Object	Web App Scanning	Web Servers	10/16/2017	info
98083	CAPTCHA Detection	Web App Scanning	Web Applications	10/16/2017	info
98080	Form-based File Upload	Web App Scanning	Web Applications	10/16/2017	info
98137	Scan aborted after too many timeouts	Web App Scanning	General	9/18/2017	info

Detections

Analytics

Recently Updated Plugins

medium

medium

medium

medium

info

info

info

info

info

info

info

info

info

info

info

info

info