Apache Struts 2.x < 2.5.29 Remote Code Execution (S2-062)

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag's attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. Using forced OGNL evaluation on untrusted user input can lead to a...

Spring Boot Actuator Detected

This is an informational notice that the scanner was able to detect an accessible Spring Actuator. Actuator endpoints let you monitor and interact with your application. Spring Boot includes a number of built-in endpoints and lets you add your own. For example, the 'health' endpoint provides basi...

Jenkins Stapler < 2.138.4 LTS / 2.154 Remote Code Execution

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not...

Basic Authentication Bruteforced

The scanner successfully authenticated on the target web application by using weak credentials in the request basic authentication HTTP header. No source data...

Microsoft Exchange Server Autodiscover Cross-Site Scripting

Microsoft Exchange Server versions 2019 before cumulative update 11, 2016 before cumulative update 22 and 2013 before cumulative update 23 are affected by a cross-site scripting vulnerability through the autodiscover/autodiscover.json endpoint. By crafting a specific URL, an attacker could target...

Virtual JDBC Remote Code Execution

Due to unsafe deserialization used in Virtual JDBC all versions allows an unauthenticated attacker with HTTP access to the service to obtain arbitrary code execution. No source data...

Rack-Mini-Profiler Information Disclosure

Rack-Mini-Profiler is a middleware that displays a speed badge for each html page. Designed to work in both production and development but when the 'enableadvanceddebuggingtools' option is selected it is possible to access sensitive information such as environment variables and other secrets stor...

Out-of-Date JQuery UI Detected

An out-of-date version of JQuery UI has been detected. An outdated version could have vulnerabilities or missing security features. No source data...

Out-of-Date Knockout JS Detected

An out-of-date version of Knockout JS has been detected. An outdated version could have vulnerabilities or missing security features. No source data...

Atlassian Jira 8.14.x < 8.16.1 Arbitrary File Read

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.14, 8.6.x 8.13.6 or 8.14.x 8.16.1. It is, therefore, affected by a path traversal vulnerability in the /WEB-INF/web.xml endpoint allowing remote attackers to read particul...

Atlassian Jira < 8.5.14 Arbitrary File Read

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.14, 8.6.x 8.13.6 or 8.14.x 8.16.1. It is, therefore, affected by a path traversal vulnerability in the /WEB-INF/web.xml endpoint allowing remote attackers to read particul...

WordPress 5.8.x < 5.8.1 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A data exposure vulnerability within the REST API. - A Lodash library prior to 4.17.21 vulnerbaility. Note that the scanner has not tested for these issues but has instead...

Microsoft SharePoint Server 2016 < 16.0.5188.1000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source da...

Microsoft SharePoint Server 2016 < 16.0.5161.1000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source da...

Microsoft SharePoint Server 2013 < 15.0.5353.1000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source da...

Apache Tomcat 9.0.44 Denial of Service

The version of Apache Tomcat installed on the remote host is 10.0.3 to 10.0.4, 9.0.44 or 8.5.64. It is, therefore, affected by a denial of service due to an error introduced as part of a change to improve error handling during non-blocking I/O. Note that the scanner has not attempted to exploit...

X-Cart 5.0.10 < 5.3.6.8 Deserialization Vulnerability

According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.6.8, 5.4.0.x 5.4.0.13 or 5.4.1.x 5.4.1.8. It is, therefore, affected by a vulnerability in the cookie viewedResources handling leading to insecure deserialization and...

Atlassian Confluence < 7.4.2 Cross-Site Scripting

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.2 or 7.5.x 7.5.2. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability in user macro parameters. Note that the scanner has not tested for these issues b...

Atlassian Confluence 6.14.x < 7.3.3 Improper Authorization

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.11 or 6.14.x 7.3.3. It is, therefore, affected by an improper authorization check vulnerability allowing remote attackers with administrator privileges to edit existing...

Atlassian Jira < 8.5.10 Server-Side Request Forgery

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.10, 8.6.x 8.13.2 or 8.14.x 8.14.1. It is, therefore, affected by a Server-Side Request Forgery SSRF vulnerability allowing unexpected DNS lookups and requests to malicious...