Atlassian Jira < 5.0.1 Arbitrary File Reads

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 5.0.1. It does, therefore, not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of servic...

Atlassian Jira < 8.9.0 Improper Authorization In Project Administration

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.9.0. It is, therefore, affected by a vulnerability which permits remote attackers to obtain information about custom project avatars via an improper authorization...

Atlassian Confluence 7.13.9 < 7.13.12 Embedded Spring-Beans Denial Of Service

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.13.9 prior to 7.13.12, 7.19.0 prior to 7.19.3. It is, therefore, affected by a Denial of Service DoS attack vulnerability when relying on attacker controlled data binding to set a...

Atlassian Jira 8.6.x < 8.8.2 WYSIWYG Editor Cross-Site Scripting

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.9 or 8.6.x prior to 8.8.2. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting X...

Nginx Missing Root Location

The scanner has detected that the Nginx installation does not have a directive for the root location '/'. This could potentially leak useful information about the server installation to a remote, unauthenticated attacker. No source data...

Nginx Cloud Storage HTTP Splitting

The scanner has detected that the Nginx configuration has a directive location specified to query a cloud storage instance. However, it is possible to insert an arbitrary payload containing a line break, which allows a malicious attacker to change the cloud storage instance to be queried. It is...

Atlassian Confluence 6.4.3 < 6.6.1 Resource Attachment Content Spoofing

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to version 6.6.1. It may, therefore, permit remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of...

Atlassian Jira Service Desk 4.7.1 < 4.10.0 Cross-Site Scripting In API and Integrations

According to its self-reported version number, the Atlassian Jira Service Desk application running on the remote host is version 4.7.x prior to 4.10.0. It is, therefore, affected by a flaw which may permit a remote attacker to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS...

Server-Side Inclusion Injection

A Server-Side Include Injection vulnerability exists when an application embeds and evaluates unsafe user-controlled server-side include directives. By injecting a specific payload an attacker can leverage this vulnerability to conduct a remote code execution. No source data...

SUSE CVE-2007-2589

Cross-site request forgery CSRF vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary users via certain data in the SRC attribute of an IMG element...

Form With Password Detected

This is an informational notice that the scanner identified a potential form with a password. No source data...

AppVeyor Configuration Detected

AppVeyor is a continuous integration and deployment service available as a Software as a Service SaaS based application or as a private instance and which is used to build and test software projects. By defining a configuration file named appveyor.yml in their source code repositories, developers...

Rails Development Mode Enabled

The Ruby on Rails RoR web framework uses three environments by default : test, development and production. When running in development mode, the application will render diagnostic pages and expose all the routes available, leaking internal information about the application. In some cases, the...

Password Reset Form Detected

This is an informational notice that the scanner identified a potential password change form. No source data...

SQL Statement Disclosure

Web applications usually rely on backend database servers to store persistent information like users, sessions or for example products of an e-commerce website. In some cases, these web applications may fail to properly handle potential errors raised when querying the database, displaying raw...

Password Submitted Using GET Method

The scanner was able to detect that the application uses the HTTP GET method to transmit a password, the information of a URL can be stored in various places web server, proxy, ... and can be transmitted to a third party via the Referer header which also increases the chances of interception by a...

Signup Form Detected

This is an informational notice that the scanner identified a potential signup form. No source data...

Oturia Smart Google Code Inserter Plugin for WordPress < 3.5 Multiple Vulnerabilities

The WordPress Oturia Smart Google Code Inserter Plugin installed on the remote host is affected by multiple vulnerabilities :\n\n - An Authentication Bypass which allows unauthenticated attackers to insert arbitrary JavaScript or HTML code via the sgcgoogleanalytic parameter.\n - An SQL Injection...

Webmin < 1.940 XML External Entity

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.940. It is, therefore, affected by an XML External Entity vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

Webmin < 1.990 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.990. It is, therefore, affected by multiple vulnerabilities. - Improper Access Control to Remote Code Execution - Improper Authorization Note that the scanner has not tested for these issues but has...