Merge pull request #8633 from ProcessMaker/FOUR-28214 #303
nolanproveracode.yml
on: push
Run Veracode DAST Essentials Scan
43m 24s
Annotations
13 errors
|
io.Fuzzer (1):
io#L1
Retrieved https://performancetest-qa.processmaker.net/metrics by using a GET request on the URL without prior knowledge.
|
|
io.Cross-Site Scripting (XSS) (1):
io#L1
The potentially vulnerable code was found on url 'https://performancetest-qa.processmaker.net/vendor/processmaker/packages/package-ai/js/webhook.js'. An attacker may be able to inject JavaScript using the the code 'location.href' at line 2:288441 and control its display using the code 'setTimeout' at line 2:34103
|
|
io.Cross-Site Scripting (XSS) (2):
io#L1
The potentially vulnerable code was found on url 'https://performancetest-qa.processmaker.net/vendor/processmaker/packages/package-savedsearch/js/addSaveButton.js'. An attacker may be able to inject JavaScript using the the code 'location.href' at line 2:315254 and control its display using the code 'setTimeout' at line 2:230985
|
|
io.Cross-Site Scripting (XSS) (3):
io#L1
The potentially vulnerable code was found on url 'https://performancetest-qa.processmaker.net/builds/login/js/app-login.js'. An attacker may be able to inject JavaScript using the the code 'document.cookie' at line 2:12994 and control its display using the code 'setTimeout' at line 2:1267
|
|
io.Transport Layer Security (TLS/SSL) (1):
io#L1
The cipher suite TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 is weak.
|
|
io.Transport Layer Security (TLS/SSL) (2):
io#L1
The cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 is weak.
|
|
io.Transport Layer Security (TLS/SSL) (3):
io#L1
The server is configured to use average ciphers like SEED + 128+256 Bit CBC ciphers (AES, CAMELLIA and ARIA) which are deprecated
|
|
io.Transport Layer Security (TLS/SSL) (4):
io#L1
OCSP_stapling is not offered by the server.
|
|
io.HTTP Header (1):
io#L1
The content security policy is missing the report-to directive. This was found on URL https://performancetest-qa.processmaker.net
|
|
io.HTTP Header (2):
io#L1
The cookie with the name 'device_id' does not have the flag 'HttpOnly' set. This may leak sensitive information. This was found on URL https://performancetest-qa.processmaker.net.
|
|
io.HTTP Header (3):
io#L1
The Referrer-Policy header is not set for URL https://performancetest-qa.processmaker.net.
|
|
io.Portscan (1):
io#L1
Found open port '80/tcp' with service name 'awselb/2.0'
|
|
io.Portscan (2):
io#L1
Found open port '443/tcp' with service name 'awselb/2.0'
|