CWE-345 on ZAP

Content-Type Header Empty

Mon, 01 Jan 0001 00:00:00 +0000

The Content-Type header was either missing or empty.

Content-Type Header Missing

Mon, 01 Jan 0001 00:00:00 +0000

The Content-Type header was either missing or empty.

JWT None Algorithm (Authorization header)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT None Algorithm (Cookie)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT None Algorithm (Form body param)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT None Algorithm (JSON body)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT Probe (Authorization + JWT cookies removed)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT Probe (Authorization header removed)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT Probe (JWT cookies removed)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

postMessage to cross-origin target with tainted payload

Mon, 01 Jan 0001 00:00:00 +0000

Tainted data sent via window.postMessage to a different origin.

Generated by OWASP PTK IAST Module

postMessage to wildcard origin with tainted payload

Mon, 01 Jan 0001 00:00:00 +0000

Tainted data sent via window.postMessage to wildcard ‘*’ targetOrigin.

Generated by OWASP PTK IAST Module

Sub Resource Integrity Attribute Missing

Mon, 01 Jan 0001 00:00:00 +0000

The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content.