/alerttags/cwe-693/ Recent content in CWE-693 on ZAP Hugo en-us /docs/alerts/200005-17/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-17/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-18/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-18/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-14/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-14/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/10038-1/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10038-1/ <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/10038-3/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10038-3/ <p>The response contained a Content-Security-Policy-Report-Only header, this may indicate a work-in-progress implementation, or an oversight in promoting pre-Prod to Prod, etc.</p> <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/200005-23/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-23/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-13/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-13/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-19/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-19/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/90004-2/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/90004-2/ <p>Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don&rsquo;t explicitly grant the document permission (using CORP or CORS).</p> /docs/alerts/90004-3/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/90004-3/ <p>Cross-Origin-Opener-Policy header is a response header that allows a site to control if others included documents share the same browsing context. Sharing the same browsing context with untrusted documents might lead to data leak.</p> /docs/alerts/90004-1/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/90004-1/ <p>Cross-Origin-Resource-Policy header is an opt-in header designed to counter side-channels attacks like Spectre. Resource should be specifically set as shareable amongst different origins.</p> /docs/alerts/200005-3/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-3/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-2/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-2/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-4/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-4/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/10055-13/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-13/ <p>The Content Security Policy fails to define one of the directives that has no fallback. Missing/excluding them is the same as allowing anything.</p> /docs/alerts/10055-12/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-12/ <p>The message contained both CSP specified via header and via Meta tag. It was not possible to union these policies in order to perform an analysis. Therefore, they have been evaluated individually.</p> /docs/alerts/10055-9/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-9/ <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/10055-11/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-11/ <p>The policy specified via meta element contains either or both the sandbox or frame-ancestors directive, which are not permitted inside meta CSP definitions.</p> /docs/alerts/10055-3/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-3/ <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/10055-10/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-10/ <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/10055-7/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-7/ <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/10055-5/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-5/ <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/10055-8/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-8/ <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/10055-6/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-6/ <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/10055-4/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-4/ <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/10055-1/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-1/ <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/10055-2/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10055-2/ <p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p> /docs/alerts/200005-15/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-15/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-12/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-12/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-7/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-7/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-1/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-1/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-10/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-10/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-16/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-16/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/100016/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/100016/ <p>Some of the following security headers are missing from the HTTP response: Strict-Transport-Security, Content-Security-Policy, X-XSS-Protection, X-Content-Type-Options, X-Frame-Options.</p> /docs/alerts/200005-5/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-5/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/10038-2/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10038-2/ <p>The &ldquo;X-Content-Security-Policy&rdquo; and &ldquo;X-WebKit-CSP&rdquo; headers are no longer recommended.</p> /docs/alerts/10063-1/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10063-1/ <p>Permissions Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Permissions Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.</p> /docs/alerts/200005-21/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-21/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-22/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-22/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-20/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-20/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-9/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-9/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-6/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-6/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/10021/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/10021/ <p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to &rsquo;nosniff&rsquo;. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p> /docs/alerts/200005-8/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-8/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p> /docs/alerts/200005-11/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/200005-11/ <p>The OWASP Secure Headers Project describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities.</p> <p>Generated by OWASP PTK DAST Module</p>