OWASP_2021_A08 on ZAP

Cross-Domain JavaScript Source File Inclusion

Mon, 01 Jan 0001 00:00:00 +0000

The page includes one or more script files from a third-party domain.

Loosely Scoped Cookie

Mon, 01 Jan 0001 00:00:00 +0000

Cookies can be scoped by domain or path. This check is only concerned with domain scope.The domain scope applied to a cookie determines which domains can access it. For example, a cookie can be scoped strictly to a subdomain e.g. www.nottrusted.com, or loosely scoped to a parent domain e.g. nottrusted.com. In the latter case, any subdomain of nottrusted.com can access the cookie. Loosely scoped cookies are common in mega-applications like google.com and live.com. Cookies set from a subdomain like app.foo.bar are transmitted only to that domain by the browser. However, cookies scoped to a parent-level domain may be transmitted to the parent, or any subdomain of the parent.

Prototype pollution influenced fetch() init

Mon, 01 Jan 0001 00:00:00 +0000

A prior tainted prototype write influenced inherited fetch() init fields.

Generated by OWASP PTK IAST Module

Review dynamic import usage

Mon, 01 Jan 0001 00:00:00 +0000

Detects dynamic script, worker, and service-worker loader endpoints that can be influenced by attacker-controlled client-side data.

Generated by OWASP PTK SAST Module

Review importScripts usage

Mon, 01 Jan 0001 00:00:00 +0000

Detects dynamic script, worker, and service-worker loader endpoints that can be influenced by attacker-controlled client-side data.

Generated by OWASP PTK SAST Module

Review jQuery getScript usage

Mon, 01 Jan 0001 00:00:00 +0000

Detects dynamic script, worker, and service-worker loader endpoints that can be influenced by attacker-controlled client-side data.

Generated by OWASP PTK SAST Module

Review serviceWorker.register usage

Mon, 01 Jan 0001 00:00:00 +0000

Detects dynamic script, worker, and service-worker loader endpoints that can be influenced by attacker-controlled client-side data.

Generated by OWASP PTK SAST Module

Review SharedWorker constructor usage

Mon, 01 Jan 0001 00:00:00 +0000

Detects dynamic script, worker, and service-worker loader endpoints that can be influenced by attacker-controlled client-side data.

Generated by OWASP PTK SAST Module

Review System.import usage

Mon, 01 Jan 0001 00:00:00 +0000

Detects dynamic script, worker, and service-worker loader endpoints that can be influenced by attacker-controlled client-side data.

Generated by OWASP PTK SAST Module

Review Worker constructor usage

Mon, 01 Jan 0001 00:00:00 +0000

Detects dynamic script, worker, and service-worker loader endpoints that can be influenced by attacker-controlled client-side data.

Generated by OWASP PTK SAST Module

Tainted dangerous key used in prototype write

Mon, 01 Jan 0001 00:00:00 +0000

Tainted data reached a dangerous prototype key write.

Generated by OWASP PTK IAST Module

Tainted worker or script loader URL

Mon, 01 Jan 0001 00:00:00 +0000

Detects dynamic script, worker, and service-worker loader endpoints that can be influenced by attacker-controlled client-side data.

Generated by OWASP PTK SAST Module