WSTG-V42-INFO-05 on ZAP

Big Redirect Detected (Potential Sensitive Information Leak)

Mon, 01 Jan 0001 00:00:00 +0000

The server has responded with a redirect that seems to provide a large response. This may indicate that although the server sent a redirect it also responded with body content (which may include sensitive details, PII, etc.).

Image Exposes Location or Privacy Data

Mon, 01 Jan 0001 00:00:00 +0000

The image was found to contain embedded location information, such as GPS coordinates, or another privacy exposure, such as camera serial number. Depending on the context of the image in the website, this information may expose private details of the users of a site. For example, a site that allows users to upload profile pictures taken in the home may expose the home’s address.

Information Disclosure - Suspicious Comments

Mon, 01 Jan 0001 00:00:00 +0000

The response appears to contain suspicious comments which may help an attacker.

Multiple HREFs Redirect Detected (Potential Sensitive Information Leak)

Mon, 01 Jan 0001 00:00:00 +0000

The server has responded with a redirect that seems to contain multiple links. This may indicate that although the server sent a redirect it also responded with body content links (which may include sensitive details, PII, lead to admin panels, etc.).

X-ChromeLogger-Data (XCOLD) Header Information Leak

Mon, 01 Jan 0001 00:00:00 +0000

The server is leaking information through the X-ChromeLogger-Data (or X-ChromePhp-Data) response header. The content of such headers can be customized by the developer, however it is not uncommon to find: server file system locations, vhost declarations, etc.