Scribd Logo
Upload

Welcome to Scribd!

  • Vulnerability

    Uploaded by

    jagdish
    10 views1 page
    The document discusses several security vulnerabilities found in a modern web application including: access control flaws, cross-site scripting via user-controllable elements, plain text credential transmission allowing session hijacking, information disclosure via server version leaks and application errors, lack of anti-CSRF tokens and HTTP-only cookies, and improper input validation. Private IP addresses and email addresses were also disclosed.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document discusses several security vulnerabilities found in a modern web application including: access control flaws, cross-site scripting via user-controllable elements, plain text credential transmission allowing session hijacking, information disclosure via server version leaks and application errors, lack of anti-CSRF tokens and HTTP-only cookies, and improper input validation. Private IP addresses and email addresses were also disclosed.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    10 views1 page

    Vulnerability

    Uploaded by

    jagdish
    The document discusses several security vulnerabilities found in a modern web application including: access control flaws, cross-site scripting via user-controllable elements, plain text credential transmission allowing session hijacking, information disclosure via server version leaks and application errors, lack of anti-CSRF tokens and HTTP-only cookies, and improper input validation. Private IP addresses and email addresses were also disclosed.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 1

    .

    Access control flaw


    .script alert xss payload
    credential sent in plain text
    session hijacking
    server leakes version information
    user agent fuzzer login page
    user controllable HTML element attribute
    x- content type option header missing patrient
    absence of anti csrf token
    Application error disclosure
    concurrent login
    content security policy header
    cookei no http only flag
    Improper validation
    information disclosure-suspicious comment
    modern web application
    private IP disclosure

    cleartext submission of password


    password field with autocomplete enabled
    Email addresses disclosed

    You might also like