Vulnerability name Vulnerability description

jQuery 3.2.1 -- Affected versions of this

package are vulnerable to Cross-site Scripting
(XSS).
Based on the impact and exploitability matrix
Vulnerable and outdated components the current version of the technologies are
vulnerable to Cross-site Scripting (XSS) by
leveraging vulnerabilities in the components.

Anyone can distribute a fake email

content/files using a company’s email. As a
Server security misconfiguration result, a company will have a reputation loss.
The attacker has several ways they can use the
redirected clicks from this attack for their own
gain. A common form of clickjacking involves
mirroring a login and password form on a
website. The user assumes that they are
entering their information into a usual form but
they are actually entering it in fields the
Clickjacking attacker has overlaid on the UI. Attackers can

TLSv 1.0 and 1.1 are supported by the web

server which are not considered to be strong
Insufficient Transport Layer Protection cryptography.
Enumerating email addresses/mobile
numbers/usernames exposed further attack
surface including but not limited to phishing
attack, social engineering, etc.

user enumerartion

Many web applications and hardware devices

have default passwords for the built-in
administrative account. Although in some cases
these can be randomly generated, they are
often static, meaning that they can be easily
Default credentials leads to admin account guessed or obtained by an [Link] can
takeover lead attackerto gain senetive information and
A lack of input validation was discovered on the
[Link] which could potentially allow
attackers to exploit various vulnerabilities such
as SQL injection, cross-site scripting (XSS), and
other security issues. This vulnerability poses a
significant security risk to the website and its
Lack of input validation users.
A brute force attack is a method of guessing a
username and password combination by trying
different combinations until the correct one is
found. Without rate limiting, an attacker can
try thousands or even millions of combinations
in a short amount of time, increasing the
likelihood of a successful attack.
No rate limit
 malicious site and trick users into clicking on
buttons or links that they did not intend to
click.

MIME type sniffing: Without the X-Content-

Type-Options header, attackers can exploit
MIME sniffing to execute scripts that the
browser would otherwise block.

Content injection attacks: Without the Content-

Security-Policy header, attackers can inject
malicious content into your website, leading to
Missing security headers unauthorized access and data theft.
If an attacker can get their domain into the
allow-origin header and the allow-credentials
header is set to true than the malicious site has
essentially the same level of access as the
victim user, which could lead to the malicious
execution of functions and confidential data
theft.
CORS misconfiguration
cookie hijacking is the exploitation of a valid
computer session—sometimes also called a
session key—to gain unauthorized access to
information or services in a computer system.

Cookie hijacking / session hijacking

A memory corruption vulnerability is a serious
security flaw that can allow attackers to
execute arbitrary code on a vulnerable system
or crash software applications. If you have
discovered a memory corruption vulnerability
in a software application, you should consider
submitting a bug bounty report to the vendor
memory corruption or organization responsible for the software.
It decreases the impact of a good password
policy by enabling users to reuse their older
passwords, hindering password rotation. A user
implemented weak password is susceptible to a
spraying attack and can even be guessed by an
attacker
weak password policy leads to account takeover Reference:
Insecure Direct Object References allow
attackers to bypass authorization and access
resources directly by modifying the value of a
parameter used to directly point to an object.
IDOR
An attacker could perform an arbitrary number
of authentication attempts using different
passwords, and eventually gain access to the
targeted account if successful which may result
in an account takeover. Sometimes, it may also
lead to a denial of service attack (application
level).
account lockout policy not enabled
Affected URL Steps
[Link] to application
"[Link]
[Link] to wapplyzer extension and check
for the versions of the libraries used by
[Link] the application.
[Link] to webpage
'[Link]
?action=blacklist
%[Link]&run=toolpage'
.
[Link] the domain name
([Link]) and select for spf
[Link] record lookup and hit the enter button..
1. Create an HTML page such as the one
below, and add the login URL of the
merchant portal within an Iframe tag

<html>
<style>
iframe {
[Link] width:1000px;
[Link] the tool, 'sslscan', Run the
following command :

'sslscan [Link] '

[Link] is observed that TLSv1.0 and TLSv1.1

[Link] are enabled.

[Link] to Login page.

[Link] correct username and incorrect
password.
3.A pop up will appear with "wrong
password".
[Link] Incorrect username and correct
[Link] password.
1) Login to
[Link]
l
2) Use the following credentials:
admin:admin
3) Click on "Login". You'll notice that
we've successfully logged in as the
[Link] admin username.
1. Login into application.
2. Go to home page add any item into
cart.
3. Go to cart page, click on place order.
4. A form will appear enter payload
<script>alert(123)</script> in the given
parameters.
[Link] 5. click on purchase and the item is
[Link] to sign up page.
ordered.
[Link] the credentials.
[Link] the request on
burpsuite,send it to intruder.
[Link] payload on username and set
payload type as simple list.
[Link] is observed that multiple users are
[Link] created.
 [Link] to [Link]
[Link] domain
[Link]
[Link] [Link] on scan.
GET \entries 1. Capture a request of the application
using burp proxy.
2. In the request headers, add "Origin: "
header to request that is fetching
sensitive
1)download information from the for
a cookie extension
respective server.
chrome called cookie editor(add to
3. Check if response contains "Access-
chrome)
Control-Allow-Credentials:
2)login in any site which you true"
wantand
to
"Access-Control-Allow-Origin:
test *"
headers.
3)copy the cookie
4)logout
5)paste the cookie and reload the
session
6)You are ableto login without getting
[Link] authorized.
1)Login to
[Link] endpoint
.
2)Capture the request on burp
suite,send it to repeater.
3)On password parameter it is observed
that that there is no limit for the
[Link] username length that allows a user to to
set a very long string as long as 1 million
[Link] to sign up page
[Link]
l.
[Link] the username and password.
[Link] is observed that application is
[Link] accepts password like "123","a","root".
[Link] into application.
[Link] products in cart.
[Link] on place order
[Link] request and found delete
cart parameter with cookie:username
[Link] [Link] username in cookie then send
the request.
[Link] to log in with an incorrect
password 3 times.
Successfully log in with the correct
password, thereby showing that the
lockout mechanism doesn’t trigger after
3 incorrect authentication attempts.
[Link] to log in with an incorrect
[Link] password 4 times.
Mitigation
Upgrade to the latest non vulnerable
and stable components. Latest
Version :Upgrade to jquery@3.6.4.
It is recommended to use a custom
http header 'X-FRAME-OPTIONS' to
Fixing
prevent vulnerability
Clickjackingrequires you to
on sensitive
add SPF
pages details
that on your
instruct domain to
the browser as a
TXT record.
not allow Also implement
framing from otherDMARC
to preventIfattackers
domains. from spoofing
content security policy
emails from it.
(CSP) has been configured, the
recommended clickjacking
protection is to incorporate the
'frame-ancestors' directive on the
application. Or else, include a
'frame-breaker' script in each page
that should not be framed. Refer
reference link for more details on
this reference link:
[Link]
Clickjacking_Defense_Cheat_Sheet

It can no longer be used for secure

communications since it has known
vulnerabilities if exploited
In case of login,
successfully, thenavoid throwing
it may lead toerror
man
like "User
in the doesattack.
middle not exists". Instead
present user with the generic
message like "username or password
is not correct"

This also calls for the fix in

application behavior when user
interacts with the listed APIs in
Affected path.
Change the default credentials: The
first step is to change the default
credentials to a strong and unique
password. This will prevent attackers
from using the default credentials to
gain access to the system.

Use strong authentication

To mitigate this
mechanisms: vulnerability,
Implement strongit is
recommended that the
authentication mechanisms, such as
website/application implement
multi-factor authentication (MFA)input
or
validation checks at all levels,
including server-side and client-side
validation. Additionally, it is
recommended that the
website/application sanitize all user
Monitoring API activity against your
rate limit.
Apply rate limiting mechanism.
We should make sure the client can
only make a certain amount of
request over a certain period.
We need to verify on the client and
server side that the request body
and response are not too big.
By implementing these headers, you
can significantly reduce the risk of
attacks like XSS, clickjacking, and
other similar attacks.

1. If a web resource contains

sensitive information, the origin
should be properly specified in the
Access-Control-Allow-Origin header.
2. It may seem obvious but origins
specified in the Access-Control-
Allow-Origin header should only be
sites that are trusted. In particular,
[Link] prevent session hijacking
through cookie editor vulnerabilities,
developers should ensure that user
input is properly validated when
setting or modifying cookies. [Link]
should also use secure techniques
for generating session IDs and
implement mechanisms to detect
Use a memory-safe programming
language: Memory-safe
programming languages like Java,
Python, and Rust provide built-in
memory management mechanisms
that make it more difficult for
attackers to exploit memory
Enforce advanced password policy
controls that blacklists passwords
and/or patterns by preventing the
use of common dictionary passwords
on the web application. Also, ensure
that the password policy tracks at
the least the last 5 passwords of the
user so that the user is unable to set
[Link] displaying private object
references such as id.
[Link] validation should be
implemented.
[Link] hash functions and hash
values instead f normal strings.
It's recommended to implement an
account lockout policy/mechanism
which should lock the user account
after a defined number of incorrect
login password attempts.
Vulnerability Name Vulnerability description

When server version and name is visible in

response, Request header or data attacker can find
out vulnerabilities and exploits related to disclosed
Server name disclosure server version
When attempting to create a new account in the
JPetStore web application, an unhandled exception
occurs due to a data integrity violation. Specifically,
the error message indicates that a NOT NULL check
constraint for the EMAIL column in the ACCOUNT
table was violated. This bug prevents users from
successfully creating new accounts on the website.

This bug has a significant impact on the usability and

functionality of the JPetStore web application, as
new users are unable to register and access the
site's features. This can lead to a loss of potential
customers and revenue for the business.

Data Violation

It decreases the impact of a good password policy

by enabling users to reuse their older passwords,
hindering password rotation. A user implemented
weak password is susceptible to a spraying attack
and can even be guessed by an attacker

Reference:
[Link]
joint-alert-warns-of-apt-groups-targeting-
Weak password policiy healthcare-and-essential-services/
 Such types of error can introduce a variety of
security problems for a web [Link] messages
reveal implementation details that should never be
revealed. Such details can provide hackers
important clues on potential flaws in the site.
[Link]
r_Handling

java stack trace

It is observed that by inserting an HTML injection an
attacker can add any malicious link and steal user
information or sensitive [Link] injection can
allow an attacker to modify the page.
To steal another person’s identity.
The attacker discovers injection vulnerability and
decides to use an HTML injection attack.
Attacker crafts malicious links, including his injected
HTML content, and sends it to a user via email.
The user visits the page due to the page being
located within a trusted domain.
The attacker’s injected HTML is rendered and
presented to the user asking for a username and
password.
The user enters a username and password, which
HTML injection are both sent to the attacker’s server if exploited
Cross-site Scripting (XSS) refers to client-side code
successfully.
injection attack wherein an attacker can execute
malicious scripts into a legitimate website or web
application. XSS occurs when a web application
makes use of unvalidated or unencoded user input
within the output it generates.

Reflected cross-site scripting vulnerabilities arise

when data is copied from a request and echoed into
the application's immediate response in an unsafe
way.

Reflected cross site scripting

 The attacker has several ways they can use the
redirected clicks from this attack for their own gain.
A common form of clickjacking involves mirroring a
login and password form on a website. The user
assumes that they are entering their information
into a usual form but they are actually entering it in
fields the attacker has overlaid on the UI. Attackers
can target credentials and any other valuable data
they can exploit. An attacker may also choose to
redirect the clicks to download malware or gain
access to vital systems as a starting point for further
Clickjacking persistent attacks.

Anyone can distribute a fake email content/files

using a company’s email. As a result, a company will
Server security misconfiguration have a reputation loss.

cookie hijacking is the exploitation of a valid

computer session—sometimes also called a session
key—to gain unauthorized access to information or
cookie hijacking services in a computer system.
 Many web applications and hardware devices have
default passwords for the built-in administrative
account. Although in some cases these can be
randomly generated, they are often static, meaning
that they can be easily guessed or obtained by an
[Link] can lead attackerto gain senetive
information and exploit further and if the attacker
the admin privilege he can perform task that should
Default credentials leads to admin account takeover not be performed.

Missing
A lack ofthese
inputheaders canwas
validation lead to variouson
discovered security
the
risks, including:
[Link] which could potentially allow
attackers to exploit various vulnerabilities such as
Cross-site scripting
SQL injection, (XSS)scripting
cross-site attacks: Without
(XSS), andthe X-XSS-
other
Protection header,
security issues. Thisattackers can execute
vulnerability malicious
poses a significant
Lack of input validation scripts
securityinrisk
theto
user's browser,and
the website leading to the theft of
its users.
sensitive information.

Clickjacking: Without the X-Frame-Options header,

attackers can frame your website in a malicious site
and trick users into clicking on buttons or links that
they did not intend to click.

MIME type sniffing: Without the X-Content-Type-

Options header, attackers can exploit MIME sniffing
to execute scripts that the browser would otherwise
block.

Content injection attacks: Without the Content-

Security-Policy header, attackers can inject
malicious content into your website, leading to
Missing security headers unauthorized access and data theft.
Affected URL Steps Mitigation

[Link] for url

"[Link]
actions/[Link]/ftp" on
browser.
[Link] is observed that server name
with version number is disclosed Response headers containing the
Apache Tomcat/9.0.62. server name or version should be
[Link] restricted
To fix this bug, the code for
[Link] to creating new accounts in the
[Link] JPetStore web application must
ctions/[Link],Click on be modified to ensure that all
sign in page and register now. required fields, including the
[Link] information form will EMAIL field, are populated with
appear. valid data before attempting to
[Link] random data or enter insert a new record into the
payloads and click on save ACCOUNT table. Additionally,
information. error handling code should be
[Link] is observed that a 500 error added to catch any potential data
response is generated with some integrity violations and provide
information disclosed. users with clear and informative
error messages if there are any
issues with their account creation
[Link]
process. Finally, thorough testing
Enforce advanced password
policy controls that blacklists
passwords and/or patterns by
preventing the use of common
dictionary passwords on the web
application. Also, ensure that the
password policy tracks at the
[Link] to sign up page least the last 5 passwords of the
[Link] user so that the user is unable to
ctions/[Link]? set passwords similar to their
newAccountForm= older passwords.
[Link] the username and
password.
[Link] is observed that application
is accepts password like
[Link]
"123","a","root".
 [Link] into application
[Link] on Fish
[Link] on any URL which has get
parameters in URL
[Link]
ctions/[Link]?
viewCategory=&categoryId=FISH
[Link] payload Application should be configured
[Link] in such a way that it should
ctions/[Link]? always fail safe whenever an
viewCategory=&categoryId=FISH exception occurs. This could be
{{3*3}} done by configuring the custom
error messages in the event of
[Link]
any exceptions.
[Link] input should be checked
if it contains any script code or
any HTML code. One should
check, if the code contains any
special script or HTML brackets –
<script></script>, <html></html>.
[Link] are many functions for
[Link] into application. checking if the code contains any
[Link] to my account. special brackets. The selection of
[Link] first name enter payload the checking function depends on
<marquee>PETSTORE</marquee the programming language that
>. you use.
[Link] on save information and
go to home
page([Link]
[Link]
om/actions/[Link])

[Link] into application.

[Link] to my account.
[Link] first name enter payload
<script>alert(123)</script>.
[Link] on save information and Do not trust user supplied data.
go to home Do not trust user supplied
page([Link] input/data. Always sanitise them
[Link]
om/actions/[Link]) before processing further.
 </style>
<body>
<button style="z-index:-
1;margin-top:215px;margin-
left:270px;width:50px;">Fun!</
button> It is recommended to use a
<iframe custom http header 'X-FRAME-
src="[Link] OPTIONS' to prevent Clickjacking
om/actions/[Link]" on sensitive pages that instruct
width="800" the browser to not allow framing
height="400"></iframe> from other domains. If content
</body> security policy (CSP) has been
</html> configured, the recommended
clickjacking protection is to
2. It is observed that the login incorporate the 'frame-ancestors'
page of the web application can directive on the application. Or
be accessed within an Iframe on else, include a 'frame-breaker'
opening the HTML page on a script in each page that should
browser, and if the victim user is not be framed. Refer reference
logged in, then the page is link for more details on this
[Link]
loaded. reference link:

[Link] to webpage
'[Link]
[Link]?action=blacklist
%[Link]&run=to
olpage'.
[Link] the domain
([Link]) and select for
DMARC lookup and hit the enter
button. [Link] preventDMARC
Implement sessiontohijacking
prevent
[Link] is observed that there is no through
attackerscookie editor emails
from spoofing
[Link] DMARC record found. vulnerabilities,
from it. developers should
ensure that user input is properly
validated when setting or
modifying cookies. [Link] should
also use secure techniques for
generating session IDs and
1)download a cookie extension implement mechanisms to detect
for chrome called cookie and prevent suspicious behavior,
editor(add to chrome) such as monitoring for multiple
2)login in any site which you concurrent sessions from
want to test different IP addresses.
3)copy the cookie [Link], users should be
4)logout cautious when using public Wi-Fi
5)paste the cookie and reload networks or accessing sensitive
the session information online, as these
6)You are ableto login without environments can increase the
[Link]
getting authorized. risk of session hijacking attacks.
 Change the default credentials:
The first step is to change the
default credentials to a strong
and unique password. This will
prevent attackers from using the
default credentials to gain access
to the system.
1) Login to
[Link] Use strong authentication
ctions/[Link]? mechanisms: Implement strong
signonForm= authentication mechanisms, such
2) Use the following credentials: as multi-factor authentication
admin:admin (MFA) or biometric
3) Click on "Login". You'll notice authentication, to further
that we've successfully logged in enhance the security of the
[Link]
as the admin username. system.

1. Login into application. To mitigate this vulnerability, it is

2. Go to Register page recommended that the
4. A User information form will website/application implement
appear enter payload input validation checks at all
<script>alert(123)</script> in the levels, including server-side and
given parameters. client-side validation.
5. click on save information. Additionally, it is recommended
6. Hence,it is found that no that the website/application
proper input validation is sanitize all user inputs to prevent
[Link]
applied. the execution of malicious code.

[Link] to By implementing these headers,

[Link] you can significantly reduce the
[Link] url risk of attacks like XSS,
[Link] clickjacking, and other similar
ctions/[Link] attacks.
[Link] on scan.