diff --git a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/http.json b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/http.json index 211dd3dbb50..78cd6a65ea7 100644 --- a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/http.json +++ b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/http.json @@ -1 +1 @@ -{"url":"https://world.openfoodfacts.org/","algorithm_version":2,"end_time":"Sun, 07 Jan 2024 23:13:21 GMT","grade":"C","hidden":false,"likelihood_indicator":"MEDIUM","response_headers":{"Connection":"keep-alive","Content-Encoding":"gzip","Content-Type":"text/html; charset=UTF-8","Date":"Sun, 07 Jan 2024 23:13:18 GMT","Expires":"Sat, 06 Jan 2024 23:13:18 GMT","Server":"nginx/1.18.0","Strict-Transport-Security":"max-age=63072000","Transfer-Encoding":"chunked","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff, nosniff","X-Download-Options":"noopen","X-Request-ID":"rzSYRHc8cOSuxCJG","X-XSS-Protection":"1; mode=block"},"scan_id":46239840,"score":50,"start_time":"Sun, 07 Jan 2024 23:08:33 GMT","state":"FINISHED","status_code":200,"tests_failed":3,"tests_passed":9,"tests_quantity":12,"details":{"content-security-policy":{"expectation":"csp-implemented-with-no-unsafe","name":"content-security-policy","output":{"data":null,"http":false,"meta":false,"numPolicies":0,"policy":null},"pass":false,"result":"csp-not-implemented","score_description":"Content Security Policy (CSP) header not implemented","score_modifier":-25},"contribute":{"expectation":"contribute-json-only-required-on-mozilla-properties","name":"contribute","output":{"data":null},"pass":true,"result":"contribute-json-only-required-on-mozilla-properties","score_description":"Contribute.json isn't required on websites that don't belong to Mozilla","score_modifier":0},"cookies":{"expectation":"cookies-secure-with-httponly-sessions","name":"cookies","output":{"data":null,"sameSite":null},"pass":true,"result":"cookies-not-found","score_description":"No cookies detected","score_modifier":0},"cross-origin-resource-sharing":{"expectation":"cross-origin-resource-sharing-not-implemented","name":"cross-origin-resource-sharing","output":{"data":{"acao":null,"clientaccesspolicy":null,"crossdomain":null}},"pass":true,"result":"cross-origin-resource-sharing-not-implemented","score_description":"Content is not visible via cross-origin resource sharing (CORS) files or headers","score_modifier":0},"public-key-pinning":{"expectation":"hpkp-not-implemented","name":"public-key-pinning","output":{"data":null,"includeSubDomains":false,"max-age":null,"numPins":null,"preloaded":false},"pass":true,"result":"hpkp-not-implemented","score_description":"HTTP Public Key Pinning (HPKP) header not implemented","score_modifier":0},"redirection":{"expectation":"redirection-to-https","name":"redirection","output":{"destination":"https://world.openfoodfacts.org/","redirects":true,"route":["http://world.openfoodfacts.org/","https://world.openfoodfacts.org/"],"status_code":200},"pass":true,"result":"redirection-to-https","score_description":"Initial redirection is to HTTPS on same host, final destination is HTTPS","score_modifier":0},"referrer-policy":{"expectation":"referrer-policy-private","name":"referrer-policy","output":{"data":null,"http":false,"meta":false},"pass":true,"result":"referrer-policy-not-implemented","score_description":"Referrer-Policy header not implemented","score_modifier":0},"strict-transport-security":{"expectation":"hsts-implemented-max-age-at-least-six-months","name":"strict-transport-security","output":{"data":"max-age=63072000","includeSubDomains":false,"max-age":63072000,"preload":false,"preloaded":false},"pass":true,"result":"hsts-implemented-max-age-at-least-six-months","score_description":"HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)","score_modifier":0},"subresource-integrity":{"expectation":"sri-implemented-and-external-scripts-loaded-securely","name":"subresource-integrity","output":{"data":{}},"pass":true,"result":"sri-not-implemented-but-all-scripts-loaded-from-secure-origin","score_description":"Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin","score_modifier":0},"x-content-type-options":{"expectation":"x-content-type-options-nosniff","name":"x-content-type-options","output":{"data":"nosniff, nosniff"},"pass":false,"result":"x-content-type-options-header-invalid","score_description":"X-Content-Type-Options header cannot be recognized","score_modifier":-5},"x-frame-options":{"expectation":"x-frame-options-sameorigin-or-deny","name":"x-frame-options","output":{"data":null},"pass":false,"result":"x-frame-options-not-implemented","score_description":"X-Frame-Options (XFO) header not implemented","score_modifier":-20},"x-xss-protection":{"expectation":"x-xss-protection-1-mode-block","name":"x-xss-protection","output":{"data":"1; mode=block"},"pass":true,"result":"x-xss-protection-enabled-mode-block","score_description":"X-XSS-Protection header set to \"1; mode=block\"","score_modifier":0}}} \ No newline at end of file +{"url":"https://world.openfoodfacts.org/","algorithm_version":2,"end_time":"Sun, 14 Jan 2024 22:34:34 GMT","grade":"C","hidden":false,"likelihood_indicator":"MEDIUM","response_headers":{"Connection":"keep-alive","Content-Encoding":"gzip","Content-Type":"text/html; charset=UTF-8","Date":"Sun, 14 Jan 2024 22:34:31 GMT","Expires":"Sat, 13 Jan 2024 22:34:31 GMT","Server":"nginx/1.18.0","Strict-Transport-Security":"max-age=63072000","Transfer-Encoding":"chunked","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff, nosniff","X-Download-Options":"noopen","X-Request-ID":"qPXiYKCE6F33XMk2","X-XSS-Protection":"1; mode=block"},"scan_id":46515606,"score":50,"start_time":"Sun, 14 Jan 2024 22:34:26 GMT","state":"FINISHED","status_code":200,"tests_failed":3,"tests_passed":9,"tests_quantity":12,"details":{"content-security-policy":{"expectation":"csp-implemented-with-no-unsafe","name":"content-security-policy","output":{"data":null,"http":false,"meta":false,"numPolicies":0,"policy":null},"pass":false,"result":"csp-not-implemented","score_description":"Content Security Policy (CSP) header not implemented","score_modifier":-25},"contribute":{"expectation":"contribute-json-only-required-on-mozilla-properties","name":"contribute","output":{"data":null},"pass":true,"result":"contribute-json-only-required-on-mozilla-properties","score_description":"Contribute.json isn't required on websites that don't belong to Mozilla","score_modifier":0},"cookies":{"expectation":"cookies-secure-with-httponly-sessions","name":"cookies","output":{"data":null,"sameSite":null},"pass":true,"result":"cookies-not-found","score_description":"No cookies detected","score_modifier":0},"cross-origin-resource-sharing":{"expectation":"cross-origin-resource-sharing-not-implemented","name":"cross-origin-resource-sharing","output":{"data":{"acao":null,"clientaccesspolicy":null,"crossdomain":null}},"pass":true,"result":"cross-origin-resource-sharing-not-implemented","score_description":"Content is not visible via cross-origin resource sharing (CORS) files or headers","score_modifier":0},"public-key-pinning":{"expectation":"hpkp-not-implemented","name":"public-key-pinning","output":{"data":null,"includeSubDomains":false,"max-age":null,"numPins":null,"preloaded":false},"pass":true,"result":"hpkp-not-implemented","score_description":"HTTP Public Key Pinning (HPKP) header not implemented","score_modifier":0},"redirection":{"expectation":"redirection-to-https","name":"redirection","output":{"destination":"https://world.openfoodfacts.org/","redirects":true,"route":["http://world.openfoodfacts.org/","https://world.openfoodfacts.org/"],"status_code":200},"pass":true,"result":"redirection-to-https","score_description":"Initial redirection is to HTTPS on same host, final destination is HTTPS","score_modifier":0},"referrer-policy":{"expectation":"referrer-policy-private","name":"referrer-policy","output":{"data":null,"http":false,"meta":false},"pass":true,"result":"referrer-policy-not-implemented","score_description":"Referrer-Policy header not implemented","score_modifier":0},"strict-transport-security":{"expectation":"hsts-implemented-max-age-at-least-six-months","name":"strict-transport-security","output":{"data":"max-age=63072000","includeSubDomains":false,"max-age":63072000,"preload":false,"preloaded":false},"pass":true,"result":"hsts-implemented-max-age-at-least-six-months","score_description":"HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)","score_modifier":0},"subresource-integrity":{"expectation":"sri-implemented-and-external-scripts-loaded-securely","name":"subresource-integrity","output":{"data":{}},"pass":true,"result":"sri-not-implemented-but-all-scripts-loaded-from-secure-origin","score_description":"Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin","score_modifier":0},"x-content-type-options":{"expectation":"x-content-type-options-nosniff","name":"x-content-type-options","output":{"data":"nosniff, nosniff"},"pass":false,"result":"x-content-type-options-header-invalid","score_description":"X-Content-Type-Options header cannot be recognized","score_modifier":-5},"x-frame-options":{"expectation":"x-frame-options-sameorigin-or-deny","name":"x-frame-options","output":{"data":null},"pass":false,"result":"x-frame-options-not-implemented","score_description":"X-Frame-Options (XFO) header not implemented","score_modifier":-20},"x-xss-protection":{"expectation":"x-xss-protection-1-mode-block","name":"x-xss-protection","output":{"data":"1; mode=block"},"pass":true,"result":"x-xss-protection-enabled-mode-block","score_description":"X-XSS-Protection header set to \"1; mode=block\"","score_modifier":0}}} \ No newline at end of file diff --git a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/lhr-aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=.html b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/lhr-aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=.html index 4532b2cafc7..ef323e15383 100644 --- a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/lhr-aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=.html +++ b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/lhr-aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=.html @@ -28,7 +28,7 @@
- + cpe:/a:igor_sysoev:nginx:1.18.0 -cpe:/a:igor_sysoev:nginx:1.18.0 - + - + diff --git a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/screenshot.jpeg b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/screenshot.jpeg index a9a65fd3725..37cf7f80053 100644 Binary files a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/screenshot.jpeg and b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/screenshot.jpeg differ diff --git a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.csv b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.csv index 276676215fc..d74c7ec12ee 100644 --- a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.csv +++ b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.csv @@ -52,7 +52,7 @@ "cert_trust_wildcard","world.openfoodfacts.org/213.36.253.214","443","LOW","trust is via wildcard","","" "cert_chain_of_trust","world.openfoodfacts.org/213.36.253.214","443","OK","passed.","","" "cert_certificatePolicies_EV","world.openfoodfacts.org/213.36.253.214","443","INFO","no","","" -"cert_expirationStatus","world.openfoodfacts.org/213.36.253.214","443","OK","82 >= 30 days","","" +"cert_expirationStatus","world.openfoodfacts.org/213.36.253.214","443","OK","75 >= 30 days","","" "cert_notBefore","world.openfoodfacts.org/213.36.253.214","443","INFO","2023-12-31 05:51","","" "cert_notAfter","world.openfoodfacts.org/213.36.253.214","443","OK","2024-03-30 05:51","","" "cert_extlifeSpan","world.openfoodfacts.org/213.36.253.214","443","OK","certificate has no extended life time according to browser forum","","" @@ -81,8 +81,8 @@ "intermediate_cert_chain <#2>","world.openfoodfacts.org/213.36.253.214","443","INFO","ISRG Root X1 <-- DST Root CA X3","","" "intermediate_cert_badOCSP","world.openfoodfacts.org/213.36.253.214","443","OK","intermediate certificate(s) is/are ok","","" "HTTP_status_code","world.openfoodfacts.org/213.36.253.214","443","INFO","200 OK ('/')","","" -"HTTP_clock_skew","world.openfoodfacts.org/213.36.253.214","443","INFO","0 seconds from localtime","","" -"HTTP_headerTime","world.openfoodfacts.org/213.36.253.214","443","INFO","1704669286","","" +"HTTP_clock_skew","world.openfoodfacts.org/213.36.253.214","443","INFO","-1 seconds from localtime","","" +"HTTP_headerTime","world.openfoodfacts.org/213.36.253.214","443","INFO","1705271757","","" "HSTS_time","world.openfoodfacts.org/213.36.253.214","443","OK","730 days (=63072000 seconds) > 15552000 seconds","","" "HSTS_subdomains","world.openfoodfacts.org/213.36.253.214","443","INFO","only for this domain","","" "HSTS_preload","world.openfoodfacts.org/213.36.253.214","443","INFO","domain is NOT marked for preloading","","" diff --git a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.html b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.html index 84f3274c963..822cdc169d7 100644 --- a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.html +++ b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.html @@ -21,11 +21,11 @@ ########################################################### Using "OpenSSL 1.0.2-bad (1.0.2k-dev)" [~183 ciphers] - on fv-az740-245:/home/testssl/bin/openssl.Linux.x86_64 + on fv-az777-93:/home/testssl/bin/openssl.Linux.x86_64 (built: "Sep 1 14:03:44 2022", platform: "linux-x86_64") - Start 2024-01-07 23:14:13 -->> 213.36.253.214:443 (world.openfoodfacts.org) <<-- + Start 2024-01-14 22:35:24 -->> 213.36.253.214:443 (world.openfoodfacts.org) <<-- rDNS (213.36.253.214): off2-2.free.org. Service detected: HTTP @@ -107,7 +107,7 @@ https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=DAE1F9CFC61A8A5FE51604CE2BB609019156E7B5DE672CCFA6973BFCDA29DF9D Chain of trust Ok EV cert (experimental) no - Certificate Validity (UTC) 82 >= 30 days (2023-12-31 05:51 --> 2024-03-30 05:51) + Certificate Validity (UTC) 75 >= 30 days (2023-12-31 05:51 --> 2024-03-30 05:51) ETS/"eTLS", visibility info not present Certificate Revocation List -- OCSP URI http://r3.o.lencr.org @@ -125,7 +125,7 @@ Testing HTTP header response @ "/" HTTP Status Code 200 OK - HTTP clock skew 0 sec from localtime + HTTP clock skew -1 sec from localtime Strict Transport Security 730 days=63072000 s, just this domain Public Key Pinning -- Server banner nginx/1.18.0 @@ -216,7 +216,7 @@ Grade cap reasons Grade capped to B. TLS 1.1 offered Grade capped to B. TLS 1.0 offered - Done 2024-01-07 23:15:44 [ 93s] -->> 213.36.253.214:443 (world.openfoodfacts.org) <<-- + Done 2024-01-14 22:36:55 [ 93s] -->> 213.36.253.214:443 (world.openfoodfacts.org) <<-- diff --git a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.json b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.json index 05a67ce3f6f..f5aaee67d47 100644 --- a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.json +++ b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/testssl.json @@ -381,7 +381,7 @@ "ip" : "world.openfoodfacts.org/213.36.253.214", "port" : "443", "severity" : "OK", - "finding" : "82 >= 30 days" + "finding" : "75 >= 30 days" } , { "id" : "cert_notBefore", @@ -584,14 +584,14 @@ "ip" : "world.openfoodfacts.org/213.36.253.214", "port" : "443", "severity" : "INFO", - "finding" : "0 seconds from localtime" + "finding" : "-1 seconds from localtime" } , { "id" : "HTTP_headerTime", "ip" : "world.openfoodfacts.org/213.36.253.214", "port" : "443", "severity" : "INFO", - "finding" : "1704669286" + "finding" : "1705271757" } , { "id" : "HSTS_time", diff --git a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/thirdparties.json b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/thirdparties.json index 2704ba9d895..5b635ffe3f5 100644 --- a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/thirdparties.json +++ b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/thirdparties.json @@ -4,14 +4,14 @@ "headers": { "content-encoding": "gzip", "content-type": "text/html; charset=UTF-8", - "date": "Sun, 07 Jan 2024 23:13:52 GMT", - "expires": "Sat, 06 Jan 2024 23:13:52 GMT", + "date": "Sun, 14 Jan 2024 22:35:02 GMT", + "expires": "Sat, 13 Jan 2024 22:35:02 GMT", "server": "nginx/1.18.0", "strict-transport-security": "max-age=63072000", "vary": "Accept-Encoding", "x-content-type-options": "nosniff\nnosniff", "x-download-options": "noopen", - "x-request-id": "JuTIfqAVB3kjKjVP", + "x-request-id": "kpNU14OBJLA8HiDK", "x-xss-protection": "1; mode=block" }, "endpoints": [ diff --git a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/zap.html b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/zap.html index 8b28ba397f7..fafb70fa9c9 100644 --- a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/zap.html +++ b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/zap.html @@ -127,7 +127,7 @@

- Generated on Sun, 7 Jan 2024 23:07:35 + Generated on Sun, 14 Jan 2024 22:33:18

@@ -220,7 +220,7 @@

Alerts

Missing Anti-clickjacking Header Medium - 9 + 8 Sub Resource Integrity Attribute Missing @@ -240,7 +240,7 @@

Alerts

Server Leaks Version Information via "Server" HTTP Response Header Field Low - 12 + 11 Strict-Transport-Security Header Not Set @@ -270,7 +270,7 @@

Alerts

Re-examine Cache-control Directives Informational - 11 + 10 Sec-Fetch-Dest Header is Missing @@ -1642,40 +1642,9 @@

Alert Detail

- - URL - https://world.openfoodfacts.org/data-quality-errors - - - Method - GET - - - Parameter - x-frame-options - - - Attack - - - - Evidence - - - - Other Info - - - Instances - 9 + 8 Solution @@ -1752,7 +1721,7 @@

Alert Detail

Evidence - <link rel="stylesheet" href="https://static.openfoodfacts.org/css/dist/app-ltr.css?v=1701784048" data-base-layout="true"> + <link rel="stylesheet" href="https://static.openfoodfacts.org/css/dist/app-ltr.css?v=1703015744" data-base-layout="true"> Alert Detail - - URL - https://world.openfoodfacts.org/additives - - - Method - GET - - - Parameter - - - - Attack - - - - Evidence - nginx/1.18.0 - - - Other Info - - - URL @@ -3635,7 +3573,7 @@

Alert Detail

Instances - 12 + 11 Solution @@ -4155,12 +4093,12 @@

Alert Detail

Evidence - 1701784048 + 1703015744 Other Info - 1701784048, which evaluates to: 2023-12-05 13:47:28 + 1703015744, which evaluates to: 2023-12-19 19:55:44 @@ -4186,12 +4124,12 @@

Alert Detail

Evidence - 1701784048 + 1703015744 Other Info - 1701784048, which evaluates to: 2023-12-05 13:47:28 + 1703015744, which evaluates to: 2023-12-19 19:55:44 @@ -4217,12 +4155,12 @@

Alert Detail

Evidence - 1701784048 + 1703015744 Other Info - 1701784048, which evaluates to: 2023-12-05 13:47:28 + 1703015744, which evaluates to: 2023-12-19 19:55:44 @@ -4248,12 +4186,12 @@

Alert Detail

Evidence - 1701784048 + 1703015744 Other Info - 1701784048, which evaluates to: 2023-12-05 13:47:28 + 1703015744, which evaluates to: 2023-12-19 19:55:44 @@ -4279,12 +4217,12 @@

Alert Detail

Evidence - 1701784048 + 1703015744 Other Info - 1701784048, which evaluates to: 2023-12-05 13:47:28 + 1703015744, which evaluates to: 2023-12-19 19:55:44 @@ -4310,12 +4248,12 @@

Alert Detail

Evidence - 1701784048 + 1703015744 Other Info - 1701784048, which evaluates to: 2023-12-05 13:47:28 + 1703015744, which evaluates to: 2023-12-19 19:55:44 @@ -4341,12 +4279,12 @@

Alert Detail

Evidence - 1701784048 + 1703015744 Other Info - 1701784048, which evaluates to: 2023-12-05 13:47:28 + 1703015744, which evaluates to: 2023-12-19 19:55:44 @@ -4372,12 +4310,12 @@

Alert Detail

Evidence - 1701784048 + 1703015744 Other Info - 1701784048, which evaluates to: 2023-12-05 13:47:28 + 1703015744, which evaluates to: 2023-12-19 19:55:44 @@ -4403,12 +4341,12 @@

Alert Detail

Evidence - 1701784048 + 1703015744 Other Info - 1701784048, which evaluates to: 2023-12-05 13:47:28 + 1703015744, which evaluates to: 2023-12-19 19:55:44 @@ -4434,12 +4372,12 @@

Alert Detail

Evidence - 1701784048 + 1703015744 Other Info - 1701784048, which evaluates to: 2023-12-05 13:47:28 + 1703015744, which evaluates to: 2023-12-19 19:55:44 @@ -4465,12 +4403,12 @@

Alert Detail

Evidence - 1701784048 + 1703015744 Other Info - 1701784048, which evaluates to: 2023-12-05 13:47:28 + 1703015744, which evaluates to: 2023-12-19 19:55:44 @@ -4746,7 +4684,7 @@

Alert Detail

URL - https://world.openfoodfacts.org/categories + https://world.openfoodfacts.org/cgi/product_image.pl Alert Detail URL - https://world.openfoodfacts.org/cgi/product_image.pl + https://world.openfoodfacts.org/checker Alert Detail - - URL - https://world.openfoodfacts.org/data-quality-errors - - - Method - GET - - - Parameter - cache-control - - - Attack - - - - Evidence - - - - Other Info - - - URL @@ -6104,7 +6011,7 @@

Alert Detail

Instances - 11 + 10 Solution diff --git a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/zap.json b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/zap.json index 067d1c2faef..c39524ec3cb 100644 --- a/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/zap.json +++ b/results/aHR0cHM6Ly93b3JsZC5vcGVuZm9vZGZhY3RzLm9yZy8=/zap.json @@ -1,7 +1,7 @@ { "@programName": "ZAP", "@version": "2.14.0", - "@generated": "Sun, 7 Jan 2024 23:07:35", + "@generated": "Sun, 14 Jan 2024 22:33:19", "site":[ { "@name": "https://world.openfoodfacts.org", @@ -283,7 +283,7 @@ "reference": "

https://vulncat.fortify.com/en/detail?id=desc.config.dotnet.html5_overly_permissive_cors_policy

", "cweid": "264", "wascid": "14", - "sourceid": "180" + "sourceid": "183" }, { "pluginid": "10020", @@ -358,17 +358,9 @@ "attack": "", "evidence": "", "otherinfo": "" - }, - { - "uri": "https://world.openfoodfacts.org/data-quality-errors", - "method": "GET", - "param": "x-frame-options", - "attack": "", - "evidence": "", - "otherinfo": "" } ], - "count": "9", + "count": "8", "solution": "

Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app.

If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's \"frame-ancestors\" directive.

", "otherinfo": "", "reference": "

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

", @@ -391,7 +383,7 @@ "method": "GET", "param": "", "attack": "", - "evidence": "", + "evidence": "", "otherinfo": "" }, { @@ -497,7 +489,7 @@ "reference": "

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

", "cweid": "345", "wascid": "15", - "sourceid": "52" + "sourceid": "44" }, { "pluginid": "10017", @@ -803,14 +795,6 @@ "evidence": "nginx/1.18.0", "otherinfo": "" }, - { - "uri": "https://world.openfoodfacts.org/additives", - "method": "GET", - "param": "", - "attack": "", - "evidence": "nginx/1.18.0", - "otherinfo": "" - }, { "uri": "https://world.openfoodfacts.org/allergen", "method": "GET", @@ -892,7 +876,7 @@ "otherinfo": "" } ], - "count": "12", + "count": "11", "solution": "

Ensure that your web server, application server, load balancer, etc. is configured to suppress the \"Server\" header or provide generic details.

", "otherinfo": "", "reference": "

http://httpd.apache.org/docs/current/mod/core.html#servertokens

http://msdn.microsoft.com/en-us/library/ff648552.aspx#ht_urlscan_007

http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx

http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html

", @@ -1030,93 +1014,93 @@ "method": "GET", "param": "", "attack": "", - "evidence": "1701784048", - "otherinfo": "1701784048, which evaluates to: 2023-12-05 13:47:28" + "evidence": "1703015744", + "otherinfo": "1703015744, which evaluates to: 2023-12-19 19:55:44" }, { "uri": "https://world.openfoodfacts.org/additives", "method": "GET", "param": "", "attack": "", - "evidence": "1701784048", - "otherinfo": "1701784048, which evaluates to: 2023-12-05 13:47:28" + "evidence": "1703015744", + "otherinfo": "1703015744, which evaluates to: 2023-12-19 19:55:44" }, { "uri": "https://world.openfoodfacts.org/allergen", "method": "GET", "param": "", "attack": "", - "evidence": "1701784048", - "otherinfo": "1701784048, which evaluates to: 2023-12-05 13:47:28" + "evidence": "1703015744", + "otherinfo": "1703015744, which evaluates to: 2023-12-19 19:55:44" }, { "uri": "https://world.openfoodfacts.org/allergens", "method": "GET", "param": "", "attack": "", - "evidence": "1701784048", - "otherinfo": "1701784048, which evaluates to: 2023-12-05 13:47:28" + "evidence": "1703015744", + "otherinfo": "1703015744, which evaluates to: 2023-12-19 19:55:44" }, { "uri": "https://world.openfoodfacts.org/amino-acid", "method": "GET", "param": "", "attack": "", - "evidence": "1701784048", - "otherinfo": "1701784048, which evaluates to: 2023-12-05 13:47:28" + "evidence": "1703015744", + "otherinfo": "1703015744, which evaluates to: 2023-12-19 19:55:44" }, { "uri": "https://world.openfoodfacts.org/amino-acids", "method": "GET", "param": "", "attack": "", - "evidence": "1701784048", - "otherinfo": "1701784048, which evaluates to: 2023-12-05 13:47:28" + "evidence": "1703015744", + "otherinfo": "1703015744, which evaluates to: 2023-12-19 19:55:44" }, { "uri": "https://world.openfoodfacts.org/brands", "method": "GET", "param": "", "attack": "", - "evidence": "1701784048", - "otherinfo": "1701784048, which evaluates to: 2023-12-05 13:47:28" + "evidence": "1703015744", + "otherinfo": "1703015744, which evaluates to: 2023-12-19 19:55:44" }, { "uri": "https://world.openfoodfacts.org/categories", "method": "GET", "param": "", "attack": "", - "evidence": "1701784048", - "otherinfo": "1701784048, which evaluates to: 2023-12-05 13:47:28" + "evidence": "1703015744", + "otherinfo": "1703015744, which evaluates to: 2023-12-19 19:55:44" }, { "uri": "https://world.openfoodfacts.org/cgi/product_image.pl", "method": "GET", "param": "", "attack": "", - "evidence": "1701784048", - "otherinfo": "1701784048, which evaluates to: 2023-12-05 13:47:28" + "evidence": "1703015744", + "otherinfo": "1703015744, which evaluates to: 2023-12-19 19:55:44" }, { "uri": "https://world.openfoodfacts.org/code", "method": "GET", "param": "", "attack": "", - "evidence": "1701784048", - "otherinfo": "1701784048, which evaluates to: 2023-12-05 13:47:28" + "evidence": "1703015744", + "otherinfo": "1703015744, which evaluates to: 2023-12-19 19:55:44" }, { "uri": "https://world.openfoodfacts.org/sitemap.xml", "method": "GET", "param": "", "attack": "", - "evidence": "1701784048", - "otherinfo": "1701784048, which evaluates to: 2023-12-05 13:47:28" + "evidence": "1703015744", + "otherinfo": "1703015744, which evaluates to: 2023-12-19 19:55:44" } ], "count": "11", "solution": "

Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.

", - "otherinfo": "

1701784048, which evaluates to: 2023-12-05 13:47:28

", + "otherinfo": "

1703015744, which evaluates to: 2023-12-19 19:55:44

", "reference": "

http://projects.webappsec.org/w/page/13246936/Information%20Leakage

", "cweid": "200", "wascid": "13", @@ -1189,7 +1173,7 @@ "otherinfo": "\uFFFDx~\uFFFD\uFFFD\uFFFD\uFFFDk\uFFFD\uFFFD~o\uFFFDhzW\uFFFDv\uFFFD\uFFFDz\uFFFDl" }, { - "uri": "https://world.openfoodfacts.org/categories", + "uri": "https://world.openfoodfacts.org/cgi/product_image.pl", "method": "GET", "param": "", "attack": "", @@ -1197,7 +1181,7 @@ "otherinfo": "\uFFFDx~\uFFFD\uFFFD\uFFFD\uFFFDk\uFFFD\uFFFD~o\uFFFDhzW\uFFFDv\uFFFD\uFFFDz\uFFFDl" }, { - "uri": "https://world.openfoodfacts.org/cgi/product_image.pl", + "uri": "https://world.openfoodfacts.org/checker", "method": "GET", "param": "", "attack": "", @@ -1517,14 +1501,6 @@ "evidence": "", "otherinfo": "" }, - { - "uri": "https://world.openfoodfacts.org/data-quality-errors", - "method": "GET", - "param": "cache-control", - "attack": "", - "evidence": "", - "otherinfo": "" - }, { "uri": "https://world.openfoodfacts.org/robots.txt", "method": "GET", @@ -1534,7 +1510,7 @@ "otherinfo": "" } ], - "count": "11", + "count": "10", "solution": "

For secure content, ensure the cache-control HTTP header is set with \"no-cache, no-store, must-revalidate\". If an asset should be cached consider setting the directives \"public, max-age, immutable\".

", "otherinfo": "", "reference": "

https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control

https://grayduck.mn/2021/09/13/cache-control-recommendations/

",