Home/Alerts/Alert detail/

Viewstate without MAC Signature (Unsure)

Risk:
High

Type:
Passive

CWE:
CWE-642

Summary: This website uses ASP.NET’s Viewstate but maybe without any MAC.

Solution: Ensure the MAC is set for all pages on this website.

References: https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff649308(v=pandp.10)

Top Security News

Ivanti Flaw CVE-2025-0282 Actively Exploited, Impacts Connect Secure and Policy Secure

Microsoft: macOS bug lets hackers install malicious kernel drivers

CISA Adds Second BeyondTrust Flaw to KEV Catalog Amid Active Attacks

Russian APT Phishes Kazakh Gov't for Strategic Intel

Biden's Cybersecurity EO Leaves Trump a Comprehensive Blueprint for Defense

Has the TikTok Ban Already Backfired on US Cybersecurity?

Risk, Reputational Scores Enjoy Mixed Success as Security Tools

European Privacy Group Sues TikTok and AliExpress for Illicit Data Transfers to China

Common Alerts

MediumJWT Scan Rule

InformationalModern Web Application

InformationalCookie Poisoning

HighHttpoxy - Proxy Header Misuse

HighExpression Language Injection

InformationalGraphQL Endpoint Supports Introspection

LowPermissions Policy Header Not Set

MediumX-Frame-Options Defined via META (Non-compliant with Spec)

MediumContent Security Policy (CSP) Header Not Set

HighRemote File Inclusion

Top CVE List

CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

CVE-2024-50603 Aviatrix Controllers OS Command Injection Vulnerability

CVE-2024-55591 Fortinet FortiOS Authorization Bypass Vulnerability

CVE-2023-48365 Qlik Sense HTTP Tunneling Vulnerability

CVE-2025-21333 Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

CVE-2025-21335 Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

CVE-2020-0618 Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

CVE-2024-12686 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability

CVE-2025-21334 Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

CVE-2021-33045 Dahua IP Camera Authentication Bypass Vulnerability

Common CWEs

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

LowCWE-462 Duplicate Key in Associative List (Alist)

CWE-145 Improper Neutralization of Section Delimiters

CWE-589 Call to Non-ubiquitous API

CWE-132 DEPRECATED: Miscalculated Null Termination

CWE-423 DEPRECATED: Proxied Trusted Channel

CWE-539 Use of Persistent Cookies Containing Sensitive Information

CWE-260 Password in Configuration File

HighCWE-242 Use of Inherently Dangerous Function

CWE-1297 Unprotected Confidential Information on Device is Accessible by OSAT Vendors

Free online web security scanner

Don't show website scan report rating on the leaderboard