Viewstate without MAC Signature (Sure)

Home/Alerts/Alert detail/

Risk:
High

Type:
Passive

CWE:
CWE-642

Summary: This website uses ASP.NET’s Viewstate but without any MAC.

Solution: Ensure the MAC is set for all pages on this website.

References: https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff649308(v=pandp.10)

Latest Security News

Anna Jaques Hospital ransomware breach exposed data of 300K patients

Ultralytics AI Library Compromised: Cryptocurrency Miner Found in PyPI Versions

Hackers Using Fake Video Conferencing Apps to Steal Web3 Professionals' Data

Romania Cancels Presidential Election Results After Alleged Russian Meddling on TikTok

Microsoft expands Recall preview to Intel and AMD Copilot+ PCs

Ultralytics AI model hijacked to infect thousands with cryptominer

Blue Yonder SaaS giant breached by Termite ransomware gang

New Windows zero-day exposes NTLM credentials, gets unofficial patch

Common Alerts

HighExternal Redirect

HighCross-Domain Misconfiguration - Silverlight

InformationalInformation Disclosure - Suspicious Comments

LowStrict-Transport-Security Disabled

InformationalInformation Disclosure - Sensitive Information in HTTP Referrer Header

MediumDirectory Browsing

InformationalGraphQL Server Implementation Identified

MediumCSP: script-src unsafe-inline

LowCookie No HttpOnly Flag

HighServer Side Template Injection (Blind)

Latest CVE List

CVE-2024-51378 CyberPanel Incorrect Default Permissions Vulnerability

CVE-2023-45727 North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability

CVE-2024-11680 ProjectSend Improper Authentication Vulnerability

CVE-2024-11667 Zyxel Multiple Firewalls Path Traversal Vulnerability

CVE-2023-28461 Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

CVE-2024-44308 Apple Multiple Products Code Execution Vulnerability

CVE-2024-44309 Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

CVE-2024-21287 Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability

CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

CVE-2024-38813 VMware vCenter Server Privilege Escalation Vulnerability

Top CWE List

HighCWE-863 Incorrect Authorization

CWE-1395 Dependency on Vulnerable Third-Party Component

CWE-15 External Control of System or Configuration Setting

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

HighCWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic

CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CWE-1426 Improper Validation of Generative AI Output

MediumCWE-190 Integer Overflow or Wraparound

CWE-236 Improper Handling of Undefined Parameters

Free security scan for your website

Don't show website scan report rating on the leaderboard