Information Disclosure - Suspicious Comments in XML via WebSocket

Home/Alerts/Alert detail/

Risk:
Informational

Type:
WebSocket Passive

CWE:
CWE-200

Summary: The response appears to contain suspicious comments which may help an attacker.

Solution: Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.

Top Security News

PoC exploit for critical WhatsUp Gold RCE vulnerability released (CVE-2024-8785)

Microsoft 365 outage impacts Exchange Online, Teams, Sharepoint

APT-K-47 Uses Hajj-Themed Lures to Deliver Advanced Asyncshell Malware

Phishing-as-a-Service "Rockstar 2FA" Targets Microsoft 365 Users with AiTM Attacks

INTERPOL Arrests 5,500 in Global Cybercrime Crackdown, Seizes Over $400 Million

Google Chrome’s AI feature lets you quickly check website trustworthiness

Veeam plugs serious holes in Service Provider Console (CVE-2024-42448, CVE-2024-42449)

Microsoft fixes RCE vulnerabilities in MSMQ, Outlook (CVE-2024-30080, CVE-2024-30103)

Top Alert List

MediumDirectory Browsing

MediumAbsence of Anti-CSRF Tokens

LowStrict-Transport-Security Multiple Header Entries (Non-compliant with Spec)

Content Security Policy (CSP) Header Not Set

InformationalModern Web Application

LowServer Leaks Information via "X-Powered-By" HTTP Response Header Field(s)

CSP

InformationalNon-Storable Content

LowCookie without SameSite Attribute

HighNoSQL Injection - MongoDB (Time Based)

Latest CVE List

CVE-2024-51378 CyberPanel Incorrect Default Permissions Vulnerability

CVE-2023-45727 North Grid Proself Improper Restriction of XML External Entity (XEE) Reference Vulnerability

CVE-2024-11680 ProjectSend Improper Authentication Vulnerability

CVE-2024-11667 Zyxel Multiple Firewalls Path Traversal Vulnerability

CVE-2023-28461 Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

CVE-2024-44308 Apple Multiple Products Code Execution Vulnerability

CVE-2024-44309 Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

CVE-2024-21287 Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability

CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

CVE-2024-38813 VMware vCenter Server Privilege Escalation Vulnerability

Top CWE List

CWE-15 External Control of System or Configuration Setting

HighCWE-863 Incorrect Authorization

HighCWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic

CWE-1395 Dependency on Vulnerable Third-Party Component

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CWE-1426 Improper Validation of Generative AI Output

MediumCWE-190 Integer Overflow or Wraparound

CWE-236 Improper Handling of Undefined Parameters

Free security scan for your website

Don't show website scan report rating on the leaderboard