You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<p>Any alert that involves a specific CVE will (generally) also have a tag for that specific CVE identifier with a value that links to Mitre’s National Vulnerability Database (NVD).</p>
<p>The SYSTEMIC tag is used to flag alerts that are often “Site wide”. These include most rules related to headers. From ZAP 2.17.0 only a limited number of systemic alerts will be included in the Desktop UI and reports by default.</p>
<p>The add-on also provides a set of Alert Tags which associate various rule types or focus areas to scan policies, see the <ahref="/docs/desktop/addons/scan-policies/">Scan
<p>PII is information like credit card number, SSN etc. This check currently reports only numbers which match credit card numbers and pass Luhn checksum, which gives high confidence, that this is a credit card number.<br>
2099
-
At MEDIUM and HIGH threshold it attempts to use three characters of context on each side of potential matches to exclude matches within decimal like content. At LOW threshold, alerts will be raised for such matches.</p>
2099
+
At MEDIUM and HIGH threshold it attempts to use three characters of context on each side of potential matches to exclude matches within decimal like content or content which includes underscores. At LOW threshold, alerts will be raised for such matches.</p>
2100
2100
<p>At MEDIUM and HIGH threshold, the following content types are evaluated:</p>
2101
2101
<ul>
2102
-
<li>HTML</li>
2102
+
<li>HTML (visible text and script blocks)</li>
2103
2103
<li>JSON</li>
2104
2104
<li>XML</li>
2105
2105
</ul>
2106
-
<p>Image and CSS files are always ignored. Every other content type is evaluated at LOW threshold.</p>
2106
+
<p>Image and CSS files are always ignored. Every other content type is evaluated at LOW threshold. Additionally at LOW threshold the entire HTML response is evaluated.</p>
2107
2107
<p>Note: In the case of suspected credit card values, the potential credit card numbers are looked up against a Bank Identification Number List
2108
2108
(BINList). If a match is found the alert is raised at High confidence and additional details are added to the ‘Other Information’ field in the
2109
2109
alert, otherwise the alerts will have Medium confidence.
0 commit comments