PCI Scan Report Summary |
||||||||||||
|
Total Requests
9962
Average Speed
8.94 req/sec.
|
29
Identified
5
Confirmed
0
Critical
6
Informational
|
||||||||||
Explanation |
||||||||||||
|
||||||||||||
29 vulnerabilities listed in PCI classification were found on this web site.
Vulnerabilities |
||||||||||||||||||||||||||||||||
|
Vulnerabilities By PCI |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
PCI v3.2
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
pentestonline.es detected that password data is being transmitted over HTTP.
pentestonline.es detected that weak ciphers are enabled during secure communication (SSL).
You should allow only strong ciphers on your web server to protect secure communication with your visitors.
httpd.conf.
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
regedt32 or type regedit, and then click OK.HKLM\SYSTEM\CurrentControlSet\Control\SecurityProvidersSCHANNEL\Ciphers\DES 56/56
SCHANNEL\Ciphers\RC4 64/128
SCHANNEL\Ciphers\RC4 40/128
SCHANNEL\Ciphers\RC2 56/128
SCHANNEL\Ciphers\RC2 40/128
SCHANNEL\Ciphers\NULL
SCHANNEL\Hashes\MD5
pentestonline.es detected that insecure transportation security protocol (SSLv3) is supported by your web server.
SSLv3 has several flaws. An attacker can cause connection failures and they can trigger the use of SSL 3.0 to exploit vulnerabilities like POODLE.
Configure your web server to disallow using weak ciphers. You need to restart the web server to enable changes.
SSLProtocol +TLSv1.1 +TLSv1.2
nginx.conf file and remove SSLv3.
ssl_protocols TLSv1.1 TLSv1.2;
regedt32 or regedit, and then click OK.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\
Server or create if it doesn't exist.Server key, locate a DWORD value named Enabled or create if it doesn't exist and set its value to "0".ssl.use-sslv2 = "disable" ssl.use-sslv3 = "disable"
pentestonline.es identified that the target web site is using Bootstrap and detected that it is out of date.
Please upgrade your installation of Bootstrap to the latest stable version.
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
pentestonline.es identified a programming error message.
| Parameter | Type | Value |
| username_id | POST | |
| __VIEWSTATE | POST | |
| __VIEWSTATE_KEY | POST | <?xml version="1.0"?><!DOCTYPE ns [<!ELEMENT ns ANY><!ENTITY lfi SYSTEM "file:///C:/Windows/System32... |
| ctl01 | POST | Inicia sesión |
| password_id | POST |
| Parameter | Type | Value |
| URI-BASED | Full URL | /"ns="pentestonline.es(0x000A1B) |
pentestonline.es identified a stack trace disclosure (ASP.NET) in the target web server's HTTP response.
web.config file to prevent information leakage by applying custom error pages. <System.Web>
<customErrors mode="On" defaultRedirect="~/error/GeneralError.aspx">
<error statusCode="403" redirect="~/error/Forbidden.aspx" />
<error statusCode="404" redirect="~/error/PageNotFound.aspx" />
<error statusCode="500" redirect="~/error/InternalError.aspx" />
</customErrors>
</System.Web>
| Parameter | Type | Value |
| Query Based | Query String | '"--></style></scRipt><scRipt src="//en5k_y54-pfmmjdpxw0jylmw7ejnljou7quqmkj2ius.r87.me"></s... |
| Parameter | Type | Value |
| URI-BASED | Full URL | '"--></style></scRipt><scRipt>pentestonline.es(0x000037)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | /'"--></style></scRipt><scRipt>pentestonline.es(0x000038)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | '"--></style></scRipt><scRipt>pentestonline.es(0x000163)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | /'"--></style></scRipt><scRipt>pentestonline.es(0x000164)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | '"--></style></scRipt><scRipt>pentestonline.es(0x00028F)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | /'"--></style></scRipt><scRipt>pentestonline.es(0x000290)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | '"--></style></scRipt><scRipt>pentestonline.es(0x00033D)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | /'"--></style></scRipt><scRipt>pentestonline.es(0x000358)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | '"--></style></scRipt><scRipt>pentestonline.es(0x00041F)</scRipt> |
pentestonline.es detected that insecure transportation security protocol (TLS 1.0) is supported by your web server.
TLS 1.0 has several flaws. An attacker can cause connection failures and they can trigger the use of TLS 1.0 to exploit vulnerabilities like BEAST (Browser Exploit Against SSL/TLS).
Websites using TLS 1.0 are considered non-compliant by PCI since 30 June 2018.
Configure your web server to disallow using weak ciphers. You need to restart the web server to enable changes.
SSLProtocol +TLSv1.1 +TLSv1.2
nginx.conf file and remove TLSv1.
ssl_protocols TLSv1.1 TLSv1.2;
regedt32 or regedit, and then click OK.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\
Server or create if it doesn't exist.Server key, locate a DWORD value named Enabled or create if it doesn't exist and set its value to "0".pentestonline.es identified the target web site is using jQuery and detected that it is out of date.
Please upgrade your installation of jQuery to the latest stable version.
pentestonline.es identified the target web site is using jQuery UI Autocomplete and detected that it is out of date.
Please upgrade your installation of jQuery UI Autocomplete to the latest stable version.
pentestonline.es identified that the target web site is using Moment.js and detected that it is out of date.
Please upgrade your installation of Moment.js to the latest stable version.