screening_portal_api_zap_scan

[github-actions]

• Site: https://spd-train.justice.gov.bc.ca
  New Alerts
  • Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 7:
    • https://spd-train.justice.gov.bc.ca/screening/api/configuration
    • https://spd-train.justice.gov.bc.ca/screening/api/metadata/address/id
    • https://spd-train.justice.gov.bc.ca/screening/api/metadata/address?search=ZAP&country=country&lastId=lastId
    • https://spd-train.justice.gov.bc.ca/screening/api/ministries
    • https://spd-train.justice.gov.bc.ca/screening/api/orgs/invite-link-verify?encodedOrgId=encodedOrgId
    • ..
  • Unexpected Content-Type was returned [100001] total: 136:
    • https://spd-train.justice.gov.bc.ca
    • https://spd-train.justice.gov.bc.ca/
    • https://spd-train.justice.gov.bc.ca/5236981486153525533
    • https://spd-train.justice.gov.bc.ca/screening
    • https://spd-train.justice.gov.bc.ca/screening/
    • ..
  • X-Content-Type-Options Header Missing [10021] total: 7:
    • https://spd-train.justice.gov.bc.ca/screening/api/configuration
    • https://spd-train.justice.gov.bc.ca/screening/api/metadata/address/id
    • https://spd-train.justice.gov.bc.ca/screening/api/metadata/address?search=ZAP&country=country&lastId=lastId
    • https://spd-train.justice.gov.bc.ca/screening/api/ministries
    • https://spd-train.justice.gov.bc.ca/screening/api/orgs/invite-link-verify?encodedOrgId=encodedOrgId
    • ..
  • Non-Storable Content [10049] total: 12:
    • https://spd-train.justice.gov.bc.ca/screening/api/applicants/applicantId/screenings
    • https://spd-train.justice.gov.bc.ca/screening/api/applicants/applicantId/screenings/applicationId
    • https://spd-train.justice.gov.bc.ca/screening/api/applicants/clearances/shareable?withOrgId=withOrgId&serviceType=PSSO
    • https://spd-train.justice.gov.bc.ca/screening/api/applicants/screenings/applicationId/files
    • https://spd-train.justice.gov.bc.ca/screening/api/applicants/userinfo
    • ..
  • Re-examine Cache-control Directives [10015] total: 5:
    • https://spd-train.justice.gov.bc.ca/screening/api/configuration
    • https://spd-train.justice.gov.bc.ca/screening/api/metadata/address?search=ZAP&country=country&lastId=lastId
    • https://spd-train.justice.gov.bc.ca/screening/api/ministries
    • https://spd-train.justice.gov.bc.ca/screening/api/orgs/invite-link-verify?encodedOrgId=encodedOrgId
    • https://spd-train.justice.gov.bc.ca/screening/swagger/v1/swagger.json

View the following link to download the report.
RunnerID:18082145812

---

ZAP by Checkmarx

[github-actions]

• Site: https://spd-train.justice.gov.bc.ca
  New Alerts
  • Application Error Disclosure [90022] total: 2:
    • https://spd-train.justice.gov.bc.ca/screening/api/metadata/address/id
    • https://spd-train.justice.gov.bc.ca/screening/api/metadata/address?search=ZAP&country=country&lastId=lastId

View the following link to download the report.
RunnerID:19619852629

[github-actions]

• Site: https://spd-train.justice.gov.bc.ca
  New Alerts

  • Content Security Policy (CSP) Header Not Set [10038] total: 1:
    • https://spd-train.justice.gov.bc.ca/screening/swagger/v1/swagger.json
  • In Page Banner Information Leak [10009] total: 1:
    • https://spd-train.justice.gov.bc.ca/screening/swagger/v1/swagger.json
  • Permissions Policy Header Not Set [10063] total: 1:
    • https://spd-train.justice.gov.bc.ca/screening/swagger/v1/swagger.json
  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 1:
    • https://spd-train.justice.gov.bc.ca/screening/swagger/v1/swagger.json
  • Strict-Transport-Security Header Not Set [10035] total: 1:
    • https://spd-train.justice.gov.bc.ca/screening/swagger/v1/swagger.json

  Resolved Alerts

  • Application Error Disclosure [90022] total: 2:
  • Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 5:
  • X-Content-Type-Options Header Missing [10021] total: 5:
  • Re-examine Cache-control Directives [10015] total: 4:

View the following link to download the report.
RunnerID:19807515419

[github-actions]

• Site: https://spd-train.justice.gov.bc.ca
  New Alerts
  • A Client Error response code was returned by the server [100000] total: 17:
    • https://spd-train.justice.gov.bc.ca/3219121430869449641
    • https://spd-train.justice.gov.bc.ca/actuator/health
    • https://spd-train.justice.gov.bc.ca/computeMetadata/v1/
    • https://spd-train.justice.gov.bc.ca/latest/meta-data/
    • https://spd-train.justice.gov.bc.ca/metadata/instance
    • ..

View the following link to download the report.
RunnerID:20013001205