Release 10.4
November 13, 2024
What's New?
New QIDs
The following new QIDs are introduced in this release:
| Vuln ID | Category | Title | Description |
|---|---|---|---|
| 150846 | Practice | Potential Business Logic abuse due to failure to perform actions | The XML HTTP Requests (XHR) allow a browser to communicate with the server without reloading the page and provide methods to send and receive data from the server. The failing XHR requests may lead to business logic misuse. Qualys now supports the detection of failing XHR requests to give you visibility into potential business logic misuse. |
| 150847 | Practice | Potential Business Logic abuse due to Site Coverage | Sometimes, authentication requests fail even when you provide the correct credentials. This means that the implemented security system is obscure and may lead to business logic misuse. Qualys now supports the detection of failed authentication requests, prompting quick actions to prevent potential business logic misuse. |
Updated QIDs
The following QIDs are updated in this release:
| Vuln ID | Category | Title | Description |
|---|---|---|---|
| 150051 | Vulnerability | Open Redirect | We updated the QID 150051 to detect the open redirects that use the base URL with the Qualys domain (qualys.com) and perform smart requests to bypass filters. |
| 150806 | Information Gathering | Local Storage or Session Storage Found | We updated the QID 150806 to report up to 5 MB of local and session storage done via client-side JavaScript. |
Issues Addressed
| Category/Component | Description |
|---|---|
| Standard Authentication | The standard authentication was failing for web applications while launching the PCI scans due to the incorrect categorization of login form fields. We fixed this issue by implementing the email-password based standard authentication. |
| False Positives | We fixed the false positives findings reported for static check-related QIDs — 150159, 150161, 150103, 150122, and 150123 by adding the check to identify the out of scope domain cookies. Now these QID does not report the out of scope domain cookies. |
| False Positives | We fixed the false positive findings reported for the session storage-related QID — 150806 by improving the detection logic to avoid reporting of PNG and PDF files. |
| False Positives | We fixed the false positive findings reported for the passive mixed content-related QID — 150146. Now we have added a check to verify the source of mixed content to prevent detection when the web application redirects from HTTP to HTTPS server. |