Hi Team
Please advise how to resolve the below vulnerabilities
Thanks
Pramod

SSL/TLS: Renegotiation DoS Vulnerability (CVE-2011-1473, CVE-2011-5094)
SSL/TLS: Renegotiation MITM Vulnerability (CVE-2009-3555)


The remote SSL/TLS service is prone to a denial of service (DoS) vulnerability.The flaw exists because the remote SSL/TLS service does not properly restrict client-initiated renegotiation within the SSL and TLS protocols. Note: The referenced CVEs are affecting OpenSSL and Mozilla Network Security Services (NSS) but both are in a DISPUTED state with the following rationale: > It can also be argued that it is the responsibility of server deployments not a security library to prevent or limit renegotiation when it is inappropriate within a specific environment. Both CVEs are still kept in this VT as a reference to the origin of this flaw.The flaw might make it easier for remote attackers to cause a DoS (CPU consumption) by performing many renegotiations within a single connection.

Hi Team
A new vulnerability got in the VAPT. How can fix it please?
Thanks
Pramod



Cookie Overly Broad Path Detected

The cookie 'path' attribute signifies the URL or path for which the cookie is valid. If an overly broad path like root '/' is specified in the cookie then it is accessible through other applications on the same domain. Exposing the cookie to all web applications on the domain can lead to sensitive information disclosure like session identifier etc. and can cause one application to compromise another application.

Hi Team
Kindly advise how to solve the below vulnerability. There are few upload and downloads in the website and everything doing through the wwwroot folder.
Thanks
Pramod

Possible Sensitive Directories/Files Detected

These directory/files may expose sensitive information that could help a malicious user to prepare more advanced attacks. A possible sensitive directory has been found. These directory/files are not directly linked from the website. This check looks for common sensitive resources like backup directories database dumps administration pages temporary directories. Each one of these directories could help an attacker to learn more about his target.

Hi Team,

Got the below vulnerability in this quarter audit. In the servercontroller security option , the checkformid is already True. the version am using is 15.2.62.
Please advise how to fix this

Thanks
Pramod

HTML Form Without Anti-CSRF Token Detected

Cross-Site Request Forgery (CSRF/XSRF) is a vulnerability where an attacker tricks the victim into making a request victim did not make. So the attacker abuses the trust a web application has with a victim's browser. Mostly the HTML forms submitted have CSRF tokens embedded in them while submitting the request. If a form is without this preventive measure enabled then it's very much prone to CSRF attacks and other dependent attacks. We are checking for the existence of the known list of CSRF tokens if none of the tokens are found the target will be flagged.

Hello,
I've encountered 404 while switching Google OAuth from SA to ISAPI (IIS).
On SA everything works fine (return to localhost:8888/$/oauth/v2 works fine). However when switching to ISAPI I got 404 when returning to mydomain.com/$/oauth/v2.
I suppose it's more server side IIS then Intraweb, but not sure if I miss something.
Any ideas how to troubleshoot? Could you please suggest debug ideas? 
Regards,

Hi,

I am using a CGIRunner to perform some database tasks.
But before the CGIRunner finishes successfully, I get a Timeout error.

What can I do to prevent this from happening?

Thanks in advance!

Cheers, Paul

Hi folks,

there is a new update available:

https://www.atozed.com/2023/06/intraweb-15-3-8/

1 important fix regarding IWButtons and also 1 feature that should have included in the previous build but due to a build failure it hasn't

Cheers

Hello!

How can I change the font / fontsize used for the buttons and the Title in a TIWModalWindow?

Best regards, Mikael

Hello!

If I set the Align property of aTIWLabel to alNone the control resizes nicely depending on Font and text  

But If I set Align to alTop the height of the control does not adjust!?

Best regads, Mikael

Hello,

I am currently encountering an issue which requires me to have 2 different sessions at the same time on a browser and on the same device.

Is there any way to do this with intraweb ?

Best regards,
Florian