Acunetix Premium - v12.0.191121158

New Features

• New scanning algorithm resulting in faster scans
• Scanner will give higher priority to locations which are dissimilar to ones that have already been scanned
• JAVA AcuSensor now supports JAVA Spring Framework

New Vulnerability Checks

• New check for Ruby on Rails Code Injection
• New check for Perl Code Injection
• AcuMonitor can now detect OOB PHP evaluation of user input
• New check for Prototype Pollution
• New check for Blind XSS via CSP report-uri
• New check for Jira Unauthorized SSRF via REST API
• New check for Apache Tapestry weak secret key
• New check for Oracle PeopleSoft SSO weak secret key
• New check for Yii2 weak secret key
• New check for Web2py weak secret key
• New check for Golang runtime profiling data
• New check for Adminer 4.6.2 file disclosure vulnerability
• New check for Apache mod_rewrite open redirect (CVE-2019-10098)
• New check for Flask weak secret key
• New check for Express express-session weak secret key
• New check for vBulletin 5.x 0day pre-auth RCE
• New check for Argument Injection

Updates

• Deepscan is now caching static assets. This will result in faster scans
• Improved memory consumption by the scanner
• Improved processing of forms and form handling
• Improved detection of paths
• Scanner will now process commented out html
• Updated command injection payloads

Fixes

• Fixed scanner crash
• Fixed WAF detection false positive
• Fixed: Check for Sensitive files was accessing restricted links
• Fixed issue causing scanner to multi-line session validation pattern
• Fixed: Some locations where incorrectly detected by DeepScan
• Fixed issue causing integrated LSR to close due to Ad blocking
• Fixed issue with HAR import files
• Fixed issue in the detection of Weak authentication credentials
• Fixed issue affecting the detection of DOM XSS vulnerabilities
• Fixed issue in the detection of possible username and password disclosure
• Fixed issue with recording restricted links in Internet Explorer
• Fixed: Tech Admin can now configure the engine to be used for a Target
• Fixed issue affecting scanning of domains with international characters