Acunetix Standard & Premium

Bug Fixes

• Bug limiting the number of external hosts in kbase
• Fixed a issue which caused the scanner to crash
• Some script dependencies could cause the scan to not finish
• Importer crash when user user cancels the importation
• Fixed syntax error affecting Chinese Windows
• Restrictions configured in LSR where not taken into consideration in some POST requests

New Features

• Added a test for Server-Side Template Injection vulnerability.
• Added tests for new WordPress (core and plugins) vulnerabilities.
• Added a test checking for Django Debug Mode

Improvements

• Improved CRLF injection/HTTP response splitting tests
• Improvements to the XSS testing script
• Updated Payment Card Industry (PCI) report to PCI 3.1
• Updated DISA Application Security and Development STIG report to V3R10
• LSR updated to support all SSL cipher suites

Bug Fixes

• Fixed a crash in WSDL scanner
• Various updates and fixes in the Login Sequence Recorder
• DeepScan blocks on a specific sites
• Fixed bug in Scan wizard
• Crash in Scan wizard when choosing a non-existent login sequence file name
• Crawler starturl was incorrectly set to http instead of https when importing from proxy log

New Features

• Added a test for WordPress 3 Persistent Script Injection
• Added multiple tests looking for User controllable tag parameter (like link href)
• Added various tests for ASP.NET version disclosure, ASP.NET MVC version disclosure, Microsoft IIS version disclosure.

Improvements

• Upgraded to a newer version of OpenSSL
• Improved the script looking for XSS vulnerabilities
• Improved the script looking for URL redirect issues
• Improved the script testing for SQL injections

Bug Fixes

• Fixed parsing issues for specific formatted links
• Fixed issue causing invalid files to be locked after drag-n-drop opening operation fails
• Crawler was aborting too early if many files were identified during the crawl
• If AcuSensor listed too many files at the beginning, crawler was stopping without actually crawling
• Fixed a memory leak

New Features

• Implemented a test for format strings vulnerabilities in web applications
• Implemented support for Hibernate Query Injection
• Implemented a check for MySQL username disclosure in error messages
• Implemented a test looking for vBulletin 5 SQL injection
• Implemented detection of Multiple Vulnerabilities in Parallels Plesk Sitebuilder
• Implemented a test looking for WordPress XMLRPC bruteforce
• Implemented a test for Remote File Upload vulnerability in Mailpoet/Wysija newsletters popular WordPress plugin
• Implemented a test for Insecure Nonce Generation in popular WordPress plugin WPTouch
• Implemented a test looking for various JSP access restriction bypasses in Java web applications
• Implemented detection of multiple vulnerabilities in Kunena Forum for Joomla
• Implemented a test checking if applets are permitted when file uploads are possible (this will lead to XSS vulnerabilities)
• Added a test for Java Debug Wire Protocol vulnerabilities
• Added a test for Zabbix XXE
• Added a test looking for Weblogic console default credentials
• Added a test for Symphony debugging console enabled
• Added a test for some MongoDB vulnerabilities
• Added a test looking for Chrome Logger information disclosure
• Added a generic script looking for unsecured mail forms that could lead to spam
• Added a test to check if ASP.NET Viewstate MAC is enabled
• Implemented a test for WordPress/Drupal/… XML quadratic blowup denial of service attack
• Added a test looking for HTML injection with unterminated tag
• Added a test for WordPress plugin Custom Contact Forms.

Improvements

• Various optimisations to Amazon S3 related scripts such as XXE and SSRF
• Improved the script looking for possible sensitive files
• XSS script can now find less common XSS variants such as double encode payloads
• SQL injection script checks for other variants such as SQL injection in order by, group by
• XSS script now checks for many user controllable tag attributes
• Various optimizations in the generation of reports
• Improved Server Directory Traversal script
• Improved Host Header Attack script

Bug Fixes

• Fixed JS errors that appear in HTTP editor.
• Restricted links matching was not working in some situations.
• Fixed the slow response time alert – moved alert details from description.
• Fixed a false positive with Struts2_Development_Mode script.
• Auto login crash if requests were failing after a long time.
• Existing cookies from manual browsing were ignored by crawler.
• Reduced some false positives in Backup file reporting.
• Login Sequence Recorder will delete the cookies it collected in the wizard.
• Crawler will use cookies from LSR in manual mode.

New Features

• Introduced capability to manipulate/test JSON and XML inputs
• Updated AcuSensor to support .NET 4 – .NET 4.5 (includes various improvements to .NET AcuSensor)
• Introduced support for CRUD (create, read, update and delete)
• Introduced support for scanning web applications developed using Google Web Toolkit
• Vulnerability Alerts now include CVSS, CVE and CWE classification
• Introduced input schemes for manipulating/testing Host header
• Introduced input schemes for manipulating Cookies with values formatted as JSON/XML
• Introduced report that covers NIST 800-53 rev4
• Added checks for Apache Struts 2 ClassLoader Manipulation (S2-020 and S2-021)
• Added checks for partial user controllable script source (that could lead to what Google is describing as Reverse Clickjacking)
• Added checks for “Security Exploit Patched in versions 3.5, 3.6, 3.7, 3.8, 4.X, 5.X of vBulletin”

Improvements

• Improved parsing of robots.txt
• Various improvements to existing reports
• Improved testing for SQL injection

Bug Fixes

• Fixed a crash in crawler caused by memory corruption
• Fixed a leak in the XML parser
• Fixed a few false positives in the Expression Language Injection script