Changelogs

Acunetix Standard & Premium

RSS Feed

v8.0.20120613 - 13 Jun 2012

Copy Link Copy Link
Build v8.0.20120613 - 13th June 2012

New Security Checks

  • New security checks for Microsoft SharePoint.
  • Debug Parameters test offers you the ability to check your web applications if common debug parameters, such as “?debug=1” disclose sensitive information.
  • New Cross-Site Scripting checks for Ruby on Rails / Homakov variants.
  • Security check for JetBrains .idea project directory.
  • ToolsPack backdoor verification.
  • Security check for Fantastico_Filelist information disclosure.
  • Tests for authentication bypass vulnerabilities in MySQL, MariaDB (CVE-2012-2122).
  • Check for Nginx restrictions bypass (CVE-2011-4963).
  • New checks when phpinfo() page is discovered: all html in such page is parsed and various alerts are issued reporting PHP configuration problems (display_errors on, register_globals etc).

New Features

  • Ability to export report in the Report Viewer.
  • Alerts you when HTML forms do not have CSRF protection.

Improvements

  • Rewrote the ASP_NET_Oracle_Padding security script.
  • Improved SVN/GIT repository security scripts.
  • Improved presentation for all the alerts generated by crawler by showing more attack details.

Bug Fixes

  • Login sequence recorder is now using the configured user-agent.
  • Cookies path parameters are better supported.
  • The scheduler authentication checkbox is restored properly if you press “Cancel”.
  • Fixed theTrace/Track HTTP method test security script issue.
  • The input forms which are part of the login sequence are no longer filled with HTML forms pre-configured data.
  • Fixed the namespaces issue on the Web Services scanner.
  • Corrected the requests which are generated by the scan results imported from the Firefox extension.
  • Blind SQL injection now reports the correct value in the alert details.
  • Fixed the Jquery problem: CSA select html element and options are now correctly handled.

v8.0.20120508 - 08 May 2012

Copy Link Copy Link
Build v8.0.20120508 – 8th May 2012

New Security Check

  • Acunetix WVS checks if your PHP-CGI installation is vulnerable to remote code execution. For further information regarding this type of vulnerability, read the PHP-CGI advisory article here.

New Features

  • Ability to edit scheduled scans. No need for scheduling new scans every time you wish to change a scan setting.
  • Amend multiple scheduled scans simultaneously by selecting them and applying the required global changes.
  • Save all your scanned results and access them at any time from your scheduler’s scan history. You can also delete your scanned results from the web-based scheduler.
  • A new setting has been introduced to configure the maximum number of pages during a crawl.

Improvements

  • Improved Cross-Site Scripting (XSS) tests.
  • The web-based scheduler has been improved to run better in the latest version of Internet Explorer.
  • Enhanced SQL injection tests to reduce the false positives reporting even more.

Bug Fixes

  • The scheduled scans can be correctly imported after upgrading to a more recent build of Acunetix WVS 8.
  • The false positives settings node can now support changes from multiple instances at the same time.
  • Web Service Definition Language (WSDL) Scanner URL edit box is now able to save history.

v8.0.20120423 - 23 Apr 2012

Copy Link Copy Link
Build v8.0.20120423 – 23rd April 2012

New Feature

  • Automatic verification of discovered web vulnerabilities.

v8.0.20120326 - 26 Mar 2012

Copy Link Copy Link
Build v8.0.20120326 – 26th March 2012

New Security Checks

  • Acunetix WVS 8 runs security tests for Joomla 1.6.x/1.7.x/2.5.x Privilege Escalation
  • Acunetix WVS 8 provides security tests Joomla 1.7/2.5 Core SQL Injection

Improvements

  • More advanced security checks for MongoDB and Rails Mass Assignment.

Bug Fixes

  • The crash in the Login Sequence Recorder has been fixed.
  • The Login Sequence Recorder is accurately parsing websites which send back GZIP encoded content, even if it was not specified in the Accept-Encoding header.
  • The Acunetix Reporter has improved the handling of missing scans reports.
  • The Acunetix Reporter Console supports spaces within the specified parameters.
  • The Acunetix Reporter accepts longer input names.

v8.0.20120305 - 07 Mar 2012

Copy Link Copy Link
Build v8.0.20120305 – 07th March 2012

New Security Checks

  • Scanning of Web Statistics Software Applications such as AWStats and Webalizer. Acunetix WVS crawls the result pages of your website(s) statistics software application and notifies you if sensitive data is disclosed in such pages.
  • Automatic checks for ASP Code injection vulnerability.
  • Further security checks for SQLite Databases.
  • Security checks for Rails Mass Assignment.

New Features

  • Ability to stop the website crawling and proceed with the scan at anytime.
  • Posibility to choose a scan report template that you would like to use when scheduling a scan.

Improvements

  • Scripts are being executed faster thus the scans are taking less time to complete.
  • Improved security scripts for Blind SQL injection, Remote File Inclusion XSS, File Inclusion and Directory Traversal.
  • If a variant check for a specific vulnerability times out, the next variant checks assigned for that type of vulnerability will be launched automatically.

Bug fixes

  • Crawler: input encoding was not correct for _EVENTTARGET = and /
  • Ansi string was not working correctly when using specific languages other than English.

v8.0.20120215 - 16 Feb 2012

Copy Link Copy Link
Build v8.0.20120215 – 16th February 2012 - NEW VERSION

New Features

  • Manipulation of inputs from URL’s
  • Automatic IIS 7 rewrite rule interpretation
  • Support for custom HTTP headers during automated scans
  • Imperva Web Application Firewall integration
  • Multiple instance support for scanning multiple websites in parallel
  • New web-based Scheduler
  • Automatic custom 404 error page recognition and detection
  • Scan settings templates
  • Simplified Scan Wizard
  • Smart memory management
  • Real-time Crawler status
  • Scan termination status included in report
  • Web application coverage report
  • Configuration of log files retention

New Vulnerability Classes Checks

New Web Security Audit Checks

  • Check website content for Bazaar source code repository
  • Check website content for Mercurial source code repository
  • Check website content for source code GIT repository
  • Disclosure of HTML Forms in redirect pages
  • Security audit of alternative PHP cache
  • Check for insecure preg replace in PHP
  • Apache httpOnly Cookie Disclosure
  • Elmah Information Disclosure
  • Checks for Options web server method
  • PHP Hash Collision Denial Of Service
  • Plone&Zope Remote Command Execution
  • Checks for Reverse Proxy bypass
  • CakePHP web application Audit
  • Web applications Configuration File Disclosure
  • phpThumb web application audit
  • Struts2 Remote Code Execution
  • Tiny MCE web application audit
  • Uploadify web application audit
  • Webmail web application audit

Improved the Web Security Audit Scripts for

  • SQL Injection
  • XSS (Cross site scripting)
  • Code Execution
  • CRLF Injection
  • Directory Traversal
  • File Inclusion
  • PHP Code Execution
  • Backup Files
  • Sensitive Text Search
  • Secure Socket Layer configuration
  • Error Messages
  • ASP.NET Application Trace
  • .htaccess File Configuration
  • Http Verb Tampering
  • PHPInfo / PHP Configuration
  • Possible Sensitive Directories Disclosure
  • Possible Sensitive Files Disclosure
  • SQL Injection In Basic Authentication
  • SQL Injection In URI
  • SVN Repository Disclosure
  • Trojan Scripts
  • File Upload Form Audits
  • Generic Oracle Padding
  • Web Form based Authentication
  • LDAP Injection
  • Script Source Code Disclosure
  • XFS and Redir
  • XPath Injection
  • Apache Geronimo Default Administrative Credentials
  • ColdFusion v9 Solr Exposed
  • Error Pages with Path Disclosure
  • Frontpage Authors Passwords
  • Frontpage Extensions Enabled
  • IIS Unicode Directory Traversal
  • JBoss Web Server Configuration
  • Unprotected phpMyAdmin Interface
  • Web Server Version Checks
  • XML External Entity Injection
  • FCKEditor security audit
  • Struts2 XWork Remote Code Execution

Improvements

  • Smart Memory management (ability to scan larger websites)
  • Detection of more web security vulnerability variants

v7.0.20111005 - 05 Oct 2011

Copy Link Copy Link
Build v7.0.20111005 - 5th October 2011

New Features

  • The Client Script Analyzer engine now supports jQuery, jQuery UI, and YUI Library
  • New URL Rewrite option: Match full URI. When enabled, a URL rewrite rule can be matched against the whole URI and not just the path

Improvements

  • Major AcuSensor improvements for PHP
  • Inclusion of more variables discovered by Acusensor during a scan

Bug Fixes

  • Login Sequence Recorder uses the specified Proxy settings correctly

v7.0.20110920 - 20 Sep 2011

Copy Link Copy Link
Build v7.0.20110920 - 20th September 2011

New Security Check

  • Security check for Apache httpd remote denial of service

Improvements

  • Firefox plugin now supports Firefox v.6
  • Inclusion of more variables discovered by Acusensor during a scan

Bug Fixes

  • Fixed HTTP verb tampering security checks with further reduction of false positives
  • Paths edited in HTTP Authentication settings node are being saved correctly
  • Actions menu is appearing correctly in the Small Business Edition

v7.0.20110823 - 23 Aug 2011

Copy Link Copy Link
Build v7.0.20110823 - 23rd August 2011

New Security Checks

  • Complex security check for Timthumb (detects WordPress installations and checks for vulnerable plugins and themes
  • Includes bruteforcing capabilites to look for plugins/themes that contain the Timthumb script
  • Security check for Sun/Oracle GlassFish Server Authentication Bypass (same check includes some additional checks for GlassFish)

Updates

  • Updated Firefox plugin to support Firefox 5

Bug Fix

  • Fixed an enumeration problem while parsing a WSDL with inputs that have a lot of possible values.
1 … 19 20 21 … 25