Acunetix Standard & Premium

New Features

• Added a test looking for insecure CORS configurations.
• Added a test looking for CVE-2014-7829 – Arbitrary file existence disclosure in Action Pack.
• Added a test looking for Rails application running in development mode.
• Added a test looking for CVE-2015-7808 vBulletin 5 PreAuth RCE.
• Added a test looking for Insecure DNS records
• Added a test looking for Spring Boot Actuator
• Added a test looking for Tornado Debug mode
• Added a test looking for Pyramid Debug mode
• Implemented PHP object deserialization of user-supplied data
• Added a test looking for older versions of the ZeroClipboard SWF library that are vulnerable to a cross-site scripting vulnerability.

Improvements

• Updated WordPress plugins and WordPress core checks.
• Improved tests for possible sensitive directories and sensitive files.
• Improved Apache Axis audit script.
• Added a test for Java object deserialization of user-supplied data
• Various improvements for XSS detection.
• Improved HTML structural parser and added allow to robots.txt parser
• Added support for WADL files when served using content-type application/vnd.sun.wadl+xml

Bug Fixes

• Fixed crash cause during auto session detection.
• Security fix for privilege escalation reported by security researcher Daniele Linguaglossa

Bug Fixes

• Bug limiting the number of external hosts in kbase
• Fixed a issue which caused the scanner to crash
• Some script dependencies could cause the scan to not finish
• Importer crash when user user cancels the importation
• Fixed syntax error affecting Chinese Windows
• Restrictions configured in LSR where not taken into consideration in some POST requests

New Features

• Added a test for Server-Side Template Injection vulnerability.
• Added tests for new WordPress (core and plugins) vulnerabilities.
• Added a test checking for Django Debug Mode

Improvements

• Improved CRLF injection/HTTP response splitting tests
• Improvements to the XSS testing script
• Updated Payment Card Industry (PCI) report to PCI 3.1
• Updated DISA Application Security and Development STIG report to V3R10
• LSR updated to support all SSL cipher suites

Bug Fixes

• Fixed a crash in WSDL scanner
• Various updates and fixes in the Login Sequence Recorder
• DeepScan blocks on a specific sites
• Fixed bug in Scan wizard
• Crash in Scan wizard when choosing a non-existent login sequence file name
• Crawler starturl was incorrectly set to http instead of https when importing from proxy log

New Features

• Added a test for WordPress 3 Persistent Script Injection
• Added multiple tests looking for User controllable tag parameter (like link href)
• Added various tests for ASP.NET version disclosure, ASP.NET MVC version disclosure, Microsoft IIS version disclosure.

Improvements

• Upgraded to a newer version of OpenSSL
• Improved the script looking for XSS vulnerabilities
• Improved the script looking for URL redirect issues
• Improved the script testing for SQL injections

Bug Fixes

• Fixed parsing issues for specific formatted links
• Fixed issue causing invalid files to be locked after drag-n-drop opening operation fails
• Crawler was aborting too early if many files were identified during the crawl
• If AcuSensor listed too many files at the beginning, crawler was stopping without actually crawling
• Fixed a memory leak

New Features

• Implemented a test for format strings vulnerabilities in web applications
• Implemented support for Hibernate Query Injection
• Implemented a check for MySQL username disclosure in error messages
• Implemented a test looking for vBulletin 5 SQL injection
• Implemented detection of Multiple Vulnerabilities in Parallels Plesk Sitebuilder
• Implemented a test looking for WordPress XMLRPC bruteforce
• Implemented a test for Remote File Upload vulnerability in Mailpoet/Wysija newsletters popular WordPress plugin
• Implemented a test for Insecure Nonce Generation in popular WordPress plugin WPTouch
• Implemented a test looking for various JSP access restriction bypasses in Java web applications
• Implemented detection of multiple vulnerabilities in Kunena Forum for Joomla
• Implemented a test checking if applets are permitted when file uploads are possible (this will lead to XSS vulnerabilities)
• Added a test for Java Debug Wire Protocol vulnerabilities
• Added a test for Zabbix XXE
• Added a test looking for Weblogic console default credentials
• Added a test for Symphony debugging console enabled
• Added a test for some MongoDB vulnerabilities
• Added a test looking for Chrome Logger information disclosure
• Added a generic script looking for unsecured mail forms that could lead to spam
• Added a test to check if ASP.NET Viewstate MAC is enabled
• Implemented a test for WordPress/Drupal/… XML quadratic blowup denial of service attack
• Added a test looking for HTML injection with unterminated tag
• Added a test for WordPress plugin Custom Contact Forms.

Improvements

• Various optimisations to Amazon S3 related scripts such as XXE and SSRF
• Improved the script looking for possible sensitive files
• XSS script can now find less common XSS variants such as double encode payloads
• SQL injection script checks for other variants such as SQL injection in order by, group by
• XSS script now checks for many user controllable tag attributes
• Various optimizations in the generation of reports
• Improved Server Directory Traversal script
• Improved Host Header Attack script

Bug Fixes

• Fixed JS errors that appear in HTTP editor.
• Restricted links matching was not working in some situations.
• Fixed the slow response time alert – moved alert details from description.
• Fixed a false positive with Struts2_Development_Mode script.
• Auto login crash if requests were failing after a long time.
• Existing cookies from manual browsing were ignored by crawler.
• Reduced some false positives in Backup file reporting.
• Login Sequence Recorder will delete the cookies it collected in the wizard.
• Crawler will use cookies from LSR in manual mode.