Acunetix Build History

Version 14 build 14.3.210628104 for Windows, Linux and macOS – 28th June 2021

Updates

Target Knowledgebase will be reset when Target Settings are changed
Updated SSL/TLS Certificate expiry threshold notification from 30 days to 60 days

Fixes

Fixed: OWASP compliance report template to not be available in some Editions
Fixed: Some scripts where not observing Excluded paths configured in Target settings

Version 14 build 14.3.210615184 for Windows, Linux and macOS – 17th June 2021

New Features

New SCA (Software Composition Analysis) for PHP, JAVA, Node.js and .NET web applications. Acunetix will report vulnerable libraries used by the web application when AcuSensor is used

New Vulnerability Checks

New check for SSRF via logo_uri in MITREid Connect (CVE-2021-26715)
New check for Oracle E-Business Suite Information Disclosure
New check for Unauthorized Access to a web app installer
New check for SAML Consumer Service XML entity injection (XXE)
New check for Grav CMS Unauthenticated RCE (CVE-2021-21425)
New check for Outsystems Upload Widget Arbitrary File Uploading (RPD-4310)
New check for Django Debug Toolbar
New check for Joomla Debug Console enabled
New check for Joomla J!Dump extension enabled
New check for Request Smuggling
New check for Unrestricted access to Caddy API interface
New check for Pyramid framework weak secret key
New check for Apache Tapestry Unauthenticated RCE (CVE-2019-0195 and CVE-2021-27850)
New check for Unrestricted access to Spring Eureka dashboard
New check for Unrestricted access to Yahei PHP Probe
New check for Unrestricted access to Envoy Dashboard
New check for Unrestricted access to Traefik2 Dashboard
New check for Dragonfly Arbitrary File Read/Write (CVE-2021-33564)
New check for Oracle E-Business Suite Frame Injection (CVE-2017-3528)
New check for Gitlab CI Lint SSRF
New check for Gitlab open user registration
New check for Gitlab user disclosure via GraphQL

Updates

Updated .NET AcuSensor
.NET AcuSensor can be now deployed from CLI
User is notified when imported URLs are out of scope
Scan events are not shown in json any more
New column for Continuous Scanning in the Targets page
New filter in Targets page to easily identify Targets with debug enabled
Vulnerabilities page shows if the vulnerability was detected by a web or network scan
Merged Add Target and Add Targets options in UI
Custom Field, labels and tags can be configured for Issue Trackers
Platform Admin can now unlock locked accounts
New column in CSV export showing details in text only
Updated the way that AcuSensor token can be updated in the Target Settings
PCI DSS compliance report updated to PCI DSS 3.2.1
Compliance Reports updated to make use of the Comprehensive report template
Browser Dev tools can be used when LSR is started from CLI
Updated XFO check
Multiple UI updates
Improved false positive detection of out of band RCE and argument injection vulnerabilities
Multiple updates to the Postman import implementation
Updated JavaScript Library Audit to support merged JavaScript files

Fixes

HSTS has been enabled for the AcuSensor bridge
Latest Alerts section of Scan results was not updated with AcuMonitor (OOB) vulnerabilities)
The Fragments was not clickable in the site structure
HSTS Best Practices was sometimes being reported multiple times
Fixed HSTS false negative
Fixed issue in the detection of Django 3 weak secret
Fixed issue causing GitHub labels not to be updated when changing Github issue Tracker Project
Fixed encoding issue in Node.js AcuSensor
Fixed issue causing corruption of Target knowledgebase
Fixed DeepScan timeout when processing Prototype JavaScript library
Fixed issue causing outdated JavaScript libraries check not to report external libraries
Fixed issue in Oauth password credentials grant

Version 14 build 14.2.210505179 for Windows, Linux and macOS – 6th May 2021

Fixes

Fixed validation errors when sorting vulnerabilities by Issue ID
Fixed issue causing Node.js sensor to fail to start on Node v6
Fixed issue causing some operations to be listed multiple times in Scan Statistics

Version 14 build 14.2.210503151 for Windows, Linux and macOS – 4th May 2021

New Features

Acunetix is now available on Docker
New Scan Statistics page for each Scan
Vulnerability information can now be sent to AWS WAF

New Vulnerability Checks

New check for Hashicorp Consul API is accessible without authentication [https://www.consul.io/docs/security]
Multiple new checks for Unrestricted access to a monitoring system
Improvements to JavaScript Library Audit checks
New check for Cisco RV Series Authentication Bypass (CVE-2021-1472)
New check for ntopng Authentication Bypass (CVE-2021-28073)
New check for Agentejo Сockpit CMS resetpassword NoSQLi (CVE-2020-35847)
New check for AppWeb Authentication Bypass (CVE-2018-8715)
New check for Apache OFBiz SOAPService Deserialization RCE (CVE-2021-26295)
New check for F5 iControl REST unauthenticated remote command execution vulnerability (CVE-2021-22986)
New check for Python Debugger Unauthorized Access Vulnerability
New check for Virtual Host locations misconfiguration
New check for Request Smuggling

Updates

Full rows and column selection is now possible in the Excluded Hours page
Updated UI with new Acunetix branding
Issue Tracker ID will be shown for vulnerabilities sent to any Issue Tracker
Issue Trackers can now be restricted to a specific Target Group
Target Description will be sent to the Issue Trackers
Updated Jira integration to support Jira version 9
Multiple updates to the JAVA AcuSensor
Scanning engine will now test cookies on pages which do not have any inputs
The scanner will stop testing cookies which have been found to be vulnerable
Where possible, DOM XSS vulnerabilities will show the code snippet of the vulnerable JavaScript call
CSV Export will now show the Target Address
Maximum size for a custom cookie configured in a Target increased to 4096 characters
New date filter in the Vulnerabilities page
Vulnerability severity now shows text in addition to color coded icon
Multiple updates to the LSR
Added support for BaseUrl / Global Variables in Postman import files

Fixes

Fixed extra CR in Target CSV export
Fixed DeepScan crash
Fixed: Discovery options are only shown to users with “Access All Targets” permission
Fixed: Existing user’s details shown when adding a new user
Fixed a scanner crash
Fixed: Blind XSS check is now part of the XSS scanning profile
Fixed: AcuMonitor checks where not done when scan done by an engineonly installation
Fixed issue causing AcuMonitor not to be registered when using authenticated proxy
Fixed issue when loading vulnerabilities for a Target Group
Fixed issue with Postman importer
Fixed sporadic issue when checking for new Acunetix updates on Mac
Fixed issue in WP XMLRPC pingback check

Version 14 build 14.1.210329187 for Windows, Linux and macOS – 30th March 2021

Fixes

Fixed issue causing proxy authentication failures
Fixed scanner crash
Fixed indentation in Comprehensive report

Version 14 build 14.1.210324124 for Windows, Linux and macOS – 25th March 2021

Updates

Updated scanner so that “Restrict scans to import files” is taken into consideration for paths coming from Target knoweldgebase

Fixes

Fixed a scanner crash
Fixed issue in Swagger 3 import feature

Version 14 build 14.1.210316110 for Windows, Linux and macOS – 17th March 2021

New Features

Web Asset Discovery, allowing users to discover domains related to their organisation or web assets already configured in Acunetix
New page showing all the Target FQDNs consuming a target license

New Vulnerability Checks

New test for SonicWall SSL-VPN 8.0.0.0 RCE via ShellShock exploit
New test for Node.js Debugger Unauthorized Access Vulnerability
New test for Node.js Inspector Unauthorized Access Vulnerability
New test for Apache Shiro authentication bypass (CVE-2020-17523)
New test for Reflected Cross-Site Scripting (XSS) vulnerability in PAN-OS management web interface (CVE-2020-2036)
New test for Missing Authentication Check in SAP Solution Manager (CVE-2020-6207)
New test for VMware vCenter Server Unauthorized Remote Code Execution (CVE-2021-21972)
New test for Delve Debugger Unauthorized Access Vulnerability
New check for HTTP response splitting with cloud storage
New tests for WordPress plugins

Updates

Acunetix updated to fully support NTLM Authentication for proxy authentication
Multiple LSR/BLR and DeepScan updates and fixes
Updated Chromium to v88.0.4298.0
Updated Postgres database to v13.2
Engines page has been updated to show the following:

Status (online or otherwise) for each Engine
The build number for each Engine
Any license issues are reported as part of the status for each Engine

Multi-Engine setups will start to automatically update the Engine only installations when the Main installation is updated
The UI will reload after Acunetix is upgraded
‘WAF Export’ button renamed to ‘Export to’, and feature added to the Scans Page
Multiple updates to the Comprehensive report
Proxy Settings can now be specified for each Issue Tracker
Updated JavaScript Library Audit check to cover libraries not hosted on the scanned target
Users can now be created from the API
Updated CORS check

Fixes

Fixed bug in “Vulnerabilities in SharePoint could allow elevation of privilege” check
Fixed issue causing check for updates to occasionally fail on MacOS
Fixed issue causing DOM XSS sink to not always be show the in the code extract displayed in the alert
Fixed issue caused when a custom collection is used in a TFS issue tracker configuration
Fixed issue in WordPress XML-RPC pingback abuse check
Fixed Deepscan crash
Fixed False Positive in Broken Link Hijacking check
Vulnerability CSV export now includes URL where vulnerability was detected