gitlab-org/security-products/dast v3.0.11

on GitLab

Changes

• Upgrade browserker to version 0.0.89 (!624)
• Enable 209.2 passive check browserker!684
• Update 829.1 to only match requests that are http(s) and in scope browserker!689
• Update 359.1 to only match requests that are http(s) and in scope browserker!690
• Update 359.2 to only match requests that are http(s) and in scope browserker!691
• Upgrade vulnerability checks to version 1.0.28 browserker!694
  • Update 209.2 uniqueness template to request method and request path dast-cwe-checks!134
• Upgrade vulnerability checks to version 1.0.29 browserker!694
  • Remove all 798 checks dast-cwe-checks!136
  • Add 798.1 Exposure of confidential secret or token Adafruit API Key dast-cwe-checks!136
  • Add 798.2 Exposure of confidential secret or token Adobe Client ID (Oauth Web) dast-cwe-checks!136
  • Add 798.3 Exposure of confidential secret or token Adobe Client Secret dast-cwe-checks!136
  • Add 798.4 Exposure of confidential secret or token Age secret key dast-cwe-checks!136
  • Add 798.5 Exposure of confidential secret or token Airtable API Key dast-cwe-checks!136
  • Add 798.6 Exposure of confidential secret or token Algolia API Key dast-cwe-checks!136
  • Add 798.7 Exposure of confidential secret or token Alibaba AccessKey ID dast-cwe-checks!136
  • Add 798.8 Exposure of confidential secret or token Alibaba Secret Key dast-cwe-checks!136
  • Add 798.9 Exposure of confidential secret or token Asana Client ID dast-cwe-checks!136
  • Add 798.10 Exposure of confidential secret or token Asana Client Secret dast-cwe-checks!136
  • Add 798.11 Exposure of confidential secret or token Atlassian API token dast-cwe-checks!136
  • Add 798.12 Exposure of confidential secret or token AWS dast-cwe-checks!136
  • Add 798.13 Exposure of confidential secret or token BitBucket Client ID dast-cwe-checks!136
  • Add 798.14 Exposure of confidential secret or token BitBucket Client Secret dast-cwe-checks!136
  • Add 798.15 Exposure of confidential secret or token Bittrex Access Key dast-cwe-checks!136
  • Add 798.16 Exposure of confidential secret or token Bittrex Secret Key dast-cwe-checks!136
  • Add 798.17 Exposure of confidential secret or token Beamer API token dast-cwe-checks!136
  • Add 798.18 Exposure of confidential secret or token Codecov Access Token dast-cwe-checks!136
  • Add 798.19 Exposure of confidential secret or token Coinbase Access Token dast-cwe-checks!136
  • Add 798.20 Exposure of confidential secret or token Clojars API token dast-cwe-checks!136
  • Add 798.21 Exposure of confidential secret or token Confluent Access Token dast-cwe-checks!136
  • Add 798.22 Exposure of confidential secret or token Confluent Secret Key dast-cwe-checks!136
  • Add 798.23 Exposure of confidential secret or token Contentful delivery API token dast-cwe-checks!136
  • Add 798.24 Exposure of confidential secret or token Databricks API token dast-cwe-checks!136
  • Add 798.25 Exposure of confidential secret or token Datadog Access Token dast-cwe-checks!136
  • Add 798.26 Exposure of confidential secret or token Discord API key dast-cwe-checks!136
  • Add 798.27 Exposure of confidential secret or token Discord client ID dast-cwe-checks!136
  • Add 798.28 Exposure of confidential secret or token Discord client secret dast-cwe-checks!136
  • Add 798.29 Exposure of confidential secret or token Doppler API token dast-cwe-checks!136
  • Add 798.30 Exposure of confidential secret or token Dropbox API secret dast-cwe-checks!136
  • Add 798.31 Exposure of confidential secret or token Dropbox long lived API token dast-cwe-checks!136
  • Add 798.32 Exposure of confidential secret or token Dropbox short lived API token dast-cwe-checks!136
  • Add 798.33 Exposure of confidential secret or token Droneci Access Token dast-cwe-checks!136
  • Add 798.34 Exposure of confidential secret or token Duffel API token dast-cwe-checks!136
  • Add 798.35 Exposure of confidential secret or token Dynatrace API token dast-cwe-checks!136
  • Add 798.36 Exposure of confidential secret or token EasyPost API token dast-cwe-checks!136
  • Add 798.37 Exposure of confidential secret or token EasyPost test API token dast-cwe-checks!136
  • Add 798.38 Exposure of confidential secret or token Etsy Access Token dast-cwe-checks!136
  • Add 798.39 Exposure of confidential secret or token facebook dast-cwe-checks!136
  • Add 798.40 Exposure of confidential secret or token Fastly API key dast-cwe-checks!136
  • Add 798.41 Exposure of confidential secret or token Finicity Client Secret dast-cwe-checks!136
  • Add 798.42 Exposure of confidential secret or token Finicity API token dast-cwe-checks!136
  • Add 798.43 Exposure of confidential secret or token Flickr Access Token dast-cwe-checks!136
  • Add 798.44 Exposure of confidential secret or token Finnhub Access Token dast-cwe-checks!136
  • Add 798.45 Exposure of confidential secret or token Finicity Public Key dast-cwe-checks!136
  • Add 798.46 Exposure of confidential secret or token Flutterwave Secret Key dast-cwe-checks!136
  • Add 798.47 Exposure of confidential secret or token Flutterwave Encryption Key dast-cwe-checks!136
  • Add 798.48 Exposure of confidential secret or token Frame.io API token dast-cwe-checks!136
  • Add 798.49 Exposure of confidential secret or token Freshbooks Access Token dast-cwe-checks!136
  • Add 798.50 Exposure of confidential secret or token GoCardless API token dast-cwe-checks!136
  • Add 798.51 Exposure of confidential secret or token GCP API key dast-cwe-checks!136
  • Add 798.52 Exposure of confidential secret or token GitHub Personal Access Token dast-cwe-checks!136
  • Add 798.53 Exposure of confidential secret or token GitHub OAuth Access Token dast-cwe-checks!136
  • Add 798.54 Exposure of confidential secret or token GitHub App Token dast-cwe-checks!136
  • Add 798.55 Exposure of confidential secret or token GitHub Refresh Token dast-cwe-checks!136
  • Add 798.56 Exposure of confidential secret or token Gitlab Personal Access Token dast-cwe-checks!136
  • Add 798.57 Exposure of confidential secret or token Gitter Access Token dast-cwe-checks!136
  • Add 798.58 Exposure of confidential secret or token HashiCorp Terraform user/org API token dast-cwe-checks!136
  • Add 798.59 Exposure of confidential secret or token Heroku API Key dast-cwe-checks!136
  • Add 798.60 Exposure of confidential secret or token HubSpot API Token dast-cwe-checks!136
  • Add 798.61 Exposure of confidential secret or token Intercom API Token dast-cwe-checks!136
  • Add 798.62 Exposure of confidential secret or token Kraken Access Token dast-cwe-checks!136
  • Add 798.63 Exposure of confidential secret or token Kucoin Access Token dast-cwe-checks!136
  • Add 798.64 Exposure of confidential secret or token Kucoin Secret Key dast-cwe-checks!136
  • Add 798.65 Exposure of confidential secret or token Launchdarkly Access Token dast-cwe-checks!136
  • Add 798.66 Exposure of confidential secret or token Linear API Token dast-cwe-checks!136
  • Add 798.67 Exposure of confidential secret or token Linear Client Secret dast-cwe-checks!136
  • Add 798.68 Exposure of confidential secret or token LinkedIn Client ID dast-cwe-checks!136
  • Add 798.69 Exposure of confidential secret or token LinkedIn Client secret dast-cwe-checks!136
  • Add 798.70 Exposure of confidential secret or token Lob API Key dast-cwe-checks!136
  • Add 798.71 Exposure of confidential secret or token Lob Publishable API Key dast-cwe-checks!136
  • Add 798.72 Exposure of confidential secret or token Mailchimp API key dast-cwe-checks!136
  • Add 798.73 Exposure of confidential secret or token Mailgun public validation key dast-cwe-checks!136
  • Add 798.74 Exposure of confidential secret or token Mailgun private API token dast-cwe-checks!136
  • Add 798.75 Exposure of confidential secret or token Mailgun webhook signing key dast-cwe-checks!136
  • Add 798.76 Exposure of confidential secret or token MapBox API token dast-cwe-checks!136
  • Add 798.77 Exposure of confidential secret or token Mattermost Access Token dast-cwe-checks!136
  • Add 798.78 Exposure of confidential secret or token MessageBird API token dast-cwe-checks!136
  • Add 798.79 Exposure of confidential secret or token MessageBird client ID dast-cwe-checks!136
  • Add 798.80 Exposure of confidential secret or token Netlify Access Token dast-cwe-checks!136
  • Add 798.81 Exposure of confidential secret or token New Relic user API Key dast-cwe-checks!136
  • Add 798.82 Exposure of confidential secret or token New Relic user API ID dast-cwe-checks!136
  • Add 798.83 Exposure of confidential secret or token New Relic ingest browser API token dast-cwe-checks!136
  • Add 798.84 Exposure of confidential secret or token npm access token dast-cwe-checks!136
  • Add 798.85 Exposure of confidential secret or token Nytimes Access Token dast-cwe-checks!136
  • Add 798.86 Exposure of confidential secret or token Okta Access Token dast-cwe-checks!136
  • Add 798.87 Exposure of confidential secret or token Plaid Client ID dast-cwe-checks!136
  • Add 798.88 Exposure of confidential secret or token Plaid Secret key dast-cwe-checks!136
  • Add 798.89 Exposure of confidential secret or token Plaid API Token dast-cwe-checks!136
  • Add 798.90 Exposure of confidential secret or token PlanetScale password dast-cwe-checks!136
  • Add 798.91 Exposure of confidential secret or token PlanetScale API token dast-cwe-checks!136
  • Add 798.92 Exposure of confidential secret or token PlanetScale OAuth token dast-cwe-checks!136
  • Add 798.93 Exposure of confidential secret or token Postman API token dast-cwe-checks!136
  • Add 798.94 Exposure of confidential secret or token Private Key dast-cwe-checks!136
  • Add 798.95 Exposure of confidential secret or token Pulumi API token dast-cwe-checks!136
  • Add 798.96 Exposure of confidential secret or token PyPI upload token dast-cwe-checks!136
  • Add 798.97 Exposure of confidential secret or token Rubygem API token dast-cwe-checks!136
  • Add 798.98 Exposure of confidential secret or token RapidAPI Access Token dast-cwe-checks!136
  • Add 798.99 Exposure of confidential secret or token Sendbird Access ID dast-cwe-checks!136
  • Add 798.100 Exposure of confidential secret or token Sendbird Access Token dast-cwe-checks!136
  • Add 798.101 Exposure of confidential secret or token SendGrid API token dast-cwe-checks!136
  • Add 798.102 Exposure of confidential secret or token Sendinblue API token dast-cwe-checks!136
  • Add 798.103 Exposure of confidential secret or token Sentry Access Token dast-cwe-checks!136
  • Add 798.104 Exposure of confidential secret or token Shippo API token dast-cwe-checks!136
  • Add 798.105 Exposure of confidential secret or token Shopify access token dast-cwe-checks!136
  • Add 798.106 Exposure of confidential secret or token Shopify custom access token dast-cwe-checks!136
  • Add 798.107 Exposure of confidential secret or token Shopify private app access token dast-cwe-checks!136
  • Add 798.108 Exposure of confidential secret or token Shopify shared secret dast-cwe-checks!136
  • Add 798.109 Exposure of confidential secret or token Slack token dast-cwe-checks!136
  • Add 798.110 Exposure of confidential secret or token Slack Webhook dast-cwe-checks!136
  • Add 798.111 Exposure of confidential secret or token Stripe dast-cwe-checks!136
  • Add 798.112 Exposure of confidential secret or token Square Access Token dast-cwe-checks!136
  • Add 798.113 Exposure of confidential secret or token Squarespace Access Token dast-cwe-checks!136
  • Add 798.114 Exposure of confidential secret or token SumoLogic Access ID dast-cwe-checks!136
  • Add 798.115 Exposure of confidential secret or token SumoLogic Access Token dast-cwe-checks!136
  • Add 798.116 Exposure of confidential secret or token Travis CI Access Token dast-cwe-checks!136
  • Add 798.117 Exposure of confidential secret or token Twilio API Key dast-cwe-checks!136
  • Add 798.118 Exposure of confidential secret or token Twitch API token dast-cwe-checks!136
  • Add 798.119 Exposure of confidential secret or token Twitter API Key dast-cwe-checks!136
  • Add 798.120 Exposure of confidential secret or token Twitter API Secret dast-cwe-checks!136
  • Add 798.121 Exposure of confidential secret or token Twitter Access Token dast-cwe-checks!136
  • Add 798.122 Exposure of confidential secret or token Twitter Access Secret dast-cwe-checks!136
  • Add 798.123 Exposure of confidential secret or token Twitter Bearer Token dast-cwe-checks!136
  • Add 798.124 Exposure of confidential secret or token Typeform API token dast-cwe-checks!136
  • Add 798.125 Exposure of confidential secret or token Yandex API Key dast-cwe-checks!136
  • Add 798.126 Exposure of confidential secret or token Yandex AWS Access Token dast-cwe-checks!136
  • Add 798.127 Exposure of confidential secret or token Yandex Access Token dast-cwe-checks!136
  • Add 798.128 Exposure of confidential secret or token Zendesk Secret Key dast-cwe-checks!136
• Replace ZAP rules 10023 and 90022 with 209.2 in browser based scan (!624)

Docker Images

• registry.gitlab.com/security-products/dast:3.0.11