Features

Vulnerability	Description
Cookie No HttpOnly Flag	Missing HttpOnly attribute in cookies.
Cookie Without Secure Flag	Cookies not using the Secure flag.
Password Autocomplete in Browser	Browser storing passwords automatically.
Incomplete or No Cache-control and Pragma HTTP Header Set	Missing cache-control headers.
Web Browser XSS Protection Not Enabled	XSS protection disabled in browsers.
Cross-Domain JavaScript Source File Inclusion	Unrestricted JavaScript from other domains.
Content-Type Header Missing	No Content-Type header in response.
X-Frame-Options Header Scanner	Lack of X-Frame-Options header.
X-Content-Type-Options Header Missing	Missing X-Content-Type-Options header.
Information Disclosure - Debug Error Messages	Debug messages revealed externally.
Information Disclosure - Sensitive Informations in URL	Sensitive data exposed in URLs.
Information Disclosure - Sensitive Information in HTTP Referrer Header	Sensitive data in Referrer header.
HTTP Parameter Override	Manipulation of HTTP parameters.
Information Disclosure - Suspicious Comments	Revealing comments in source code.
Viewstate Scanner	Vulnerabilities in ViewState.
Secure Pages Include Mixed Content	Mixed HTTP and HTTPS content.
Source Code Disclosure - /WEB-INF folder	Exposure of source code in /WEB-INF.
Remote Code Execution - Shell Shock	Remote code execution via Shell Shock.
Backup File Disclosure	Accessible or exposed backup files.
Weak Authentication Method	Insufficient authentication mechanisms.
Absence of Anti-CSRF Tokens	Missing CSRF protection tokens.
Private IP Disclosure	Exposure of internal IP addresses.
Anti CSRF Tokens Scanner	Lack of CSRF token check.
HTTP Parameter Pollution scanner	HTTP parameter manipulation.
Heartbleed OpenSSL Vulnerability	Exposure via Heartbleed vulnerability.
Cross-Domain Misconfiguration	Improper cross-domain configurations.
Source Code Disclosure - CVE-2012-1823	Public exposure of source code.
Remote Code Execution - CVE-2012-1823	Code execution vulnerability CVE-2012-1823.
External Redirect	Redirects to untrusted external sites.
Session ID in URL Rewrite	Session IDs exposed in URLs.
Buffer Overflow	Memory overflow vulnerabilities.
Format String Error	Incorrect string formatting issues.
Integer Overflow Error	Overflow vulnerabilities in integer values.
CRLF Injection	Carriage return and line feed attacks.
Parameter Tampering	Alteration of request parameters.
Server Side Include	Vulnerabilities in server-side includes.
Cross Site Scripting (Reflected	Reflected XSS vulnerabilities.
Session Fixation	Hijacking sessions through fixation.
Cross Site Scripting (Persistent	Persistent XSS in applications.
Cross Site Scripting (Persistent) - Prime	Persistent XSS targeting prime systems.
Cross Site Scripting (Persistent) - Spider	Persistent XSS targeting spiders.
SQL Injection	Injection of SQL queries.
SQL Injection - MySQL	SQL injection specific to MySQL.
SQL Injection - Hypersonic SQL	SQL injection specific to Hypersonic SQL.
SQL Injection - Oracle	SQL injection specific to Oracle.
SQL Injection - PostgreSQL	SQL injection specific to PostgreSQL.
Possible Username Enumeration	Identification of usernames via response.
Source Code Disclosure - SVN	Source code disclosed through SVN.
Script Active Scan Rules	Active scanning script rules.
Script Passive Scan Rules	Passive scanning script rules.
Path Traversal	Directory traversal vulnerabilities.
Remote File Inclusion	Inclusion of unintended remote files.
Insecure JSF ViewState	Insecure JavaServer Faces ViewState.
Charset Mismatch	Incorrect character set specification.
Server Side Code Injection	Injection vulnerabilities in server-side code.
Remote OS Command Injection	Remote execution of OS commands.
XPath Injection	Injection vulnerabilities in XPath expressions.
Application Error Disclosure	Error messages revealing application details.
XML External Entity Attack	Vulnerabilities in XML parsing.
Generic Padding Oracle	Padding oracle vulnerabilities.
Expression Language Injection	Injection in expression language processing.
SOAP Action Spoofing	Tampering SOAP actions.
Insecure HTTP Method	Use of insecure HTTP methods.
SOAP XML Injection	Injection in SOAP XML.
WSDL File Passive Scanner - Passive/alpha)	Scanning WSDL files for vulnerabilities.
Loosely Scoped Cookie	Cookies scoped too broadly.

Note