From dbb556396b488fc068ced89c70ac289675ba8007 Mon Sep 17 00:00:00 2001 From: Engincan VESKE <43685404+EngincanV@users.noreply.github.com> Date: Thu, 4 Jul 2024 10:15:56 +0300 Subject: [PATCH] Update penetration-test-report.md --- en/others/penetration-test-report.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/en/others/penetration-test-report.md b/en/others/penetration-test-report.md index b592e07f..1876054d 100644 --- a/en/others/penetration-test-report.md +++ b/en/others/penetration-test-report.md @@ -302,8 +302,6 @@ Manually confirm that the timestamp data is not sensitive, and that the data can This vulnerability was reported as a positive alert, because ABP uses the [zxcvbn](https://github.com/dropbox/zxcvbn) library for [password complexity indicators](https://docs.abp.io/en/commercial/latest/ui/angular/password-complexity-indicator-component). This library is one of the most used password strength estimator and it does not disclosure any sensitive data related to web server's timestamp and therefore it's a **false-positive** alert. ---- - ### X-Content-Type-Options Header Missing [Risk: Low] - Positive (Fixed) - *[GET] — https://localhost:44349/client-proxies/account-proxy.js?_v=638550091940000000 (and other client-proxies related URLs)*