licensing_portal_api_zap_scan

[github-actions]

• Site: https://justice.gov.bc.ca
  New Alerts
  • Content Security Policy (CSP) Header Not Set [10038] total: 1:
    • https://justice.gov.bc.ca/train-security/swagger/v1/swagger.json
  • A Server Error response code was returned by the server [100000] total: 1:
    • https://justice.gov.bc.ca/latest/meta-data/
  • Permissions Policy Header Not Set [10063] total: 1:
    • https://justice.gov.bc.ca/train-security/swagger/v1/swagger.json
  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 1:
    • https://justice.gov.bc.ca/train-security/swagger/v1/swagger.json
  • Strict-Transport-Security Header Not Set [10035] total: 1:
    • https://justice.gov.bc.ca/train-security/swagger/v1/swagger.json
  • Unexpected Content-Type was returned [100001] total: 16:
    • https://justice.gov.bc.ca
    • https://justice.gov.bc.ca/
    • https://justice.gov.bc.ca/4481941550774886350
    • https://justice.gov.bc.ca/actuator/health
    • https://justice.gov.bc.ca/latest/meta-data/
    • ..
  • A Client Error response code was returned by the server [100000] total: 13:
    • https://justice.gov.bc.ca/4481941550774886350
    • https://justice.gov.bc.ca/actuator/health
    • https://justice.gov.bc.ca/latest/meta-data/
    • https://justice.gov.bc.ca/train-security/
    • https://justice.gov.bc.ca/train-security/1406562397743612384
    • ..
  • Storable and Cacheable Content [10049] total: 1:
    • https://justice.gov.bc.ca/train-security/swagger/v1/swagger.json

View the following link to download the report.
RunnerID:12624334248

---

ZAP by Checkmarx

[github-actions]

• Site: https://justice.gov.bc.ca
  New Alerts

  • Missing Anti-clickjacking Header [10020] total: 2:
    • https://justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • https://justice.gov.bc.ca/licensing/personal-licence/payment-error/
  • Sub Resource Integrity Attribute Missing [90003] total: 2:
    • https://justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • https://justice.gov.bc.ca/licensing/personal-licence/payment-error/
  • Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 1:
    • https://justice.gov.bc.ca/licensing/api/controlling-members/invites
  • X-Content-Type-Options Header Missing [10021] total: 8:
    • https://justice.gov.bc.ca/licensing/api/configuration
    • https://justice.gov.bc.ca/licensing/api/licence-fee?serviceTypeCode=PSSO
    • https://justice.gov.bc.ca/licensing/api/metadata/address/id
    • https://justice.gov.bc.ca/licensing/api/metadata/address?search=search&country=country&lastId=lastId
    • https://justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • ..
  • Modern Web Application [10109] total: 2:
    • https://justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • https://justice.gov.bc.ca/licensing/personal-licence/payment-error/
  • Re-examine Cache-control Directives [10015] total: 7:
    • https://justice.gov.bc.ca/licensing/api/configuration
    • https://justice.gov.bc.ca/licensing/api/licence-fee?serviceTypeCode=PSSO
    • https://justice.gov.bc.ca/licensing/api/metadata/address/id
    • https://justice.gov.bc.ca/licensing/api/metadata/address?search=search&country=country&lastId=lastId
    • https://justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • ..

  Resolved Alerts

  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 1:
  • Strict-Transport-Security Header Not Set [10035] total: 1:

View the following link to download the report.
RunnerID:12638856181

[github-actions]

• Site: https://justice.gov.bc.ca
  Resolved Alerts
  • A Server Error response code was returned by the server [100000] total: 1:
  • A Client Error response code was returned by the server [100000] total: 4515:

View the following link to download the report.
RunnerID:12738514827

[github-actions]

• Site: https://spd-train.justice.gov.bc.ca
  New Alerts
  • Content Security Policy (CSP) Header Not Set [10038] total: 2:
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/payment-error/
  • Missing Anti-clickjacking Header [10020] total: 2:
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/payment-error/
  • Sub Resource Integrity Attribute Missing [90003] total: 2:
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/payment-error/
  • Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 9:
    • https://spd-train.justice.gov.bc.ca/licensing/api/configuration
    • https://spd-train.justice.gov.bc.ca/licensing/api/licence-fee?serviceTypeCode=PSSO
    • https://spd-train.justice.gov.bc.ca/licensing/api/metadata/address/id
    • https://spd-train.justice.gov.bc.ca/licensing/api/metadata/address?search=ZAP&country=country&lastId=lastId
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/payment-error/
    • ..
  • Permissions Policy Header Not Set [10063] total: 2:
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/payment-error/
  • Unexpected Content-Type was returned [100001] total: 667:
    • https://spd-train.justice.gov.bc.ca
    • https://spd-train.justice.gov.bc.ca/
    • https://spd-train.justice.gov.bc.ca/7900891248243066364
    • https://spd-train.justice.gov.bc.ca/licensing
    • https://spd-train.justice.gov.bc.ca/licensing/
    • ..
  • X-Content-Type-Options Header Missing [10021] total: 8:
    • https://spd-train.justice.gov.bc.ca/licensing/api/configuration
    • https://spd-train.justice.gov.bc.ca/licensing/api/licence-fee?serviceTypeCode=PSSO
    • https://spd-train.justice.gov.bc.ca/licensing/api/metadata/address/id
    • https://spd-train.justice.gov.bc.ca/licensing/api/metadata/address?search=ZAP&country=country&lastId=lastId
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • ..
  • Modern Web Application [10109] total: 2:
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/payment-error/
  • Non-Storable Content [10049] total: 12:
    • https://spd-train.justice.gov.bc.ca/licensing/api/applicant
    • https://spd-train.justice.gov.bc.ca/licensing/api/applicant/id
    • https://spd-train.justice.gov.bc.ca/licensing/api/applicant/merge/oldApplicantId/newApplicantId
    • https://spd-train.justice.gov.bc.ca/licensing/api/applicant/search
    • https://spd-train.justice.gov.bc.ca/licensing/api/business-licence-application/licenceAppId
    • ..
  • Re-examine Cache-control Directives [10015] total: 6:
    • https://spd-train.justice.gov.bc.ca/licensing/api/configuration
    • https://spd-train.justice.gov.bc.ca/licensing/api/licence-fee?serviceTypeCode=PSSO
    • https://spd-train.justice.gov.bc.ca/licensing/api/metadata/address?search=ZAP&country=country&lastId=lastId
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/application/payment-error/
    • https://spd-train.justice.gov.bc.ca/licensing/personal-licence/payment-error/
    • ..

View the following link to download the report.
RunnerID:13533012472

[github-actions]

• Site: https://spd-train.justice.gov.bc.ca
  New Alerts
  • Application Error Disclosure [90022] total: 1:
    • https://spd-train.justice.gov.bc.ca/licensing/api/permit-application

View the following link to download the report.
RunnerID:13889026312

[github-actions]

• Site: https://spd-train.justice.gov.bc.ca
  New Alerts
  • PII Disclosure [10062] total: 1:
    • https://spd-train.justice.gov.bc.ca/licensing/api/licence-application-documents/anonymous/files

View the following link to download the report.
RunnerID:14161597591

[github-actions]

• Site: https://spd-train.justice.gov.bc.ca
  Resolved Alerts
  • PII Disclosure [10062] total: 1:

View the following link to download the report.
RunnerID:14298266084

[github-actions]

• Site: https://spd-train.justice.gov.bc.ca
  New Alerts

  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 1:
    • https://spd-train.justice.gov.bc.ca/licensing/swagger/v1/swagger.json

  Resolved Alerts

  • Missing Anti-clickjacking Header [10020] total: 2:
  • Sub Resource Integrity Attribute Missing [90003] total: 2:
  • Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 10:
  • X-Content-Type-Options Header Missing [10021] total: 9:
  • Modern Web Application [10109] total: 2:
  • Re-examine Cache-control Directives [10015] total: 7:

View the following link to download the report.
RunnerID:15381234744