Reports

Scheduled report name 

Provide a name for the Scheduled report.

Schedule name

Provide a name for the schedule.

Time

Set a time with a time zone when the schedule must be triggered. The time value is saved in UTC (Coordinated Universal Time) and the offset corresponds to the system time in the user web browser and therefore might differ for users accessing the schedule options in different time zones.

Example: A schedule time set to 10:00 in July (summer time) by a user located in Copenhagen (UTC+2) appears as 09:00 to a user located in London (UTC+1) at the same time.

Recurrence / Every

Determines the frequency of the schedule. Select one of the available options in the menu:

None

Once - The schedule is set to run only once on a select start date. 

Hour - Set the recurrence window by providing the Number of Hours.

Day - Set the recurrence window by providing the Number of Days in this field. 
Example: If set to 2, it means that the schedule runs once in every 2 days.

Week - Select the days of the week for the schedule.

Month - Select the occurrence of days, weekday, day of the month for the schedule.

Year - Select the day of year for the schedule.

On these days

Determines what days of the week the schedule should run. Select one of the available options in the menu.

Occurrence of the weekday

Determines occurrence of the selected weekday the schedule should run.

2,3 - will schedule 2nd and 3rd selected weekday in the month

Day of the month

Determines what day of the month the schedule should run.

4,8,10 - will schedule 4th, 8th, and 10th day of the month

Starts on

Set the start date for the schedule. 

Ends on

Set an end date for the schedule. The schedule becomes inactive after this date.

Ends after_occurrences

Set the number of occurrences the schedule must be triggered before it becomes inactive.

Never ends

If set, the schedule never becomes inactive.

Technical details

(no additional sections)

Web application summary

Web application summary
Web application details

A01

Broken Access Control

Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

A02

Cryptographic Failures

Poor protection of data in transit and/or at rest. For example, passwords, credit card numbers, health records, personal information, and business secrets require extra protection, mainly if that data falls under privacy laws, e.g., EU's General Data Protection Regulation (GDPR), or regulations, e.g., financial data protection such as PCI Data Security Standard (PCI DSS).

A03

Injection

Injection flaws occur when an attacker can manipulate user input to inject malicious code into an application as part of a command or a query and execute it. This can lead to data loss, corruption, or unauthorized access to sensitive data.

A04

Insecure Design

Insecure design is a broad category representing different weaknesses, expressed as “missing or ineffective control design". An insecure design cannot be fixed by a perfect implementation as by definition, needed security controls were never created to defend against specific attacks.

A05

Security Misconfiguration

Security misconfigurations occur when security features are not configured properly. This includes presence of improperly configured permissions, default accounts and their passwords, stack traces or overly verbose error messages as well as poor hardening of the used frameworks and libraries leaving systems and applications vulnerable to attacks.

A06

Vulnerable and Outdated Components

Vulnerabilities introduced by the use of third-party or open source components with known security issues. These components may contain unpatched vulnerabilities, which can be exploited by attackers to gain unauthorized access, steal data, or execute malicious code.

A07

Identification and Authentication
Failures

Vulnerabilities related to the verification of user identity and access control. This can include weak password policies, lack of multi-factor authentication, insufficient user validation, and improper session management. These vulnerabilities can be exploited by attackers to bypass authentication mechanisms, impersonate legitimate users, gain unauthorized access to sensitive data or functionalities, and conduct other malicious activities.

A08

Software and Data Integrity Failures

Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations. An example of this is where an application relies upon plugins, libraries, or modules from untrusted sources, repositories, and content delivery networks (CDNs). An insecure CI/CD pipeline can introduce the potential for unauthorized access, malicious code, or system compromise.

A09

Security Logging and Monitoring
Failures

Lack of proper logging and monitoring of security events. This can include issues such as missing or incomplete logs, insufficient monitoring, and inadequate incident response procedures. These vulnerabilities can be exploited by attackers to evade detection and remain undetected on the affected system for an extended period, leading to further compromises and data theft.

A10

Server-Side Request Forgery (SSRF)

SSRF flaws occur whenever a web application is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall, VPN, or another type of network access control list (ACL).

High (H)

Specialized access conditions exist. For example:
In most configurations, the attacking party must already have elevated privileges or spoof additional systems in addition to the attacking system (e.g., DNS hijacking).
The attack depends on social engineering methods that would be easily detected by knowledgeable people. For example, the victim must perform several suspicious or atypical actions.
The vulnerable configuration is seen very rarely in practice.

Medium (M)

The access conditions are somewhat specialized; the following are examples:
The attacking party is limited to a group of systems or users at some level of authorization, possibly untrusted.
Some information must be gathered before a successful attack can be launched.
The affected configuration is non-default, and is not commonly configured (e.g., vulnerability present when a server performs user account authentication via a specific scheme, but not present for another authentication scheme).
The attack requires a small amount of social engineering that might occasionally fool cautious users (e.g., phishing attacks that modify a web browser's status bar to show a false link, having to be on someone's "buddy" list before sending an IM exploit)

Low (L)

Specialized access conditions or extenuating circumstances do not exist. The following are examples:
The affected product typically requires access to a wide range of systems and users, possibly anonymous and untrusted (e.g.,Internet-facing web or mail server).
The affected configuration is default or ubiquitous.
The attack can be performed manually and requires little skill or additional information gathering.
The "race condition" is a lazy one (i.e., it is technically a race but easily winnable).

Local (L)

 Vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local (shell) account. Examples of locally exploitable vulnerabilities are peripheral attacks such as Firewire/USB DMA attacks, and local privilege escalations (e.g., sudo).

Adjacent Network (A)

Vulnerability exploitable with adjacent network access requires the attacker to have access to either the broadcast or collision domain of the vulnerable software. Examples of local networks include local IP subnet, Bluetooth, IEEE 802.11, and local Ethernet segment.

Network (N)

A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such vulnerability is often termed "remotely exploitable". An example of a network attack is an RPC buffer overflow.

Multiple (M)

Exploiting the vulnerability requires that the attacker authenticate two or more times, even if the same credentials are used each time. An example is an attacker authenticating to an operating system in addition to providing credentials to access an application hosted on that system.

Single (S)

One instance of authentication is required to access and exploit the vulnerability.

None (N)

Authentication is not required to access and exploit the vulnerability.

Partial (P)

There is considerable informational disclosure. Access to some system files is possible, but the attacker does not have control over what is obtained, or the scope of the loss is constrained. An example is a vulnerability that divulges only certain tables in a database.

Complete (C)

There is total information disclosure, resulting in all system files being revealed. The attacker is able to read all of the system's data (memory, files, etc.)

None (N)

There is no impact to the confidentiality of the system.

Partial (P)

Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited. For example, system or application files may be overwritten or modified, but either the attacker has no control over which files are affected or the attacker can modify files within only a limited context or scope.

Complete (C)

There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised. The attacker is able to modify any files on the target system.

None (N)

There is no impact to the integrity of the system.

Partial (P)

There is reduced performance or interruptions in resource availability. An example is a network-based flood attack that permits a limited number of successful connections to an Internet service.

Complete (C)

 There is total information disclosure, resulting in all system files being revealed. The attacker is able to read all of the system's data (memory, files, etc.)

None (N)

There is no impact to the availability of the system.