CAMD Administrative & General Services ZAP Scan

[github-actions]

• Site: https://api.epa.gov
  New Alerts

  • Cross-Domain Misconfiguration [10098] total: 12:
    • https://api.epa.gov/easey/dev/camd-services/bookmarks/1.2
    • https://api.epa.gov/easey/dev/camd-services/bookmarks
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/allowance-compliance
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/allowance-holdings
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/allowance-transactions
    • ..
  • Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec) [10035] total: 5:
    • https://api.epa.gov/easey/dev/camd-services/bulk-files
    • https://api.epa.gov/easey/dev/camd-services/reports/list
    • https://api.epa.gov/easey/dev/camd-services/reports?reportCode=reportCode&facilityId=1.2&monitorPlanId=monitorPlanId&testId=testId&qceId=qceId&teeId=teeId&year=1.2&quarter=1.2
    • https://api.epa.gov/easey/dev/camd-services/workspace/reports/list
    • https://api.epa.gov/easey/dev/camd-services/workspace/reports?reportCode=reportCode&facilityId=1.2&monitorPlanId=monitorPlanId&testId=testId&qceId=qceId&teeId=teeId&year=1.2&quarter=1.2
  • Timestamp Disclosure - Unix [10096] total: 1:
    • https://api.epa.gov/easey/dev/camd-services/bulk-files
  • A Client Error response code was returned by the server [100000] total: 34:
    • https://api.epa.gov/easey/dev/camd-services/admin/qa-maintenance/cert-events/id
    • https://api.epa.gov/easey/dev/camd-services/admin/qa-maintenance/extension-exemptions/id
    • https://api.epa.gov/easey/dev/camd-services/admin/qa-maintenance/test-summary/id
    • https://api.epa.gov/easey/dev/camd-services/admin/em-submission-access?orisCode=1.2&monitorPlanId=monitorPlanId&year=1.2&quarter=1.2&status=OPEN
    • https://api.epa.gov/easey/dev/camd-services/admin/error-suppressions?checkTypeCode=checkTypeCode&checkNumber=1.2&checkResult=checkResult&severityCode=ADMNOVR&orisCode=1.2&locations=locations&reasonCode=APPROVE&beginDateHrQtr=beginDateHrQtr&endDateHrQtr=endDateHrQtr&active=true
    • ..
  • Non-Storable Content [10049] total: 10:
    • https://api.epa.gov/easey/dev/camd-services/bookmarks/1.2
    • https://api.epa.gov/easey/dev/camd-services/bookmarks
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/allowance-compliance
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/allowance-holdings
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/allowance-transactions
    • ..
  • Re-examine Cache-control Directives [10015] total: 1:
    • https://api.epa.gov/easey/dev/camd-services/bulk-files
  • Retrieved from Cache [10050] total: 5:
    • https://api.epa.gov/easey/dev/camd-services/bulk-files
    • https://api.epa.gov/easey/dev/camd-services/reports/list
    • https://api.epa.gov/easey/dev/camd-services/reports?reportCode=reportCode&facilityId=1.2&monitorPlanId=monitorPlanId&testId=testId&qceId=qceId&teeId=teeId&year=1.2&quarter=1.2
    • https://api.epa.gov/easey/dev/camd-services/workspace/reports/list
    • https://api.epa.gov/easey/dev/camd-services/workspace/reports?reportCode=reportCode&facilityId=1.2&monitorPlanId=monitorPlanId&testId=testId&qceId=qceId&teeId=teeId&year=1.2&quarter=1.2
  • Storable and Cacheable Content [10049] total: 1:
    • https://api.epa.gov/easey/dev/camd-services/bulk-files

• Site: https://api-easey-dev.app.cloud.gov
  New Alerts

  • Unexpected Content-Type was returned [100001] total: 4:
    • https://api-easey-dev.app.cloud.gov/winscp.ini
    • https://api-easey-dev.app.cloud.gov/WS_FTP.ini
    • https://api-easey-dev.app.cloud.gov?aaa=bbb
    • https://api-easey-dev.app.cloud.gov?class.module.classLoader.DefaultAssertionStatus=nonsense
  • A Client Error response code was returned by the server [100000] total: 67:
    • https://api-easey-dev.app.cloud.gov
    • https://api-easey-dev.app.cloud.gov/
    • https://api-easey-dev.app.cloud.gov/._darcs
    • https://api-easey-dev.app.cloud.gov/.bzr
    • https://api-easey-dev.app.cloud.gov/.DS_Store
    • ..
  • Non-Storable Content [10049] total: 1:
    • https://api-easey-dev.app.cloud.gov/camd-services/swagger-json

View the following link to download the report.
RunnerID:5560932915

[github-actions]

• Site: https://api.epa.gov
  New Alerts

  • Sec-Fetch-Dest Header is Missing [90005] total: 3:
    • https://api.epa.gov/easey/dev/camd-services/bulk-files
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/apportioned-emissions/quarter
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/apportioned-emissions/state
  • Sec-Fetch-Mode Header is Missing [90005] total: 3:
    • https://api.epa.gov/easey/dev/camd-services/bulk-files
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/apportioned-emissions/quarter
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/apportioned-emissions/state
  • Sec-Fetch-Site Header is Missing [90005] total: 3:
    • https://api.epa.gov/easey/dev/camd-services/bulk-files
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/apportioned-emissions/quarter
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/apportioned-emissions/state
  • Sec-Fetch-User Header is Missing [90005] total: 3:
    • https://api.epa.gov/easey/dev/camd-services/bulk-files
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/apportioned-emissions/quarter
    • https://api.epa.gov/easey/dev/camd-services/bulk-files/apportioned-emissions/state

• Site: https://api-easey-dev.app.cloud.gov

View the following link to download the report.
RunnerID:5629341235

[github-actions]

• Site: https://api.epa.gov

• Site: https://api-easey-dev.app.cloud.gov
  New Alerts

  • Sec-Fetch-Dest Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/camd-services/swagger-json
  • Sec-Fetch-Mode Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/camd-services/swagger-json
  • Sec-Fetch-Site Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/camd-services/swagger-json
  • Sec-Fetch-User Header is Missing [90005] total: 1:
    • https://api-easey-dev.app.cloud.gov/camd-services/swagger-json

View the following link to download the report.
RunnerID:5699075743

[github-actions]

• Site: https://api.epa.gov

• Site: https://api-easey-dev.app.cloud.gov
  New Alerts

  • Base64 Disclosure [10094] total: 1:
    • https://api-easey-dev.app.cloud.gov/camd-services/swagger-json

View the following link to download the report.
RunnerID:5769326896

[github-actions]

• Site: https://api.epa.gov

• Site: https://api-easey-dev.app.cloud.gov
  Resolved Alerts

  • Sec-Fetch-Dest Header is Missing [90005] total: 1:
  • Sec-Fetch-Mode Header is Missing [90005] total: 1:
  • Sec-Fetch-Site Header is Missing [90005] total: 1:
  • Sec-Fetch-User Header is Missing [90005] total: 1:

View the following link to download the report.
RunnerID:5983389419