mon-entreprise.urssaf.fr

Guider les créateurs et créatrices d’entreprise.

environ 8 heures

dinum

fiche beta.gouv.fr

Nmap

Scan Summary :

Scan Summary :

Impact	Description	Documentation
-20	Content Security Policy (CSP) implemented unsafely. This includes `'unsafe-inline'` or `data:` inside `script-src`, overly broad sources such as `https:` inside `object-src` or `script-src`, or not restricting the sources for `object-src` or `script-src`.	Remove `unsafe-inline` and `data:` from `script-src`, overly broad sources from `object-src` and `script-src`, and ensure `object-src` and `script-src` are set.
-20	`X-Frame-Options` (XFO) header not implemented.	Documentation for x-frame-options-sameorigin-or-deny
-5	`X-Content-Type-Options` header not implemented.	Documentation for x-content-type-options-nosniff

Scan Summary :

A+

risk	name
High (Medium)	Vulnerable JS Library
Medium (High)	CSP: Failure to Define Directive with No Fallback
Medium (High)	CSP: script-src unsafe-eval
Medium (High)	CSP: script-src unsafe-inline
Medium (High)	CSP: style-src unsafe-inline
Medium (High)	Content Security Policy (CSP) Header Not Set
Medium (Medium)	Cross-Domain Misconfiguration
Medium (Medium)	Missing Anti-clickjacking Header
Low (Medium)	Insufficient Site Isolation Against Spectre Vulnerability
Low (Medium)	Permissions Policy Header Not Set
Low (Medium)	X-Content-Type-Options Header Missing
Low (Low)	Timestamp Disclosure - Unix
Informational (High)	Sec-Fetch-Dest Header is Missing
Informational (High)	Sec-Fetch-Mode Header is Missing
Informational (High)	Sec-Fetch-Site Header is Missing
Informational (High)	Sec-Fetch-User Header is Missing
Informational (Medium)	Base64 Disclosure
Informational (Medium)	Modern Web Application
Informational (Medium)	Retrieved from Cache
Informational (Medium)	Storable and Cacheable Content
Informational (Low)	Information Disclosure - Suspicious Comments
Informational (Low)	Re-examine Cache-control Directives
Informational (Low)	User Controllable HTML Element Attribute (Potential XSS)