Issues

[Web] - Missing Secure Flag on Session Cookie

Host Header Injection

Detailed server configuration in the error

Stored XSS on "Node Label"

Missing Access Control on "Geocoder Configuration"

Missing Access Control on "Grafana Endpoints"

Stored XSS on "Scheduled Outages"

Stored XSS on "MIB Compiler"

Stored XSS on "Monitoring Locations"

Missing Access Control on Geocoder Configuration.

Self XSS via User-Agent

Improper Error Handling

Stored XSS On-Call Roles.

Weak Basic Authentication Protocol Used

Stored XSS on Quick-Add Node

Stored XSS in Discovery configuration

[Web] - WebServer Fingerprinting

[Web] - Vulnerable Angular JS version in Use

[Web] - Missing Secure & HTTP Only Flags on Session Cookie

[Web] - Session Fixation/Misconfigured Session Cookie Implementation

[Web] - Password field with autocomplete enabled on Login page

[Web] - Inadequate Account Lockout Policy

[Web] - Weak Password Policy

Internal Port Scan using SSRF

Open Redirect using Host Header Injection

Server Banner Disclosure