Kategori: Remediation Guides
Apache Log4j 1.x Multiple Vulnerabilities: How to Migrate to Log4j 2
The Log4j 1.x vulnerabilities finding means a Log4j 1.x jar (usually log4j-1.2.17.jar) was found on the host. Log4j 1.x reached end of…
JQuery UI < 1.13.0 Multiple XSS: How to Fix CVE-2021-41184 (Nessus 156443 and 163599)
JQuery UI < 1.13.0 Multiple XSS is a Nessus finding (plugin 156443) meaning a web server hosts a jQuery UI library older…
Google Chrome Multiple Vulnerabilities in Nessus: How to Fix Them
Google Chrome < 134.0.6998.177 Vulnerability is a Nessus finding meaning a Windows host runs a Chrome build older than the fix for…
CVE-2022-42475: How to Fix the FortiOS SSL-VPN Heap Overflow (FG-IR-22-398)
CVE-2022-42475 is a critical heap-based buffer overflow in the FortiOS and FortiProxy SSL-VPN daemon (sslvpnd) that lets an unauthenticated remote attacker run…
7-Zip CVE-2025-0411: How to Fix the Nessus “7-Zip < 24.09 (ZDI-25-045)” Finding
7-Zip CVE-2025-0411 (ZDI-25-045) is a Mark-of-the-Web bypass in 7-Zip before 24.09: files opened from a crafted archive nested inside another archive lose…
How to Set X-Content-Type-Options: nosniff (Missing Header Fix)
The finding “Missing ‘X-Content-Type-Options’ Header” means your web server sends responses without X-Content-Type-Options: nosniff, so browsers may guess (sniff) a response’s type…
Cookies Not Marked Secure: How to Set the Secure Flag on Session Cookies
“Cookies not marked secure” means the web application sends a Set-Cookie header without the Secure attribute, so browsers also send it over…
How to Set the Permissions-Policy Header (Missing Permissions Policy Fix)
A “Missing Permissions Policy” finding means your web server returns pages without a Permissions-Policy header, so the site never tells the browser…
How to Set ms-DS-MachineAccountQuota to 0 (Users Allowed to Join Computers to the Domain)
ms-DS-MachineAccountQuota is the domain attribute that caps how many computer accounts a non-administrator can create. Its default of 10, plus the “Add…
Cookie Without HttpOnly Flag: How to Fix “Web Application Cookies Not Marked HttpOnly”
A cookie without HttpOnly flag finding means the server sends a Set-Cookie header lacking the HttpOnly attribute, so any JavaScript on the…