Get Started
- CodeAnt AI
- Control Center
- Pull Request Review
- IDE
- Compliance
- Anti-Patterns
- Code Governance
- Infrastructure Security Database
- Application Security Database
- Apex
- Bash
- C
- Clojure
- Cpp
- Csharp
- Dockerfile
- Elixir
- Lang
- Best practice
- Correctness
- Correctness
- Security
- Command-injection
- Rce-code
- Rce-eex
- Sql-injection
- Traversal-file
- Traversal-send-download
- Traversal-send-file
- Unsafe-atom-interpolation
- Unsafe-binary-to-term
- Xss-content-type
- Xss-controller-html
- Xss-raw
- Phoenix
- Fingerprints
- Generic
- Go
- Html
- Java
- Javascript
- Json
- Kotlin
- Ocaml
- Php
- Problem-based-packs
- Python
- Ruby
- Rust
- Scala
- Solidity
- Swift
- Terraform
- Typescript
- Yaml
Xss-content-type
Xss content type
The application is dynamically setting the Content-Type of a connection response. If an attacker is able to set arbitrary content types for an HTTP response containing user input, the attacker is likely to be able to leverage this for cross-site scripting (XSS).
Likelihood: LOW
Confidence: MEDIUM
CWE:
- CWE-79: Improper Neutralization of Input During Web Page Generation
OWASP:
- A03:2021 - Injection