The last few dependency updates have introduced deprecations in the bugtracker add-on. As mentioned here: zaproxy/zap-extensions#3273

They should be addressed.

🐛 Bug report

Description

Hacking Instructor doesn't take into account a custom domain.

Here's a part of my custom config:

application:
  domain: "example.com"

Take the "Login Jim" challenge instructor script. At the stage of inputting Jim's email, the instructor script expects "jim@juice-sh.op" and not "jim@example.com".

Looking at the source code, looks li

What would you like added?
Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. Based upon the generic syntax for Uniform Resource Identifiers (URI), CPE includes a formal name format, a method for checking names against a system, and a description format for binding text and tests to a name.

The usage of CPE naming is

Slack us first!
Hello. I write about problem here:
https://owasp.slack.com/archives/C2P5BA8MN/p1624892081234100

Be informative
As additional into slack I find the same behaviour with Risk Accepted findings. Into Metrics I see 0 Risk Accepted findings, but I have 1 Risk Accepted finding

Bug description
No error. Metrics into product, or metrics dushboard has incorrect info

Description

BeanUtils is a library that is doing automatic mapping to Java object.
It can cause arm when the attack controls part of the list of properties being sets. BeanUtils does not blacklist properties like class, classloader or other objects that are likely to load arbitrary classes and possibly run code.

Code

import org.apache.commons.beanutils.BeanUtils;

public

The current swagger definition is autogenerated. The automatically generated definitions rely on reflection and annotations to create the documentation. The reflection capabilities are poor at best and lead to missing API parameters. Annotations can help in some cases, but the only fix for Swagger is to create individual POJOs for every possible request. This will lead to unnecessary large number

Description

Windows triple dot is a path traversal that we do not detect. See #1991.

I's probably best to add this to an existing rule.

I just finished dealing with auto-migrated issues for this article, it could definitely use some content updates:
https://github.com/OWASP/www-community/blob/master/pages/HttpOnly.md it still talks about old versions of IE and Opera.

This article includes an extensive table that needs re-working after the auto-migration as well (which I did not tackle).

Is Opera even relevant in 2020? Do