1、漏洞总数
AppScan Source:91
Fortify:121
2、Disclaimer.htm:34(Cross-Site Scripting:DOM)的漏洞Fortify能扫描出来,AppScan Source扫描不出来
另外,Fortify能扫描出比较多Persistent类型的XSS漏洞
并且归类比较好(分DOM、Persistent、Reflected类型列出)
3、AdminLoginServlet.java:35(Password Management:Hardcoded Password)的漏洞Fortify能扫描出来,AppScan Source扫描不出来
4、Fortify扫出的DBUtil.java:238(Access Control:Database)在AppScan中被归类到SQL Injection
5、admin.jsp:18(Password Management:Empty Password)属于误报
<script language="javascript">
function confirmpass(myform)
{
if (myform.password1.value.length && (myform.password1.value==myform.password2.value))
{
return true;
}
else
{
myform.password1.value="";
myform.password2.value="";