The web server on the remote host allows read access to files within a 'CVS' directory exposing files tracked inside. This potential flaw can be used to access content from the web server that might otherwise be private.

The web server on the remote host allows read access to files within a '.svn' directory exposing files tracked inside. This potential flaw can be used to access content from the web server that might otherwise be private & permit download of the source code of listed pages hosted on the remote server.

The web server on the remote host allows read access to a OSX .DS_Store file. This potential flaw can be used to access content from the web server that might otherwise be private.

The web server on the remote host contains publically accessible WS_FTP log files. These log files are produced by WS_FTP and contain details of source/destination file names, date of upload and other potentially sensitive information. This may be used to access content from the web server that might otherwise be private.

An error or warning message has been found on the remote web server. It may be possible for an attacker to view sensitive information and conduct further attacks.

The web server on the remote host contains gitignore configuration files. This potential flaw can be used to access content from the web server that might otherwise be private.

An information disclosure vulnerability exists in the remote web server due to the disclosure of the web.config file. An unauthenticated, remote attacker can exploit this, via a simple GET request, to disclose potentially sensitive configuration information.

The web server on the remote host allows read access to a Git repository. This potential flaw can be used to access content from the web server that might otherwise be private.

The remote web server contains an application which is affected by a path disclosure issue. It may be possible for an attacker to view full path names and conduct further attacks.

Credit card numbers are used in applications where a user is able to purchase
  goods and/or services.

  A credit card number is a sensitive piece of information and should be handled
  as such. Cyber-criminals will use various methods to attempt to compromise credit
  card information that can then be used for fraudulent purposes.

  Through the use of regular expressions and CC number format validation using
  known issuer numbers and luhn check validation, the scanner was able to
  discover a credit card number located within the affected page.

A modern web application will be reliant on several different programming languages.

  These languages can be broken up in two flavours. These are client-side languages
  (such as those that run in the browser -- like JavaScript) and server-side
  languages (which are executed by the server -- like ASP, PHP, JSP, etc.) to form
  the dynamic pages (client-side code) that are then sent to the client.

  Because all server side code should be executed by the server, it should never be
  seen by the client. However in some scenarios, it is possible that:

  1. The server side code has syntax errors and therefore is not executed by the
  server but is instead sent to the client.
  2. Using crafted requests it is possible to force the server into displaying the
  source code of the application without executing it.

  As the server-side source code often contains sensitive information, such as
  database connection strings or details into the application workflow, this can be
  extremely risky.

  Cyber-criminals will attempt to discover pages that either accidentally or
  forcefully allow the server-side source code to be disclosed, to assist in
  discovering further vulnerabilities or sensitive information.

  Scanner has detected server-side source code within the server's response.

  _(False positives may occur when requesting binary files such as images
  (.JPG or .PNG) and may require manual verification.)_

Concurrent Version System (CVS) and Subversion (SVN) provide a method for
  application developers to control different versions of their code.

  Occasionally, the developer's version or user information can be stored incorrectly
  within the code and may be visible to the end user (either in the HTML or code
  comments). As one of the initial steps in information gathering, cyber-criminals
  will spider a website and using automated methods attempt to discover any CVS/SVN
  information that may be present in the page.

  This will aid them in developing a better understanding of the deployed
  application (potentially through the disclosure of version information), or it
  may assist in further information gathering or social engineering attacks.

  Using the same automated methods, scanner was able to detect CVS or SVN details
  stored within the affected page.

Email addresses are typically found on "Contact us" pages, however, they can also
  be found within scripts or code comments of the application. They are used to
  provide a legitimate means of contacting an organisation.

  As one of the initial steps in information gathering, cyber-criminals will spider
  a website and using automated methods collect as many email addresses as possible,
  that they may then use in a social engineering attack.

  Using the same automated methods, scanner was able to detect one or more email
  addresses that were stored within the affected page.

Private, or non-routable, IP addresses are generally used within a home or
  company network and are typically unknown to anyone outside of that network.

  Cyber-criminals will attempt to identify the private IP address range being used
  by their victim, to aid in collecting further information that could then lead
  to a possible compromise.

  Scanner discovered that the affected page returned a RFC 1918 compliant private
  IP address and therefore could be revealing sensitive information.

  This finding typically requires manual verification to ensure the context is
  correct, as any private IP address within the HTML body will trigger it.

A common practice when administering web applications is to create a copy/backup
  of a particular file or directory prior to making any modification to the file.
  Another common practice is to add an extension or change the name of the original
  file to signify that it is a backup (examples include `.bak`, `.orig`, `.backup`,
  etc.).

  During the initial recon stages of an attack, cyber-criminals will attempt to
  locate backup files by adding common extensions onto files already discovered on
  the webserver. By analysing the response headers from the server they are able to
  determine if the backup file exists.
  These backup files can then assist in the compromise of the web application.

  By utilising the same method, scanner was able to discover a possible backup file.

A common practice when administering web applications is to create a copy/backup
  of a particular directory prior to making any modification.
  Another common practice is to add an extension or change the name of the original
  directory to signify that it is a backup (examples include `.bak`, `.orig`, `.backup`,
  etc.).

  During the initial recon stages of an attack, cyber-criminals will attempt to
  locate backup directories by adding common extensions onto directories already
  discovered on the webserver. By analysing the response headers from the server
  they are able to determine if a backup directory exists.
  These backup directories can then assist in the compromise of the web application.

  By utilising the same method, scanner was able to discover a possible backup directory.

ID	Name	Severity
98671	CVS Entries Detected	Medium
98650	SVN Repository Detected	Medium
98646	.DS_Store File Detected	Medium
98632	WS_FTP.LOG File Detected	Medium
98611	Error Message	Info
98595	Gitignore File Detected	Medium
98594	Web.config File Information Disclosure	Medium
112531	Git Repository Detected	Medium
112550	Full Path Disclosure	Info
98129	Credit card number disclosure	Medium
98098	Source code disclosure	Medium
98079	CVS/SVN user disclosure	Medium
98078	E-mail address disclosure	Info
98077	Private IP address disclosure	Low
98074	Backup file	Medium
98073	Backup directory	Medium

Data Exposure Family for Web Application Scanning