Active scanner rules version 73

Changed

• Maintenance changes.
• Depends on an updated version of the Common Library add-on.
• The following scan rules and their alerts have been renamed to clarify that they're time based (Issue 7341).
  • SQL Injection - Oracle
  • SQL Injection - MsSQL
  • SQL Injection - MySQL
  • SQL Injection - Hypersonic
  • SQL Injection - SQLite
  • SQL Injection - PostgreSQL
• The Remote OS Command Injection scan rule has been broken into two rules; one feedback based, and one time based (Issue 7341). This includes assigning the time based rule ID 90037.
• The External Redirect scan rule payload were slightly re-ordered to prioritize HTTPS variants.
• For Alerts raised by the SQL Injection scan rules the Attack field values are now simply the payload, not an assembled description.
• The Cross Site Scripting (Reflected) scan rule was updated to address potential false negatives when the injection context is a tag name and there is some filtering.
• The Path Traversal scan rule now includes further details when directory matches are made (Issue 8379).
• Add help details about behavior of scan rules which leverage OAST (Issue 8682).

Added

• Rules (as applicable) have been tagged in relation to HIPAA and PCI DSS.
• The Cloud Metadata Potentially Exposed scan rules now has a CWE reference.
• Scan rules which execute time based attacks now include the "TEST_TIMING" alert tag.
• The XPath Injection scan rule now supports error patterns provided via the Custom Payloads add-on (Issue 8958). A minimum of Custom Payloads 0.15.0 is required to take advantage of this optional functionality.