Passive scanner rules version 54

Changed

• The Big Redirect scan rule will now also alert on responses that have multiple HREFs (idea from xnl-h4ck3r).
• The references for the following scan rules are now all HTTPS (Issue 8262) and in some cases updated:
  • Loosely Scoped Cookie
  • Charset Mismatch
  • Strict-Transport-Security Header
  • Content Security Policy (CSP) Header Not Set
  • CSP
  • Session ID in URL Rewrite
  • HTTP Server Response Header
  • Cookie Poisoning
  • User Controllable HTML Element Attribute (Potential XSS)
  • X-Content-Type-Options Header Missing
  • Content-Type Header Missing
  • Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
  • Retrieved from Cache
• The Absence of Anti-CSRF Tokens scan rule now takes into account the Partial Match settings from the Anti-CSRF Options (Issue 8280).
• On Non-LOW threshold, PII Scan rule only evaluates HTML, JSON and XML responses (Issue 8264).
• Maintenance changes.
• The following rules now include example alert functionality for documentation generation and cross linking purposes (Issues 6119, and 8189).
  • Big Redirect
  • Information Disclosure: Debug Errors
  • Information Disclosure: In URL
  • Information Disclosure: Referrer
  • Cookie Poisoning
  • User Controllable Charset
  • Open Redirect
  • User Controllable HTML Element Attribute (Potential XSS)
  • Heartbleed OpenSSL Vulnerability (Indicative)
  • Strict-Transport-Security Header
  • Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
  • X-Content-Type-Options Header Missing
  • Content-Type Header Missing
• The CWE for the Cookie Poisoning scan rule was updated to a more specific one.
• The Strict-Transport-Security Header and Big Redirect scan rules now use alert references for their different types of alerts (Issue 7100).