Area: Website and certificates
JavaScript libraries
JavaScript libraries (jQuery, Bootstrap, AngularJS and others) with a visible version in your homepage HTML, and their known vulnerabilities according to a local database. No script is downloaded.
What it can report
Open each one to see what it means and how to fix it.
JavaScript library with known vulnerabilities
What it means
jquery is a free code library that your website appears to load for ready-made features. The version your homepage appears to load has published security flaws. Ward deduces this from the file name, without testing or downloading anything.
What could happen
A flaw in a library can let someone run their own code in your visitors' browsers while they're on your site, for example to show a fake login box or capture what they type. The risk depends on how the site uses the library, and the version label can be wrong if someone patched it by hand.
How an attacker would use it
Someone adds a malicious snippet to a comment or a form field of your site. Because the old library handles it carelessly, it runs in the next visitor's browser, shows a fake “session expired” box and captures the password they type.
How to fix it
- Make a backup of the website, or ask your host to do it.
- Ask whoever maintains your website to update jquery to the latest version.The library usually comes with the theme or a plugin, so updating those, or the content system, is often how it gets updated.
- If a theme or plugin carries an old copy, ask its maker for an update or look for an alternative.
- Test the site afterwards, especially menus, forms and sliders, which often use these libraries.
How to check it's fixed
Ward reads the jquery version from your homepage again. Mark the finding as “Pending verification” and Ward will check it again within a minute or two. Once the problem is gone, it moves to “Resolved” on its own.
Who usually fixes it
Your IT person
Example with sample data. In your dashboard, the explanation uses your own domain and details.
JavaScript library no longer supported
What it means
angularjs is a code library your homepage appears to load, and its makers no longer maintain that version. Ward deduces it from the file name your homepage loads.
What could happen
Any flaw discovered from now on will stay unfixed, so the library becomes a growing weak point. Nothing is broken today, which is why this is a planning matter more than an emergency.
How an attacker would use it
A new flaw is found in the old library and published. Because nobody fixes it, every site that still uses it stays exposed, and automated programs start looking for those sites. Yours is on the list for as long as it keeps loading it.
How to fix it
- Ask whoever maintains your website where angularjs comes from: your own pages, the theme or a plugin.
- Plan the move to a supported version or to an alternative.
- Update or replace the theme or plugin that carries the old copy, if that's where it comes from.
- Until then, keep the rest of the site updated and avoid showing third-party content without filtering it.
How to check it's fixed
Ward reads the angularjs version from your homepage again. Mark the finding as “Pending verification” and Ward will check it again within a minute or two. Once the problem is gone, it moves to “Resolved” on its own.
Who usually fixes it
Your IT person
Example with sample data. In your dashboard, the explanation uses your own domain and details.