From ace67c9c47ce4720a0257e3be6ab7370af764808 Mon Sep 17 00:00:00 2001
From: Aaron Weaver <aweaver@ml-c02tw3n0hv2r.localdomain>
Date: Mon, 13 Nov 2017 08:37:41 -0500
Subject: [PATCH] Update API to support Dojo changes and CI/CD example

---
 .gitignore                                 | 106 ++++++++
 README.rst                                 |   1 +
 defectdojo_api/__init__.py                 |   2 +-
 defectdojo_api/__init__.pyc                | Bin 0 -> 145 bytes
 defectdojo_api/defectdojo.py               |   6 +-
 defectdojo_api/defectdojo.pyc              | Bin 0 -> 28741 bytes
 examples/.DS_Store                         | Bin 0 -> 8196 bytes
 examples/dojo_ci_cd.py                     | 286 +++++++++++++++------
 examples/reports/.DS_Store                 | Bin 0 -> 6148 bytes
 examples/reports/bandit/generic_bandit.csv |   2 +
 examples/reports/burp/burp.xml             | 267 +++++++++++++++++++
 examples/reports/junit_dojo.xml            |  97 +++++++
 12 files changed, 680 insertions(+), 87 deletions(-)
 create mode 100644 .gitignore
 create mode 100644 defectdojo_api/__init__.pyc
 create mode 100644 defectdojo_api/defectdojo.pyc
 create mode 100644 examples/.DS_Store
 create mode 100644 examples/reports/.DS_Store
 create mode 100644 examples/reports/bandit/generic_bandit.csv
 create mode 100644 examples/reports/burp/burp.xml
 create mode 100644 examples/reports/junit_dojo.xml

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..10da2a6
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,106 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+env/
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+.hypothesis/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# pyenv
+.python-version
+
+# celery beat schedule file
+celerybeat-schedule
+
+# SageMath parsed files
+*.sage.py
+
+# dotenv
+.env
+
+# virtualenv
+.venv
+venv/
+ENV/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+
+# Config file
+config/config.json
+
+test.py
diff --git a/README.rst b/README.rst
index 6eba370..994b382 100644
--- a/README.rst
+++ b/README.rst
@@ -13,6 +13,7 @@ Several quick start options are available:
 - Install with pip (recommended): :code:`pip install defectdojo_api`
 - `Download the latest release <https://github.com/aaronweaver/defectdojo_api/releases/latest>`_
 - Clone the repository: :code:`git clone https://github.com/aaronweaver/defectdojo_api`
+- If you are testing the api locally make sure to set the PYTHONPATH. export PYTHONPATH=/path/totheapi/defectdojo_api:$PYTHONPATH
 
 Example
 -------
diff --git a/defectdojo_api/__init__.py b/defectdojo_api/__init__.py
index 10939f0..1f356cc 100644
--- a/defectdojo_api/__init__.py
+++ b/defectdojo_api/__init__.py
@@ -1 +1 @@
-__version__ = '0.1.2'
+__version__ = '1.0.0'
diff --git a/defectdojo_api/__init__.pyc b/defectdojo_api/__init__.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..9b3663b1192b6aeeddfdb776439a94a1091fb937
GIT binary patch
literal 145
zcmZSn%*!=pFH2N10~9baFfceUFfbHzF)%QsFfc?hFr+Xt1ZyyX#8?>^7!33b^^E*9
zK<Y}k85kJi<I7TuiZk=`;^Q?yW*~@SDUcDVX{pI2DfwCX@rebQ`tk9Zd6^~g@p=W7
WB^(S43^uv>DWy57b|B-5LD~Vv7aMp0

literal 0
HcmV?d00001

diff --git a/defectdojo_api/defectdojo.py b/defectdojo_api/defectdojo.py
index 830389d..a9d68ed 100644
--- a/defectdojo_api/defectdojo.py
+++ b/defectdojo_api/defectdojo.py
@@ -153,9 +153,9 @@ class DefectDojoAPI(object):
         """
         return self._request('GET', 'engagements/' + str(engagement_id) + '/')
 
-    def create_engagement(self, name, product_id, lead_id, status, target_start, target_end, active='true',
-        pen_test='false', check_list='false', threat_model='false', risk_path="", test_strategy="", progress="",
-        done_testing=""):
+    def create_engagement(self, name, product_id, lead_id, status, target_start, target_end, active='True',
+        pen_test='False', check_list='False', threat_model='False', risk_path="", test_strategy="", progress="",
+        done_testing='False'):
         """Creates an engagement with the given properties.
 
         :param name: Engagement name.
diff --git a/defectdojo_api/defectdojo.pyc b/defectdojo_api/defectdojo.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..35ab2615cd920482745008bb444d8ed76ca9c94d
GIT binary patch
literal 28741
zcmZSn%*!Ro%@&o+00qnp3=9qo3=G8u3=9k@3=AoZ3^@!8QE)aRLlh%SoC%4|3}!Pi
zq%bq&urTDZGDNX4Fs86Dq_Q)lF*2mEGPE!-G&3+nMsYBtu)##x;i8-%i-I*c7#J8b
z|NsC0-!GGqfq_8-M3itdFfhc&m!%dJXXfX{$CvOjFfh2JrllsAxa4Q$I|g{d9WTtl
zz~BUO{Awl!hExWylNcDHm_UZ7GBczwF{J1~Q7S9QsV(dvcc!p_+!4hNbtc4#Ees4%
zoD3;oCq{8Gq;P=Ma5JQEf*CwubGR5%xEWfQ7@~L?Qh31Pd|+{iEnEyKybLWY3{m_H
zDSTjA0frQQh7<u95@bk$AOVIHA%+$XhA2TK?GQuokirZtd<;=SFfCjRDIyFl%nVV&
z3@M^u>qHn*#J~(um>M016mhT`F_;J!Ly81gM4TZ-60BGPEG5Oz!pIOM31*|YL7Jh3
zjUh@3n-rQ#OfDBgiVQ=G5JQwSLy9ceIvJQba^R4Zg>f<U!bRj6TDTda<X|clz#8RY
zTrP$bMX-+)7*e<xQk1|RQH06D4dG%)Q3iWN39L*7tV|iEjEf;f6>NwKSXK=zs|uFo
zVn|U3+o%TS>VOq!fEBAFiD-gFG#FAf8B(-BK5b@Xh|+>7&|yf?1}o5J2nyEF1tnTJ
z1_lPlJO#%9PlfWL#Dap<B89a4A_YWJ*DGOSU|=XS%(P)(U`PgK3lIj0IfL}iVPIgW
zVFaah@fsEe@f0Qo@frq(cm{?VCI%3Lk)ehe%wS@uVF5Fk8ERO;3>JnOb})mLp@t32
zU}LD^U?@%mWs(whh(R0-d7L0okXalIHJo5|oD4NwU<R1XVqqwr!BE1@kj2B0#mkVz
z2g>t|c?=9GEDXUKtRPn|V`gCR%*!mvOw7rwN>xZi@*mjinR&$}iFwJXdR$xzP+(P%
zSd^Hnkda?pVx<t0k*W|H<O2?xl8jVj?Zv4@WvNAa3L2?;>3TW}86_nJR{Hum`N@en
zV7(Rw1_t_w;MCVdw;{10Gd?@D5@HD`9<oy_71C4lQi~ExQd1Q2^Ayl*gsCY=Oi$HA
zH?6cdwFqJqh^3HNT%4br2{x!avm^s-6jVQkR**xW1)dc+RG=J%l6-~a#GD)*u<n%9
zw8YY!5{1lSg)&17Gs;qnGSe#Ki;Hut6oLy<lQYvQ6*AMnrWK_YmZlb$6f2Zx=Hw_q
z6oO3z1(SNQLU6E;LUL+RNoHDRa$-rUjsn!CVvzkMMWvX2Ey>JH%`YvnQt$`~2~dFY
z6f*M^ic^#G^HPf8Mt~e^Y=Gg|f};G2%wj8rfTH}0N^snQf(GVJ4CSBzjZaKZ&4bwp
z5>NmOC={0zW#*-$Sg3@E^!UVrO#NtRaK<WOm<;l^l|p2GsX}sMo<d?yalS$^H1HA?
zz)1-lGN6DcElyQPELKR)$xO{FQ7Fz#Nd-&611+&wAyJ_?GcP?SRUs`iCsjcsIX|x?
zF*7eSFCCs%Knbd#D6=fFBvk>F+7k0pz%c=G2h=1@h5RCrMTrU}r3E>u3i)XYN%<ui
zU^CT=6$%ndGT_ERvr0;8QfWFUG&A!`iWOkNr~op&D7CmCKd(5oSVy6>I5n*_2OQd9
z4e6PA=}6hG7?fZ2LE%*bs)zN9`B5rfa7g-TfCNie7#J8pX{Uspfq?;(c(YS0!GfT8
z0axH4L1?I#aDhrOc<Kb}0mpx8F_;ZaJzzGn7LZwxNCz7Y3ZW8^6TxmT0W}?99tCp>
z5|gtN)1hXT7Ukq*CK;CqfLb+~#feEdsqy8BMWCoC*5GDfU;rCgoSKss1oBG|$lM?{
z1_p*8kdJ~uh6jP19mEL|;{g%8Ac7CnN&z*UG(beL9RmY{erR!OQL%nvd1_)=YLR|=
zW{G|ZxV4g!pOp^|G@M+$f=aN{<Kr{)GE3s)LG~2OfJ_z?W#mLaCN@R^CQc?!Mi5R0
zRRACiYPx|d0$GqJ89}9T76YUnC}9NE49$!T;wj7w;=vjqKNiP;Jdj#aT9j7|PI8D$
z0xl#%gFL}WBN3ENijdL;G>w6yBQwQH!7~MvBtZ!oB!noo5$UHG6o~pD*<$@5kTW$v
z?ga;J35Z)<QUnnJHQ>PU4pJMRnF0<~FhPx=1qEk%YDqlU@Y148Lr{GLatQ-F*@2i(
zWFY1#q~@h3rl;nn=9OTEB|<J9HAE2-Si=>R2K5nYFhVy-6qG(eUJL>UEl52=In@JL
zh=G9t6u?MUlon-L!GoEN>|jnMGME(#it<xRld%LbR01u0p`us=7nI-ip$Z6wEJ!g_
zE!Be+RK$XU6=r^EQ6{*T1BzD$^23zq{9lq<j3q!pqG+KB62cmk;QSAgB^Zt%l^}&w
z4@6kz2OC~ml<9?(DnZp741-HhkSl5!7_t}`g28>zVo(D;2zOZtt)`GNHdq_DgoCg^
z*$-ThfeC7qW}sRNYHxgLQBDxtKP;HJOcByG$O8B0n;98u!Sw;WR!CuDkdO@402jq^
zXgST(MIo&yKNm|4f#h3Ql~9yp1#X-dfrBbFMIosYtkE&R6Ok^!H9#gP@q!C|a2;M;
zkds*gt_yNf^T5K80t@7%(xM!2pn(Z$gd8kCWv0Y~ycS<tloJ68Jy5O4z{by*DFW(W
zfvg6JfG{{w*n<Wq7#M1qK^>|hNf24X4C-##<bgY0MLM8L79_;P02Tr#pcH0M=ck65
zp_v)h1!{%_aZzS!S!%IDVonY?j6k(gF_thbPA$qy%uTgY2u@8bO3nZUDM%?u45Rg$
zlbM@YVx{0$nwykb1ge#bQj_zGQo!wYNSq*901kMt4sfFbW+*ro++9P8LCqhKV6i?p
z34;~ILz`IO76dqof>c1hQ3f@kKpMbZwPJ8ofeC8F7pQE_$t;Fc+{K{Lo?=jLW?*My
zWMkxI0%3TP2Q}Qlu?6Z)L$YuRBWUCYp4h=npk^ipXe%fY<owhUSY&`3I|`+sW;-}m
z(lg6a^B{tmDM*0_OYz02Mc_gZ)aX;lOi9gycA7Ht^N>^rse;lMD10CR3eEzMWUdCX
zAGMke5(CxRpk^P{f)Lbz1yvzn>p^Y-Wj_YCWKeK{oCQzhpo%t=fuWWaG)4eQ<Sd{u
zf)qwbie_Q}C2}UP5Hyi9G8EZ^(>-`V4V><o8H$3yV-2jJqz@K?WCd2x*k27RBrAZ*
z*x~~q-y=dFniUZ32P_!^Rtsk4St<Br7MFmMIaEv`Go@HT!%)Xa6C-DUvP(R)|5a?I
z;0kYyDS%|q`%mCpL2Nz>0w;b@aSU|^sQF$33f1D0#FElt@PH-A7P$S8<N!*;NIr$+
zvLH};&;V(M<SuPc#sXyknAw?mK{}v716dlRPW6NW>L7vh8j{OuKnVs^CNgj$avUhv
zfiU?wuL|T1MBF2{kTEhK!ZixmvLQkmoEec~mq3<8j{^c3Q-bQ@4eCIGGA6<YQ$V2&
z$)4a&X-H9ND!8b2OUx-wEddn^$)Fkx6jPw=3oh*@fa)ebP(DmyWH5u2do@f9&ETRB
z%m<JDf%wb}W;HCJjA>TG3L5b?t6>9WOS2kw&}g?=4F_nf+pLBYG}3KW!vz}MG^^nT
z4Ro8;@PLN7&1!f-1KVabe4t@%vs!*|Pm>8Yv@OU`!_Uyn#2Bmr>JAj2V`5-%E=o--
z0abM<aSR^?gOsraMfnAwF{e~4c^;H|FfuJh9*1X<6wuHIxE}x>Q^`!x!%&-(nwSDk
zD<P@HC7F5Y3LpVQO9xa=DwKeR2{3d*GBt{8g2DORO2IP^G=P;}lv-S@qu`&X;E|t`
zqNCuPpIeZVT9TTAVN^+C5h(79OA?DpPz(f%D5NBoU>RwH=t<2>LD7+#mx5h=Vsc4l
zS*n$SBbY`n=n7Kv;z2E9D}{j6JOvO7+~-H6MhrJ6XQU=)$AgLpD+Ol|TLHu-q^l$Y
zlmy~)^HWlDKx3jssfj5Hz91eUokf|&+3}z;E-M8%6WtdecgGi(fJSN4L8G^+#U%>C
zP%fxFT8yrtpeP?4ODI7I6D(H9O-(E=ElN!R4PX|e7A2$h*}=IIlp?_+70^Tn76hfC
zAaIEdDp!zW7d++#6-doX0oM+Ym;pDdV9@|ph6v#jurWwMSHj7_zyJ>haK(b+cZgw7
z&w+KP<maV=V>mM}9qh&c|KJdC^9d2h#rj~Gl*E!ma33H@8dNfig9vbK1S)ADwUIGM
zOp1Yl0qk{<cjGftz&;K#14)^K2n!Hl2_ir}{~&7+3p8U9WD8<}hRA|IP3a&<su!k$
zpmsYbp{2$nd<U8qDOLa#o1)B&?2H180*vffAQy8o$e$o1;H9b?BLf4dF(d$L>w_9Y
zObj&w@D@KaLy;-C=wkpicA6Q%a?n;03qw&LSdNjQ1Y8V*^f5ykQLGF_DWDb<NQea@
z#Kurm4xV`t0F}t#785%|Q5SetMgUYggM~O4isphRU<5!VHCTv~p=bjGXevekRBD5T
zxEP8KgC}JKKqWX>h?}A48bb{?*nwOS8+jOtUNY41fQ7grLc9z`e;8_b!9qL`AwGs8
ze#RO;un;dqh@YWIiLr(sEW`&9VqnN(hL-*%ETB3FJkTh}Af6%wQU<OIK>gq14@?XU
zp#`8~tym$E+`0fXK!#GmV-!)Kyor*tK>`@6pcxlj2?Rh!jYew=NSQQRTR>(Wp`AQf
z#ekBgV1k5diy&~BX#y(xOhE*wdLX^91b4~<LNQBjaDx?6l!A&aq@o+ti3Im1AcMf5
zf(=}VgC~(QQy}gFmE}R8!NkE+h=W?h#i=DoCHN6gix^acFo?5(d;4sRVoVSW>HUNH
zA%t);sEZ2<A`lI3GlNFVK&3kisQ3nz?#!S*FRZJ}2=3}Kf`y=kIup373!XhsftKZv
zek}{A)UIKH^lL$Vx8gmZs7CZ{p#55Ck%O~=ix}a7sswjVF-k5_aR%>8B99B<)kS)r
z7Mw&%Kz$9cjq#bV{xhWi3Tlf$ZG;XHfs-3}njf6f!1`(0TLsN$fSRB2Fn4e<GB6Z_
z>T&e0D*4^iT-2z9%`jkeQK3%2+CPQLq0}`5dZs9$3(n=Z$BRI@7(7%2Ca5vw1{%!(
zbxoiSmj?waq)!UZN1(g}&PSkWv`l7Dy$|ktGJ!_h%s|7S%nW9=EZ|lUcmYTXWcY^#
z(m4bV|Ey;~>KwvDmgJ5htojBeQ;gh_l3JWxlvz-cnV(0vTL|)Rd`V?NDncoUhdh)A
zD$l`F+DHb2+vRY*LEr^+s1XQm?1JVPu;vlaWJHiRD4~JXff}n+i%L*=nha?agIrje
zT%rz&P0*MU11G3O%+AQg3?B%D$0}%;6;wL1BDH;4k=wpHpkfm=ga9oaS-_<uWVjHs
zbVM3{Wn&OeVFxvU!3{&u$Yk+V2Bd}|Iq3lEGn5SG>4M(v1Emi{#DaKqNi9K$=yd^A
zWvD3wG|vF3z(E-doID^kHmD+jl%t^h4Jk|!CQ(13fbu-3;)RB#1t^t(i&8FFtqZAb
z;UxgPCIxlpKxqYgO$r}0W&xE9;0_6-+JwxEK&wqq!Yl3pWdV$86V%1UQD@Sl8Y}_j
zAVhx>G`b6^06`H1b{q20Eyy2`SOXUnpc)EEZ)P5Nw3r41x1jtCt_r~}3Is(S52zgB
zKn&TEUk9R3l7Q^Mr~tu&*hXhT65yN(8fznFk_4myWu_Q33<1d$;5-8AOa_70#efS*
zFhPw<4^$L^Dm{?(NuU4(S;oMY463R?a-gUM*LeP*(N;ES%~rz*9%cm%yP{NmSO-~a
z*}=LPK^^!M4p0ZZh8<ELg5s}On~}o$5IL!#4iJJO2GXlhP=NMpK>mbQcHo!+)pW2f
zFnZAm9lHV#Oj;>`m4n&X2OXiR!Gn}wwK#_-p~GwO$<RSk&_E=3z%4O7RiQMmBr^vx
zDhZWGomK-6mm$0iu7%;A0@u;0d1aYJ`FWsKH;7Ibcoi7B#gIxHk)@G}WJyq|1WJP7
z_34nz4VnoE3I<7pfC$9sS15=}o5C4di-UZa1xlXa!kL>HX+VpMIT@5tK@|)<u`UHA
zRtAPz4sb=T1Wte8HNl_}D-Pru-4tA-bHGb!7KS1ZQ2z%sB>=6_Ss99=K~*<M2r+h*
z2OhiP0QG{v#XCDgQ6qTl3cT1KEX2T&1xxfLOrW+Rc#MdXK|F;EG^7P?3V<u1(JVkx
z76=0MVsR%#aC-wOQ6m}~U=}=OLkd?=x`8BbP~jRx?=%idx}XLKD1kSC5;({e3_PIL
z2dKXfX?-B~^OHdp0cc_p-V(`&j@Sw_)Ce(v`t(8!HNx;T4)4<o!_zptPcIBw>JCn-
z@abz|&@35Ph=rjj6`T`<;c1+ep{N3!6NKU8vuq4S-Qb)c3@YBi8rd0&=7Dp9FnoNL
zgP~|6D9MA|#R(Ze<zy&20v^Q`2F<pCHF7Z&T?dci3WH|ez(U*%MX$i4xWb@WIIs{8
zL(yOGD6TMQMh+~*%TOf12pYu|2F=cah4>kYl)*!`!k|%Fun-?Zkr{YkR~WPx1uP`M
zP~^#2BLEIBL5RBq8H!>UYXreULJ%QH%S{-x)ucukGT;GPyioj!g@FOKKq@UWrz90L
zeFAEafTriuGV@Y0^U|@j;b7y9ZV(lq)!{H94bVb!(9-8L(7Y$cTK$yLf*kPbbSniH
z7*hdikpcm|xtS%I>7bSPRtml_Cb4>pQ$g$HODaL*E-;o)ez}f<Z)!?rX|9ffM`n5k
zc%`*-QD#YIa$*if9|NQ<Ei*O6N&)6=m<Wbam~HVnB?t=@a#D*yOLi0U6iBogZd^LD
zap~aRVUa>f1_dU<#)gobi4f9&1r97sFru?0vm_@KsWtBgPD7x@PGA`Ys9B(yTF^@4
z?9|Hg{36U5)zYFItcHMgj1XxAXnF!1+%BLs`S75|h#IguP&k6sA%`JWrB(`%>;X$>
z#o&q0M1_LHqLR$y(wxL1>`f_XZ!A7DB_6cm1vb=?nW9mwiLs|75oWp`co_^R_ZVUX
zHKM@;GZbYyg=}*{#WvWD;1(YR4ooV|%z;eKgI85S_FrUzRuh6G6f#p3ic)hD!L#-y
z`QTMrU>yp1kY#V6HGN2;@LfS(sd?F%dBr*kAw`L0nZ*jJCCPf23x&uSCIwA+g4>?(
zG6~FsmongqSa{Zp&&&f))57vRnru!9nm~F<33wp|wA_h@r*H7cEI4-{iGli?piF>J
z1*%oSX*E8l1Z**clU@Rw^i2hukCZAv$pYj`eg*~xSn`93f%=r-h=vJ(+y)MQumCiV
z6+=46p!Ni`NJbeU236URb_OWuf<TKegCaq*${@GG0xBpPBm!;|!n~eS0&dj9RK%y3
zlz^r+;Cz_v;2t|9WZ*&|hl2tJE&%G)frBEa1U#D!W~Y|~fd;<7GwU#~gL59Z&wvz0
z5J6C<4ICN}E~w274hvd!@<Fi+s#N1)p}H8<O!5Ks^Q95}eB>q)Ic)OB2|%lp;62A6
z#6S+LSi%@HfcgVGXpYu9g-U@34q){p`j|OP3zp=Df5;r%b41tx9zp;U)EGwqrCHE8
z0@VEPpf~~#C9q;HF<1%eo$-S@M3{r;Xd?*VrdJIcc(j2HvdD`O)V2gI>SBlRnLrIo
z5T66WX9l$@L3~aIVwQ5%@PitNX0-y~P9h7aX$ab&j5dqEh#7g10_sTx5(e$TITO+N
z0dwK020Au@G`NmXnUY$Pn3<EBqJSieQQ5*u1B5n&2>#|0x*L+qQ>_%7!(A0LGV@9>
zs!>pRVWr@bS)80-25#+w+5s4@K@=j0foE8d6=&p^=A<YjfwmDABkv8xFa@RHL79do
z-7IK%1s%j8T|a1P95_=3r55BDl|a^+Lyf_3cxG-vVseR<f(tC>AOc980t_v%_CGAo
zL-^npbrHly&`w+oZLsPT5$zd?#R^HOsd<nMu9;ZY-$83=@XSzfNooOjojg=972Jft
z<*%aDwA7;1yyVnknBR&)+k<f_2UiMK3iNEwfR~Jdvle9fAp=yKf;#=l<*DF0E(p9P
z0W^F7ZU}&q1-N+t4df#58Z}6C1%az+aD5D_@t`4;nV$zPMiF5F)(`e8XjvG177Q9H
z#rlvjHBc=HS*HLVegN%O3_>h616Amdwm~^)Bn>>_0djj#1&9l(oP)sAArc@iXn+8`
zT0W>6#DzOE2()B5s1_tv3?isM9><4RY6kV*KTt8R1geU~AhT+aRc4^|W*`jVfk<pC
z&9b5676PCl1<<$!D`@2uY%KyCcr5}OSO_}X#txosV+RXC$L2V|%kDYALeQ}}PVl$|
zCs>FT(t&3JkIg~q68OqAHi#TEc!3#ss1CGY1+t=z9U{lVP_z?VEr8cQfW{6{mYiJ$
z%Q1t7ETD4Gu?=p9q8H#%3jz4p1`k8gZ}6yv0DNqNm!XIcJZd4pkb+oyrU)LQ5P*+u
z@G}&dfCn-JU}GC4EDS~NjG$F#;G;Fb0~rhqS**~itAq_yvx0{jg&4$Bgh2rT9%=-&
zK#LbMBhNZQqj9t%Qy8tt(lM$RNI?iI>_JO|!8O}xMMkrJIlMI%gtH=m*I+@Fpi&;Z
zp#*0|PzO>19uG(9mV)~UkctV^Bg9%Uf$I>^1Q2AH98pD;g3Ls#j&QmbydV#!^Qd1%
zfx02ZsU@(!B53(gF{n;vkN}OSV~(anR@8w;+F=-*8eS&MDW<ic?WJs>Vmh0Hp-2=o
z-d@Yb0NNGF4inS@3$lX*GuatHt3kl$F*Sovj514M1XmxhiJ>$m(8xPjl!*bvVPybw
zSil@M2!|ESVTW+oz#I+;haJq}WH1BGc|jH@gAZy-;Q@D#KwDEl)pzj{@T!xX{KOQ{
za^w`yx|8J8;$qN76@}vD#60i`8%Rrkpk0&10?5cS=rk(OVq`}IA3nLAT7*%8fQ|rx
zZe$2Z1fBl^8M=a71UgbADOI7g0OTN0V-=ABj6iKSP!F;w3EWl#83msB0gp3*OaM>g
zf}3dwAy5Yeth^*Ky*LP*{6W!Q3`!T7xuCW?NT)uyp$Iau*bls`6RgEAKQ9%`$S+9E
z3j(*(K<QtD6O`aVvo4UyA@EMtCXg7o>D2;awSow6j-gGGh6GSN$nC{U3=GAfjh+nb
zJdB)7APkxf6=URuLIGwrMovb|1uLLdFYW~^@M$8%f))5Q5es~p2;789!Cd+YTFZnq
z^Z{M^nVyrMl$euK2^z>w%S;FFE=ev*1#cKl%qhl9WuVnb@IgG#pgL^xFG3gg)uEvN
z8Avm-9+((BNkNk`>4Tl%p*4{4NMnwmAwZZ72w}*W3~1O5;bN3gKyW_*oR&Z<Wf1#_
zX|Om3G*b>9H$!sDL{Q=ZNnk7$1@)3Z800|kdJj+%gY2opzn8dyfq?-Y#7JpC0bwo1
z2pEzSmL(bpS#X!z8J=R`B~5Z7Xk{a!w80+i;93q;127;hFa!A!+|>e)e}b$6b=yE2
zOTj~7V1gRsVW7emG#&=B0klCnF=rVl>_G(@11o%W4SWu_8#E-wzyMk*!v>ziWdn_J
z!TLh*%*l>9hszGnobWkZc2G?M?iRr3aKY#Nfra36xa{ybTu82F2hG-kR_1{A?1RcY
zw2jKSpySz6kfL?yWMIfTLeMtvpcGI^od&8~KqLLo{!cu396vJ;l8!+ABt*2ugZvGe
z$VFc81{$*mry_{SpmQUG3PC0pflLOCSi?*P50cYrXdE;ifR@GK&Rq{mZlJLO^sJ6N
zI-U&54j@c&wg**!)X(-X*OQj<aYYz`0sxc%K=F)ZDLA6QWdN9<MnM2-0izZKF#FDe
zVhCCwfC>Uo9DrzW@jF^ugHP2^AicH@>H_6KP}YD>d!-hETZ-tlG-y;0t^zr8gW>^^
zxxtk`TpidXa4MlejSWhWkn9XOGcUEM_!=mUP`APc^%$|{TxgMnSzE(ggKfqN5i+1|
zfisd)P^||(OA)+&5p~uIHS7uGQ*d(%W-x7PYfy;|&ZIDFUW39Nnm0k^BPd^jFgS0*
zmVQ%wD9&V1m4TQsgf^Q?^7C^PK<iRTsbJxnus4v&%tnw35!87CnGa6<D9u?=kRY-O
z&GQAq5nn*@14<YS$ZNep&H?3K5DktgT9%@FaYi1=@doN!AX>A~ehS>P;K~rOO%5au
zP96%GDe!y@)k9`9gQxyM=7M7w)Ea_BJa`dhetr&0oPz=w5$E8A8wjnLDYQxipdtfY
zID#xIW@W~;=M5D1ASZ(8(KG-Wt1ZHF9u_3Fz%?eQp#ln9PzM~`TL*Wt5Qza)Mk2}M
zOB0~gkw{8Qiy%hPE^&Z*<M6}*-xw){Gm(IbbWq|3VQ?Y=mBgUI5oU%G@H+7nMuui4
zhN5gxf2)>-p`sA9klZEK33NylXdsUjv?8H~89b=R0AhpA7zIhNfH>kQEDYix9(bFC
zxD9Ag11p1hEek`T5<_^N3RoLtA`00EHdIZZei&$YwitAVgcE2P80c_akT*fG3OdsQ
zw2&?_H?<_Ss2FmLOCsc8lKdjr8N6kQIi;z3;5o|p_{@^jqWJhs&~zR6blYgqSQ105
z9{Ak(Vo-*OHi*>&_n5)G<BY`O#FCOC$N(@XsK8U7;C5L&sK^3u&<34)3z7rdR19tv
zfk)Re^HNePz$~x~xIGOfsL`kf#dkbp(iIdQ@nAO<8^Yt8nT?SjbWR$h5u+fJ3S%<J
zfuLFplrX{ZeVqw>fJHGs_^b<N&=7463qz4QDEhO&8=yfa2C{&}Gnt^{w4lW*DG&}b
z<WO1A_z39KaTW%%S~k!uW^pcPtu*9tA)6HN!Qv^<xkT^`T~QO*ELKoQKaUM;H#<Y+
zJVuZ~Yz##!K{IzL91P+$Obp`g9yQDi?jCvIgGaI;`(_wH^NAqEoS^h5p27{<y#N~G
zWdV&jgEl7effi$@K#nKk0?i15RC9yQ+y^muKxgiQ`uGf7&~aimh9X(U8V=CO<?bFJ
znh#=U<rC1jaTYH_iZDYq6GKrSSP?&H4YXvI0O+uNPylf<fX+-3W00)nVyF~gC=rCt
zh1Rk#gy#t}FfxL5fp0;mWnsu;WQZsc0-eU6A_1E61Z4|Jh7w_hW(MY9klnltDN<nD
zHZVffNrMjP2diL$sgMDyxCB!n3sxb*(98f)0kaHhfE<cNDe_QXH8ZdThvz9Wu#|{0
zWOFeTsW34z!c0^^GBF}NZxsVe2|GiU7(<pgSgAjfQbi=CFjW#@Ri#L(l(49h1glzu
zq)M5gL<*cbxFAJ{3WIoxBtr?rXE4L1!P+h%X;VcqJR(JnAy@-+Kw2^A@IB}J+}!*;
zg^a|!lpN^6`k;ds!N-+D&onI7E9L^t2o$Fl={kbW76%_&>{yWLom!~?E+nkLjRVKh
zl8pSK%qnm}4&H2zG$Wv&Rh*v(UOM5JoSa%v0zPU7)D=k0E71+9EJy_#qySctn_7~Q
zpArN*oD*DDfM=nC+CW`4P+6CenwXMWR17|M8mu0?#HBI_RQZ6<q0T%BQVJS>@yUk_
z1A==Gng9O({|_#-a#M?oK}TSNI#Z$Gc?AXNKB`o(d~s<qXu>1&3}{y>NRfY1R%&vI
zLMix+mK43rDWEkCpwWM*L}rRYN`7jwLSBA}LTW{3afu$-oM4DK;Ls_8o-ZDsoS%|f
z3>r-I3ikI?fC(!kgV#KP3`j~<NJ#~$O3^C@Rk)6M;DhH=i;D7#6!MdkON)w9Q}n>+
zUps<^&GS-|K|`Gi*c5<n1%O5)`1JV{h5XVIg~T+_@}y$W03Pfhdc9&j1_p+ZjMSo3
zg>ujd?Ril1$}>Pmw1d+JY>_$CKs`SV(AW`pIs_cMpe9vHX>LJr5UAA+IVKz=29A^<
z&}e56C@{f612qG3syHZlLCz8f#UW%ZEBNRzaA1KgC`qj-30engPRoNL7gRZC=0R2f
zBhKdzf`)OB0Z1We|2?=i3IkPeuAtxpb5koo2{1E1uNYkC1qb^;<Unq7&d-AeCqxXC
z-a;T}_=BrB@N(B6$Tb13Fmu2Mr9+y#pcy}G2^ZpYP=JH&gvB~|QYs&uxZ*P*r(b2K
zR#N+nU+~bj9jM|<0M+YEY>b>tY>Yxo%#2)&GR$m@T#UR-oQyn7Y)s6IoQ%AT984yR
zDomV=9E{vd%#8euVvJmjp!p+aMgb;CMt(+N5N6_GRAc02lwcHwLs>?4Mqx%j4bVA^
zU~k5Qn*j0g;9!pjopM&1lNuinP5|-oDf!9q@sOx$hs9SAXq*nR>Isy+AhXWkl~AC$
zh9D)7I#3HCNE5^YCD|Z-5DQdc2f2Y*9w5RKM1Yq62Kj<m0U#m}M1+Bea1a4nk{eV8
zV%38P&=f^bCx`{!YuyK8O#~63R$tIG5NigAm<b|4M`s1i2c<($LI)jumzfMLv{r!R
z!Bc{upawaW0ZdS#MH2)%CIOU$ia}=)voW$U$*FR3a&mwn8z(ov04JxY1SbbGqYxvH
z8b6~DqmYY`C?^M}ppc}HASVZp7$>8Uk`N<5qg)Ut2frpKqYxv%C%>GKC=aK!91kam
z<`)za6%yy?4cZM_#|82N2!nDP=rEjO&@us(`-9j))7L3X;A>x4K(h>>>w&<>n}Qf@
zpq37Z!OoBh-tq{#I)@W<u?whhE(S#!xOWPw2NE;$km?^qo(7+}56dsbItr<vb7#Rt
z9jprtz8DF7Py?v20S(B23@!!*dkrI~wgg@E!VG3Gf|^92ds@JYwLlDJ(4|d~!>l3G
zyg?g5F$kKX4cY`^Z2_Ie1~M3u!NIa%39u5dEGURTwlPp6l0g}u1(a7oLBs&P+aMVf
z^&kxQ9jI~ywbmFIip0QO1@Ht-Gb2MVNR){oI0be_w;$x}I<Rv=ZCkJh!6z4keFSzm
zn4p5|p*g#_q$obV3*-q<qZ;H1UM9E~xIt%|fGSo{)&w~geE2q~{pbMlND31}2@~kx
zG>{ZHNtJ-p6XcYX6i$X_MrQG5MusLvP{SLvkd1*M3*4g$)&SKbewh<Ml{0Am6k0ih
z>Qu-U;S?)yfm@tkR06usrWo9M0Cht0N-{xR8*n*QoC@kGl;jr`gPSBe;0}<L0=UZ)
zbQa`rP$XC>Xn^X5AW#Ab0-tKM6_i@Gfe3I=gR7ujpu_`;H|hs<kShZN!vsVa^D`PU
z!owKkLU1Mk)oGxB1c$L?3KIkLICDR6rJ9>sk_fJCOY%z+K^w$M^GYBo1LOq=3lxyx
z<N+qAkw!q7DLKD1uVgC7^&qD*Fv7Q1aKcgt=v=EBMus8{Sa*woAq#wASqXT74CMIm
z6b?{w2rhvv%>=6eWq}lShG6iL3~(U;*<S|Q7?=v$N|p$@Go~ytCo@F>+y;Z(jH4HH
z3KV&#L9?u&#1I5({UJxVA7&B&tHToU5S5^y11GV9qSTU-N^k&z32KBQD4;+mQ^tdu
zUNb-;3C?RwY>Y}we&C!CbQI*DV<6%<hyYizpyDM6)IJ8MpP&mM2~a~R=n^QY!b>u0
zITKuu)PY<Fswvr6*qHd)IN3N^Ihi3&1cx0ck(Pi03)(0w)<bHdftmquaoF88deD1o
zf<P;PKm)i8L7-v<9N3WN6u7bk+Ya^$f}lp&gNkOG-29Z%oK!nd?k)z6HSjQkA(H^J
K*nb8PtN;Mgh+JU+

literal 0
HcmV?d00001

diff --git a/examples/.DS_Store b/examples/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..7810611dc74d792f9145620157eebed9f5024b63
GIT binary patch
literal 8196
zcmZQzU|@7AO)+F(kYHe7;9!8z0^AH(0Z1N%F(jFwA|Odd1_l8Jh9ZU%hT^31;)0|c
zsN5(u8UmvsFd71*Aut*OqaiT3LVywC91a}yK16nu91Vfd5Ezjm04g68Kz#)U1_lQx
z-2kCMQVfg?4B##RBLf2qEPx>W00xj8NGpg2X$8?BtqhDH7T651Rt83>Rz`3)1f)*@
zY!o8{SUUqF*k+J8SUUqF*k%R>Mu>I>MySn<piT(LT!?lCMu>I>MzHN*BS(qR5Eu;s
zv=9Jg8+L{whE#?EhJ57ydwvoF1H;Lrf}G6a5(9(lj7-cdtZeKYoSYn-yd1H?8TsYG
zC5a`a#ZHMu(O_O?N@^069g?4)17{~Dg=MCe#|wx!=jW9qX6B_9At{du&&*57FL%l>
z%}Xf;n-h>&l97~H1hyz%K%%<Z#K25P!O+;eR!5=Q)W}dr!NkO*ww8lKT-DIlGa<LK
zs=B7OZYIQAu+o8nAHs)|vlti{(7c(GZWx@LpIZP|gQ=pp%sD9s6c9|4U;%Lh5fI#x
z9-dy_@d5&+#i>E5If*5iWvMQSC8@>n0{q1p`Q@I;`FR0Fsb!g|<>ATsIi<OI#qk1y
z$%#41r8$Wusg5~0!I@R5#StZ`6(t~6RB?V$i8EMXL}qe+9!M-+KnSGYzn~;DKd(3}
zwWv5VKaZ1hHIJyQlA5-Gsg<4c6<$7m0Zt)Kk?^w2;>@I+)X?(Gl#-0d#Ny=Cyp+tm
z^r*~~)Vz|+w9M2ZPC-T;&XBys+|(;#;t~RqQj#*bba4nMb3~LTWfqoZmQ+IQke5{C
z6xhlUlag4H>YJYeGBE`#BPlPb%E1v05_c|2O)N=;2y<#kYH<oAa)cCTR;7X!a_VyG
za|#r5hGb{vLDWbZahh-lq;Q7jBqpWifE7uab6Ro;cyorALA(nQ6ymhy;EYJl&&^HE
zD=CJEIY>Hj2%O-E16k~oSX|;?keZj80`Z!>q#FlEBuK_FB_%b5L)k$C64PMsD?1oK
zcmkk`N0LE@!H&U=A&McHA&;S)p@*TDp^sq}!(xWj3>z7CGaO?$&Txw1G{Xgkn+y*b
zo-=%8_{8vq;VZ*GMs`LHMlMEfMhQkmMkPjNMtw#LMoUI(MjJ*)MlVKhMqfrh#$d)6
z##qL9#stPR#(c&C#v;aI#%jhE##Y8Q#(u^bj58T$GtOaL&A5eeE8{lC1B?e5Pcfcn
zya90^6STf#@PY7QB;zeCDZ03<0GeJSv87j8S2uUZ0ZFenc|eI&P)JxrR8Cn#*T~$)
z0UniTv4@<BzzGMEGQcSYmLkAWh?)$=#3dx9q&a0nGxJhXE6}q5ERhSagE9aID1}JM
zE6B<UfRYb{tD-6^E5IbMl>@@n)RN^CU=~Q^-~=ny)8~{GU=>K=gvc73aB>Q;2o!Td
zWGyT?Wd+y-yrHtT(wv+E3{W{oRas5}Mh;F~36Oz<0ekXW$gqlGC&N*OQw$dvt}@(Z
zc*O9Y;RnM%MixdsMlnVSMrlSFMp;HRMh!+SMr}qNMpH&}MoUI3Mr%eFMmI(eMo&gB
z#$d)!#&E_6#z@8_#uUah#&pIE#zMwo#!|*I#&X66#wNyQ#umn2#(u^Lj1w6rG0tXO
z07+o*Wak0l!$`)Jn8_|T-^C@Rv?Q5<;hL`5ZLmtTqBb`_g@B5J3_^u*S#VKaPJUiG
zsEr4<W0asY1ehTPNPznPt_%#g#{VIzM#<3-7!84883K$fF2OENcnVffUmMh)PJntJ
z)FuIS#~DHWa)>^V5>VG3+#P3xOe%s^GcrJW@{Eu%1dtk#)`1%c(1F&{qxJu2{SQu|
HBa;9C5(O9_

literal 0
HcmV?d00001

diff --git a/examples/dojo_ci_cd.py b/examples/dojo_ci_cd.py
index 0e05d9a..8f6cfca 100644
--- a/examples/dojo_ci_cd.py
+++ b/examples/dojo_ci_cd.py
@@ -6,126 +6,230 @@ Description: CI/CD example for DefectDojo
 """
 from defectdojo_api import defectdojo
 from datetime import datetime, timedelta
-import os
+import os, sys
 import argparse
+import time
+import junit_xml_output
 
-DEBUG = False
+DEBUG = True
 
-def sum_severity(findings):
-    severity = [0,0,0,0,0]
-    for finding in findings.data["objects"]:
-        if finding["severity"] == "Critical":
-            severity[4] = severity[4] + 1
-        if finding["severity"] == "High":
-            severity[3] = severity[3] + 1
-        if finding["severity"] == "Medium":
-            severity[2] = severity[2] + 1
-        if finding["severity"] == "Low":
-            severity[1] = severity[1] + 1
-        if finding["severity"] == "Info":
-            severity[0] = severity[0] + 1
+test_cases = []
 
-    return severity
+def junit(toolName, file):
 
-def print_findings(findings):
-    print "Critical: " + str(findings[4])
-    print "High: " + str(findings[3])
-    print "Medium: " + str(findings[2])
-    print "Low: " + str(findings[1])
-    print "Info: " + str(findings[0])
-
-def create_findings(host, api_key, user, product_id, file, scanner, engagement_id=None, max_critical=0, max_high=0, max_medium=0, build=None):
+    junit_xml = junit_xml_output.JunitXml(toolName, test_cases, total_tests=None, total_failures=None)
+    with open(file, 'w') as file:
+        print "Writing Junit test files"
+        file.write(junit_xml.dump())
 
+def dojo_connection(host, api_key, user):
     #Optionally, specify a proxy
     proxies = {
-      'http': 'http://localhost:8080',
-      'https': 'http://localhost:8080',
+      'http': 'http://localhost:8081',
+      'https': 'http://localhost:8081',
     }
 
-    if DEBUG:
+    #if DEBUG:
         # Instantiate the DefectDojo api wrapper
-        dd = defectdojo.DefectDojoAPI(host, api_key, user, proxies=proxies, verify_ssl=False, timeout=360, debug=False)
-    else:
-        dd = defectdojo.DefectDojoAPI(host, api_key, user, verify_ssl=False, timeout=360, debug=False)
+    dd = defectdojo.DefectDojoAPI(host, api_key, user, proxies=proxies, verify_ssl=False, timeout=360, debug=False)
+    #else:
+    #    dd = defectdojo.DefectDojoAPI(host, api_key, user, verify_ssl=False, timeout=360, debug=False)
 
+    return dd
     # Workflow as follows:
     # 1. Scan tool is run against build
     # 2. Reports is saved from scan tool
     # 3. Call this script to load scan data, specifying scanner type
     # 4. Script returns along with a pass or fail results: Example: 2 new critical vulns, 1 low out of 10 vulnerabilities
 
+def return_engagement(dd, product_id):
     #Specify the product id
     product_id = product_id
-    engagement_id = None
 
     # Check for a CI/CD engagement_id
     engagements = dd.list_engagements(product_in=product_id, status="In Progress")
+
     if engagements.success:
         for engagement in engagements.data["objects"]:
             if "Recurring CI/CD Integration" == engagement['name']:
                 engagement_id = engagement['id']
 
-    # Engagement doesn't exist, create it
     if engagement_id == None:
         start_date = datetime.now()
         end_date = start_date+timedelta(days=180)
-        users = dd.list_users("admin")
+        users = dd.list_users(user)
         user_id = None
+
         if users.success:
             user_id = users.data["objects"][0]["id"]
-        engagement_id = dd.create_engagement("Recurring CI/CD Integration", product_id, user_id,
+
+        engagement_id = dd.create_engagement("Recurring CI/CD Integration", product_id, str(user_id),
         "In Progress", start_date.strftime("%Y-%m-%d"), end_date.strftime("%Y-%m-%d"))
+    return engagement_id
 
-    # Upload the scanner export
-    #dir_path = os.path.dirname(os.path.realpath(__file__))
+def process_findings(dd, engagement_id, dir, build=None):
+    test_ids = []
+    for root, dirs, files in os.walk(dir):
+        for name in files:
+            file = os.path.join(os.getcwd(),root, name)
+            test_id = processFiles(dd, engagement_id, file)
+            if test_id is not None:
+                test_ids.append(str(test_id))
+    return ','.join(test_ids)
 
-    print "Uploading scanner data."
+def processFiles(dd, engagement_id, file, scanner=None, build=None):
+    upload_scan = None
+    scannerName = None
+    path=os.path.dirname(file)
+    name = os.path.basename(file)
+    tool = os.path.basename(path)
+    tool = tool.lower()
+
+    test_id = None
     date = datetime.now()
-    print scanner
-    upload_scan = dd.upload_scan(engagement_id, scanner, file, "true", date.strftime("%Y-%m-%d"), build=build)
+    dojoDate = date.strftime("%Y-%m-%d")
 
-    if upload_scan.success:
-        test_id = upload_scan.id()
-    else:
-        print upload_scan.message
-        quit()
-
-    findings = dd.list_findings(engagement_id_in=engagement_id, duplicate="false", active="true", verified="true")
-    print"=============================================="
-    print "Total Number of Vulnerabilities: " + str(findings.data["meta"]["total_count"])
-    print"=============================================="
-    print_findings(sum_severity(findings))
-    print
-    findings = dd.list_findings(test_id_in=test_id, duplicate="true")
-    print"=============================================="
-    print "Total Number of Duplicate Findings: " + str(findings.data["meta"]["total_count"])
-    print"=============================================="
-    print_findings(sum_severity(findings))
-    print
-    findings = dd.list_findings(test_id_in=test_id, duplicate="false")
-    print"=============================================="
-    print "Total Number of New Findings: " + str(findings.data["meta"]["total_count"])
-    print"=============================================="
-    sum_new_findings = sum_severity(findings)
-    print_findings(sum_new_findings)
-    print
-    print"=============================================="
-
-    strFail = None
-    if max_critical is not None:
-        if sum_new_findings[4] > max_critical:
-            strFail =  "Build Failed: Max Critical"
-    if max_high is not None:
-        if sum_new_findings[3] > max_high:
-            strFail = strFail +  " Max High"
-    if max_medium is not None:
-        if sum_new_findings[2] > max_medium:
-            strFail = strFail +  " Max Medium"
-    if strFail is None:
-        print "Build Passed!"
+    #Tools without an importer in Dojo; attempted to import as generic
+    if "generic" in name:
+        scanner = "Generic Findings Import"
+        if tool == "nikto":
+            print "Uploading nikto scan: " + file
+            test_id = dd.upload_scan(engagement_id, scanner, file, "true", dojoDate, build)
+        elif tool == "bandit":
+            print "Uploading bandit scan: " + file
+            test_id = dd.upload_scan(engagement_id, scanner, file, "true", dojoDate, build)
     else:
-        print "Build Failed: " + strFail
-    print"=============================================="
+        if tool == "burp":
+            scannerName = "Burp Scan"
+        elif tool == "nessus":
+            scannerName = "Nessus Scan"
+        elif tool == "nmap":
+            scannerName = "Nmap Scan"
+        elif tool == "nexpose":
+            scannerName = "Nexpose Scan"
+        elif tool == "veracode":
+            scannerName = "Veracode Scan"
+        elif tool == "checkmarx":
+            scannerName = "Checkmarx Scan"
+        elif tool == "zap":
+            scannerName = "ZAP Scan"
+        elif tool == "appspider":
+            scannerName = "AppSpider Scan"
+        elif tool == "Arachni Scan":
+            scannerName = "Arachni Scan"
+        elif tool == "vcg":
+            scannerName = "VCG Scan"
+        elif tool == "dependency":
+            scannerName = "Dependency Check Scan"
+        elif tool == "retirejs":
+            scannerName = "Retire.js Scan"
+        elif tool == "nodesecurity":
+            scannerName = "Node Security Platform Scan"
+        elif tool == "qualys":
+            scannerName = "Qualys Scan"
+        elif tool == "qualyswebapp":
+            scannerName = "Qualys Webapp Scan"
+        elif tool == "openvas":
+            scannerName = "OpenVAS CSV"
+        elif tool == "snyk":
+            scannerName = "Snyk Scan"
+
+        if scannerName is not None:
+            print "Uploading " + scannerName + " scan: " + file
+            test_id = dd.upload_scan(engagement_id, scannerName, file, "true", dojoDate, build)
+
+    return test_id
+    #print os.path.basename(full_path)
+
+def create_findings(dd, engagement_id, scanner, file, build=None):
+    # Upload the scanner export
+    if engagement_id > 0:
+        print "Uploading scanner data."
+        date = datetime.now()
+
+        upload_scan = dd.upload_scan(engagement_id, scanner, file, "true", date.strftime("%Y-%m-%d"), build=build)
+
+        if upload_scan.success:
+            test_id = upload_scan.id()
+        else:
+            print upload_scan.message
+            quit()
+
+def summary(dd, engagement_id, test_ids, max_critical=0, max_high=0, max_medium=0):
+        findings = dd.list_findings(engagement_id_in=engagement_id, duplicate="false", active="true", verified="true")
+        print"=============================================="
+        print "Total Number of Vulnerabilities: " + str(findings.data["meta"]["total_count"])
+        print"=============================================="
+        print_findings(sum_severity(findings))
+        print
+        findings = dd.list_findings(test_id_in=test_ids, duplicate="true")
+        print"=============================================="
+        print "Total Number of Duplicate Findings: " + str(findings.data["meta"]["total_count"])
+        print"=============================================="
+        print_findings(sum_severity(findings))
+        print
+        #Delay while de-dupes
+        sys.stdout.write("Sleeping for 30 seconds for de-dupe celery process:")
+        sys.stdout.flush()
+        for i in range(15):
+            time.sleep(2)
+            sys.stdout.write(".")
+            sys.stdout.flush()
+
+        findings = dd.list_findings(test_id_in=test_ids, duplicate="false", limit=500)
+        if findings.count() > 0:
+            for finding in findings.data["objects"]:
+                test_cases.append(junit_xml_output.TestCase(finding["title"] + " Severity: " + finding["severity"], finding["description"],"failure"))
+            if not os.path.exists("reports"):
+                os.mkdir("reports")
+            junit("DefectDojo", "reports/junit_dojo.xml")
+
+        print"\n=============================================="
+        print "Total Number of New Findings: " + str(findings.data["meta"]["total_count"])
+        print"=============================================="
+        sum_new_findings = sum_severity(findings)
+        print_findings(sum_new_findings)
+        print
+        print"=============================================="
+
+        strFail = ""
+        if max_critical is not None:
+            if sum_new_findings[4] > max_critical:
+                strFail =  "Build Failed: Max Critical"
+        if max_high is not None:
+            if sum_new_findings[3] > max_high:
+                strFail = strFail +  " Max High"
+        if max_medium is not None:
+            if sum_new_findings[2] > max_medium:
+                strFail = strFail +  " Max Medium"
+        if strFail is None:
+            print "Build Passed!"
+        else:
+            print "Build Failed: " + strFail
+        print"=============================================="
+
+def sum_severity(findings):
+    severity = [0,0,0,0,0]
+    for finding in findings.data["objects"]:
+        if finding["severity"] == "Critical":
+            severity[4] = severity[4] + 1
+        if finding["severity"] == "High":
+            severity[3] = severity[3] + 1
+        if finding["severity"] == "Medium":
+            severity[2] = severity[2] + 1
+        if finding["severity"] == "Low":
+            severity[1] = severity[1] + 1
+        if finding["severity"] == "Info":
+            severity[0] = severity[0] + 1
+
+    return severity
+
+def print_findings(findings):
+    print "Critical: " + str(findings[4])
+    print "High: " + str(findings[3])
+    print "Medium: " + str(findings[2])
+    print "Low: " + str(findings[1])
+    print "Info: " + str(findings[0])
 
 class Main:
     if __name__ == "__main__":
@@ -134,8 +238,9 @@ class Main:
         parser.add_argument('--api_key', help="API Key", required=True)
         parser.add_argument('--user', help="User", required=True)
         parser.add_argument('--product', help="Dojo Product ID", required=True)
-        parser.add_argument('--file', help="Scanner file", required=True)
-        parser.add_argument('--scanner', help="Type of scanner", required=True)
+        parser.add_argument('--file', help="Scanner file", required=False)
+        parser.add_argument('--dir', help="Scanner directory, needs to have the scanner name with the scan file in the folder. Ex: reports/nmap/nmap.csv", required=False)
+        parser.add_argument('--scanner', help="Type of scanner", required=False)
         parser.add_argument('--build', help="Build ID", required=False)
         parser.add_argument('--engagement', help="Engagement ID (optional)", required=False)
         parser.add_argument('--critical', help="Maximum new critical vulns to pass the build.", required=False)
@@ -149,6 +254,7 @@ class Main:
         user = args["user"]
         product_id = args["product"]
         file = args["file"]
+        dir = args["dir"]
         scanner = args["scanner"]
         engagement_id = args["engagement"]
         max_critical = args["critical"]
@@ -156,4 +262,18 @@ class Main:
         max_medium = args["medium"]
         build = args["build"]
 
-        create_findings(host, api_key, user, product_id, file, scanner, engagement_id, max_critical, max_high, max_medium, build)
+        if dir is not None or file is not None:
+            dd = dojo_connection(host, api_key, user)
+            engagement_id = return_engagement(dd, product_id)
+            test_ids = None
+            if file is not None:
+                if scanner is not None:
+                    test_ids = processFiles(dd, engagement_id, file, scanner=scanner)
+                else:
+                    print "Scanner type must be specified for a file import. --scanner"
+            else:
+                test_ids = process_findings(dd, engagement_id, dir, build)
+
+            summary(dd, engagement_id, test_ids, max_critical, max_high, max_medium)
+        else:
+            print "No file or directory to scan specified."
diff --git a/examples/reports/.DS_Store b/examples/reports/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..0d3edc4a883fc41d9817b49c6ba491a8d7f757b3
GIT binary patch
literal 6148
zcmZQzU|@7AO)+F(5MW?n;9!8zEL;p&0Z1N%F(jFwB0M1Tz-DAJlq8iG7bNB6Cqd;#
zsnHM^4S~TM0-(Ih#*oC2$dJd7!ho88PbL-QWEPhg7+hy$VrF4wW9Q)H<lyAxhz-uj
zFApwBEGaE^N-T;7^D<LXlc4O7{QMj^J25FNGqpTkK*TveuOu-uFSQ6sc}#d_UP^ws
zQ+{b)N-@}+fW(rFq{JeyMeza>)zu~jW;zOn#^$v;3e~1YhB^u+CMLDD930}RhPIvw
zxs_GbHMMm!A>qr&2%#DHp)`z|#lXOT;>nzJ!{Frn+ya;abotzT7nhXMl4J&kYr1BS
zz^YL6=jNy2l`qJ^Z+=;DQC?1dUOJ@UWME-PVkl)OVkkf=Jcm`_!##*4;Nfy8f&L5}
z=ty!%0gfhzC9vW8&;lB4=qLdV0cdvN;D+)?snHM^4S~@RfQ104d{BT^Q4UbL0YZbM
z7#JBCz+C`F1_l-+J)k}XNDibGM1!<~XpmM0Mi2{Z23RWtBUCFRxEsR2zzFV=fM~FG
z21W+3b_PZUuyzJm9nT2S&cFz@nGxDUVFcUGz`zL6&cF!K4s+fpJsJX|Api{lW(X|+
zs{dUX7;yFfA*x2n(GVC7fngZ}j4Up}E>7S|8N2^LbuFkqO@K;+YJX65%m}KdA^Jc{
nz_Lt`0YwQg2O<a33aa+ORWTz2q$VG22*5&UlpYNM`iB4j?)Ao*

literal 0
HcmV?d00001

diff --git a/examples/reports/bandit/generic_bandit.csv b/examples/reports/bandit/generic_bandit.csv
new file mode 100644
index 0000000..b1fb170
--- /dev/null
+++ b/examples/reports/bandit/generic_bandit.csv
@@ -0,0 +1,2 @@
+Date,Title,CweId,Url,Severity,Description,Mitigation,Impact,References,Active,Verified,FalsePositive,Duplicate
+11/09/2017,blacklist,,,3,"Using cElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace cElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Filename: PyBitBucket.py Line number: 6 Line range: [6, 7, 8, 9] Issue Confidence: HIGH",,,,False,False,False,False
diff --git a/examples/reports/burp/burp.xml b/examples/reports/burp/burp.xml
new file mode 100644
index 0000000..b80bcc6
--- /dev/null
+++ b/examples/reports/burp/burp.xml
@@ -0,0 +1,267 @@
+<?xml version="1.0"?>
+<!DOCTYPE issues [
+<!ELEMENT issues (issue*)>
+<!ATTLIST issues burpVersion CDATA "">
+<!ATTLIST issues exportTime CDATA "">
+<!ELEMENT issue (serialNumber, type, name, host, path, location, severity, confidence, issueBackground?, remediationBackground?, references?, vulnerabilityClassifications?, issueDetail?, issueDetailItems?, remediationDetail?, requestresponse*, collaboratorEvent*, infiltratorEvent*)>
+<!ELEMENT serialNumber (#PCDATA)>
+<!ELEMENT type (#PCDATA)>
+<!ELEMENT name (#PCDATA)>
+<!ELEMENT host (#PCDATA)>
+<!ATTLIST host ip CDATA "">
+<!ELEMENT path (#PCDATA)>
+<!ELEMENT location (#PCDATA)>
+<!ELEMENT severity (#PCDATA)>
+<!ELEMENT confidence (#PCDATA)>
+<!ELEMENT issueBackground (#PCDATA)>
+<!ELEMENT remediationBackground (#PCDATA)>
+<!ELEMENT references (#PCDATA)>
+<!ELEMENT vulnerabilityClassifications (#PCDATA)>
+<!ELEMENT issueDetail (#PCDATA)>
+<!ELEMENT issueDetailItems (issueDetailItem*)>
+<!ELEMENT issueDetailItem (#PCDATA)>
+<!ELEMENT remediationDetail (#PCDATA)>
+<!ELEMENT requestresponse (request?, response?, responseRedirected?)>
+<!ELEMENT request (#PCDATA)>
+<!ATTLIST request method CDATA "">
+<!ATTLIST request base64 (true|false) "false">
+<!ELEMENT response (#PCDATA)>
+<!ATTLIST response base64 (true|false) "false">
+<!ELEMENT responseRedirected (#PCDATA)>
+<!ELEMENT sender (#PCDATA)>
+<!ELEMENT message (#PCDATA)>
+<!ELEMENT conversation (#PCDATA)>
+<!ELEMENT recipient (#PCDATA)>
+<!ELEMENT recipients (recipient*)>
+<!ELEMENT smtp (sender, recipients, message, conversation)>
+<!ELEMENT collaboratorEvent (interactionType, originIp, time, lookupType?, lookupHost?, requestresponse?, smtp?)>
+<!ELEMENT interactionType (#PCDATA)>
+<!ELEMENT originIp (#PCDATA)>
+<!ELEMENT time (#PCDATA)>
+<!ELEMENT lookupType (#PCDATA)>
+<!ELEMENT lookupHost (#PCDATA)>
+<!ELEMENT infiltratorEvent (parameterName, platform, signature, stackTrace?, parameterValue?, collaboratorEvent)>
+<!ELEMENT parameterName (#PCDATA)>
+<!ELEMENT platform (#PCDATA)>
+<!ELEMENT signature (#PCDATA)>
+<!ELEMENT stackTrace (#PCDATA)>
+<!ELEMENT parameterValue (#PCDATA)>
+]>
+<issues burpVersion="1.7.27" exportTime="Fri Nov 10 10:46:16 EST 2017">
+  <issue>
+    <serialNumber>4332586205316654080</serialNumber>
+    <type>1049088</type>
+    <name><![CDATA[SQL injection]]></name>
+    <host ip="198.252.230.171">https://kace.nabancard.com</host>
+    <path><![CDATA[/common/user_profile.php]]></path>
+    <location><![CDATA[/common/user_profile.php [sort_column parameter]]]></location>
+    <severity>High</severity>
+    <confidence>Firm</confidence>
+    <issueBackground><![CDATA[<p>SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.</p>
+<p>A wide range of damaging attacks can often be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and taking control of the database server. </p>]]></issueBackground>
+    <remediationBackground><![CDATA[<p>The most effective way to prevent SQL injection attacks is to use parameterized queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already been defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterized queries. It is strongly recommended that you parameterize <i>every</i> variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.</p>
+<p>You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective: </p>
+<ul>
+  <li>One common defense is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defense is designed to prevent malformed data from terminating the string into which it is inserted. However, if the data being incorporated into queries is numeric, then the defense may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defense to be bypassed.</li>
+  <li>Another often cited defense is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.</li>
+</ul>]]></remediationBackground>
+    <references><![CDATA[<ul>
+<li><a href="https://support.portswigger.net/customer/portal/articles/1965677-using-burp-to-test-for-injection-flaws">Using Burp to Test for Injection Flaws</a></li>
+<li><a href="http://websec.ca/kb/sql_injection">SQL Injection Cheat Sheet</a></li>
+<li><a href="https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet">SQL Injection Prevention Cheat Sheet</a></li>
+</ul>]]></references>
+    <vulnerabilityClassifications><![CDATA[<ul>
+<li><a href="https://cwe.mitre.org/data/definitions/89.html">CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')</a></li>
+<li><a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94: Improper Control of Generation of Code ('Code Injection')
+</a></li>
+<li><a href="https://cwe.mitre.org/data/definitions/116.html">CWE-116: Improper Encoding or Escaping of Output</a></li>
+</ul>]]></vulnerabilityClassifications>
+    <issueDetail><![CDATA[The <b>sort_column</b> parameter appears to be vulnerable to SQL injection attacks. The payload <b>,(select*from(select(sleep(20)))a)</b> was submitted in the sort_column parameter. The application took <b>20562</b> milliseconds to respond to the request, compared with <b>1980</b> milliseconds for the original request, indicating that the injected SQL command caused a time delay.<br><br>The database appears to be MySQL.]]></issueDetail>
+    <requestresponse>
+      <request method="GET" base64="true"><![CDATA[R0VUIC9jb21tb24vdXNlcl9wcm9maWxlLnBocD9JRD01NDkmdGFibGVfaWQ9dXBfYXNzaWduZWRfZGV2aWNlc190YWJsZSZzb3J0X2NvbHVtbj1JU19QUklNQVJZX0RFVklDRSUyYyhzZWxlY3QqZnJvbShzZWxlY3Qoc2xlZXAoMjApKSlhKSZzb3J0X2RpcmVjdGlvbj1kZXNjJnJlY29yZHNfcGVyX3BhZ2U9NSZwYWdlX251bWJlcj0xIEhUVFAvMS4xDQpIb3N0OiBrYWNlLm5hYmFuY2FyZC5jb20NClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwLjEyOyBydjo1Ni4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzU2LjANCkFjY2VwdDogYXBwbGljYXRpb24vanNvbiwgdGV4dC9qYXZhc2NyaXB0LCAqLyo7IHE9MC4wMQ0KQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlDQpSZWZlcmVyOiBodHRwczovL2thY2UubmFiYW5jYXJkLmNvbS91c2VydWkvYWR2aXNvcnlfZGV0YWlsLnBocD9JRD0xJTIwKyUyMDENClgtUmVxdWVzdGVkLVdpdGg6IFhNTEh0dHBSZXF1ZXN0DQpDb29raWU6IGtib3hpZD1lbWkzbmZtaDUyMW82OWE1dGQ5bHY3M2ViNjsgS0FDRV9DU1JGX1RPS0VOPTMyZWIxOTg3MmU3NTYwYWExNjMyYzQ5ODc2OTEwYzUwYjdiOTMwMDY5YWRkOGYwNDIzYjBlNzVjYjY3YjRiYjdkM2U3MDMyMWRiY2U0MDRhYjEzZTU0NjkwNmY2ZWM5ODAwY2RjYzRjMTZmZWEwYWNiMjBhN2FmNTdjNDRkNzkzOyBLQUNFX0xBU1RfVVNFUl9TRUNVUkU9JTlDJTlFJTA3JTkwJUEwJUM5JUUzJUVDJTBCJTFEJUIwJTgyJUIzJThGJTg2cDsgS0FDRV9MQVNUX09SR19TRUNVUkU9JURFJUEzJTBFMjAlOEUlODQlQkYlQjElRDUlODklRTAlQTglRTYlMkElRkQ7IHgtZGVsbC1hdXRoLWp3dD1leUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpTVXpJMU5pSjkuZXlKcGMzTWlPaUpCVFZOSlpHVnVkR2wwZVZCeWIzWnBaR1Z5SWl3aWMzVmlJam8xTkRFc0ltRjFaQ0k2SWtWVFRWQnNZWFJtYjNKdElpd2lZMjl1SWpvaVkyVTBaak5qT0RZeE5EWTBORGxqTVRnM056YzBPV1l3TXpjNE5qVmlPRFVpTENKbGVIQWlPakUxTVRBeE9EUTROalY5LlNCcl9rSUwwdVJYQ0RVYV9WdzVGM2NMRVRXalJ6NlI1VlZYSlpPYUpjT2FqYUJla2Q4RW5xM3FSU0FhdXY1TmVQR0NQOWRra3JHQ0JUWjZqeHlMZ19HOEM1MV9iekl0ckM2OS1meFZZLXlqaGNPX1dlSi1MREpITGRPbVhaWm1oQ1NWSmhyTHJ1blNJc0xESmJ3cHFGV0ZhRGJtN05KWWM5NXMxcGU3a1FnMDsgS0FDRV9MQVNUX0FETUlOX1NFQ1VSRT0lOUMlOUUlMDclOTAlQTAlQzklRTMlRUMlMEIlMUQlQjAlODIlQjMlOEYlODZwDQpDb25uZWN0aW9uOiBjbG9zZQ0KDQo=]]></request>
+      <response base64="true"><![CDATA[SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBXZWQsIDA4IE5vdiAyMDE3IDE5OjUwOjE0IEdNVA0KU2VydmVyOiBBcGFjaGUNCkV4cGlyZXM6IFRodSwgMTkgTm92IDE5ODEgMDg6NTI6MDAgR01UDQpDYWNoZS1Db250cm9sOiBuby1zdG9yZSwgbm8tY2FjaGUsIG11c3QtcmV2YWxpZGF0ZSwgcG9zdC1jaGVjaz0wLCBwcmUtY2hlY2s9MA0KUHJhZ21hOiBuby1jYWNoZQ0KVmFyeTogQWNjZXB0LUVuY29kaW5nDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1IZWFkZXJzOiB4LWRlbGwtYXV0aC10aW1lc3RhbXAsIHgtZGVsbC1hdXRoLWtleSwgeC1kZWxsLWF1dGgtc2lnbmF0dXJlLCBhY2NlcHQsIG9yaWdpbiwgY29udGVudC10eXBlDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1PcmlnaW46ICoNCkFjY2Vzcy1Db250cm9sLUFsbG93LU1ldGhvZHM6IFBVVCwgREVMRVRFLCBQT1NULCBHRVQsIE9QVElPTlMNClgtRGVsbEtBQ0UtQXBwbGlhbmNlOiBrMTAwMA0KWC1EZWxsS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtRGVsbEtBQ0UtVmVyc2lvbjogNy4yLjEwMg0KWC1LQk9YLVdlYlNlcnZlcjogS0FDRS5uYWJhbmNhcmQuY29tDQpYLUtCT1gtVmVyc2lvbjogNy4yLjEwMg0KWC1LQUNFLUFwcGxpYW5jZTogSzEwMDANClgtS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtS0FDRS1WZXJzaW9uOiA3LjIuMTAyDQpYLUtBQ0UtV2ViU2VydmVyOiBLQUNFLm5hYmFuY2FyZC5jb20NClgtVUEtQ29tcGF0aWJsZTogSUU9OSxFREdFDQpDYWNoZS1Db250cm9sOiBwcml2YXRlLCBuby1jYWNoZSwgbm8tc3RvcmUsIHByb3h5LXJldmFsaWRhdGUsIG5vLXRyYW5zZm9ybQ0KQ29udGVudC1MZW5ndGg6IDQ0DQpDb25uZWN0aW9uOiBjbG9zZQ0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgNClN0cmljdC1UcmFuc3BvcnQtU2VjdXJpdHk6IG1heC1hZ2U9MTU3NjgwMDANCg0KeyJjdXJyZW50X3BhZ2UiOjEsInRvdGFsX3BhZ2VzIjowLCJyb3dzIjpbXX0=]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+  <issue>
+    <serialNumber>268361935394890752</serialNumber>
+    <type>1049088</type>
+    <name><![CDATA[SQL injection]]></name>
+    <host ip="198.252.230.171">https://kace.nabancard.com</host>
+    <path><![CDATA[/common/user_profile.php]]></path>
+    <location><![CDATA[/common/user_profile.php [sort_direction parameter]]]></location>
+    <severity>High</severity>
+    <confidence>Firm</confidence>
+    <issueBackground><![CDATA[<p>SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.</p>
+<p>A wide range of damaging attacks can often be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and taking control of the database server. </p>]]></issueBackground>
+    <remediationBackground><![CDATA[<p>The most effective way to prevent SQL injection attacks is to use parameterized queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already been defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterized queries. It is strongly recommended that you parameterize <i>every</i> variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.</p>
+<p>You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective: </p>
+<ul>
+  <li>One common defense is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defense is designed to prevent malformed data from terminating the string into which it is inserted. However, if the data being incorporated into queries is numeric, then the defense may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defense to be bypassed.</li>
+  <li>Another often cited defense is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.</li>
+</ul>]]></remediationBackground>
+    <references><![CDATA[<ul>
+<li><a href="https://support.portswigger.net/customer/portal/articles/1965677-using-burp-to-test-for-injection-flaws">Using Burp to Test for Injection Flaws</a></li>
+<li><a href="http://websec.ca/kb/sql_injection">SQL Injection Cheat Sheet</a></li>
+<li><a href="https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet">SQL Injection Prevention Cheat Sheet</a></li>
+</ul>]]></references>
+    <vulnerabilityClassifications><![CDATA[<ul>
+<li><a href="https://cwe.mitre.org/data/definitions/89.html">CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')</a></li>
+<li><a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94: Improper Control of Generation of Code ('Code Injection')
+</a></li>
+<li><a href="https://cwe.mitre.org/data/definitions/116.html">CWE-116: Improper Encoding or Escaping of Output</a></li>
+</ul>]]></vulnerabilityClassifications>
+    <issueDetail><![CDATA[The <b>sort_direction</b> parameter appears to be vulnerable to SQL injection attacks. The payload <b>,(select*from(select(sleep(20)))a)</b> was submitted in the sort_direction parameter. The application took <b>20314</b> milliseconds to respond to the request, compared with <b>1980</b> milliseconds for the original request, indicating that the injected SQL command caused a time delay.<br><br>The database appears to be MySQL.]]></issueDetail>
+    <requestresponse>
+      <request method="GET" base64="true"><![CDATA[R0VUIC9jb21tb24vdXNlcl9wcm9maWxlLnBocD9JRD01NDkmdGFibGVfaWQ9dXBfYXNzaWduZWRfZGV2aWNlc190YWJsZSZzb3J0X2NvbHVtbj1JU19QUklNQVJZX0RFVklDRSZzb3J0X2RpcmVjdGlvbj1kZXNjJTJjKHNlbGVjdCpmcm9tKHNlbGVjdChzbGVlcCgyMCkpKWEpJnJlY29yZHNfcGVyX3BhZ2U9NSZwYWdlX251bWJlcj0xIEhUVFAvMS4xDQpIb3N0OiBrYWNlLm5hYmFuY2FyZC5jb20NClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwLjEyOyBydjo1Ni4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzU2LjANCkFjY2VwdDogYXBwbGljYXRpb24vanNvbiwgdGV4dC9qYXZhc2NyaXB0LCAqLyo7IHE9MC4wMQ0KQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlDQpSZWZlcmVyOiBodHRwczovL2thY2UubmFiYW5jYXJkLmNvbS91c2VydWkvYWR2aXNvcnlfZGV0YWlsLnBocD9JRD0xJTIwKyUyMDENClgtUmVxdWVzdGVkLVdpdGg6IFhNTEh0dHBSZXF1ZXN0DQpDb29raWU6IGtib3hpZD1lbWkzbmZtaDUyMW82OWE1dGQ5bHY3M2ViNjsgS0FDRV9DU1JGX1RPS0VOPTMyZWIxOTg3MmU3NTYwYWExNjMyYzQ5ODc2OTEwYzUwYjdiOTMwMDY5YWRkOGYwNDIzYjBlNzVjYjY3YjRiYjdkM2U3MDMyMWRiY2U0MDRhYjEzZTU0NjkwNmY2ZWM5ODAwY2RjYzRjMTZmZWEwYWNiMjBhN2FmNTdjNDRkNzkzOyBLQUNFX0xBU1RfVVNFUl9TRUNVUkU9JTlDJTlFJTA3JTkwJUEwJUM5JUUzJUVDJTBCJTFEJUIwJTgyJUIzJThGJTg2cDsgS0FDRV9MQVNUX09SR19TRUNVUkU9JURFJUEzJTBFMjAlOEUlODQlQkYlQjElRDUlODklRTAlQTglRTYlMkElRkQ7IHgtZGVsbC1hdXRoLWp3dD1leUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpTVXpJMU5pSjkuZXlKcGMzTWlPaUpCVFZOSlpHVnVkR2wwZVZCeWIzWnBaR1Z5SWl3aWMzVmlJam8xTkRFc0ltRjFaQ0k2SWtWVFRWQnNZWFJtYjNKdElpd2lZMjl1SWpvaVkyVTBaak5qT0RZeE5EWTBORGxqTVRnM056YzBPV1l3TXpjNE5qVmlPRFVpTENKbGVIQWlPakUxTVRBeE9EUTROalY5LlNCcl9rSUwwdVJYQ0RVYV9WdzVGM2NMRVRXalJ6NlI1VlZYSlpPYUpjT2FqYUJla2Q4RW5xM3FSU0FhdXY1TmVQR0NQOWRra3JHQ0JUWjZqeHlMZ19HOEM1MV9iekl0ckM2OS1meFZZLXlqaGNPX1dlSi1MREpITGRPbVhaWm1oQ1NWSmhyTHJ1blNJc0xESmJ3cHFGV0ZhRGJtN05KWWM5NXMxcGU3a1FnMDsgS0FDRV9MQVNUX0FETUlOX1NFQ1VSRT0lOUMlOUUlMDclOTAlQTAlQzklRTMlRUMlMEIlMUQlQjAlODIlQjMlOEYlODZwDQpDb25uZWN0aW9uOiBjbG9zZQ0KDQo=]]></request>
+      <response base64="true"><![CDATA[SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBXZWQsIDA4IE5vdiAyMDE3IDE5OjUyOjI2IEdNVA0KU2VydmVyOiBBcGFjaGUNCkV4cGlyZXM6IFRodSwgMTkgTm92IDE5ODEgMDg6NTI6MDAgR01UDQpDYWNoZS1Db250cm9sOiBuby1zdG9yZSwgbm8tY2FjaGUsIG11c3QtcmV2YWxpZGF0ZSwgcG9zdC1jaGVjaz0wLCBwcmUtY2hlY2s9MA0KUHJhZ21hOiBuby1jYWNoZQ0KVmFyeTogQWNjZXB0LUVuY29kaW5nDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1IZWFkZXJzOiB4LWRlbGwtYXV0aC10aW1lc3RhbXAsIHgtZGVsbC1hdXRoLWtleSwgeC1kZWxsLWF1dGgtc2lnbmF0dXJlLCBhY2NlcHQsIG9yaWdpbiwgY29udGVudC10eXBlDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1PcmlnaW46ICoNCkFjY2Vzcy1Db250cm9sLUFsbG93LU1ldGhvZHM6IFBVVCwgREVMRVRFLCBQT1NULCBHRVQsIE9QVElPTlMNClgtRGVsbEtBQ0UtQXBwbGlhbmNlOiBrMTAwMA0KWC1EZWxsS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtRGVsbEtBQ0UtVmVyc2lvbjogNy4yLjEwMg0KWC1LQk9YLVdlYlNlcnZlcjogS0FDRS5uYWJhbmNhcmQuY29tDQpYLUtCT1gtVmVyc2lvbjogNy4yLjEwMg0KWC1LQUNFLUFwcGxpYW5jZTogSzEwMDANClgtS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtS0FDRS1WZXJzaW9uOiA3LjIuMTAyDQpYLUtBQ0UtV2ViU2VydmVyOiBLQUNFLm5hYmFuY2FyZC5jb20NClgtVUEtQ29tcGF0aWJsZTogSUU9OSxFREdFDQpDYWNoZS1Db250cm9sOiBwcml2YXRlLCBuby1jYWNoZSwgbm8tc3RvcmUsIHByb3h5LXJldmFsaWRhdGUsIG5vLXRyYW5zZm9ybQ0KQ29udGVudC1MZW5ndGg6IDQ0DQpDb25uZWN0aW9uOiBjbG9zZQ0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgNClN0cmljdC1UcmFuc3BvcnQtU2VjdXJpdHk6IG1heC1hZ2U9MTU3NjgwMDANCg0KeyJjdXJyZW50X3BhZ2UiOjEsInRvdGFsX3BhZ2VzIjowLCJyb3dzIjpbXX0=]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+  <issue>
+    <serialNumber>4332586205316654080</serialNumber>
+    <type>1049088</type>
+    <name><![CDATA[SQL injection]]></name>
+    <host ip="198.252.230.171">https://kace.nabancard.com</host>
+    <path><![CDATA[/common/user_profile.php]]></path>
+    <location><![CDATA[/common/user_profile.php [sort_column parameter]]]></location>
+    <severity>High</severity>
+    <confidence>Firm</confidence>
+    <issueBackground><![CDATA[<p>SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.</p>
+<p>A wide range of damaging attacks can often be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and taking control of the database server. </p>]]></issueBackground>
+    <remediationBackground><![CDATA[<p>The most effective way to prevent SQL injection attacks is to use parameterized queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already been defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterized queries. It is strongly recommended that you parameterize <i>every</i> variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.</p>
+<p>You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective: </p>
+<ul>
+  <li>One common defense is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defense is designed to prevent malformed data from terminating the string into which it is inserted. However, if the data being incorporated into queries is numeric, then the defense may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defense to be bypassed.</li>
+  <li>Another often cited defense is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.</li>
+</ul>]]></remediationBackground>
+    <references><![CDATA[<ul>
+<li><a href="https://support.portswigger.net/customer/portal/articles/1965677-using-burp-to-test-for-injection-flaws">Using Burp to Test for Injection Flaws</a></li>
+<li><a href="http://websec.ca/kb/sql_injection">SQL Injection Cheat Sheet</a></li>
+<li><a href="https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet">SQL Injection Prevention Cheat Sheet</a></li>
+</ul>]]></references>
+    <vulnerabilityClassifications><![CDATA[<ul>
+<li><a href="https://cwe.mitre.org/data/definitions/89.html">CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')</a></li>
+<li><a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94: Improper Control of Generation of Code ('Code Injection')
+</a></li>
+<li><a href="https://cwe.mitre.org/data/definitions/116.html">CWE-116: Improper Encoding or Escaping of Output</a></li>
+</ul>]]></vulnerabilityClassifications>
+    <issueDetail><![CDATA[The <b>sort_column</b> parameter appears to be vulnerable to SQL injection attacks. The payload <b>,(select*from(select(sleep(20)))a)</b> was submitted in the sort_column parameter. The application took <b>20562</b> milliseconds to respond to the request, compared with <b>1980</b> milliseconds for the original request, indicating that the injected SQL command caused a time delay.<br><br>The database appears to be MySQL.]]></issueDetail>
+    <requestresponse>
+      <request method="GET" base64="true"><![CDATA[R0VUIC9jb21tb24vdXNlcl9wcm9maWxlLnBocD9JRD01NDkmdGFibGVfaWQ9dXBfYXNzaWduZWRfZGV2aWNlc190YWJsZSZzb3J0X2NvbHVtbj1JU19QUklNQVJZX0RFVklDRSUyYyhzZWxlY3QqZnJvbShzZWxlY3Qoc2xlZXAoMjApKSlhKSZzb3J0X2RpcmVjdGlvbj1kZXNjJnJlY29yZHNfcGVyX3BhZ2U9NSZwYWdlX251bWJlcj0xIEhUVFAvMS4xDQpIb3N0OiBrYWNlLm5hYmFuY2FyZC5jb20NClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwLjEyOyBydjo1Ni4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzU2LjANCkFjY2VwdDogYXBwbGljYXRpb24vanNvbiwgdGV4dC9qYXZhc2NyaXB0LCAqLyo7IHE9MC4wMQ0KQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlDQpSZWZlcmVyOiBodHRwczovL2thY2UubmFiYW5jYXJkLmNvbS91c2VydWkvYWR2aXNvcnlfZGV0YWlsLnBocD9JRD0xJTIwKyUyMDENClgtUmVxdWVzdGVkLVdpdGg6IFhNTEh0dHBSZXF1ZXN0DQpDb29raWU6IGtib3hpZD1lbWkzbmZtaDUyMW82OWE1dGQ5bHY3M2ViNjsgS0FDRV9DU1JGX1RPS0VOPTMyZWIxOTg3MmU3NTYwYWExNjMyYzQ5ODc2OTEwYzUwYjdiOTMwMDY5YWRkOGYwNDIzYjBlNzVjYjY3YjRiYjdkM2U3MDMyMWRiY2U0MDRhYjEzZTU0NjkwNmY2ZWM5ODAwY2RjYzRjMTZmZWEwYWNiMjBhN2FmNTdjNDRkNzkzOyBLQUNFX0xBU1RfVVNFUl9TRUNVUkU9JTlDJTlFJTA3JTkwJUEwJUM5JUUzJUVDJTBCJTFEJUIwJTgyJUIzJThGJTg2cDsgS0FDRV9MQVNUX09SR19TRUNVUkU9JURFJUEzJTBFMjAlOEUlODQlQkYlQjElRDUlODklRTAlQTglRTYlMkElRkQ7IHgtZGVsbC1hdXRoLWp3dD1leUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpTVXpJMU5pSjkuZXlKcGMzTWlPaUpCVFZOSlpHVnVkR2wwZVZCeWIzWnBaR1Z5SWl3aWMzVmlJam8xTkRFc0ltRjFaQ0k2SWtWVFRWQnNZWFJtYjNKdElpd2lZMjl1SWpvaVkyVTBaak5qT0RZeE5EWTBORGxqTVRnM056YzBPV1l3TXpjNE5qVmlPRFVpTENKbGVIQWlPakUxTVRBeE9EUTROalY5LlNCcl9rSUwwdVJYQ0RVYV9WdzVGM2NMRVRXalJ6NlI1VlZYSlpPYUpjT2FqYUJla2Q4RW5xM3FSU0FhdXY1TmVQR0NQOWRra3JHQ0JUWjZqeHlMZ19HOEM1MV9iekl0ckM2OS1meFZZLXlqaGNPX1dlSi1MREpITGRPbVhaWm1oQ1NWSmhyTHJ1blNJc0xESmJ3cHFGV0ZhRGJtN05KWWM5NXMxcGU3a1FnMDsgS0FDRV9MQVNUX0FETUlOX1NFQ1VSRT0lOUMlOUUlMDclOTAlQTAlQzklRTMlRUMlMEIlMUQlQjAlODIlQjMlOEYlODZwDQpDb25uZWN0aW9uOiBjbG9zZQ0KDQo=]]></request>
+      <response base64="true"><![CDATA[SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBXZWQsIDA4IE5vdiAyMDE3IDE5OjUwOjE0IEdNVA0KU2VydmVyOiBBcGFjaGUNCkV4cGlyZXM6IFRodSwgMTkgTm92IDE5ODEgMDg6NTI6MDAgR01UDQpDYWNoZS1Db250cm9sOiBuby1zdG9yZSwgbm8tY2FjaGUsIG11c3QtcmV2YWxpZGF0ZSwgcG9zdC1jaGVjaz0wLCBwcmUtY2hlY2s9MA0KUHJhZ21hOiBuby1jYWNoZQ0KVmFyeTogQWNjZXB0LUVuY29kaW5nDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1IZWFkZXJzOiB4LWRlbGwtYXV0aC10aW1lc3RhbXAsIHgtZGVsbC1hdXRoLWtleSwgeC1kZWxsLWF1dGgtc2lnbmF0dXJlLCBhY2NlcHQsIG9yaWdpbiwgY29udGVudC10eXBlDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1PcmlnaW46ICoNCkFjY2Vzcy1Db250cm9sLUFsbG93LU1ldGhvZHM6IFBVVCwgREVMRVRFLCBQT1NULCBHRVQsIE9QVElPTlMNClgtRGVsbEtBQ0UtQXBwbGlhbmNlOiBrMTAwMA0KWC1EZWxsS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtRGVsbEtBQ0UtVmVyc2lvbjogNy4yLjEwMg0KWC1LQk9YLVdlYlNlcnZlcjogS0FDRS5uYWJhbmNhcmQuY29tDQpYLUtCT1gtVmVyc2lvbjogNy4yLjEwMg0KWC1LQUNFLUFwcGxpYW5jZTogSzEwMDANClgtS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtS0FDRS1WZXJzaW9uOiA3LjIuMTAyDQpYLUtBQ0UtV2ViU2VydmVyOiBLQUNFLm5hYmFuY2FyZC5jb20NClgtVUEtQ29tcGF0aWJsZTogSUU9OSxFREdFDQpDYWNoZS1Db250cm9sOiBwcml2YXRlLCBuby1jYWNoZSwgbm8tc3RvcmUsIHByb3h5LXJldmFsaWRhdGUsIG5vLXRyYW5zZm9ybQ0KQ29udGVudC1MZW5ndGg6IDQ0DQpDb25uZWN0aW9uOiBjbG9zZQ0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgNClN0cmljdC1UcmFuc3BvcnQtU2VjdXJpdHk6IG1heC1hZ2U9MTU3NjgwMDANCg0KeyJjdXJyZW50X3BhZ2UiOjEsInRvdGFsX3BhZ2VzIjowLCJyb3dzIjpbXX0=]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+  <issue>
+    <serialNumber>268361935394890752</serialNumber>
+    <type>1049088</type>
+    <name><![CDATA[SQL injection]]></name>
+    <host ip="198.252.230.171">https://kace.nabancard.com</host>
+    <path><![CDATA[/common/user_profile.php]]></path>
+    <location><![CDATA[/common/user_profile.php [sort_direction parameter]]]></location>
+    <severity>High</severity>
+    <confidence>Firm</confidence>
+    <issueBackground><![CDATA[<p>SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.</p>
+<p>A wide range of damaging attacks can often be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and taking control of the database server. </p>]]></issueBackground>
+    <remediationBackground><![CDATA[<p>The most effective way to prevent SQL injection attacks is to use parameterized queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already been defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterized queries. It is strongly recommended that you parameterize <i>every</i> variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.</p>
+<p>You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective: </p>
+<ul>
+  <li>One common defense is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defense is designed to prevent malformed data from terminating the string into which it is inserted. However, if the data being incorporated into queries is numeric, then the defense may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defense to be bypassed.</li>
+  <li>Another often cited defense is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.</li>
+</ul>]]></remediationBackground>
+    <references><![CDATA[<ul>
+<li><a href="https://support.portswigger.net/customer/portal/articles/1965677-using-burp-to-test-for-injection-flaws">Using Burp to Test for Injection Flaws</a></li>
+<li><a href="http://websec.ca/kb/sql_injection">SQL Injection Cheat Sheet</a></li>
+<li><a href="https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet">SQL Injection Prevention Cheat Sheet</a></li>
+</ul>]]></references>
+    <vulnerabilityClassifications><![CDATA[<ul>
+<li><a href="https://cwe.mitre.org/data/definitions/89.html">CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')</a></li>
+<li><a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94: Improper Control of Generation of Code ('Code Injection')
+</a></li>
+<li><a href="https://cwe.mitre.org/data/definitions/116.html">CWE-116: Improper Encoding or Escaping of Output</a></li>
+</ul>]]></vulnerabilityClassifications>
+    <issueDetail><![CDATA[The <b>sort_direction</b> parameter appears to be vulnerable to SQL injection attacks. The payload <b>,(select*from(select(sleep(20)))a)</b> was submitted in the sort_direction parameter. The application took <b>20314</b> milliseconds to respond to the request, compared with <b>1980</b> milliseconds for the original request, indicating that the injected SQL command caused a time delay.<br><br>The database appears to be MySQL.]]></issueDetail>
+    <requestresponse>
+      <request method="GET" base64="true"><![CDATA[R0VUIC9jb21tb24vdXNlcl9wcm9maWxlLnBocD9JRD01NDkmdGFibGVfaWQ9dXBfYXNzaWduZWRfZGV2aWNlc190YWJsZSZzb3J0X2NvbHVtbj1JU19QUklNQVJZX0RFVklDRSZzb3J0X2RpcmVjdGlvbj1kZXNjJTJjKHNlbGVjdCpmcm9tKHNlbGVjdChzbGVlcCgyMCkpKWEpJnJlY29yZHNfcGVyX3BhZ2U9NSZwYWdlX251bWJlcj0xIEhUVFAvMS4xDQpIb3N0OiBrYWNlLm5hYmFuY2FyZC5jb20NClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwLjEyOyBydjo1Ni4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzU2LjANCkFjY2VwdDogYXBwbGljYXRpb24vanNvbiwgdGV4dC9qYXZhc2NyaXB0LCAqLyo7IHE9MC4wMQ0KQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlDQpSZWZlcmVyOiBodHRwczovL2thY2UubmFiYW5jYXJkLmNvbS91c2VydWkvYWR2aXNvcnlfZGV0YWlsLnBocD9JRD0xJTIwKyUyMDENClgtUmVxdWVzdGVkLVdpdGg6IFhNTEh0dHBSZXF1ZXN0DQpDb29raWU6IGtib3hpZD1lbWkzbmZtaDUyMW82OWE1dGQ5bHY3M2ViNjsgS0FDRV9DU1JGX1RPS0VOPTMyZWIxOTg3MmU3NTYwYWExNjMyYzQ5ODc2OTEwYzUwYjdiOTMwMDY5YWRkOGYwNDIzYjBlNzVjYjY3YjRiYjdkM2U3MDMyMWRiY2U0MDRhYjEzZTU0NjkwNmY2ZWM5ODAwY2RjYzRjMTZmZWEwYWNiMjBhN2FmNTdjNDRkNzkzOyBLQUNFX0xBU1RfVVNFUl9TRUNVUkU9JTlDJTlFJTA3JTkwJUEwJUM5JUUzJUVDJTBCJTFEJUIwJTgyJUIzJThGJTg2cDsgS0FDRV9MQVNUX09SR19TRUNVUkU9JURFJUEzJTBFMjAlOEUlODQlQkYlQjElRDUlODklRTAlQTglRTYlMkElRkQ7IHgtZGVsbC1hdXRoLWp3dD1leUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpTVXpJMU5pSjkuZXlKcGMzTWlPaUpCVFZOSlpHVnVkR2wwZVZCeWIzWnBaR1Z5SWl3aWMzVmlJam8xTkRFc0ltRjFaQ0k2SWtWVFRWQnNZWFJtYjNKdElpd2lZMjl1SWpvaVkyVTBaak5qT0RZeE5EWTBORGxqTVRnM056YzBPV1l3TXpjNE5qVmlPRFVpTENKbGVIQWlPakUxTVRBeE9EUTROalY5LlNCcl9rSUwwdVJYQ0RVYV9WdzVGM2NMRVRXalJ6NlI1VlZYSlpPYUpjT2FqYUJla2Q4RW5xM3FSU0FhdXY1TmVQR0NQOWRra3JHQ0JUWjZqeHlMZ19HOEM1MV9iekl0ckM2OS1meFZZLXlqaGNPX1dlSi1MREpITGRPbVhaWm1oQ1NWSmhyTHJ1blNJc0xESmJ3cHFGV0ZhRGJtN05KWWM5NXMxcGU3a1FnMDsgS0FDRV9MQVNUX0FETUlOX1NFQ1VSRT0lOUMlOUUlMDclOTAlQTAlQzklRTMlRUMlMEIlMUQlQjAlODIlQjMlOEYlODZwDQpDb25uZWN0aW9uOiBjbG9zZQ0KDQo=]]></request>
+      <response base64="true"><![CDATA[SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBXZWQsIDA4IE5vdiAyMDE3IDE5OjUyOjI2IEdNVA0KU2VydmVyOiBBcGFjaGUNCkV4cGlyZXM6IFRodSwgMTkgTm92IDE5ODEgMDg6NTI6MDAgR01UDQpDYWNoZS1Db250cm9sOiBuby1zdG9yZSwgbm8tY2FjaGUsIG11c3QtcmV2YWxpZGF0ZSwgcG9zdC1jaGVjaz0wLCBwcmUtY2hlY2s9MA0KUHJhZ21hOiBuby1jYWNoZQ0KVmFyeTogQWNjZXB0LUVuY29kaW5nDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1IZWFkZXJzOiB4LWRlbGwtYXV0aC10aW1lc3RhbXAsIHgtZGVsbC1hdXRoLWtleSwgeC1kZWxsLWF1dGgtc2lnbmF0dXJlLCBhY2NlcHQsIG9yaWdpbiwgY29udGVudC10eXBlDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1PcmlnaW46ICoNCkFjY2Vzcy1Db250cm9sLUFsbG93LU1ldGhvZHM6IFBVVCwgREVMRVRFLCBQT1NULCBHRVQsIE9QVElPTlMNClgtRGVsbEtBQ0UtQXBwbGlhbmNlOiBrMTAwMA0KWC1EZWxsS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtRGVsbEtBQ0UtVmVyc2lvbjogNy4yLjEwMg0KWC1LQk9YLVdlYlNlcnZlcjogS0FDRS5uYWJhbmNhcmQuY29tDQpYLUtCT1gtVmVyc2lvbjogNy4yLjEwMg0KWC1LQUNFLUFwcGxpYW5jZTogSzEwMDANClgtS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtS0FDRS1WZXJzaW9uOiA3LjIuMTAyDQpYLUtBQ0UtV2ViU2VydmVyOiBLQUNFLm5hYmFuY2FyZC5jb20NClgtVUEtQ29tcGF0aWJsZTogSUU9OSxFREdFDQpDYWNoZS1Db250cm9sOiBwcml2YXRlLCBuby1jYWNoZSwgbm8tc3RvcmUsIHByb3h5LXJldmFsaWRhdGUsIG5vLXRyYW5zZm9ybQ0KQ29udGVudC1MZW5ndGg6IDQ0DQpDb25uZWN0aW9uOiBjbG9zZQ0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgNClN0cmljdC1UcmFuc3BvcnQtU2VjdXJpdHk6IG1heC1hZ2U9MTU3NjgwMDANCg0KeyJjdXJyZW50X3BhZ2UiOjEsInRvdGFsX3BhZ2VzIjowLCJyb3dzIjpbXX0=]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+  <issue>
+    <serialNumber>2096392919560836096</serialNumber>
+    <type>2098688</type>
+    <name><![CDATA[Cross-origin resource sharing]]></name>
+    <host ip="198.252.230.171">https://kace.nabancard.com</host>
+    <path><![CDATA[/common/user_profile.php]]></path>
+    <location><![CDATA[/common/user_profile.php]]></location>
+    <severity>Information</severity>
+    <confidence>Certain</confidence>
+    <issueBackground><![CDATA[<p>An HTML5 cross-origin resource sharing (CORS) policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of the request.</p><p>If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially retrieve content from the application, and sometimes carry out actions within the security context of the logged in user.</p>
+<p>Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by an attacker to exploit the trust relationship and attack the application that allows access. CORS policies on pages containing sensitive information should be reviewed to determine whether it is appropriate for the application to trust both the intentions and security posture of any domains granted access.</p>]]></issueBackground>
+    <remediationBackground><![CDATA[<p>Any inappropriate domains should be removed from the CORS policy.</p>]]></remediationBackground>
+    <references><![CDATA[<ul>
+  <li> <a href="http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html">Exploiting CORS Misconfigurations</a> </li>
+</ul>]]></references>
+    <vulnerabilityClassifications><![CDATA[<ul>
+<li><a href="https://cwe.mitre.org/data/definitions/942.html">CWE-942: Overly Permissive Cross-domain Whitelist</a></li>
+</ul>]]></vulnerabilityClassifications>
+    <issueDetail><![CDATA[The application implements an HTML5 cross-origin resource sharing (CORS) policy for this request.<br><br>If the application relies on network firewalls or other IP-based access controls, this policy is likely to present a security risk.<br><br>Since the Vary: Origin header was not present in the response, reverse proxies and intermediate servers may cache it. This may enable an attacker to carry out cache poisoning attacks.]]></issueDetail>
+    <requestresponse>
+      <request method="GET" base64="true"><![CDATA[R0VUIC9jb21tb24vdXNlcl9wcm9maWxlLnBocD9JRD01NDkmdGFibGVfaWQ9dXBfYXNzaWduZWRfZGV2aWNlc190YWJsZSZzb3J0X2NvbHVtbj1JU19QUklNQVJZX0RFVklDRSZzb3J0X2RpcmVjdGlvbj1kZXNjJnJlY29yZHNfcGVyX3BhZ2U9NSZwYWdlX251bWJlcj0xIEhUVFAvMS4xDQpIb3N0OiBrYWNlLm5hYmFuY2FyZC5jb20NClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwLjEyOyBydjo1Ni4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzU2LjANCkFjY2VwdDogYXBwbGljYXRpb24vanNvbiwgdGV4dC9qYXZhc2NyaXB0LCAqLyo7IHE9MC4wMQ0KQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlDQpSZWZlcmVyOiBodHRwczovL2thY2UubmFiYW5jYXJkLmNvbS91c2VydWkvYWR2aXNvcnlfZGV0YWlsLnBocD9JRD0xJTIwKyUyMDENClgtUmVxdWVzdGVkLVdpdGg6IFhNTEh0dHBSZXF1ZXN0DQpDb29raWU6IGtib3hpZD1lbWkzbmZtaDUyMW82OWE1dGQ5bHY3M2ViNjsgS0FDRV9DU1JGX1RPS0VOPTMyZWIxOTg3MmU3NTYwYWExNjMyYzQ5ODc2OTEwYzUwYjdiOTMwMDY5YWRkOGYwNDIzYjBlNzVjYjY3YjRiYjdkM2U3MDMyMWRiY2U0MDRhYjEzZTU0NjkwNmY2ZWM5ODAwY2RjYzRjMTZmZWEwYWNiMjBhN2FmNTdjNDRkNzkzOyBLQUNFX0xBU1RfVVNFUl9TRUNVUkU9JTlDJTlFJTA3JTkwJUEwJUM5JUUzJUVDJTBCJTFEJUIwJTgyJUIzJThGJTg2cDsgS0FDRV9MQVNUX09SR19TRUNVUkU9JURFJUEzJTBFMjAlOEUlODQlQkYlQjElRDUlODklRTAlQTglRTYlMkElRkQ7IHgtZGVsbC1hdXRoLWp3dD1leUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpTVXpJMU5pSjkuZXlKcGMzTWlPaUpCVFZOSlpHVnVkR2wwZVZCeWIzWnBaR1Z5SWl3aWMzVmlJam8xTkRFc0ltRjFaQ0k2SWtWVFRWQnNZWFJtYjNKdElpd2lZMjl1SWpvaVkyVTBaak5qT0RZeE5EWTBORGxqTVRnM056YzBPV1l3TXpjNE5qVmlPRFVpTENKbGVIQWlPakUxTVRBeE9EUTROalY5LlNCcl9rSUwwdVJYQ0RVYV9WdzVGM2NMRVRXalJ6NlI1VlZYSlpPYUpjT2FqYUJla2Q4RW5xM3FSU0FhdXY1TmVQR0NQOWRra3JHQ0JUWjZqeHlMZ19HOEM1MV9iekl0ckM2OS1meFZZLXlqaGNPX1dlSi1MREpITGRPbVhaWm1oQ1NWSmhyTHJ1blNJc0xESmJ3cHFGV0ZhRGJtN05KWWM5NXMxcGU3a1FnMDsgS0FDRV9MQVNUX0FETUlOX1NFQ1VSRT0lOUMlOUUlMDclOTAlQTAlQzklRTMlRUMlMEIlMUQlQjAlODIlQjMlOEYlODZwDQpDb25uZWN0aW9uOiBjbG9zZQ0KDQo=]]></request>
+      <response base64="true"><![CDATA[SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBXZWQsIDA4IE5vdiAyMDE3IDE5OjQ4OjM5IEdNVA0KU2VydmVyOiBBcGFjaGUNCkV4cGlyZXM6IFRodSwgMTkgTm92IDE5ODEgMDg6NTI6MDAgR01UDQpDYWNoZS1Db250cm9sOiBuby1zdG9yZSwgbm8tY2FjaGUsIG11c3QtcmV2YWxpZGF0ZSwgcG9zdC1jaGVjaz0wLCBwcmUtY2hlY2s9MA0KUHJhZ21hOiBuby1jYWNoZQ0KVmFyeTogQWNjZXB0LUVuY29kaW5nDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1IZWFkZXJzOiB4LWRlbGwtYXV0aC10aW1lc3RhbXAsIHgtZGVsbC1hdXRoLWtleSwgeC1kZWxsLWF1dGgtc2lnbmF0dXJlLCBhY2NlcHQsIG9yaWdpbiwgY29udGVudC10eXBlDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1PcmlnaW46ICoNCkFjY2Vzcy1Db250cm9sLUFsbG93LU1ldGhvZHM6IFBVVCwgREVMRVRFLCBQT1NULCBHRVQsIE9QVElPTlMNClgtRGVsbEtBQ0UtQXBwbGlhbmNlOiBrMTAwMA0KWC1EZWxsS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtRGVsbEtBQ0UtVmVyc2lvbjogNy4yLjEwMg0KWC1LQk9YLVdlYlNlcnZlcjogS0FDRS5uYWJhbmNhcmQuY29tDQpYLUtCT1gtVmVyc2lvbjogNy4yLjEwMg0KWC1LQUNFLUFwcGxpYW5jZTogSzEwMDANClgtS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtS0FDRS1WZXJzaW9uOiA3LjIuMTAyDQpYLUtBQ0UtV2ViU2VydmVyOiBLQUNFLm5hYmFuY2FyZC5jb20NClgtVUEtQ29tcGF0aWJsZTogSUU9OSxFREdFDQpDYWNoZS1Db250cm9sOiBwcml2YXRlLCBuby1jYWNoZSwgbm8tc3RvcmUsIHByb3h5LXJldmFsaWRhdGUsIG5vLXRyYW5zZm9ybQ0KQ29udGVudC1MZW5ndGg6IDQ0DQpDb25uZWN0aW9uOiBjbG9zZQ0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgNClN0cmljdC1UcmFuc3BvcnQtU2VjdXJpdHk6IG1heC1hZ2U9MTU3NjgwMDANCg0KeyJjdXJyZW50X3BhZ2UiOjEsInRvdGFsX3BhZ2VzIjowLCJyb3dzIjpbXX0=]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+  <issue>
+    <serialNumber>450331590754026496</serialNumber>
+    <type>2098688</type>
+    <name><![CDATA[Cross-origin resource sharing]]></name>
+    <host ip="198.252.230.171">https://kace.nabancard.com</host>
+    <path><![CDATA[/common/user_profile.php]]></path>
+    <location><![CDATA[/common/user_profile.php]]></location>
+    <severity>Information</severity>
+    <confidence>Certain</confidence>
+    <issueBackground><![CDATA[<p>An HTML5 cross-origin resource sharing (CORS) policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of the request.</p><p>If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially retrieve content from the application, and sometimes carry out actions within the security context of the logged in user.</p>
+<p>Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by an attacker to exploit the trust relationship and attack the application that allows access. CORS policies on pages containing sensitive information should be reviewed to determine whether it is appropriate for the application to trust both the intentions and security posture of any domains granted access.</p>]]></issueBackground>
+    <remediationBackground><![CDATA[<p>Any inappropriate domains should be removed from the CORS policy.</p>]]></remediationBackground>
+    <references><![CDATA[<ul>
+  <li> <a href="http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html">Exploiting CORS Misconfigurations</a> </li>
+</ul>]]></references>
+    <vulnerabilityClassifications><![CDATA[<ul>
+<li><a href="https://cwe.mitre.org/data/definitions/942.html">CWE-942: Overly Permissive Cross-domain Whitelist</a></li>
+</ul>]]></vulnerabilityClassifications>
+    <issueDetail><![CDATA[The application implements an HTML5 cross-origin resource sharing (CORS) policy for this request.<br><br>If the application relies on network firewalls or other IP-based access controls, this policy is likely to present a security risk.<br><br>Since the Vary: Origin header was not present in the response, reverse proxies and intermediate servers may cache it. This may enable an attacker to carry out cache poisoning attacks.]]></issueDetail>
+    <requestresponse>
+      <request method="GET" base64="true"><![CDATA[R0VUIC9jb21tb24vdXNlcl9wcm9maWxlLnBocD9JRD01NDkmdGFibGVfaWQ9dXBfYXNzaWduZWRfZGV2aWNlc190YWJsZSZzb3J0X2NvbHVtbj1JU19QUklNQVJZX0RFVklDRSZzb3J0X2RpcmVjdGlvbj1kZXNjJnJlY29yZHNfcGVyX3BhZ2U9NSZwYWdlX251bWJlcj0xIEhUVFAvMS4xDQpIb3N0OiBrYWNlLm5hYmFuY2FyZC5jb20NClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwLjEyOyBydjo1Ni4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzU2LjANCkFjY2VwdDogYXBwbGljYXRpb24vanNvbiwgdGV4dC9qYXZhc2NyaXB0LCAqLyo7IHE9MC4wMQ0KQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlDQpSZWZlcmVyOiBodHRwczovL2thY2UubmFiYW5jYXJkLmNvbS91c2VydWkvYWR2aXNvcnlfZGV0YWlsLnBocD9JRD0xJTIwKyUyMDENClgtUmVxdWVzdGVkLVdpdGg6IFhNTEh0dHBSZXF1ZXN0DQpDb29raWU6IGtib3hpZD00ZDJ0bzdodmN1N21hNGZidDdlN2FkMHQ1MTsgS0FDRV9DU1JGX1RPS0VOPTU4ZDQ5ZDIwMTY4MjMwNWUzOTZjZGFiZTMyOWYxZjUyOGE1NmFkYTkyZWNiZDk0NDM1ZmY5NGMyYzY4Y2E0ZmY2ZmI1NjE4ZDhiYzhmOTU3NmNkMmYzNzQ4ZjQ2Y2UzMTY3Y2Y2MGRhZWVjNDAwYjQ4MTc4YWYxZWI4Mjc1NDA5OyBLQUNFX0xBU1RfVVNFUl9TRUNVUkU9JTlDJTlFJTA3JTkwJUEwJUM5JUUzJUVDJTBCJTFEJUIwJTgyJUIzJThGJTg2cDsgS0FDRV9MQVNUX09SR19TRUNVUkU9JURFJUEzJTBFMjAlOEUlODQlQkYlQjElRDUlODklRTAlQTglRTYlMkElRkQ7IHgtZGVsbC1hdXRoLWp3dD1leUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpTVXpJMU5pSjkuZXlKcGMzTWlPaUpCVFZOSlpHVnVkR2wwZVZCeWIzWnBaR1Z5SWl3aWMzVmlJam8xTkRFc0ltRjFaQ0k2SWtWVFRWQnNZWFJtYjNKdElpd2lZMjl1SWpvaVkyVTBaak5qT0RZeE5EWTBORGxqTVRnM056YzBPV1l3TXpjNE5qVmlPRFVpTENKbGVIQWlPakUxTVRBeE9EVTFNamg5LktqdC1mbFlKMm5DMjJiRXp0V20xVFZiajFERjN0UkFCbU8zNzYyQTYtYmllY1QtZllLVzJCVGNOaTZXQzFva2d6V3pHSXFucnVac05hbS1OaXNDQk54WjJzU3dDakZPXzBEUjN4YzBQUXQwLXJJVTBZLWxnNTBZY09PQXk2MTFuSEtxazBERzBZb2ZxNWFPUUtPWGtxcXlZdmdpVUxfc3I0WmdaRkNjLU52czsgS0FDRV9MQVNUX0FETUlOX1NFQ1VSRT0lOUMlOUUlMDclOTAlQTAlQzklRTMlRUMlMEIlMUQlQjAlODIlQjMlOEYlODZwOyBrYm94X25hdj0xDQpDb25uZWN0aW9uOiBjbG9zZQ0KT3JpZ2luOiBodHRwczovL2thY2UubmFiYW5jYXJkLmNvbQ0KDQo=]]></request>
+      <response base64="true"><![CDATA[SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBXZWQsIDA4IE5vdiAyMDE3IDIwOjAxOjM1IEdNVA0KU2VydmVyOiBBcGFjaGUNCkV4cGlyZXM6IFRodSwgMTkgTm92IDE5ODEgMDg6NTI6MDAgR01UDQpDYWNoZS1Db250cm9sOiBuby1zdG9yZSwgbm8tY2FjaGUsIG11c3QtcmV2YWxpZGF0ZSwgcG9zdC1jaGVjaz0wLCBwcmUtY2hlY2s9MA0KUHJhZ21hOiBuby1jYWNoZQ0KVmFyeTogQWNjZXB0LUVuY29kaW5nDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1IZWFkZXJzOiB4LWRlbGwtYXV0aC10aW1lc3RhbXAsIHgtZGVsbC1hdXRoLWtleSwgeC1kZWxsLWF1dGgtc2lnbmF0dXJlLCBhY2NlcHQsIG9yaWdpbiwgY29udGVudC10eXBlDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1PcmlnaW46ICoNCkFjY2Vzcy1Db250cm9sLUFsbG93LU1ldGhvZHM6IFBVVCwgREVMRVRFLCBQT1NULCBHRVQsIE9QVElPTlMNClgtRGVsbEtBQ0UtQXBwbGlhbmNlOiBrMTAwMA0KWC1EZWxsS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtRGVsbEtBQ0UtVmVyc2lvbjogNy4yLjEwMg0KWC1LQk9YLVdlYlNlcnZlcjogS0FDRS5uYWJhbmNhcmQuY29tDQpYLUtCT1gtVmVyc2lvbjogNy4yLjEwMg0KWC1LQUNFLUFwcGxpYW5jZTogSzEwMDANClgtS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtS0FDRS1WZXJzaW9uOiA3LjIuMTAyDQpYLUtBQ0UtV2ViU2VydmVyOiBLQUNFLm5hYmFuY2FyZC5jb20NClgtVUEtQ29tcGF0aWJsZTogSUU9OSxFREdFDQpDYWNoZS1Db250cm9sOiBwcml2YXRlLCBuby1jYWNoZSwgbm8tc3RvcmUsIHByb3h5LXJldmFsaWRhdGUsIG5vLXRyYW5zZm9ybQ0KQ29udGVudC1MZW5ndGg6IDQ0DQpDb25uZWN0aW9uOiBjbG9zZQ0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgNClN0cmljdC1UcmFuc3BvcnQtU2VjdXJpdHk6IG1heC1hZ2U9MTU3NjgwMDANCg0KeyJjdXJyZW50X3BhZ2UiOjEsInRvdGFsX3BhZ2VzIjowLCJyb3dzIjpbXX0=]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+  <issue>
+    <serialNumber>6870999518795599872</serialNumber>
+    <type>2098689</type>
+    <name><![CDATA[Cross-origin resource sharing: arbitrary origin trusted]]></name>
+    <host ip="198.252.230.171">https://kace.nabancard.com</host>
+    <path><![CDATA[/common/user_profile.php]]></path>
+    <location><![CDATA[/common/user_profile.php]]></location>
+    <severity>Information</severity>
+    <confidence>Certain</confidence>
+    <issueBackground><![CDATA[<p>An HTML5 cross-origin resource sharing (CORS) policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of the request.</p><p>
+Trusting arbitrary origins effectively disables the same-origin policy, allowing two-way interaction by third-party web sites. Unless the response consists only of unprotected public content, this policy is likely to present a security risk.</p>
+<p>If the site  specifies the header Access-Control-Allow-Credentials: true, third-party sites may be able to carry out privileged actions and retrieve sensitive information. Even if it does not, attackers may be able to  bypass any IP-based access controls by proxying through users'  browsers.</p>]]></issueBackground>
+    <remediationBackground><![CDATA[<p>Rather than using a wildcard or programmatically verifying supplied origins, use a whitelist of trusted domains.</p>]]></remediationBackground>
+    <references><![CDATA[<ul>
+  <li> <a href="http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html">Exploiting CORS Misconfigurations</a> </li>
+</ul>]]></references>
+    <vulnerabilityClassifications><![CDATA[<ul>
+<li><a href="https://cwe.mitre.org/data/definitions/942.html">CWE-942: Overly Permissive Cross-domain Whitelist</a></li>
+</ul>]]></vulnerabilityClassifications>
+    <issueDetail><![CDATA[The application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain.<br><br>The application allowed access from the requested origin <strong>https://pfcxuvwamstc.com</strong><br><br>If the application relies on network firewalls or other IP-based access controls, this policy is likely to present a security risk.<br><br>Since the Vary: Origin header was not present in the response, reverse proxies and intermediate servers may cache it. This may enable an attacker to carry out cache poisoning attacks.]]></issueDetail>
+    <requestresponse>
+      <request method="GET" base64="true"><![CDATA[R0VUIC9jb21tb24vdXNlcl9wcm9maWxlLnBocD9JRD01NDkmdGFibGVfaWQ9dXBfYXNzaWduZWRfZGV2aWNlc190YWJsZSZzb3J0X2NvbHVtbj1JU19QUklNQVJZX0RFVklDRSZzb3J0X2RpcmVjdGlvbj1kZXNjJnJlY29yZHNfcGVyX3BhZ2U9NSZwYWdlX251bWJlcj0xIEhUVFAvMS4xDQpIb3N0OiBrYWNlLm5hYmFuY2FyZC5jb20NClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwLjEyOyBydjo1Ni4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzU2LjANCkFjY2VwdDogYXBwbGljYXRpb24vanNvbiwgdGV4dC9qYXZhc2NyaXB0LCAqLyo7IHE9MC4wMQ0KQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQ0KQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlDQpSZWZlcmVyOiBodHRwczovL2thY2UubmFiYW5jYXJkLmNvbS91c2VydWkvYWR2aXNvcnlfZGV0YWlsLnBocD9JRD0xJTIwKyUyMDENClgtUmVxdWVzdGVkLVdpdGg6IFhNTEh0dHBSZXF1ZXN0DQpDb29raWU6IGtib3hpZD00ZDJ0bzdodmN1N21hNGZidDdlN2FkMHQ1MTsgS0FDRV9DU1JGX1RPS0VOPTU4ZDQ5ZDIwMTY4MjMwNWUzOTZjZGFiZTMyOWYxZjUyOGE1NmFkYTkyZWNiZDk0NDM1ZmY5NGMyYzY4Y2E0ZmY2ZmI1NjE4ZDhiYzhmOTU3NmNkMmYzNzQ4ZjQ2Y2UzMTY3Y2Y2MGRhZWVjNDAwYjQ4MTc4YWYxZWI4Mjc1NDA5OyBLQUNFX0xBU1RfVVNFUl9TRUNVUkU9JTlDJTlFJTA3JTkwJUEwJUM5JUUzJUVDJTBCJTFEJUIwJTgyJUIzJThGJTg2cDsgS0FDRV9MQVNUX09SR19TRUNVUkU9JURFJUEzJTBFMjAlOEUlODQlQkYlQjElRDUlODklRTAlQTglRTYlMkElRkQ7IHgtZGVsbC1hdXRoLWp3dD1leUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpTVXpJMU5pSjkuZXlKcGMzTWlPaUpCVFZOSlpHVnVkR2wwZVZCeWIzWnBaR1Z5SWl3aWMzVmlJam8xTkRFc0ltRjFaQ0k2SWtWVFRWQnNZWFJtYjNKdElpd2lZMjl1SWpvaVkyVTBaak5qT0RZeE5EWTBORGxqTVRnM056YzBPV1l3TXpjNE5qVmlPRFVpTENKbGVIQWlPakUxTVRBeE9EVTFNamg5LktqdC1mbFlKMm5DMjJiRXp0V20xVFZiajFERjN0UkFCbU8zNzYyQTYtYmllY1QtZllLVzJCVGNOaTZXQzFva2d6V3pHSXFucnVac05hbS1OaXNDQk54WjJzU3dDakZPXzBEUjN4YzBQUXQwLXJJVTBZLWxnNTBZY09PQXk2MTFuSEtxazBERzBZb2ZxNWFPUUtPWGtxcXlZdmdpVUxfc3I0WmdaRkNjLU52czsgS0FDRV9MQVNUX0FETUlOX1NFQ1VSRT0lOUMlOUUlMDclOTAlQTAlQzklRTMlRUMlMEIlMUQlQjAlODIlQjMlOEYlODZwOyBrYm94X25hdj0xDQpDb25uZWN0aW9uOiBjbG9zZQ0KT3JpZ2luOiBodHRwczovL3BmY3h1dndhbXN0Yy5jb20NCg0K]]></request>
+      <response base64="true"><![CDATA[SFRUUC8xLjEgMjAwIE9LDQpEYXRlOiBXZWQsIDA4IE5vdiAyMDE3IDIwOjAxOjM2IEdNVA0KU2VydmVyOiBBcGFjaGUNCkV4cGlyZXM6IFRodSwgMTkgTm92IDE5ODEgMDg6NTI6MDAgR01UDQpDYWNoZS1Db250cm9sOiBuby1zdG9yZSwgbm8tY2FjaGUsIG11c3QtcmV2YWxpZGF0ZSwgcG9zdC1jaGVjaz0wLCBwcmUtY2hlY2s9MA0KUHJhZ21hOiBuby1jYWNoZQ0KVmFyeTogQWNjZXB0LUVuY29kaW5nDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1IZWFkZXJzOiB4LWRlbGwtYXV0aC10aW1lc3RhbXAsIHgtZGVsbC1hdXRoLWtleSwgeC1kZWxsLWF1dGgtc2lnbmF0dXJlLCBhY2NlcHQsIG9yaWdpbiwgY29udGVudC10eXBlDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1PcmlnaW46ICoNCkFjY2Vzcy1Db250cm9sLUFsbG93LU1ldGhvZHM6IFBVVCwgREVMRVRFLCBQT1NULCBHRVQsIE9QVElPTlMNClgtRGVsbEtBQ0UtQXBwbGlhbmNlOiBrMTAwMA0KWC1EZWxsS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtRGVsbEtBQ0UtVmVyc2lvbjogNy4yLjEwMg0KWC1LQk9YLVdlYlNlcnZlcjogS0FDRS5uYWJhbmNhcmQuY29tDQpYLUtCT1gtVmVyc2lvbjogNy4yLjEwMg0KWC1LQUNFLUFwcGxpYW5jZTogSzEwMDANClgtS0FDRS1Ib3N0OiBLQUNFLm5hYmFuY2FyZC5jb20NClgtS0FDRS1WZXJzaW9uOiA3LjIuMTAyDQpYLUtBQ0UtV2ViU2VydmVyOiBLQUNFLm5hYmFuY2FyZC5jb20NClgtVUEtQ29tcGF0aWJsZTogSUU9OSxFREdFDQpDYWNoZS1Db250cm9sOiBwcml2YXRlLCBuby1jYWNoZSwgbm8tc3RvcmUsIHByb3h5LXJldmFsaWRhdGUsIG5vLXRyYW5zZm9ybQ0KQ29udGVudC1MZW5ndGg6IDQ0DQpDb25uZWN0aW9uOiBjbG9zZQ0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgNClN0cmljdC1UcmFuc3BvcnQtU2VjdXJpdHk6IG1heC1hZ2U9MTU3NjgwMDANCg0KeyJjdXJyZW50X3BhZ2UiOjEsInRvdGFsX3BhZ2VzIjowLCJyb3dzIjpbXX0=]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+</issues>
diff --git a/examples/reports/junit_dojo.xml b/examples/reports/junit_dojo.xml
new file mode 100644
index 0000000..642ff46
--- /dev/null
+++ b/examples/reports/junit_dojo.xml
@@ -0,0 +1,97 @@
+<?xml version="1.0" ?>
+<testsuite failures="4" name="DefectDojo" tests="4">
+	<testcase name="blacklist Severity: Info">
+		<failure>Using cElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace cElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Filename: PyBitBucket.py Line number: 6 Line range: [6, 7, 8, 9] Issue Confidence: HIGH</failure>
+	</testcase>
+	<testcase name="SQL injection Severity: High">
+		<failure>SQL injection vulnerabilities arise when user-controllable data is
+incorporated into database SQL queries in an unsafe manner. An attacker can
+supply crafted input to break out of the data context in which their input
+appears and interfere with the structure of the surrounding query.
+
+A wide range of damaging attacks can often be delivered via SQL injection,
+including reading or modifying critical application data, interfering with
+application logic, escalating privileges within the database and taking
+control of the database server.
+
+
+
+The **sort_column** parameter appears to be vulnerable to SQL injection
+attacks. The payload **,(select*from(select(sleep(20)))a)** was submitted in
+the sort_column parameter. The application took **20562** milliseconds to
+respond to the request, compared with **1980** milliseconds for the original
+request, indicating that the injected SQL command caused a time delay.  
+  
+The database appears to be MySQL.
+
+</failure>
+	</testcase>
+	<testcase name="Cross-origin resource sharing Severity: Info">
+		<failure>An HTML5 cross-origin resource sharing (CORS) policy controls whether and how
+content running on other domains can perform two-way interaction with the
+domain that publishes the policy. The policy is fine-grained and can apply
+access controls per-request based on the URL and other features of the
+request.
+
+If another domain is allowed by the policy, then that domain can potentially
+attack users of the application. If a user is logged in to the application,
+and visits a domain allowed by the policy, then any malicious content running
+on that domain can potentially retrieve content from the application, and
+sometimes carry out actions within the security context of the logged in user.
+
+Even if an allowed domain is not overtly malicious in itself, security
+vulnerabilities within that domain could potentially be leveraged by an
+attacker to exploit the trust relationship and attack the application that
+allows access. CORS policies on pages containing sensitive information should
+be reviewed to determine whether it is appropriate for the application to
+trust both the intentions and security posture of any domains granted access.
+
+
+
+The application implements an HTML5 cross-origin resource sharing (CORS)
+policy for this request.  
+  
+If the application relies on network firewalls or other IP-based access
+controls, this policy is likely to present a security risk.  
+  
+Since the Vary: Origin header was not present in the response, reverse proxies
+and intermediate servers may cache it. This may enable an attacker to carry
+out cache poisoning attacks.
+
+</failure>
+	</testcase>
+	<testcase name="Cross-origin resource sharing: arbitrary origin trusted Severity: Info">
+		<failure>An HTML5 cross-origin resource sharing (CORS) policy controls whether and how
+content running on other domains can perform two-way interaction with the
+domain that publishes the policy. The policy is fine-grained and can apply
+access controls per-request based on the URL and other features of the
+request.
+
+Trusting arbitrary origins effectively disables the same-origin policy,
+allowing two-way interaction by third-party web sites. Unless the response
+consists only of unprotected public content, this policy is likely to present
+a security risk.
+
+If the site specifies the header Access-Control-Allow-Credentials: true,
+third-party sites may be able to carry out privileged actions and retrieve
+sensitive information. Even if it does not, attackers may be able to bypass
+any IP-based access controls by proxying through users' browsers.
+
+
+
+The application implements an HTML5 cross-origin resource sharing (CORS)
+policy for this request that allows access from any domain.  
+  
+The application allowed access from the requested origin
+**https://pfcxuvwamstc.com**  
+  
+If the application relies on network firewalls or other IP-based access
+controls, this policy is likely to present a security risk.  
+  
+Since the Vary: Origin header was not present in the response, reverse proxies
+and intermediate servers may cache it. This may enable an attacker to carry
+out cache poisoning attacks.
+
+</failure>
+	</testcase>
+</testsuite>
-- 
GitLab