nginx
tcp/443
GraphQL introspection is enabled.
This could leak to data leak if not properly configured.
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3259f0531fa8e8b33c258e98c6ffe6eec2f70464b
GraphQL introspection enabled at /graphql Types: 54 (by kind: ENUM: 3, INPUT_OBJECT: 11, OBJECT: 32, SCALAR: 8) Operations: - Query: Query | fields: data_privacy_app, data_privacy_website, imprint, terms_and_conditions - Subscription: Subscription | fields: data_privacy_app_mutated, data_privacy_website_mutated, directus_dashboards_mutated, directus_files_mutated, directus_flows_mutated Directives: deprecated, include, skip (total: 3) Readable stores: 4 data_privacy_app (args: none) : content=<h1>Datenschutzerklärung nach der Datenschutz-Grundveror... data_privacy_website (args: none) : content=<h1>Datenschutzerklärung nach der Datenschutz-Grundveror... imprint (args: none) : content=<h1>Impressum</h1> <p>Das Impressum gilt für die Seite h... date_created=2023-10-26T16:13:39.000Z date_updated=2024-08-26T08:34:49.000Z id=1 user_created=8f438240-c34e-4c3c-a485-5bfae79d2025 user_updated=71f58ad4-ba4c-4cf9-96a8-ac4ccccc7d2d terms_and_conditions (args: none) : content=<h1 class="MsoTitle">Nutzungsbedingungen der App</h1> <p clas...
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3259f0531fa8e8b33c258e98c6ffe6eecce368cf5
GraphQL introspection enabled at /graphql Types: 54 (by kind: ENUM: 3, INPUT_OBJECT: 11, OBJECT: 32, SCALAR: 8) Operations: - Query: Query | fields: data_privacy_app, data_privacy_website, imprint, terms_and_conditions - Subscription: Subscription | fields: data_privacy_app_mutated, data_privacy_website_mutated, directus_dashboards_mutated, directus_files_mutated, directus_flows_mutated Directives: deprecated, include, skip (total: 3) Readable stores: 4 data_privacy_app (args: none) : content=<h1>Datenschutzerklärung nach der Datenschutz-Grundveror... data_privacy_website (args: none) : content=<h1>Datenschutzerklärung nach der Datenschutz-Grundveror... imprint (args: none) : date_created=2023-10-26T16:13:39.000Z date_updated=2024-08-26T08:34:49.000Z id=1 user_created=8f438240-c34e-4c3c-a485-5bfae79d2025 user_updated=71f58ad4-ba4c-4cf9-96a8-ac4ccccc7d2d content=<h1>Impressum</h1> <p>Das Impressum gilt für die Seite h... terms_and_conditions (args: none) : content=<h1 class="MsoTitle">Nutzungsbedingungen der App</h1> <p clas...
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3259f0531fa8e8b33c258e98c6ffe6eecb1e794bb
GraphQL introspection enabled at /graphql Types: 54 (by kind: ENUM: 3, INPUT_OBJECT: 11, OBJECT: 32, SCALAR: 8) Operations: - Query: Query | fields: data_privacy_app, data_privacy_website, imprint, terms_and_conditions - Subscription: Subscription | fields: data_privacy_app_mutated, data_privacy_website_mutated, directus_dashboards_mutated, directus_files_mutated, directus_flows_mutated Directives: deprecated, include, skip (total: 3) Readable stores: 4 data_privacy_app (args: none) : content=<h1>Datenschutzerklärung nach der Datenschutz-Grundveror... data_privacy_website (args: none) : content=<h1>Datenschutzerklärung nach der Datenschutz-Grundveror... imprint (args: none) : user_created=8f438240-c34e-4c3c-a485-5bfae79d2025 user_updated=71f58ad4-ba4c-4cf9-96a8-ac4ccccc7d2d content=<h1>Impressum</h1> <p>Das Impressum gilt für die Seite h... date_created=2023-10-26T16:13:39.000Z date_updated=2024-08-26T08:34:49.000Z id=1 terms_and_conditions (args: none) : content=<h1 class="MsoTitle">Nutzungsbedingungen der App</h1> <p clas...
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3259f0531fa8e8b33c258e98c6ffe6eec6c5ffce5
GraphQL introspection enabled at /graphql Types: 54 (by kind: ENUM: 3, INPUT_OBJECT: 11, OBJECT: 32, SCALAR: 8) Operations: - Query: Query | fields: data_privacy_app, data_privacy_website, imprint, terms_and_conditions - Subscription: Subscription | fields: data_privacy_app_mutated, data_privacy_website_mutated, directus_dashboards_mutated, directus_files_mutated, directus_flows_mutated Directives: deprecated, include, skip (total: 3) Readable stores: 4 data_privacy_app (args: none) : content=<h1>Datenschutzerklärung nach der Datenschutz-Grundveror... data_privacy_website (args: none) : content=<h1>Datenschutzerklärung nach der Datenschutz-Grundveror... imprint (args: none) : id=1 user_created=8f438240-c34e-4c3c-a485-5bfae79d2025 user_updated=71f58ad4-ba4c-4cf9-96a8-ac4ccccc7d2d content=<h1>Impressum</h1> <p>Das Impressum gilt für die Seite h... date_created=2023-10-26T16:13:39.000Z date_updated=2024-08-26T08:34:49.000Z terms_and_conditions (args: none) : content=<h1 class="MsoTitle">Nutzungsbedingungen der App</h1> <p clas...
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3259f0531fa8e8b33c258e98c6ffe6eec5131daa3
GraphQL introspection enabled at /graphql Types: 54 (by kind: ENUM: 3, INPUT_OBJECT: 11, OBJECT: 32, SCALAR: 8) Operations: - Query: Query | fields: data_privacy_app, data_privacy_website, imprint, terms_and_conditions - Subscription: Subscription | fields: data_privacy_app_mutated, data_privacy_website_mutated, directus_dashboards_mutated, directus_files_mutated, directus_flows_mutated Directives: deprecated, include, skip (total: 3) Readable stores: 4 data_privacy_app (args: none) : content=<h1>Datenschutzerklärung nach der Datenschutz-Grundveror... data_privacy_website (args: none) : content=<h1>Datenschutzerklärung nach der Datenschutz-Grundveror... imprint (args: none) : user_updated=71f58ad4-ba4c-4cf9-96a8-ac4ccccc7d2d content=<h1>Impressum</h1> <p>Das Impressum gilt für die Seite h... date_created=2023-10-26T16:13:39.000Z date_updated=2024-08-26T08:34:49.000Z id=1 user_created=8f438240-c34e-4c3c-a485-5bfae79d2025 terms_and_conditions (args: none) : content=<h1 class="MsoTitle">Nutzungsbedingungen der App</h1> <p clas...
GraphQL introspection is enabled.
This could leak to data leak if not properly configured.
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3259f0531fa8e8b33c258e98c6ffe6eec43b34db0
GraphQL introspection enabled at /graphql Types: 54 (by kind: ENUM: 3, INPUT_OBJECT: 11, OBJECT: 32, SCALAR: 8) Operations: - Query: Query | fields: data_privacy_app, data_privacy_website, imprint, terms_and_conditions - Subscription: Subscription | fields: data_privacy_app_mutated, data_privacy_website_mutated, directus_dashboards_mutated, directus_files_mutated, directus_flows_mutated Directives: deprecated, include, skip (total: 3) Readable stores: 4 data_privacy_app (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... data_privacy_website (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... imprint (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... date_created=2024-01-18T15:20:03.000Z id=1 user_created=172f0b7a-8add-41be-89b8-cc9452a44902 terms_and_conditions (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein...
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3259f0531fa8e8b33c258e98c6ffe6eec188627b0
GraphQL introspection enabled at /graphql Types: 54 (by kind: ENUM: 3, INPUT_OBJECT: 11, OBJECT: 32, SCALAR: 8) Operations: - Query: Query | fields: data_privacy_app, data_privacy_website, imprint, terms_and_conditions - Subscription: Subscription | fields: data_privacy_app_mutated, data_privacy_website_mutated, directus_dashboards_mutated, directus_files_mutated, directus_flows_mutated Directives: deprecated, include, skip (total: 3) Readable stores: 4 data_privacy_app (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... data_privacy_website (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... imprint (args: none) : user_created=172f0b7a-8add-41be-89b8-cc9452a44902 content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... date_created=2024-01-18T15:20:03.000Z id=1 terms_and_conditions (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein...
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3259f0531fa8e8b33c258e98c6ffe6eec42373800
GraphQL introspection enabled at /graphql Types: 54 (by kind: ENUM: 3, INPUT_OBJECT: 11, OBJECT: 32, SCALAR: 8) Operations: - Query: Query | fields: data_privacy_app, data_privacy_website, imprint, terms_and_conditions - Subscription: Subscription | fields: data_privacy_app_mutated, data_privacy_website_mutated, directus_dashboards_mutated, directus_files_mutated, directus_flows_mutated Directives: deprecated, include, skip (total: 3) Readable stores: 4 data_privacy_app (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... data_privacy_website (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... imprint (args: none) : date_created=2024-01-18T15:20:03.000Z id=1 user_created=172f0b7a-8add-41be-89b8-cc9452a44902 content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... terms_and_conditions (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein...
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3259f0531fa8e8b33c258e98c6ffe6eec2f4e2ddc
GraphQL introspection enabled at /graphql Types: 54 (by kind: ENUM: 3, INPUT_OBJECT: 11, OBJECT: 32, SCALAR: 8) Operations: - Query: Query | fields: data_privacy_app, data_privacy_website, imprint, terms_and_conditions - Subscription: Subscription | fields: data_privacy_app_mutated, data_privacy_website_mutated, directus_dashboards_mutated, directus_files_mutated, directus_flows_mutated Directives: deprecated, include, skip (total: 3) Readable stores: 4 data_privacy_app (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... data_privacy_website (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... imprint (args: none) : id=1 user_created=172f0b7a-8add-41be-89b8-cc9452a44902 content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein... date_created=2024-01-18T15:20:03.000Z terms_and_conditions (args: none) : content=<p>Dies ist die Staging. Texte hier werden nirgendwo erschein...
.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).
They store information about the files within a folder, including display options of folders, such as icon positions and view settings.
It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.
Severity: low
Fingerprint: 5f32cf5d6962f09c4239b3d84239b3d8f3a7cd8df5ad344f56b54788823b3f26
Found 8 files trough .DS_Store spidering: /favicon /real-favicon /real-favicon/faviconData.json /real-favicon/faviconDescription.json /real-favicon/icon.svg /real-favicon/Logo.svg /real-favicon/output /vibary_logo_white.png
Severity: low
Fingerprint: 5f32cf5d6962f09cc169dbbec169dbbe30dce80286ef7d1f95b93edfeb1750c9
Found 15 files trough .DS_Store spidering: /activity_screenshot.png /favicon /favorites_screenshot.png /Gruppe 27.png /Gruppe 28.png /Gruppe 30.png /Onboarding_1.png /real-favicon /real-favicon/faviconData.json /real-favicon/faviconDescription.json /real-favicon/icon.svg /real-favicon/Logo.svg /real-favicon/output /tinder_phone.png /vibary_logo_white.png
Open service 37.120.163.71:443 · manage.vibary.de
2026-01-09 18:09
HTTP/1.1 302 Found Server: nginx Date: Fri, 09 Jan 2026 18:09:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 29 Connection: close Content-Security-Policy: script-src 'self' 'unsafe-eval';worker-src 'self' blob:;child-src 'self' blob:;img-src 'self' data: blob:;media-src 'self';connect-src 'self' https://*;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' X-Powered-By: Directus Access-Control-Allow-Origin: https://vibary.de Vary: Origin, Accept Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Content-Range Location: ./admin Strict-Transport-Security: max-age=15724800; includeSubdomains Found. Redirecting to ./admin
Open service 37.120.163.71:443 · staging-manage.vibary.de
2026-01-09 11:39
HTTP/1.1 302 Found Server: nginx Date: Fri, 09 Jan 2026 11:39:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 29 Connection: close Content-Security-Policy: script-src 'self' 'unsafe-eval';worker-src 'self' blob:;child-src 'self' blob:;img-src 'self' data: blob:;media-src 'self';connect-src 'self' https://*;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' X-Powered-By: Directus Location: ./admin Vary: Accept Strict-Transport-Security: max-age=15724800; includeSubdomains Found. Redirecting to ./admin
Open service 37.120.163.71:443 · staging-manage.vibary.de
2026-01-02 16:36
HTTP/1.1 302 Found Server: nginx Date: Fri, 02 Jan 2026 16:36:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 29 Connection: close Content-Security-Policy: script-src 'self' 'unsafe-eval';worker-src 'self' blob:;child-src 'self' blob:;img-src 'self' data: blob:;media-src 'self';connect-src 'self' https://*;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' X-Powered-By: Directus Location: ./admin Vary: Accept Strict-Transport-Security: max-age=15724800; includeSubdomains Found. Redirecting to ./admin
Open service 37.120.163.71:443 · manage.vibary.de
2026-01-02 07:12
HTTP/1.1 302 Found Server: nginx Date: Fri, 02 Jan 2026 07:12:11 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 29 Connection: close Content-Security-Policy: script-src 'self' 'unsafe-eval';worker-src 'self' blob:;child-src 'self' blob:;img-src 'self' data: blob:;media-src 'self';connect-src 'self' https://*;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' X-Powered-By: Directus Access-Control-Allow-Origin: https://vibary.de Vary: Origin, Accept Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Content-Range Location: ./admin Strict-Transport-Security: max-age=15724800; includeSubdomains Found. Redirecting to ./admin
Open service 37.120.163.71:443 · manage.vibary.de
2025-12-30 08:46
HTTP/1.1 302 Found Server: nginx Date: Tue, 30 Dec 2025 08:46:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 29 Connection: close Content-Security-Policy: script-src 'self' 'unsafe-eval';worker-src 'self' blob:;child-src 'self' blob:;img-src 'self' data: blob:;media-src 'self';connect-src 'self' https://*;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' X-Powered-By: Directus Access-Control-Allow-Origin: https://vibary.de Vary: Origin, Accept Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Content-Range Location: ./admin Strict-Transport-Security: max-age=15724800; includeSubdomains Found. Redirecting to ./admin
Open service 37.120.163.71:443 · staging-manage.vibary.de
2025-12-23 02:00
HTTP/1.1 302 Found Server: nginx Date: Tue, 23 Dec 2025 02:00:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 29 Connection: close Content-Security-Policy: script-src 'self' 'unsafe-eval';worker-src 'self' blob:;child-src 'self' blob:;img-src 'self' data: blob:;media-src 'self';connect-src 'self' https://*;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' X-Powered-By: Directus Location: ./admin Vary: Accept Strict-Transport-Security: max-age=15724800; includeSubdomains Found. Redirecting to ./admin
Open service 37.120.163.71:443 · manage.vibary.de
2025-12-22 10:38
HTTP/1.1 302 Found Server: nginx Date: Mon, 22 Dec 2025 10:38:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 29 Connection: close Content-Security-Policy: script-src 'self' 'unsafe-eval';worker-src 'self' blob:;child-src 'self' blob:;img-src 'self' data: blob:;media-src 'self';connect-src 'self' https://*;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' X-Powered-By: Directus Access-Control-Allow-Origin: https://vibary.de Vary: Origin, Accept Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Content-Range Location: ./admin Strict-Transport-Security: max-age=15724800; includeSubdomains Found. Redirecting to ./admin
Open service 37.120.163.71:443 · staging-manage.vibary.de
2025-12-21 08:46
HTTP/1.1 302 Found Server: nginx Date: Sun, 21 Dec 2025 08:46:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 29 Connection: close Content-Security-Policy: script-src 'self' 'unsafe-eval';worker-src 'self' blob:;child-src 'self' blob:;img-src 'self' data: blob:;media-src 'self';connect-src 'self' https://*;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' X-Powered-By: Directus Location: ./admin Vary: Accept Strict-Transport-Security: max-age=15724800; includeSubdomains Found. Redirecting to ./admin
Open service 37.120.163.71:443 · manage.vibary.de
2025-12-21 05:29
HTTP/1.1 302 Found Server: nginx Date: Sun, 21 Dec 2025 05:29:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 29 Connection: close Content-Security-Policy: script-src 'self' 'unsafe-eval';worker-src 'self' blob:;child-src 'self' blob:;img-src 'self' data: blob:;media-src 'self';connect-src 'self' https://*;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' X-Powered-By: Directus Access-Control-Allow-Origin: https://vibary.de Vary: Origin, Accept Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Content-Range Location: ./admin Strict-Transport-Security: max-age=15724800; includeSubdomains Found. Redirecting to ./admin
Open service 37.120.163.71:443 · staging-manage.vibary.de
2025-12-19 05:11
HTTP/1.1 302 Found Server: nginx Date: Fri, 19 Dec 2025 05:11:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 29 Connection: close Content-Security-Policy: script-src 'self' 'unsafe-eval';worker-src 'self' blob:;child-src 'self' blob:;img-src 'self' data: blob:;media-src 'self';connect-src 'self' https://*;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' X-Powered-By: Directus Location: ./admin Vary: Accept Strict-Transport-Security: max-age=15724800; includeSubdomains Found. Redirecting to ./admin