Skip to content

Overview Vendors Assets Scans Findings Reports Team Integrations

FindingsAll findings

26 of 39KJ

Missing protection · Scan · first seen 1 Oct

Cookie laravel_session set without Secure

MediumLikelyOpenMobilefix by 30 Nov

Open · Mobile's

Nobody has it yet

It's Mobile's, but no one has picked it up.

Where it came from, and where it is

One problem in one place, found by scan.

1 source · 1 place

Scan
Standard scan of tessellate.ng, Thu 15 Oct
First found Thu 1 Oct, last seen Thu 15 Oct
- agents.tessellate.ngOpen

What closes it

Not yet: A complete scan stops seeing it on agents.tessellate.ng

Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.

Why it ranks here

26th of 39 in your queue

Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters

Priority

42 / 100

Medium Where its severity starts it26
Straight onto the internet Its own address answers, with nothing in front+8
Criticality A Money moves or customer data lives here+8
Its priority42

The evidence

What each source saw

As each source gives it · secrets, keys and card numbers stay masked

The scan's case file · tessellate.ng

See it in that scan

What we saw

The response from https://agents.tessellate.ng has no header.

The fix

Add the header at your edge (Cloudflare can set it for every host at once) or in the app.

Where

Activity

What happened, and what was said

1 event · 0 comments · oldest first

SecureAssure found it in the standard scan of tessellate.ngThu 1 Oct, 02:00

KO

⌘ Enter to send

Where it stands

New
Open
In progress
Fix submitted
Fixed

Fixed is a scan’s to give: it closes when a complete scan or a retest stops seeing it.

Who has it

Fix by

30 NovDue on 30 Nov

Medium: 60 days from when it was first seen, 1 Oct. The rules

Other ways forward