Takeover · Scan · first seen 5 Oct
HighLikelyOpenKelvin Obisesanfix by 4 Nov
Open · with Kelvin
Nothing's blocking it. It closes when the check that found it stops seeing it.
One problem in one place, found by scan.
1 source · 1 place
Scan
First found Mon 5 Oct, last seen Mon 12 Oct
What closes it
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
24th of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
44 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The scan's case file · tessellatepay.com
See it in that scanWhy it matters here
Anyone can claim the Heroku app this name points to and serve pages on your domain: phishing your customers with a real tessellatepay.com address.
What we saw
old.tessellatepay.com points at tessellate-legacy.herokuapp.com, which no longer exists. Anyone can create an app with that name and serve pages on your domain.
tessellate-legacy.herokuapp.comThe fix
Delete the CNAME for old.tessellatepay.com, or claim the Heroku app name again.
Where
What happened, and what was said
1 event · 0 comments · oldest first