Web application Scanning Report for https://11.111.11.111:1111/redmine/

unauthenticated scan

Summary of Alerts

Risk Level	Number of Alerts
High	0
Medium	9
Low	23
Informational	0

Alert Detail

Medium (Warning)	Secure page browser cache
Description	Secure page can be cached in browser. Cache control is not set in HTTP header nor HTML header. Sensitive content can be recovered from browser storage.

URL	https://11.111.11.111:1111/redmine/

Solution	The best way is to set HTTP header with: 'Pragma: No-cache' and 'Cache-control: No-cache'. Alternatively, this can be set in the HTML header by: <META HTTP-EQUIV='Pragma' CONTENT='no-cache'> <META HTTP-EQUIV='Cache-Control' CONTENT='no-cache'> but some browsers may have problem using this method.
Reference	How to prevent caching in Internet Explorer - http://support.microsoft.com/default.aspx?kbid=234067 Pragma: No-cache Tag May Not Prevent Page from Being Cached - http://support.microsoft.com/default.aspx?kbid=222064
CWE Id	525

Medium (Warning)	Secure page browser cache
Description	Secure page can be cached in browser. Cache control is not set in HTTP header nor HTML header. Sensitive content can be recovered from browser storage.

URL	https://11.111.11.111:1111/redmine/login

Solution	The best way is to set HTTP header with: 'Pragma: No-cache' and 'Cache-control: No-cache'. Alternatively, this can be set in the HTML header by: <META HTTP-EQUIV='Pragma' CONTENT='no-cache'> <META HTTP-EQUIV='Cache-Control' CONTENT='no-cache'> but some browsers may have problem using this method.
Reference	How to prevent caching in Internet Explorer - http://support.microsoft.com/default.aspx?kbid=234067 Pragma: No-cache Tag May Not Prevent Page from Being Cached - http://support.microsoft.com/default.aspx?kbid=222064
CWE Id	525

Medium (Warning)	Secure page browser cache
Description	Secure page can be cached in browser. Cache control is not set in HTTP header nor HTML header. Sensitive content can be recovered from browser storage.

URL	https://11.111.11.111:1111/redmine/login?back_url=https%3A%2F%2F11.111.11.111%3A1111%2Fredmine%2F

Solution	The best way is to set HTTP header with: 'Pragma: No-cache' and 'Cache-control: No-cache'. Alternatively, this can be set in the HTML header by: <META HTTP-EQUIV='Pragma' CONTENT='no-cache'> <META HTTP-EQUIV='Cache-Control' CONTENT='no-cache'> but some browsers may have problem using this method.
Reference	How to prevent caching in Internet Explorer - http://support.microsoft.com/default.aspx?kbid=234067 Pragma: No-cache Tag May Not Prevent Page from Being Cached - http://support.microsoft.com/default.aspx?kbid=222064
CWE Id	525

Medium (Warning)	Secure page browser cache
Description	Secure page can be cached in browser. Cache control is not set in HTTP header nor HTML header. Sensitive content can be recovered from browser storage.

URL	https://11.111.11.111:1111/redmine/account/lost_password

Solution	The best way is to set HTTP header with: 'Pragma: No-cache' and 'Cache-control: No-cache'. Alternatively, this can be set in the HTML header by: <META HTTP-EQUIV='Pragma' CONTENT='no-cache'> <META HTTP-EQUIV='Cache-Control' CONTENT='no-cache'> but some browsers may have problem using this method.
Reference	How to prevent caching in Internet Explorer - http://support.microsoft.com/default.aspx?kbid=234067 Pragma: No-cache Tag May Not Prevent Page from Being Cached - http://support.microsoft.com/default.aspx?kbid=222064
CWE Id	525

Medium (Warning)	Secure page browser cache
Description	Secure page can be cached in browser. Cache control is not set in HTTP header nor HTML header. Sensitive content can be recovered from browser storage.

URL	https://11.111.11.111:1111/redmine/javascripts/application.js

Solution	The best way is to set HTTP header with: 'Pragma: No-cache' and 'Cache-control: No-cache'. Alternatively, this can be set in the HTML header by: <META HTTP-EQUIV='Pragma' CONTENT='no-cache'> <META HTTP-EQUIV='Cache-Control' CONTENT='no-cache'> but some browsers may have problem using this method.
Reference	How to prevent caching in Internet Explorer - http://support.microsoft.com/default.aspx?kbid=234067 Pragma: No-cache Tag May Not Prevent Page from Being Cached - http://support.microsoft.com/default.aspx?kbid=222064
CWE Id	525

Medium (Warning)	Secure page browser cache
Description	Secure page can be cached in browser. Cache control is not set in HTTP header nor HTML header. Sensitive content can be recovered from browser storage.

URL	https://11.111.11.111:1111/redmine/javascripts/jquery-1.11.1-ui-1.11.0-ujs-3.1.1.js

Solution	The best way is to set HTTP header with: 'Pragma: No-cache' and 'Cache-control: No-cache'. Alternatively, this can be set in the HTML header by: <META HTTP-EQUIV='Pragma' CONTENT='no-cache'> <META HTTP-EQUIV='Cache-Control' CONTENT='no-cache'> but some browsers may have problem using this method.
Reference	How to prevent caching in Internet Explorer - http://support.microsoft.com/default.aspx?kbid=234067 Pragma: No-cache Tag May Not Prevent Page from Being Cached - http://support.microsoft.com/default.aspx?kbid=222064
CWE Id	525

Medium (Warning)	Secure page browser cache
Description	Secure page can be cached in browser. Cache control is not set in HTTP header nor HTML header. Sensitive content can be recovered from browser storage.

URL	https://11.111.11.111:1111/redmine/plugin_assets/redmine_agile/stylesheets/redmine_agile.css

Solution	The best way is to set HTTP header with: 'Pragma: No-cache' and 'Cache-control: No-cache'. Alternatively, this can be set in the HTML header by: <META HTTP-EQUIV='Pragma' CONTENT='no-cache'> <META HTTP-EQUIV='Cache-Control' CONTENT='no-cache'> but some browsers may have problem using this method.
Reference	How to prevent caching in Internet Explorer - http://support.microsoft.com/default.aspx?kbid=234067 Pragma: No-cache Tag May Not Prevent Page from Being Cached - http://support.microsoft.com/default.aspx?kbid=222064
CWE Id	525

Medium (Warning)	Secure page browser cache
Description	Secure page can be cached in browser. Cache control is not set in HTTP header nor HTML header. Sensitive content can be recovered from browser storage.

URL	https://11.111.11.111:1111/redmine/stylesheets/application.css

Solution	The best way is to set HTTP header with: 'Pragma: No-cache' and 'Cache-control: No-cache'. Alternatively, this can be set in the HTML header by: <META HTTP-EQUIV='Pragma' CONTENT='no-cache'> <META HTTP-EQUIV='Cache-Control' CONTENT='no-cache'> but some browsers may have problem using this method.
Reference	How to prevent caching in Internet Explorer - http://support.microsoft.com/default.aspx?kbid=234067 Pragma: No-cache Tag May Not Prevent Page from Being Cached - http://support.microsoft.com/default.aspx?kbid=222064
CWE Id	525

Medium (Warning)	Secure page browser cache
Description	Secure page can be cached in browser. Cache control is not set in HTTP header nor HTML header. Sensitive content can be recovered from browser storage.

URL	https://11.111.11.111:1111/redmine/stylesheets/jquery/jquery-ui-1.11.0.css

Solution	The best way is to set HTTP header with: 'Pragma: No-cache' and 'Cache-control: No-cache'. Alternatively, this can be set in the HTML header by: <META HTTP-EQUIV='Pragma' CONTENT='no-cache'> <META HTTP-EQUIV='Cache-Control' CONTENT='no-cache'> but some browsers may have problem using this method.
Reference	How to prevent caching in Internet Explorer - http://support.microsoft.com/default.aspx?kbid=234067 Pragma: No-cache Tag May Not Prevent Page from Being Cached - http://support.microsoft.com/default.aspx?kbid=222064
CWE Id	525

Low (Warning)	Incomplete or no cache-control and pragma HTTPHeader set
Description	The cache-control and pragma HTTPHeader have not been set properly allowing the browser and proxies to cache content

URL	https://11.111.11.111:1111/redmine/
Parameter	max-age=0, private, must-revalidate

Solution	Whenever possible ensure the cache-control HTTPHeader is set with no-cache, no-store, must-revalidate, private, and the pragma HTTPHeader is set with no-cache.
Reference	https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Web_Content_Caching

Low (Warning)	Cookie set without secure flag
Description	A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections.

URL	https://11.111.11.111:1111/redmine/
Parameter	_redmine_session=akZORkpDM2dYamo3eTc5bk53cHFoOHVrNldoZ2JReG5DUzlhczg1eXduL0NURGRycnlsL3FOTm5xWFhZc0NUdU9uay9pMEh4U2E2YzNhd1RDL3p2NE1OK3RHR2crSHBhYitiUHhZT0ovQ3FBUjYrMW5ycE5ibStBRStDM2x0dnlNN3MwTHZPRFA2SzdySzRMdFh6MXNmK1QwUTh2azI5K0Izb1ZKVStPT1lIaXdid1d1M0hHQjkzYjJibmFsMEV6LS1ET08zNmtYYU1jVi9KYzBLNWtwYml3PT0%3D--3c51ea1f329064339cada37135f905d54b5763fb; path=/; HttpOnly

Solution	Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted tunnel. Ensure that the secure flag is set for cookies containing such sensitive information.
Reference	http://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002)
WASC Id	13

Low (Warning)	Password Autocomplete in browser
Description	AUTOCOMPLETE attribute is not disabled in HTML FORM/INPUT element containing password type input. Passwords may be stored in browsers and retrieved.

URL	https://11.111.11.111:1111/redmine/
Parameter	input
Attack	<input type="password" name="password" id="password" tabindex="2" />

Solution	Turn off AUTOCOMPLETE attribute in form or individual input elements containing password by using AUTOCOMPLETE='OFF'
Reference	http://msdn.microsoft.com/library/default.asp?url=/workshop/author/forms/autocomplete_ovr.asp
CWE Id	525

Low (Warning)	Private IP disclosure
Description	A private IP such as 10.x.x.x, 172.x.x.x, 192.168.x.x has been found in the HTTP response body. This information might be helpful for further attacks targeting internal systems.

URL	https://11.111.11.111:1111/redmine/
Attack	11.111.11.111:1111
Other information	11.111.11.111:1111

Solution	Remove the private IP address from the HTTP response body. For comments, use JSP/ASP comment instead of HTML/JavaScript comment which can be seen by client browsers.

Reference
CWE Id	200
WASC Id	13

Low (Warning)	Incomplete or no cache-control and pragma HTTPHeader set
Description	The cache-control and pragma HTTPHeader have not been set properly allowing the browser and proxies to cache content

URL	https://11.111.11.111:1111/redmine/
Parameter	no-cache

Solution	Whenever possible ensure the cache-control HTTPHeader is set with no-cache, no-store, must-revalidate, private, and the pragma HTTPHeader is set with no-cache.
Reference	https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Web_Content_Caching

Low (Warning)	Private IP disclosure
Description	A private IP such as 10.x.x.x, 172.x.x.x, 192.168.x.x has been found in the HTTP response body. This information might be helpful for further attacks targeting internal systems.

URL	https://11.111.11.111:1111/redmine/
Attack	11.111.11.111:1111
Other information	11.111.11.111:1111 10.134.13.196

Solution	Remove the private IP address from the HTTP response body. For comments, use JSP/ASP comment instead of HTML/JavaScript comment which can be seen by client browsers.

Reference
CWE Id	200
WASC Id	13

Low (Warning)	Incomplete or no cache-control and pragma HTTPHeader set
Description	The cache-control and pragma HTTPHeader have not been set properly allowing the browser and proxies to cache content

URL	https://11.111.11.111:1111/redmine/login?back_url=https%3A%2F%2F11.111.11.111%3A1111%2Fredmine%2F
Parameter	max-age=0, private, must-revalidate

Solution	Whenever possible ensure the cache-control HTTPHeader is set with no-cache, no-store, must-revalidate, private, and the pragma HTTPHeader is set with no-cache.
Reference	https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Web_Content_Caching

Low (Warning)	Password Autocomplete in browser
Description	AUTOCOMPLETE attribute is not disabled in HTML FORM/INPUT element containing password type input. Passwords may be stored in browsers and retrieved.

URL	https://11.111.11.111:1111/redmine/login?back_url=https%3A%2F%2F11.111.11.111%3A1111%2Fredmine%2F
Parameter	input
Attack	<input type="password" name="password" id="password" tabindex="2" />

Solution	Turn off AUTOCOMPLETE attribute in form or individual input elements containing password by using AUTOCOMPLETE='OFF'
Reference	http://msdn.microsoft.com/library/default.asp?url=/workshop/author/forms/autocomplete_ovr.asp
CWE Id	525

Low (Warning)	Cookie set without secure flag
Description	A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections.

URL	https://11.111.11.111:1111/redmine/login?back_url=https%3A%2F%2F11.111.11.111%3A1111%2Fredmine%2F
Parameter	_redmine_session=QlhHZERRUTJncGZxZDhjendwTXlSblhDK25CMjNLcHRzUXdFamk2R2JNUy9LcnZMczFOd0Vod3pjV3ZYVkh2blE1dy9WTGxlbUVsczZhKzJEd0ZTRkZnM0c3N1AzTTF6V24rV0pMWHNncFFxUzQ4RlhETEZHTDU0b20xNVN1RTJkaDFWekFtVm4xRkd1cktFYU15Qjc0WWdDWkJKUGlhRkc2aTZ3UG1XSzJCT0JBa2dhbEpOY2JlWU04NDBqM2RrLS1PbHhLVm4zZWJxdU5RZm5VWmVXamZRPT0%3D--47a69ad15c897045fce06d068d856c2c1a23bdd9; path=/; HttpOnly

Solution	Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted tunnel. Ensure that the secure flag is set for cookies containing such sensitive information.
Reference	http://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002)
WASC Id	13

Low (Warning)	Private IP disclosure
Description	A private IP such as 10.x.x.x, 172.x.x.x, 192.168.x.x has been found in the HTTP response body. This information might be helpful for further attacks targeting internal systems.

URL	https://11.111.11.111:1111/redmine/login?back_url=https%3A%2F%2F11.111.11.111%3A1111%2Fredmine%2F
Attack	11.111.11.111:1111
Other information	11.111.11.111:1111

Solution	Remove the private IP address from the HTTP response body. For comments, use JSP/ASP comment instead of HTML/JavaScript comment which can be seen by client browsers.

Reference
CWE Id	200
WASC Id	13

Low (Warning)	Incomplete or no cache-control and pragma HTTPHeader set
Description	The cache-control and pragma HTTPHeader have not been set properly allowing the browser and proxies to cache content

URL	https://11.111.11.111:1111/redmine/login
Parameter	max-age=0, private, must-revalidate

Solution	Whenever possible ensure the cache-control HTTPHeader is set with no-cache, no-store, must-revalidate, private, and the pragma HTTPHeader is set with no-cache.
Reference	https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Web_Content_Caching

Low (Warning)	Password Autocomplete in browser
Description	AUTOCOMPLETE attribute is not disabled in HTML FORM/INPUT element containing password type input. Passwords may be stored in browsers and retrieved.

URL	https://11.111.11.111:1111/redmine/login
Parameter	input
Attack	<input type="password" name="password" id="password" tabindex="2" />

Solution	Turn off AUTOCOMPLETE attribute in form or individual input elements containing password by using AUTOCOMPLETE='OFF'
Reference	http://msdn.microsoft.com/library/default.asp?url=/workshop/author/forms/autocomplete_ovr.asp
CWE Id	525

Low (Warning)	Cookie set without secure flag
Description	A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections.

URL	https://11.111.11.111:1111/redmine/login
Parameter	_redmine_session=ZHYxRnhtSVIzWFBLd3NVb002VER3RHdMUmlUWElLbHE3VGdDRVBkMUdkeTF0M3NMWlZJVUs3NjlwWnNQdUdTQzFXekZBZjVIb0JBWXd3SWtKaFc4dDBTdUcrcmYvUHY2Ym1ZT0ZTRVV5QnUzMGl6dWloVWVkamRsSkp1czUzbnVUeHN5R2xvcDQycmRUeG42QmZxYWNmbEovbG5razJ1Y0N3dlY3anpCUmVUVEFNM0NEbnNSTWI1dElUS2pvdUEvLS00cWxPZ0xJZkRwZmltSlNrWFZhMTNBPT0%3D--8fa25d486b70c91cb73eca2e945cff59919a29ba; path=/; HttpOnly

Solution	Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted tunnel. Ensure that the secure flag is set for cookies containing such sensitive information.
Reference	http://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002)
WASC Id	13

Low (Warning)	Incomplete or no cache-control and pragma HTTPHeader set
Description	The cache-control and pragma HTTPHeader have not been set properly allowing the browser and proxies to cache content

URL	https://11.111.11.111:1111/redmine/account/lost_password
Parameter	max-age=0, private, must-revalidate

Solution	Whenever possible ensure the cache-control HTTPHeader is set with no-cache, no-store, must-revalidate, private, and the pragma HTTPHeader is set with no-cache.
Reference	https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Web_Content_Caching

Low (Warning)	Cookie set without secure flag
Description	A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections.

URL	https://11.111.11.111:1111/redmine/account/lost_password
Parameter	_redmine_session=UVBtT1kySDVXOWRJWm10SHNva1pub2Y3VjlIZU5wdVQ4ZFJtWWc1MjJZaVJaajFsVlZuemtuRXpCQ0RnbHZIclFHL094aFFRa0RuLzl0V3ZrQVBhOHVJS2NtSVRPRE5qRWpwSVhodnFSMXJmc2xLMnduMy9MQmpGQUJkcm1yMUdoWnpBUlpxd2VyeTY3d3VXTDdNWVh5ZW5jQjgvUW9SWjlUbkNhZm4rQU9jU2pVZE0rbHc4SDN5VjVZUjRrUGNYLS02MGQ0ZjBxeXBaYitDeDcvRkxlZmVRPT0%3D--40e6cb54148faa51ec5eba6f5a6f90ce7d44f081; path=/; HttpOnly

Solution	Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted tunnel. Ensure that the secure flag is set for cookies containing such sensitive information.
Reference	http://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002)
WASC Id	13

Low (Warning)	X-Content-Type-Options header missing
Description	The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URL	https://11.111.11.111:1111/redmine/favicon.ico

Solution	Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
Reference

Low (Warning)	X-Content-Type-Options header missing
Description	The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URL	https://11.111.11.111:1111/redmine/stylesheets/jquery/jquery-ui-1.11.0.css

Solution	Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
Reference

Low (Warning)	X-Content-Type-Options header missing
Description	The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URL	https://11.111.11.111:1111/redmine/stylesheets/application.css

Solution	Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
Reference

Low (Warning)	X-Content-Type-Options header missing
Description	The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URL	https://11.111.11.111:1111/redmine/plugin_assets/redmine_agile/stylesheets/redmine_agile.css

Solution	Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
Reference

Low (Warning)	X-Content-Type-Options header missing
Description	The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URL	https://11.111.11.111:1111/redmine/javascripts/application.js

Solution	Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
Reference

Low (Warning)	Incomplete or no cache-control and pragma HTTPHeader set
Description	The cache-control and pragma HTTPHeader have not been set properly allowing the browser and proxies to cache content

URL	https://11.111.11.111:1111/redmine/login
Parameter	no-cache

Solution	Whenever possible ensure the cache-control HTTPHeader is set with no-cache, no-store, must-revalidate, private, and the pragma HTTPHeader is set with no-cache.
Reference	https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Web_Content_Caching

Low (Warning)	X-Content-Type-Options header missing
Description	The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URL	https://11.111.11.111:1111/redmine/javascripts/jquery-1.11.1-ui-1.11.0-ujs-3.1.1.js

Solution	Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
Reference

Low (Warning)	Incomplete or no cache-control and pragma HTTPHeader set
Description	The cache-control and pragma HTTPHeader have not been set properly allowing the browser and proxies to cache content

URL	https://11.111.11.111:1111/redmine/account/lost_password
Parameter	no-cache

Solution	Whenever possible ensure the cache-control HTTPHeader is set with no-cache, no-store, must-revalidate, private, and the pragma HTTPHeader is set with no-cache.
Reference	https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Web_Content_Caching