Research is one of Shielder’s pillars.We invest from 25% to 100% of employees’ time into 0day vulnerability research, exploit development and training. By constantly pushing the boundaries of our knowledge and discovering new vulnerabilities, we contribute to the security of the digital ecosystem.For each and every finding, we adhere to our disclosure policy and we publish an advisory with the technical details about the issue and the remediation. Furthermore, after completing throughout and long-term research campaigns, we openly share with the information security community our modus operandi, tools and lessons learned in our blog and at conferences around the world.We strive to continuously improve our capabilities and offer research-driven security consultancy to our clients. For any information, get in touch with us.
05/04/2023 CVE-2023-28634 high
![[Advisory]](https://www.shielder.com//img/advisory.png)
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin account, resulting in a Privilege Escalation. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
21/12/2022 CVE-2022-20958 high
CVE-2022-20958: Cisco BroadWorks CommPilot Application allows authenticated users to upload configuration files on the platform. The lack of file validation and a broken access control on the vulnerable upload serverlet allows any authenticated user to upload a file which could be abused to run arbitrary code on the server.
21/12/2022 CVE-2022-20951 medium
CVE-2022-20951: Cisco BroadWorks CommPilot Application exposes a servlet that allows the application to be used as an HTTP proxy server. The lack of validation of the the target URL and the lack of authentication protection allows an unauthenticated attacker to achieve a full-read SSRF.
02/11/2022 CVE-2022-3308 high
Insufficient policy enforcement in developer tools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
The Google Chrome Web Share API prior to 100.0.4896.60 allowed an attacker website to force a victim into downloading a file or leaking their Windows NetNTLMv2 password hashes over the internet.
Autodesk Fusion 360 <= 2.0.12887 parses SVG files with a vulnerable XML parser, leading to a Blind XML External Entities (XXE).
pfSense <= 2.5.2 allows authenticated users to inject arbitrary sed-specific code, which leads to an Arbitrary File Write, resulting in a Remote Code Execution. The vulnerability is also exploitable through a Cross-Site Request Forgery.
24/09/2021 CVE-2020-17148 high
Visual Studio Code Remote Development Extension 1.50 failed to sanitize the host field before using it as an argument of the ssh command, allowing to inject a ProxyCommand option which could be used to run arbitray commands.
06/08/2021 CVE-2021-38136 medium
Corero SecureWatch Managed Services 9.7.2.0020 is affected by a Path Traversal vulnerability via the `snap_file` parameter in the `/it-IT/splunkd/__raw/services/get_snapshot` HTTP API endpoint. A 'low privileged' attacker can read any file on the target host.
06/08/2021 CVE-2021-38137 high
Corero SecureWatch Managed Services 9.7.2.0020 does not correctly check swa-monitor and cns-monitor user's privileges, allowing a user to perform actions not belonging to his role.