La ricerca è uno dei pilastri di Shielder.Investiamo dal 25% al 100% del tempo dei dipendenti nella ricerca di vulnerabilità, nello sviluppo di exploit e nella formazione. Approfondendo le nostre conoscenze tecniche e scoprendo nuove vulnerabilità, contribuiamo alla sicurezza dell’ecosistema digitale.Ogni nostra scoperta è seguita dalla pubblicazione di un avviso con dettagli tecnici riguardanti il problema e la risoluzione, il tutto nel rispetto della nostra politica di divulgazione. Al termine di campagne di ricerca particolarmente approfondite o a lungo termine, condividiamo apertamente con la comunità internazionale il nostro modus operandi, gli strumenti e le lezioni apprese nel nostro blog e nelle conferenze in tutto il mondo.Ci sforziamo di migliorare continuamente e di offrire ai nostri clienti consulenza sulla sicurezza basata sulla ricerca. Per qualsiasi informazione, contattaci.
05/04/2023 CVE-2023-28634 high
![[Advisory]](https://www.shielder.com//img/advisory.png)
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin account, resulting in a Privilege Escalation. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
21/12/2022 CVE-2022-20958 high
CVE-2022-20958: Cisco BroadWorks CommPilot Application allows authenticated users to upload configuration files on the platform. The lack of file validation and a broken access control on the vulnerable upload serverlet allows any authenticated user to upload a file which could be abused to run arbitrary code on the server.
21/12/2022 CVE-2022-20951 medium
CVE-2022-20951: Cisco BroadWorks CommPilot Application exposes a servlet that allows the application to be used as an HTTP proxy server. The lack of validation of the the target URL and the lack of authentication protection allows an unauthenticated attacker to achieve a full-read SSRF.
02/11/2022 CVE-2022-3308 high
Insufficient policy enforcement in developer tools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
The Google Chrome Web Share API prior to 100.0.4896.60 allowed an attacker website to force a victim into downloading a file or leaking their Windows NetNTLMv2 password hashes over the internet.
Autodesk Fusion 360 <= 2.0.12887 parses SVG files with a vulnerable XML parser, leading to a Blind XML External Entities (XXE).
pfSense <= 2.5.2 allows authenticated users to inject arbitrary sed-specific code, which leads to an Arbitrary File Write, resulting in a Remote Code Execution. The vulnerability is also exploitable through a Cross-Site Request Forgery.
24/09/2021 CVE-2020-17148 high
Visual Studio Code Remote Development Extension 1.50 failed to sanitize the host field before using it as an argument of the ssh command, allowing to inject a ProxyCommand option which could be used to run arbitray commands.
06/08/2021 CVE-2021-38136 medium
Corero SecureWatch Managed Services 9.7.2.0020 is affected by a Path Traversal vulnerability via the `snap_file` parameter in the `/it-IT/splunkd/__raw/services/get_snapshot` HTTP API endpoint. A 'low privileged' attacker can read any file on the target host.
06/08/2021 CVE-2021-38137 high
Corero SecureWatch Managed Services 9.7.2.0020 does not correctly check swa-monitor and cns-monitor user's privileges, allowing a user to perform actions not belonging to his role.