SEC Consult Vulnerability Lab: Multiple CVE Disclosures Summary

SEC Consult operates its own internal security lab, the Vulnerability Lab, to maintain international leadership in the fields of cybersecurity and application security. The lab provides high-quality penetration testing support, evaluates new technologies, and delivers up-to-date security vulnerability information and risk status reports to clients. The lab follows a responsible disclosure policy, which includes providing vendors with the necessary information and time to validate and fix vulnerabilities, and coordinating the public release of security advisories as part of the responsible disclosure process. Offers research and whitepapers from the SEC Consult Vulnerability Lab. The Vulnerability Lab is an official CVE Numbering Authority (CNA) and assigns CVE identifiers to vulnerabilities discovered in third-party hardware/software that fall outside the scope of other CNAs. Recent research findings: An unprotected NFC card operation vulnerability in GiroWeb cash checkout solution, leading to free recharges, discovered on October 29, 2022. An unauthenticated local file disclosure vulnerability in MDPV Mikrolab MIP2 / FEDRA2 / HYDRA X manufacturing execution systems, discovered on October 27, 2022. Multiple vulnerabilities found in Professional, detected on October 21, 2022. Multiple vulnerabilities in iMonitorSoft EAM, detected on September 25, 2022. Missing certificate validation in Clevercontrol employee monitoring software, potentially leading to remote code execution, reported on September 23, 2022. An unauthenticated SQL injection vulnerability (ODBC interface) in Shibboleth Service Provider (SP), reported on September 10, 2022. NFC card exploitation vulnerability in KioSoft "Store Value" unattended payment solution (Mifare), leading to free recharges, reported on September 8, 2022. Race condition in Shopware gift voucher submission, discovered on August 7, 2022. * Multiple stored cross-site scripting (XSS) vulnerabilities in Optimizely Episerver content management system, discovered on July 28, 2022.

Goal Reached Thanks to every supporter — we hit 100%!

SEC Consult Vulnerability Lab: Multiple CVE Disclosures Summary