Hidde Smit

Role: Researcher level 2

Social media

Icon - @HiddeSmit
Icon - Hidde Smit
Icon - https://www.cybereagle.io

Articles / cases / cves

CSIRT Cases

• DIVD-2021-00037 - Critical vulnerabilities in ITarian MSP platform and on-premise solution
• DIVD-2021-00021 - Qlik Sense Enterprise domain user enumeration
• DIVD-2021-00017 - SolarWinds N-able N-central agent vulnerabilities
• DIVD-2021-00011 - Kaseya VSA Disclosure
• DIVD-2021-00010 - vCenter Server PreAuth RCE
• DIVD-2021-00007 - EA Origin XSS and RCE 1-click

CVEs discovered

• CVE-2022-0564 - Qlik sense Enterprise Domain User enumeration

CVEs contributed to

• CVE-2021-30119 - Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6
• CVE-2022-25151 - ITarian - Session cookie not protected by HttpOnly flag
• CVE-2022-25152 - ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals
• CVE-2022-25153 - ITarian - Local privilege escalation in Endpoint Manager agent on Windows

CSIRT blog posts

• 10 August 2022 - Itarian Full disclosure
• 06 June 2021 - vCenter Server PreAuth RCE