IMAGIX values the contribution of security researchers who help protect our systems and the people who use them. This page recognises those who have reported vulnerabilities responsibly, following the Vulnerability Disclosure Policy.
Fabricio Bonilla
Fixed- Category:
- API and web application security
- CWE:
- 918 (SSRF), 203 (Account enumeration), 1428 (Improper use of HTTP)
An SSRF vulnerability in a DICOMweb integration, along with account enumeration and an inadequate HTTPS redirection setting. The findings led to stronger access controls and a tighter security configuration for the web services.
Harsh Maheta
Fixed- Category:
- Asset and DNS record management
A service associated with the IMAGIX domain still accepted the TLS 1.1 protocol and an obsolete cipher suite. The internal investigation showed that the service belonged to external infrastructure the company had used in the past and was still referenced by an outdated DNS record. Removing that record solved the problem.
Kunal Mhaske
Fixed- Category:
- Email authentication (DMARC)
No DMARC policy on the corporate domain, which made it easier to send fake messages on behalf of IMAGIX. The fix strengthened the authentication of emails sent from the domain.