Latest press releases

Redazione ufficio stampa

Read the latest press releases and search the archives of TIM Group's Press Office. Read more

Responsible Disclosure

06/30/2022 - 11:30 AM

To send a detected vulnerability write to

Below you will find the rules to follow.

What is Responsible Disclosure

Responsible Disclosure is a method to report system vulnerabilities which allows the recipient sufficient time to identify and apply the necessary countermeasures before making the information public.

By following this controlled and ethically correct model of reporting, the sender helps companies to identify and resolve system flaws, thus providing a valuable and efficient contribution to increase the security of ICT services and avoiding damage or disruption to the systems involved.

How Responsible Disclosure works in TIM

Whenever a customer, researcher or expert should identify one or more vulnerabilities in the following environments:

  • TIM portals (i.e.,, etc.)
  • Mobile applications bearing the TIM logo and published on official stores (i.e. TIM Music, My TIM Fisso, TIM Telefono)
  • Devices bearing the TIM logo (i.e. TIM Vision decoderADSL modem-router, etc. except for cellular phones)
  • Equipment pertaining to TIM’s fixed-line or mobile network (i.e. routers, load balancers, etc.)

he or she can send the information to TIM following the procedure laid out below.

Using the following procedure, whoever informs TIM of a system vulnerability is required to make a responsible disclosure so as not to expose other clients to unnecessary security risks.

The reporting person must avoid performing any activity that can either disrupt the impacted system or service or cause any data leakage/loss, limiting his/her use of the system/service to the minimum necessary and refraining from accessing data not strictly necessary to prove the existence of the vulnerability. Any activity on the impacted system/service must be carried out in full compliance with the provisions of the present policy. Moreover, the use of intensive or invasive scanning tools is not allowed.

Responsible disclosure implies that the reporting person has not spied on or disclosed any third-party data without their consent.

Specifically, whoever activates the procedure must:

Send the information via email to with the following details:

  • Personal data (name, surname and, if applicable, organization for which the person works)
  • The type of vulnerability identified
  • The service/device/application impacted by the flaw
  • A detailed description of the problem encountered
  • IP address from which the vulnerability was identified, together with the date and time of discovery
  • A compressed archive (zip) with all the files which can help in reproducing the flaw (i.e. images, screenshots, text files with description details, PoC, source code, scripts, pcap traces, logs, source IP addresses, …). The maximum dimension of the archive cannot exceed 10MB. If the archive is password protected please specify the password in the body of the mail.
  • The consensus or not to sending your personal data to the producer, if available, of the technology involved for a possible direct contact between the parties.
  • The consensus or not to being listed in the Hall of Fame section, together with an optional personal contact, if you want it to be mentioned alongside your Name and Surname.
  • In activating the Responsible Disclosure procedure you may encrypt your mail using the following public key:
    PGP key: 0x68DEAD71
    Fingerprint: 0184D9E3E0CACB6F6E9A813BDE90CF9768DEAD71

Observe strict secrecy on all information pertaining to the vulnerabilities discovered, and therefore commit not to reveal any of these, entirely or partially, or in any form make them available to third parties for a period of not less than 90 days, allowing TIM the required time to identify and apply the necessary countermeasures. In especially complex cases, TIM reserves the right to extend this period, giving appropriate notice to whoever sent the information.

In the cases where the information regarding the vulnerabilities comes from a legal entity (public or private), corporation, consortium or other associative body, the sender must take the necessary steps to limit access to said information to those employees who require the use of the affected system for their work activities, enacting all suitable and appropriate measures to maintain confidentiality and abovementioned limits while accessing and using the information.

Once a notice has been received, TIM is committed to following up as follows:

  1. Send an email to the reporting person/entity to acknowledge reception of the mail with the information outlined above. Within 10 days from this confirmation TIM will send a second email with an evaluation of the relevance of the vulnerability and the results of an initial analysis.
  2. Adequately manage the vulnerability report so as to respect the timeline indicated previously and, in case of an eligible report on a vulnerability which is not already being handled, publicly thank the sender in the Hall of Fame section, if the necessary authorization accompanied the original mail.

TIM does not offer economic rewards; moreover, TIM reserves the right not to manage reports which do not respect the criteria indicated in this procedure.

TIM stresses the importance of assuming responsible behavior even after the release of any patch as the rollout process can be long and complicated. Therefore, we ask a careful evaluation of information released in this regard, with the objective of safeguarding user security.

Below you will find some examples of vulnerability categories which are considered eligible for publication in the Hall of Fame:

  • Cross Site Scripting (XSS)
  • Cross Site Request Forgery (CSRF)
  • Injection (i.e. SQL injection, user input)
  • Broken Authentication and Session Management
  • Broken Access Control
  • Security Misconfiguration
  • Redirect / Man in the Middle attacks
  • Remote code execution
  • Underprotected API
  • Privilege Escalation

On the other hand, the following situations are not covered by this Responsible Disclosure initiative and therefore are not eligible for the Hall of Fame:

  • Situations which are not inherent to security aspects (i.e. unavailability of a service, bugs in a GUI, etc.) and therefore managed through traditional channels of customer care.
  • Problems regarding phishing or spam and vulnerabilities inherent to social engineering techniques; these must be signaled either via email to or through the form available on
  • Results of automatic tools for vulnerability assessment/penetration testing (i.e. Nessus, nmap, …).
  • Reports on the use of weak configurations of the TLS protocol, or reports on non-compliance with best practices, such as, for example, the lack of security headers.

TIM reserves the right to update this Responsible Disclosure procedure at any time.

Hall of Fame

We would like to thank all persons who make a responsible disclosure to us and recognize their valuable contribution in increasing the security of our products and services.



  • Adrián Pérez Ruiz, | Underprotected API
  • Gaurang Maheta, | Security Misconfiguration
  • Mipam Ludwig Uderzo,| Remote Code Execution e SQL Injection
  • Simone Quatrini | Cross-Site Scripting (XSS) , Security Misconfiguration


  • Agrim Dua, | Broken Authentication and Session Management
  • Anthony Richa, | Broken Authentication and Session Management
  • Banavath Aravind, | Security Misconfiguration
  • Clandestine, | Cross Site Scripting (XSS)
  • Domenico Veneziano, | Server-Side Request Forgery (SSRF)
  • Gaetano Perrone, | Multiple Security Misconfiguration
  • Gaurang Maheta, | Security Misconfiguration
  • Harsh Dinesh bhai maheta, | Outdated software
  • Jay Mehta,| Security Misconfiguration
  • Justin Patrick, | Security Misconfiguration
  • Mipam Ludwig Uderzo, | Cross Site Scripting (XSS)
  • Mohammadreza Sarayloo, | Security Misconfiguration
  • Muhammed Ashique, | Cross Site Scripting (XSS)
  • Nilabh Rajpoot, | Outdated software
  • Rock Pratap Singh, | Security Misconfiguration
  • Simone Quatrini, | Multiple Security Misconfiguration, Cross Site Scripting (XSS), Redirect
  • Syed Ahmed, | Security Misconfiguration
  • tuo4n8, | Outdated software
  • Tushar Vaidya, | Cross Site Scripting (XSS)
  • Varel Valensio, | Security Misconfiguration
  • Vu Van Tien, | Security Misconfiguration


  • Abdelrahman Tarek, | Security Misconfiguration
  • Andrea Santese, | Security Misconfiguration, Cross Site Scripting (XSS)
  • Anthony Richa, | Broken Authentication and Session Management
  • Donato Scaramuzzo, | Cross Site Scripting (XSS)
  • Ekin Şiar Bayer, | Outdated software
  • Gaurang Maheta, | Cross Site Scripting (XSS), Multiple Security Misconfigurations
  • Giacomo Sighinolfi, | Cross Site Scripting (XSS)         
  • Ivo de Abreu Araújo, | Multiple Cross Site Scripting (XSS)
  • Ken Kaneki, | Security Misconfiguration
  • Krishna Agarwal, | Redirect
  • Lorenzo Toti, | Cross Site Scripting (XSS), Multiple Security Misconfigurations
  • Michele  Carone, | Multiple Cross Site Scripting (XSS) 
  • Mipam Ludwig Uderzo, | Cross Site Scripting (XSS)
  • Mohammadreza Sarayloo, | Redirect, Security Misconfiguration
  • Nguyen Anh Tuan,| Cross Site Scripting (XSS)
  • Nicola Concas, | Security Misconfiguration
  • Ramon Dunker, | Remote code execution
  • Ritu raj Choudhary, | HTML Code injections
  • Roshan Zameer, | Security Misconfiguration
  • Savino Sisco, | Multiple Outdated software, Security Misconfiguration
  • Shreyas Ghevariya,| Security Misconfiguration
  • Shruti Kapoor, | Security Misconfiguration
  • Simone Paganessi, | Outdated software
  • Simone Quatrini, | Security Misconfiguration
  • Valerio Casalino, | Multiple Outdated software, Security Misconfiguration


  • Abhijith A, | Clickjacking
  • Andrea Cappa, |  HTML Code Injection
  • Anthony Richa, | Broken Authentication and Session Management
  • Antonio Rocco Spataro, |Security Misconfiguration
  • Dan Fabro, | XSS vulnerability
  • Donato Di Pasquale, | Redirect, Security Misconfiguration
  • Enes Saltik, | Cross Site Scripting (XSS)
  • Francesco Ferreri, | HTML Code Injection
  • Gaurang Maheta, | Security Misconfiguration, Outdated software
  • George Crook, | Clickjacking, Multiple Security Misconfigurations
  • Joaquín López-Cortijo Guijarro, | Cross Site Scripting (XSS)
  • Krishna Kaiwartya, | Security Misconfiguration
  • Lavan Kumar, | Redirect
  • Marco Ilardi, | HTML Code Injection
  • Mipam Ludwig Uderzo, |Cross Site Scripting (XSS)
  • Mirko Caruso, | Security Misconfiguration
  • Nguyen Anh Tuan, | Redirect, XSS vulnerability, Multiple Remote code execution
  • Patrizio Tufarolo, | Security Misconfiguration
  • Prince Prafull, | Security Misconfiguration
  • Ridoy Khan | Security Misconfiguration
  • Sanket Ambalkar, | Security Misconfiguration
  • Shay Ben Tikva | Cross Site Scripting (XSS)
  • Sheikh Rishad, | Security Misconfiguration
  • Simone Quatrini | Broken Authentication and Session Management
  • Taha Bıyıklı, | HTML Code injections
  • Vijay Sutar, | Security Misconfiguration


  • Alessandro Braccio | Broken Access Control
  • Alessio Della Libera, | XSS vulnerability
  • Andrei Manole, | Security Misconfiguration
  • Antonio Cannito, | Broken Authentication and Session Management
  • BabaBounty, | XSS vulnerability
  • Emad Youssef,|Security Misconfiguration
  • Fabio Mariani, | XSS vulnerability
  • Felipe Renzi, | Security Misconfiguration
  • Filippo Sorbellini, | Broken Access Control
  • Flavio Baldassi, | Security Misconfiguration
  • Florian Kunushevci, | XSS vulnerability
  • Gourab Sadhukhan, | Security Misconfiguration
  • Ismail Tasdelen, | Security Misconfiguration
  • Lütfü Mert Ceylan, | XSS vulnerability
  • Marco Nappi, |  XSS vulnerability
  • Mauro Piva, | Underprotected API
  • Mehmet Can GÜNEŞ, | Security Misconfiguration
  • Mohd Asif Khan, | Security Misconfiguration
  • Muhammad Hassam, | Security Misconfiguration
  • Nirjhar Banik, | Security Misconfiguration
  • Pierpaolo Palmisano, | Broken Access Control
  • Pratik Khalane, | Security Misconfiguration
  • Pritam Mukherjee, | Clickjacking
  • Reando Veshi, | Broken Access Control, Multiple Security Misconfigurations
  • Robert Aaron, | Security Misconfiguration
  • Siddharth Bose, | Security Misconfiguration
  • Simone Quatrini | Multiple Security Misconfigurations
  • Souvik Mondal, | Multiple Security Misconfigurations, Clickjacking
  • Umesh Prakash Jore, | Security Misconfiguration
  • Vaibhav Atkale, | Multiple Security Misconfigurations
  • Valerio Alessandroni, | Security Misconfiguration


  • Alessandro Groppo, | Underprotected API
  • Andrea Bocchetti, | Security Misconfiguration
  • Andrea Guglielmini, | XSS vulnerability
  • Andrei Conache, | Multiple XSS vulnerabilities
  • Andrei Manole, | SQL injection
  • Antonio Arlia Ciombo,| XSS vulnerability
  • Antonio Blescia, | CSRF
  • Cristian Giustini, | Security Misconfiguration, XSS vulnerability, SQL injection
  • Emad Youssef, | Redirect, Cross Site Scripting (XSS)
  • Ennio Campagna, | XSS vulnerability
  • Filippo Sorbellini, | Broken Authentication and Session Management
  • Flavio Baldassi, | Multiple Security Misconfigurations
  • Francesco Lacerenza, | Security Misconfiguration
  • Giantonio Chiarelli, |  XSS vulnerability
  • Kasper Karlsson | XSS vulnerability
  • Lorenzo Comi, | XSS vulnerability
  • Marco Nappi,| Multiple XSS vulnerabilities
  • Mario Alviano, | Broken Authentication and Session Management, Underprotected API
  • Michele Romano, | XSS vulnerability
  • Pethuraj M, | Security Misconfiguration
  • Pierpaolo Palmisano, | Broken Access Control | XSS vulnerability
  • Rahad Chowdhury, | Multiple Security Misconfigurations
  • Rupesh Kokare, | Redirect
  • Simone Quatrini | Multiple Security Misconfiguration
  • Tushar Shinde, | Security Misconfiguration
  • Vishal Bharad, | Security Misconfiguration



  • Abdel Adim Oisfi, | XSS vulnerability
  • Akash Labade, | CSRF, XSS vulnerability
  • Akash Upadhyay, | Multiple Redirects
  • Alessandro Groppo, | Security Misconfiguration
  • Alessandro Moccia, | XSS vulnerability
  • Alessio Santoru, | XSS vulnerability
  • Alfie Njeru, | Multiple Security Misconfigurations
  • Andrea Bocchetti, | Multiple XSS vulnerabilities, Redirect
  • Andrea Draghetti, | Security Misconfiguration
  • Andrea Guglielmini, | Underprotected API
  • Andrei Conache, | Multiple XSS vulnerabilities
  • Andrei Manole, | XSS vulnerability
  • Angelo Anatrella, | XSS vulnerability, Security Misconfiguration
  • Antonio Cannito, | Multiple Security Misconfigurations, CSRF, Multiple XSS vulnerabilities, Broken Authentication and Session Management, SQL injection
  • Bill Ben Haim, | XSS vulnerability, Redirect
  • Carlo Pelliccioni, | Multiple XSS vulnerabilities, Redirect
  • Cristiano Maruti, | Broken Access Control, XSS vulnerability
  • Davide Del Vecchio, | XSS vulnerability, Security Misconfiguration
  • Domenico Curigliano, | Multiple Remote code executions, Multiple XSS vulnerabilities, Redirect
  • Donato Scaramuzzo, | Broken Authentication and Session Management
  • Emanuele Gentili, | HTML Code injections, XSS vulnerability, Redirect, Security Misconfiguration
  • Ezio Paglia, | Multiple Security Misconfigurations, Multiple XSS vulnerabilities
  • Fabio Pietrosanti, | Security Misconfiguration
  • Federico Camponogara,| Redirect, Broken Access Control, Security Misconfiguration
  • Federico Valentini, | SQL injection
  • Federico Zambito, | Redirect
  • Frank Vickers, | Multiple Security Misconfigurations
  • Giovanni Guido, | XSS vulnerability
  • Giulio Comi, | Remote code execution
  • Ismail Tasdelen, | Multiple Security Misconfigurations
  • Jacopo Jannone, | XSS vulnerability
  • Jose Carlos Exposito Bueno | Multiple XSS vulnerabilities, SQL injection
  • Kasper Karlsson | XSS vulnerability
  • Lorenzo Comi, | SQL Injection, Broken Authentication and Session Management
  • Lorenzo Stella, | Security Misconfiguration, Underprotected API
  • Luca Capacci, | Redirect
  • Luigi Gubello, | Multiple XSS vulnerabilities
  • Marco Nappi, | Multiple XSS vulnerabilities
  • Matteo Neri, |SQL injection
  • Mattia Reggiani, | XSS vulnerability
  • Mert Can Esen, | XSS vulnerability
  • Michele Toccagni, | SQL injection, XSS vulnerability, Multiple Security Misconfigurations
  • Mohamed Ouad, | Broken Authentication and Session Management, Underprotected API
  • Paolo Giai | | XSS vulnerability
  • Paolo Montesel, | Underprotected API
  • Paolo Stagno, | XSS vulnerability, Redirect
  • Pasquale Fiorillo, | XSS vulnerability, Multiple SQL injections
  • Raffaele Forte, | Remote Code Execution
  • Raffaele Sabato, | Multiple Security Misconfigurations
  • Shubham Pathak, | Multiple Security Misconfigurations
  • Simone Cardona, | Multiple XSS vulnerabilities, Redirect, Security, Misconfiguration
  • Simone Onofri, | XSS vulnerability, Redirect
  • Simone Quatrini | Security Misconfiguration, XSS vulnerability
  • Valerio Mancini, | Remote code execution
  • Vincenzo Chieppa, | XSS vulnerability, SQL injection
  • Vishal Jain, | Security Misconfiguration