The Old, The New and The Bypass - One-click/Open-redirect to own Samsung S22 at Pwn2Own 2022 TLDR;We began our work on Samsung immediately after the release of the Pwn2Own Toronto 2022 target... 2023-6-14 08:0:0 | 阅读: 23 | 收藏 | Blogs on STAR Labs - starlabs.sg samsung deeplink samsungapps p0

Unearthing Vulnerabilities in the Apple Ecosystem: The Art of KidFuzzerV2.0 Publication May 19, 2023 By Pan Zhenpeng... 2023-5-19 00:0:0 | 阅读: 12 | 收藏 | Publications on STAR Labs - starlabs.sg slides kidfuzzerv2 uncovered fuzzer

Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707) IntroductionWhile analyzing CVE-2022-41082, also known as ProxyNotShell, we discovered this vulnera... 2023-4-28 08:0:0 | 阅读: 30 | 收藏 | Blogs on STAR Labs - starlabs.sg powershell exchange payload

(CVE-2023-2017) Shopware 6 Server-side Template Injection (SSTI) via Twig Security Extension Summary:ProductShopwareVendorShopware AGSeverityHigh - Users with login access to Sho... 2023-4-17 08:0:0 | 阅读: 37 | 收藏 | Advisories on STAR Labs - starlabs.sg shopware arrow php twig xa9

CS-Cart PDF Plugin Unauthenticated Command Injection SummaryA command injection vulnerability exists in CS-Cart’s HTML to PDF converter (https://github.... 2023-3-3 08:0:0 | 阅读: 22 | 收藏 | Blogs on STAR Labs - starlabs.sg converter php cscart github injection

Microsoft Azure Account Takeover via DOM-based XSS in Cosmos DB Explorer Upon finding the vulnerability, our team member, Ngo Wei Lin (@Creastery), immediately reported it t... 2023-2-24 08:0:0 | 阅读: 26 | 收藏 | Blogs on STAR Labs - starlabs.sg cosmos heatmap attacker

STAR LABS SG PTE. LTD. has been authorized by the CVE Program as a CVE Numbering Authority (CNA) STAR LABS SG PTE. LTD. (STAR Labs) announced today that it has become a CVE Numbering Authority (CNA... 2023-2-22 08:0:0 | 阅读: 20 | 收藏 | Blogs on STAR Labs - starlabs.sg security cna publishing

Gotta KEP-tcha 'Em All - Bypassing Anti-Debugging methods in KEPServerEX BackgroundLately, my focus has been on discovering any potential vulnerabilities in KEPServerEX.KE... 2023-2-17 08:0:0 | 阅读: 41 | 收藏 | Blogs on STAR Labs - starlabs.sg pwvtdata libua kepua libthread 70h

Dissecting the Vulnerabilities - A Comprehensive Teardown of acmailer's N-Days IntroductionIn this post, one of our recent intern, Wang Hengyue (@w_hy_04) was given the task to a... 2023-2-16 08:0:0 | 阅读: 26 | 收藏 | Blogs on STAR Labs - starlabs.sg acmailer enq subaccount 091 ctl

Deconstructing and Exploiting CVE-2020-6418 As part of my internship at STAR Labs, I conducted n-day analysis of CVE-2020-6418. This vulnerabili... 2022-12-21 08:0:0 | 阅读: 29 | 收藏 | Blogs on STAR Labs - starlabs.sg oob vic doubles receiver jscreate

(CVE-2022-44667) Windows CDirectMusicPortDownload Integer Overflow Vulnerability SummaryProductMicrosoft DirectMusicVendorMicrosoftSeverityHighAffected VersionsMi... 2022-12-13 08:0:0 | 阅读: 20 | 收藏 | Advisories on STAR Labs - starlabs.sg dwsize articdata

(CVE-2022-44668) Windows DirectMusicPortDownload Double Free Vulnerability SummaryProductMicrosoft DirectMusicVendorMicrosoftSeverityHighAffected VersionsMi... 2022-12-13 08:0:0 | 阅读: 23 | 收藏 | Advisories on STAR Labs - starlabs.sg 00000074 00007ffb dsmusic dmusic

The Last Breath of Our Netgear RAX30 Bugs - A Tragic Tale before Pwn2Own Toronto 2022 BackgroundSome time ago, we were playing with some Netgear routers and we learned so much from this... 2022-12-6 08:0:0 | 阅读: 17 | 收藏 | Blogs on STAR Labs - starlabs.sg fw dhcp lease netgear curlopt

TheHole New World - how a small leak will sink a great browser (CVE-2021-38003) IntroductionCVE-2021-38003 is a vulnerability that exists in the V8 Javascript engine. The vulnerab... 2022-12-6 08:0:0 | 阅读: 47 | 收藏 | Blogs on STAR Labs - starlabs.sg oob victim hole memory thehole

Multiple Vulnerabilities in Proxmox VE & Proxmox Mail Gateway BackgroundProxmox Virtual Environment (Proxmox VE or PVE) is an open-source type-1 hypervisor. It i... 2022-12-2 08:0:0 | 阅读: 26 | 收藏 | Blogs on STAR Labs - starlabs.sg pve pmg authkey backup username

How to Backup and Pwn using Time Machine macOS Time Machine's backup mechanism as an unexpected attack surface for pri... 2022-11-10 00:0:0 | 阅读: 17 | 收藏 | Publications on STAR Labs - starlabs.sg slides backup machine workflows attacker

The Journey To Hybrid Apple Driver Fuzzing Publication November 10, 2022 By Pan... 2022-11-10 00:0:0 | 阅读: 13 | 收藏 | Publications on STAR Labs - starlabs.sg slides guided surveys tackle combining

Microsoft SharePoint Server Post-Authentication Server-Side Request Forgery vulnerability OverviewDisclaimer: No anime characters or animals were harmed during the research. The bug had bee... 2022-10-25 08:0:0 | 阅读: 34 | 收藏 | Blogs on STAR Labs - starlabs.sg bcsodata microsoft ssrf

Apple CoreText - An Unexpected Journey to Learn about Failure Late last year, I have focused my research on the CoreText framework for 2-3 months. In particular,... 2022-9-29 08:0:0 | 阅读: 23 | 收藏 | Blogs on STAR Labs - starlabs.sg ligature trunglue morx glyphs subtable

Step-by-Step Walkthrough of CVE-2022-32792 - WebKit B3ReduceStrength Out-of-Bounds Write Recently, ZDI released the advisory for a Safari out-of-bounds write vulnerability exploited by Manf... 2022-9-8 08:0:0 | 阅读: 26 | 收藏 | Blogs on STAR Labs - starlabs.sg intrange rangefor lhs rhs timetolive