prctl anon_vma_name: An Amusing Linux Kernel Heap Spray TLDRprctl PR_SET_VMA (PR_SET_VMA_ANON_NAME) can be used as a (possibly new!) heap spray meth... 2023-7-25 00:0:0 | 阅读: 15 | 收藏 | Blogs on STAR Labs - starlabs.sg anon vma prctl kref kmalloc

(CVE-2023-3513) RazerCentralService unsafe deserialization Escalation of Privilege Vulnerability SummaryProductRazer CentralServiceVendorRazerSeverityHigh - Adversaries may exploit s... 2023-7-14 08:0:0 | 阅读: 42 | 收藏 | Advisories on STAR Labs - starlabs.sg razer software rzr

(CVE-2023-3514) RazerCentralSerivce unsafe NamedPipe permission Escalation of Privilege Vulnerability SummaryProductRazer CentralServiceVendorRazerSeverityHigh - Adversaries may exploit s... 2023-7-14 08:0:0 | 阅读: 37 | 收藏 | Advisories on STAR Labs - starlabs.sg razer rid

Breaking the Code - Exploiting and Examining CVE-2023-1829 in cls_tcindex Classifier Vulnerability BackgroundThe discovery and analysis of vulnerabilities is a critical aspect of cybersecurity resea... 2023-6-19 08:0:0 | 阅读: 26 | 收藏 | Blogs on STAR Labs - starlabs.sg netlink exts tcindex rtm tcf

The Old, The New and The Bypass - One-click/Open-redirect to own Samsung S22 at Pwn2Own 2022 TLDR;We began our work on Samsung immediately after the release of the Pwn2Own Toronto 2022 target... 2023-6-14 08:0:0 | 阅读: 29 | 收藏 | Blogs on STAR Labs - starlabs.sg samsung deeplink samsungapps p0

Unearthing Vulnerabilities in the Apple Ecosystem: The Art of KidFuzzerV2.0 Publication May 19, 2023 By Pan Zhenpeng... 2023-5-19 00:0:0 | 阅读: 20 | 收藏 | Publications on STAR Labs - starlabs.sg slides kidfuzzerv2 uncovered fuzzer

Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707) IntroductionWhile analyzing CVE-2022-41082, also known as ProxyNotShell, we discovered this vulnera... 2023-4-28 08:0:0 | 阅读: 40 | 收藏 | Blogs on STAR Labs - starlabs.sg powershell exchange payload

(CVE-2023-2017) Shopware 6 Server-side Template Injection (SSTI) via Twig Security Extension Summary:ProductShopwareVendorShopware AGSeverityHigh - Users with login access to Sho... 2023-4-17 08:0:0 | 阅读: 45 | 收藏 | Advisories on STAR Labs - starlabs.sg shopware arrow php twig xa9

CS-Cart PDF Plugin Unauthenticated Command Injection SummaryA command injection vulnerability exists in CS-Cart’s HTML to PDF converter (https://github.... 2023-3-3 08:0:0 | 阅读: 27 | 收藏 | Blogs on STAR Labs - starlabs.sg converter php cscart github injection

Microsoft Azure Account Takeover via DOM-based XSS in Cosmos DB Explorer Upon finding the vulnerability, our team member, Ngo Wei Lin (@Creastery), immediately reported it t... 2023-2-24 08:0:0 | 阅读: 26 | 收藏 | Blogs on STAR Labs - starlabs.sg cosmos heatmap attacker

STAR LABS SG PTE. LTD. has been authorized by the CVE Program as a CVE Numbering Authority (CNA) STAR LABS SG PTE. LTD. (STAR Labs) announced today that it has become a CVE Numbering Authority (CNA... 2023-2-22 08:0:0 | 阅读: 23 | 收藏 | Blogs on STAR Labs - starlabs.sg security cna publishing

Gotta KEP-tcha 'Em All - Bypassing Anti-Debugging methods in KEPServerEX BackgroundLately, my focus has been on discovering any potential vulnerabilities in KEPServerEX.KE... 2023-2-17 08:0:0 | 阅读: 47 | 收藏 | Blogs on STAR Labs - starlabs.sg pwvtdata libua kepua libthread 70h

Dissecting the Vulnerabilities - A Comprehensive Teardown of acmailer's N-Days IntroductionIn this post, one of our recent intern, Wang Hengyue (@w_hy_04) was given the task to a... 2023-2-16 08:0:0 | 阅读: 34 | 收藏 | Blogs on STAR Labs - starlabs.sg acmailer enq subaccount 091 ctl

Deconstructing and Exploiting CVE-2020-6418 As part of my internship at STAR Labs, I conducted n-day analysis of CVE-2020-6418. This vulnerabili... 2022-12-21 08:0:0 | 阅读: 43 | 收藏 | Blogs on STAR Labs - starlabs.sg oob vic doubles receiver jscreate

(CVE-2022-44667) Windows CDirectMusicPortDownload Integer Overflow Vulnerability SummaryProductMicrosoft DirectMusicVendorMicrosoftSeverityHighAffected VersionsMi... 2022-12-13 08:0:0 | 阅读: 22 | 收藏 | Advisories on STAR Labs - starlabs.sg dwsize articdata

(CVE-2022-44668) Windows DirectMusicPortDownload Double Free Vulnerability SummaryProductMicrosoft DirectMusicVendorMicrosoftSeverityHighAffected VersionsMi... 2022-12-13 08:0:0 | 阅读: 27 | 收藏 | Advisories on STAR Labs - starlabs.sg 00000074 00007ffb dsmusic dmusic

The Last Breath of Our Netgear RAX30 Bugs - A Tragic Tale before Pwn2Own Toronto 2022 BackgroundSome time ago, we were playing with some Netgear routers and we learned so much from this... 2022-12-6 08:0:0 | 阅读: 19 | 收藏 | Blogs on STAR Labs - starlabs.sg fw dhcp lease netgear curlopt

TheHole New World - how a small leak will sink a great browser (CVE-2021-38003) IntroductionCVE-2021-38003 is a vulnerability that exists in the V8 Javascript engine. The vulnerab... 2022-12-6 08:0:0 | 阅读: 75 | 收藏 | Blogs on STAR Labs - starlabs.sg oob victim hole memory thehole

Multiple Vulnerabilities in Proxmox VE & Proxmox Mail Gateway BackgroundProxmox Virtual Environment (Proxmox VE or PVE) is an open-source type-1 hypervisor. It i... 2022-12-2 08:0:0 | 阅读: 28 | 收藏 | Blogs on STAR Labs - starlabs.sg pve pmg authkey backup username

How to Backup and Pwn using Time Machine macOS Time Machine's backup mechanism as an unexpected attack surface for pri... 2022-11-10 00:0:0 | 阅读: 18 | 收藏 | Publications on STAR Labs - starlabs.sg slides backup machine workflows attacker