info@starlabs.sg
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS info@starlabs.sg
03
assessed vulnerabilities (35)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-9539US | — | Exploit | ||
An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g.… | ||||
| CVE-2024-7009US | high7.1 | — | ||
Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database. | ||||
| CVE-2024-7008US | medium6.1 | — | ||
Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting. | ||||
| CVE-2024-6782US | —OT elevated | Exploit | ||
Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution. | ||||
| CVE-2024-6781US | high7.5 | — | ||
Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. | ||||
| CVE-2023-4226US | high8.8 | Exploit | ||
Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading… | ||||
| CVE-2023-4225US | high8.8 | — | ||
Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploa… | ||||
| CVE-2023-4224US | high8.8 | — | ||
Unrestricted file upload in `/main/inc/ajax/dropbox.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via upload… | ||||
| CVE-2023-4223US | high8.8 | — | ||
Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploa… | ||||
| CVE-2023-4222US | high8.8 | — | ||
Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via imp… | ||||
| CVE-2023-4221US | high8.8 | — | ||
Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via impr… | ||||
| CVE-2023-4220US | medium6.1 | Exploit | ||
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to p… | ||||
| CVE-2023-3545US | critical9.8 | — | ||
Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload sec… | ||||
| CVE-2023-3533US | critical9.8 | — | ||
Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-si… | ||||
| CVE-2023-3368US | critical9.8 | — | ||
Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutral… | ||||
| CVE-2023-1720US | high8.0 | — | ||
Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbi… | ||||
| CVE-2023-1719US | critical9.8 | — | ||
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute… | ||||
| CVE-2023-1718US | high7.5 | Exploit | ||
Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted "… | ||||
| CVE-2023-1717US | critical9.6 | — | ||
Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code i… | ||||
| CVE-2023-1716US | critical9.6 | — | ||
Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly exec… | ||||