CVE Program partner

STAR_Labs

STAR Labs SG Pte. Ltd.

API
CVEs, 365 days145 all time, 10 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationSTAR Labs SG Pte. Ltd.
RoleCNA
TypeResearcher
Reports tomitre
ScopeVulnerabilities discovered by, or reported to, STAR Labs SG that are not in another CNA’s scope.
Advisorieshttps://starlabs.sg/advisories/

Latest CVEs · RSS

  • CVE-2026-9539 2026-06-24 · CVSS 6.5
    An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor hos
  • CVE-2024-7009 2024-08-06 · CVSS 4.2
    Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.
  • CVE-2024-7008 2024-08-06 · CVSS 5.4
    Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.
  • CVE-2024-6782 2024-08-06 · CVSS 9.8
    Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.
  • CVE-2024-6781 2024-08-06 · CVSS 7.5
    Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.
  • CVE-2023-4225 2023-11-28 · CVSS 8.8
    Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code
  • CVE-2023-4226 2023-11-28 · CVSS 8.8
    Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code exe
  • CVE-2023-4224 2023-11-28 · CVSS 8.8
    Unrestricted file upload in `/main/inc/ajax/dropbox.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code
  • CVE-2023-4223 2023-11-28 · CVSS 8.8
    Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code
  • CVE-2023-4222 2023-11-28 · CVSS 7.2
    Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote co
  • CVE-2023-4221 2023-11-28 · CVSS 7.2
    Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote cod
  • CVE-2023-4220 2023-11-28 · CVSS 8.1
    Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenti
  • CVE-2023-3545 2023-11-28 · CVSS 9.8
    Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to by
  • CVE-2023-3533 2023-11-28 · CVSS 9.8
    Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to per
  • CVE-2023-3368 2023-11-28 · CVSS 9.8
    Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution
  • CVE-2023-1720 2023-11-01 · CVSS 9.6
    Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and p
  • CVE-2023-1719 2023-11-01 · CVSS 7.5
    Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the ser
  • CVE-2023-1718 2023-11-01 · CVSS 7.5
    Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-ser
  • CVE-2023-1717 2023-11-01 · CVSS 9.6
    Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitra
  • CVE-2023-1716 2023-11-01 · CVSS 9.0
    Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browse
  • CVE-2023-1715 2023-11-01 · CVSS 9.0
    A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags
  • CVE-2023-1714 2023-11-01 · CVSS 8.8
    Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitra
  • CVE-2023-1713 2023-11-01 · CVSS 8.8
    Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authentica
  • CVE-2023-4198 2023-11-01 · CVSS 6.5
    Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data
  • CVE-2023-4197 2023-11-01 · CVSS 7.5
    Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker

All CVE Program partners