Advisories

A chronological list of vulnerabilities published by STAR Labs researchers, with technical details, affected versions, and disclosure timelines.

Advisory Nov 28, 2023

(CVE-2023-4221) Chamilo LMS Learning Path PPT2LP OpenofficePresentation Command Injection

Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. …

ByNgo Wei Lin

Advisory Nov 28, 2023

(CVE-2023-4222) Chamilo LMS Learning Path PPT2LP OpenofficeTextDocument Command Injection

Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. …

ByNgo Wei Lin

Advisory Nov 28, 2023

(CVE-2023-4223) Chamilo LMS Document Ajax File Upload Functionality Remote Code Execution

Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. …

ByNgo Wei Lin

Advisory Nov 28, 2023

(CVE-2023-4224) Chamilo LMS Dropbox Ajax File Upload Functionality Remote Code Execution

Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. …

ByNgo Wei Lin

Advisory Nov 28, 2023

(CVE-2023-4225) Chamilo LMS Exercise Ajax File Upload Functionality Remote Code Execution

Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. …

ByNgo Wei Lin

Advisory Nov 28, 2023

(CVE-2023-4226) Chamilo LMS Work Ajax File Upload Functionality Remote Code Execution

Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. …

ByNgo Wei Lin

Advisory Nov 01, 2023

(CVE-2023-1713) Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation

Summary Product Bitrix24 Vendor Bitrix24 Severity High Affected Versions Bitrix24 22.0.300 (latest version as of writing) Tested Versions Bitrix24 22.0.300 …

ByLam Jun Rong & Li Jiantao

Advisory Nov 01, 2023

(CVE-2023-1714) Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction

Summary: Product Bitrix24 Vendor Bitrix24 Severity High Affected Versions Bitrix24 22.0.300 (latest version as of writing) Tested Versions Bitrix24 22.0.300 …

ByLam Jun Rong & Li Jiantao

Advisory Nov 01, 2023

(CVE-2023-1715 & CVE-2023-1716) Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page

Summary: Product Bitrix24 Vendor Bitrix24 Severity Critical Affected Versions Bitrix24 22.0.300 (latest version as of writing) Tested Versions Bitrix24 22.0.300 …

ByLam Jun Rong & Li Jiantao

Advisory Nov 01, 2023

(CVE-2023-1717) Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution

Summary: Product Bitrix24 Vendor Bitrix24 Severity Critical Affected Versions Bitrix24 22.0.300 (latest version as of writing) Tested Versions Bitrix24 22.0.300 …

ByLam Jun Rong & Li Jiantao