Archive - Calif

Wormable Substack XSS

We found a stored Cross-Site Scripting (XSS) vulnerability in Substack.

Aug 12 •

July 2024

Type confusion attacks in ProseMirror editors

Jul 16 •

May 2024

Dissecting LockBit v3 ransomware

We analyzed a variant of LockBit v3 ransomware, and rediscovered a bug that allows us to decrypt some data without paying the ransom. We also found a…

May 2 •

,

, and

April 2024

Ransomware Response Strategy

Apr 11 •

March 2024

Microsoft Exchange 2010 Arbitrary User Impersonation

Microsoft Exchange is one of the most critical assets in any organization.

Mar 5 •

February 2024

A trip to the White House

Two days before the Lunar New Year 2024, I went to the White House to meet with representatives of the National Security Council (NSC) to discuss…

Feb 11 •

A letter from Thai

Feb 1 •

January 2024

During a recent engagement, we exploited CSRF to take over Argo CD and get Kubernetes cluster admin privileges.

Jan 10 •

December 2023

Improving AI Safety with Red Teaming

We had the honor to join many esteemed speakers at AI Day 2023 to talk about improving AI safety with red teaming.

Dec 7, 2023 •

October 2023

US Offsite Summer 2023

This summer, Team Calif in Vietnam went to the US to visit the company's "headquarters".

Oct 18, 2023 •

September 2023

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web—and beyond.

Sep 14, 2023 •

July 2023

Reproducing CVE-2023-38646: Metabase Pre-auth RCE

By Duc Nguyen and Jang Nguyen

Jul 27, 2023

#nojs-banner { position: fixed; bottom: 0; left: 0; padding: 16px 16px 16px 32px; width: 100%; box-sizing: border-box; background: red; color: white; font-family: -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 13px; line-height: 13px; } #nojs-banner a { color: inherit; text-decoration: underline; } This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts