318 matches found
PT-2020-14874 · Razer · Razer Chroma Sdk Rest Server
Name of the Vulnerable Software and Affected Versions: Razer Chroma SDK Rest Server versions 3.12.17 and earlier Description: The issue allows remote attackers to execute arbitrary programs due to a race condition. This condition occurs when a file created under "%PROGRAMDATA%Razer ChromaSDKApps"...
Razer: [api.easy2pay.co] SQL Injection in cashcard via card_no parameter ⭐️Bypassing IP whitelist⭐️
The tester discovered a Razer Thailand server suffered from a SQL injection vulnerability due to input sanitization failure. Razer thanks the tester for his diligence and clear report...
Razer: [api.easy2pay.co] SQL Injection at fortumo via TransID parameter [Bypassing Signature Validation🔥]
The tester discovered the api.easy2pay.co suffered from a SQL injection vulnerability, affecting Razer Gold Thailand. Razer thanks the tester for his report and diligence...
Razer: HTML injection in support.razer.com [IE only]
The tester discovered the support.razer.com site had an HTML injection vulnerability that could have facilitated a phishing attack. Razer thanks the tester for his report and for working with the team to help remediate...
Razer: SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter.
The tester discovered a monitoring server in a Razer Gold environment was running legacy software with a SQL injection vulnerability. Razer thanks the tester for his diligence and helping keep Razer's customer data secure. A Razer Gold asset suffered from an SQL injection due to an outdated...
Razer Synapse Service 1.0.0 DLL Injection
Discovered by: Juan Sacco Razer Synapse Service v1.0.0 is prone to a DLL Injection because it fails to properly filter user supplied input and loads a .DLL from %ProgramData% from userland with SYSTEM rights allowing to escalate the priveleges from a regular user to SYSTEM rights. Program: Raze...
Razer: 🐞 OS Command Injection at https://sea-web.gold.razer.com/lab/ws-lookup via IP parameter
The tester discovered a Razer Gold Thailand site that suffered from a service with a command injection vulnerability. Razer thanks the tester for his report and clear PoC. a real world CTF-Like challenge 😅 Burpsuite Collaborator Client was very helpful Thanks @Razer for the bounty 🥳...
Razer: SQL injection at https://sea-web.gold.razer.com/ajax-get-status.php via txid parameter
The tester determined the Razer Gold TH site suffered from a SQL injection issue. Razer thanks the tester for his due diligence and clear report...
Razer: Subdomain takeover at iosota.razersynapse.com via Amazon S3
The tester discovered a dangling DNS record for iosota.razersynapse.com that was no longer in use and demonstrated a subdomain takeover. Subdomain takeovers by themselves are not in the scope of our program, but Razer thanks the tester for their diligence and clear report...
Razer: SQL Injection in https://api-my.pay.razer.com/inviteFriend/getInviteHistoryLog
The tester determined the Razer Pay API server was vulnerable to a SQL injection that could allow the exposure of user information. Razer Fintech appreciates the clear and detailed PoC...
Razer: Helpdesk takeover (subdomain takeover) in razerzone.com domain via unclaimed Zendesk instance
The tester discovered a Razer subdomain subject to a takeover. Although we do not normally accept these as part of this program, Razer thanks the tester for his report...
Razer: Post Based Reflected XSS on [https://investor.razer.com/s/ir_contact.php]
The tester discovered our investor relations website suffered from a reflected XSS issue due to unsanitized user input. Razer thanks the tester for his clear PoC and working with us to resolve this issue...
Razer: Reflected XSS on molpay.com with cloudflare bypass
The tester discovered a reflected XSS vulnerability on molpay.com which could allow an adversary to steal client side information such as a cookie. Razer Fintech thanks the tester for his clear report and PoC. Follow brutelogic for amazing bypass tips. Thank you for bounty @razer 🙏...
Razer: Insecure HostnameVerifier within WebView of Razer Pay Android (TLS Vulnerability)
The tester discovered the Razer Pay Android application was vulnerable to a client side hijack which could have allowed the capture of important user data. Razer Fintech thanks the tester for their clear PoC...
Razer: RXSS at https://api.easy2pay.co/inquiry.php via txid parameter.
The tester discovered a reflected XSS on an API server related to Razer Pay TH. Note this is not a site that users will typically visit via a web browser front end. Razer thanks the tester for his diligence and the clear report...
Razer: Blind SQL Injection at http://easytopup.in.th/es-services/mps.php via serial_no parameter
The tester determined a Razer Gold Thailand server was vulnerable to a boolean-based blind SQL injection attack. Razer thanks the tester for the very clear PoC...
Razer: IDOR in eform.molpay.com leads to see other users application forms with private data
The tester discovered an IDOR which could allow an adversary to view the application form data of another user's application form given knowledge of the application ID. He worked with Triage to provide a working PoC. Razer Fintech appreciates the report to help keep customer data secure...
Razer: Reflected XSS in eform.molpay.com
The tester discovered a reflected XSS on eform.molpay.com. This was fixed in production on Feb 12. Razer Fintech thanks the tester for his diligence and clear PoC...
Razer: Blind SQL Injection(Time Based Payload) in https://www.easytopup.in.th/store/game/digimon-master via CheckuserForm[user_id]
The tester determined the Top Up site for Razer Gold TH suffered from a blind SQL injection vulnerability due to lack of input sanitization. Razer thanks the tester for his clear PoC and working with us to resolve the issue...
Razer: AWS subdomain Takeover at estore.razersynapse.com
The tester discovered the razersynapse.com domain was vulnerable to a subdomain takeover. Although this is out of scope of our program, we appreciate the tester bringing this to our attention...