Valve: GetReports works for hubs you don't have access to

Admin permissions on a game hub could be leveraged to view UGC reports on unrelated games. If an account had admin permissions on a game hub, he'd be able to view other game hubs UGC reports by simply making the appid parameter the appid of the game hub he has admin permissions on...

Valve: ImageMagick GIF coder vulnerability leading to memory disclosure

Due to CVE-2017-15277, portions of server memory on some steamcommunity web servers could be leaked via image updates. An attacker would not be able to control what memory would be returned, but system information could be obtained. I was able to arbitrarily disclose server memory on...

Valve: Xss was found by exploiting the URL markdown on http://store.steampowered.com

Hello guys I found an xss vulnerability on store.steampowered.com markdown POC http://store.steampowered.com/widget/386360/?t=url=google.com:/onclick=%27alertdocument.domain%27url=xss/url Here is my exploit url=google.com:/onclick='alertdocument.domain'url=xss/url Steps 1 - go to any product 2 -...

Valve Steam Link has an unspecified vulnerability (CNVD-2018-01479)

The Valve Steam Link is a Steam online gaming device from Value Software in the United States. A security vulnerability exists in Valve Steam Link build 643, which stems from the program only detecting the first 8 characters of a password. No details of the vulnerability are available at this tim...

Valve Steam Link Unspecified Vulnerability

The Valve Steam Link is a Steam online gaming device from Value Software in the United States. A security vulnerability exists in Valve Steam Link. A remote attacker can exploit this vulnerability by guessing the 24-bit MAC address and attempting to log in with root privileges to gain access...

CVE-2017-17877

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

CVE-2017-17878

An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES aka the CONFIGFEATUREDEFAULTPASSWDALGO="des" setting...

CVE-2017-17878

An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES aka the CONFIGFEATUREDEFAULTPASSWDALGO="des" setting...

Design/Logic Flaw

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

Design/Logic Flaw

An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES aka the CONFIGFEATUREDEFAULTPASSWDALGO="des" setting...

CVE-2017-17878

An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES aka the CONFIGFEATUREDEFAULTPASSWDALGO="des" setting...

CVE-2017-17877

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

CVE-2017-17877

The CVE-2017-17877 entry concerns Valve Steam Link (build 643). When the SSH daemon is enabled for local development, the device becomes publicly reachable via IPv6 TCP port 22 over the internet by default, enabling remote access by guessing 24 bits of the MAC address and attempting a root login....

CVE-2017-17878

CVE-2017-17878 affects Valve Steam Link build 643. The root password handling truncates passwords longer than 8 characters due to the default DES algorithm (CONFIG_FEATURE_DEFAULT_PASSWD_ALGO="des"). The issue is documented across multiple sources (NVD entry, Red Hat CVEs, and related disclosures...

CVE-2017-17878

An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES aka the CONFIGFEATUREDEFAULTPASSWDALGO="des" setting...

Valve: Reflected XSS in www.dota2.com

Hi guys, Description I found another XSS in www.dota2.com. This time it is located in http://www.dota2.com/international/live/5/5/1. However it seems that when you can change the /5/5 folders to any other number to confirm and it still worked. I tested this on...

Valve: Link filter protection bypass

Description Hi, there is a protection bypass in the linkfilter function. By using the character 。 %E3%80%82 url encoded instead of a normal dot in urls, it is possible to bypass the blocking. PoC Normal request : https://steamcommunity.com/linkfilter/?url=pornhub.com F240919 Bypass :...

Valve: MySQL username and password leaked in developer.valvesoftware.com via source code dislosure

Hey there it looks like you are relying on a script that cleans up your backup process on developer.valvesoftware.com: /scripts/finalcleanup.sh: Remove files post cleanup rm -r $SITEPATH/data rm $SITEPATH/.sql rm $SITEPATH/.sql.gz rm $SITEPATH/.tgz rm $SITEPATH/.tar.gz rm $SITEPATH/.log rm -r...

Valve: LFI in pChart php library

Local File Inclusion LFI vulnerability in the pChart php library...

Threat Outbreak Alert RuleID30338: Email Messages Distributing Malicious Software on August 24, 2017

Medium Alert ID: 54939 First Published: 2017 August 24 18:44 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30338 may contain the following files: Name |...