Nintendo Switch Hacked to Run Pirated Games

By Waqas There is no doubt about the fact that Nintendo Switch This is a post from HackRead.com Read the original post: Nintendo Switch Hacked to Run Pirated Games...

November 14, 2017—KB4048955 (OS Build 16299.64)

None None...

Augmented Reality games and real-world trolling

Augmented Reality games—where you wave a device around and the digital collides with reality— have been booming in popularity ever since Pokemon GO! rolled into mobile storefronts. However, many AR games haven't really been designed with the possible consequences of real-world safety in mind. Tak...

Rockstar Games: SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCE

In this report, the researcher found that by submitting crafted SVG files, he was able to establish a listener on our server that enabled SSRF attacks. This potentially could have been pivoted to carry out more damaging attacks as well. We improved our validation of user-submitted SVG files to...

Fraud Detection in Pokémon Go

I play Pokémon Go. There, I've admitted it. One of the interesting aspects of the game I've been watching is how the game's publisher, Niantic, deals with cheaters. There are three basic types of cheating in Pokémon Go. The first is botting, where a computer plays the game instead of a person. Th...

mi.daybreakgames.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-355454 Description| Value ---|--- Affected Website:| mi.daybreakgames.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

accounts.epicgames.com XSS vulnerability

Vulnerable URL: https://accounts.epicgames.com/login/external?authType=OPENBUGBOUNTY=false;;$functionalertwindow.location.search.substr10,13 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculate...

majosoft.com XSS vulnerability

Vulnerable URL: http://www.majosoft.com/online-games/Pool/flashdetection.swf?flashContentURL=javascript:alert1 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4776344 VIP website...

Rockstar Games: Your support community suffers from angularjs injection and must be fixed immediately [CRITICAL]

In this report, the researcher found that due to our implementation of AngularJS on our Support site, we were susceptible to limited-scope code injection attacks. Particularly, they found that by injecting ... blocks in the comment body parameter, they were able to cause errors that could be...

Rockstar Games: Stored XSS via Send crew invite

In this report, the researcher was able to demonstrate a vulnerability in our Crew Invite mechanism that could have allowed an attacker to carry out a Stored XSS attack. By modifying a request in-flight and injecting unexpected characters in the Invitation message body, it was possible to escape...

Rockstar Games: Leak IP internal

The researcher found an old marketing web application for one of our previous titles that was not properly decommissioned. As a result, an internal IP address and a set of DB credentials were being exposed. Fortunately, the database in question had already been decommissioned so the credentials...

froyogames.com XSS vulnerability

Vulnerable URL: http://www.froyogames.com/action.php?=11'=1 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 03.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 330264 VIP website status:| No Coordinated Disclosure Timeline:...

Rockstar Games: Stored XSS on support.rockstargames.com

In this report, the researcher was able to demonstrate a proof-of-concept exploit for a Stored XSS vulnerability on our Support site at support.rockstargames.com. The POC consisted of two parts; the setup and the trigger. The setup required entering a particular XSS payload in the Title for a new...

Rockstar Games: Stored XSS on support.rockstargames.com

In this report, the researcher demonstrated an AngularJS injection that allowed them to leave Stored XSS attacks on Support Community threads. We were able to resolve this issue and others by updating the version of AngularJS we run on the Support site...

Rockstar Games: Stored XSS on member post feed

In this report, the researcher found a Stored XSS vulnerability in Profile Feeds. A POC was provided demonstrating the ability to affect any accessible member's Feed. We improved our filtering to automatically remove the harmful input, specifically including the bypass technique the researcher...

Rockstar Games: Stored XSS with CRLF injection via post message to user feed

In this report, the researcher was able to demonstrate a Stored XSS vulnerability in User Feeds. This vulnerability leveraged CRLF injection in order to bypass existing filters and execute the payload. With their help we were able to improve our filtering and sanitization rules in order to preven...

Rockstar Games: dom based xss in http://www.rockstargames.com/GTAOnline/ (Fix bypass)

The researcher was able to bypass a previous fix for a DOM-Based XSS vulnerability 254343 by hashing part of the payload. This showed that our previous fix was insufficient, so we updated it to a more thorough solution...

freeaddictinggames.com XSS vulnerability

Vulnerable URL: http://www.freeaddictinggames.com/search/results/%3Cimg%20src=x%20onerror=alert'openbugbounty'%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 01.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 458678 VIP website...

Joomla! Component StreetGuessr Game 1.1.8 - SQL Injection

Joomla! Component StreetGuessr Game 1.1.8 - SQL Injection Exploit Title: Joomla! Component StreetGuessr Game v1.1.8 - SQL Injection Dork: N/A Date: 03.08.2017 Vendor : https://www.nordmograph.com/ Software: https://extensions.joomla.org/extensions/extension/sports-a-games/streetguessr-game/ Demo:...

Joomla StreetGuessr Game 1.1.8 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component StreetGuessr Game v1.1.8 - SQL Injection Dork: N/A Date: 03.08.2017 Vendor : https://www.nordmograph.com/ Software: https://extensions.joomla.org/extensions/extension/sports-a-games/streetguessr-game/ Demo:...