HBO hackers upload Games of Thrones episodes & other data on their site

By Carolina On 31st July, it was reported that HBO Home Box This is a post from HackRead.com Read the original post: HBO hackers upload Games of Thrones episodes other data on their site...

Rockstar Games: dom based xss in https://www.rockstargames.com/GTAOnline/

In this report, the researcher found a DOM-Based XSS Vulnerability and was able to demonstrate an exploit that exposed cookie values. New 404 page handling code resulted in a fix for the issue...

Adobe is Finally Killing FLASH — At the End of 2020!

Finally, Adobe is Killing FLASH — the software that helped make the Internet a better place with slick graphics, animation, games and applications and bring online video to the masses, but it has been hated for years by people and developers over its buggy nature. But the end of an era for Adobe...

Rockstar Games: CSRF Vulnerability allows attackers to steal SocialClub private token.

The researcher was able to combine a Flash exploit with a CSRF vulnerability in order to obtain sensitive user tokens from https://socialclub.rockstargames.com/profileedit/GetTokens. This page is ordinarily only called in a secure fashion such that an attacker is unable to see another user's...

Girls Who Code Week 2: Let the Coding Begin!!

The Akamai-sponsored Girls Who Code program is well under way! Week 2 featured lots of activity in the Girls Who Code classroom at Akamai's Cambridge, MA headquarters. The girls learned to use Scratch, a visual programming language that was developed at MIT to help people learn to code. They used...

proprofs.com XSS vulnerability

Vulnerable URL: https://www.proprofs.com/games/word-games/word-scramble/tree-life-cycle/?ew=500alert/OPENBUGBOUNTY/...

Rockstar Games: Reflected XSS via Double Encoding

The researcher found a Reflected XSS vulnerability in the search query on support.rockstargames.com. This exploit worked by using double-encoding to bypass our filters. With the researcher's help we were able to resolve this vulnerability...

Rockstar Games: XSS in http://www.rockstargames.com/theballadofgaytony/js/jquery.base.js

The researcher found a Reflected XSS vulnerability at http://www.rockstargames.com/theballadofgaytony/js/jquery.base.js. This vulnerability could be exploited in multiple ways throughout different areas of the site. A bonus was awarded due to the prolific nature of the vulnerability...

Urban Terror: Multiple vulnerabilities

Background Urban Terror is a free multiplayer first person shooter developed by FrozenSand, that will run on any Quake III Arena compatible engine. Description Multiple vulnerabilities have been discovered in Urban Terror. Please review the CVE identifiers referenced below for details. Impact A...

Rockstar Games: flash injection in http://www.rockstargames.com/IV/imgPlayer/imageEmbed.swf

In this report, the researcher found a vulnerability in one of our Flash players http://www.rockstargames.com/IV/imgPlayer/imageEmbed.swf that allowed loading of external .swf files. This in turn allowed the researcher to perform a XSS attack...

Educational Games for Kids - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Educational Games for Kids published at the 'play' market has multiple vulnerabilities...

Judy Android Malware Infects Over 36.5 Million Google Play Store Users

Security researchers have claimed to have discovered possibly the largest malware campaign on Google Play Store that has already infected around 36.5 million Android devices with malicious ad-click software. The security firm Checkpoint on Thursday published a blog post revealing more than 41...

Rockstar Games: Control characters incorrectly handled on Crew Status Update

The researcher found that it was possible to inject the NULL control character %00 into the Crew Status field. This resulted in a condition in which a user may be unable to further update the Crew Status...

Rockstar Games: Stored XSS in profile activity feed messages

The researcher was able to demonstrate a Stored XSS vulnerability in the Profile and Crew Feed endpoints. The exploit string worked because the researcher realized that certain obscure characters were not being converted to HTML entities properly. The exploit string was †‡•＜img src=a...

Rockstar Games: Stored XSS in snapmatic comments

In this report, the researcher found that we were not filtering ＜ and ＞ characters the same as . This allowed the researcher to craft XSS POCs that bypassed our filters, particularly on UGC comments. We have updated our filters to amend this oversight...

hasbro.com XSS vulnerability

Vulnerable URL: https://www.hasbro.com/en-us/toys-games/segments:" style=background:red;left:0;top:0;height:500px;width:500px;position :absolute;z-index:1000 onmouseover=alert'openbugbounty' "?sortdir=1"--...

Rockstar Games: XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker)

In this report, the researcher discovered a Stored XSS vulnerability in the Add Friend functionality. It worked by filling the optional Message field with a XSS payload utilized an SVG object tag and some character escaping. When the recipient of the malicious friend request clicked or tapped the...

Google Play Games - BSD license, ContentProvider mode not defined, Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Google Play Games published at the 'play' market has multiple vulnerabilities...

Rockstar Games: Profile bio at rockstar is accepting control characters

This report involved the injection of control characters, such as Null Byte 0x00, into the profile Bio field in order to cause unexpected, harmful behaviors. Our solution was to both block control characters from being saved on the backend when included in user-input, as well as to suppress the...

Rockstar Games: Comments Denial of Service in socialclub.rockstargames.com

In this report, the researcher was able to demonstrate a POC utilizing control character injection that disabled a chain of comments in sections of the site containing UGC, particularly Jobs and Job playlists. Although denial-of-service attacks are typically closed as Not Applicable in our progra...