Razer: SQLi at https://sea-web.gold.razer.com/demo-th/purchase-result.php via orderid Parameter

The tester discovered a SQLi vulnerability on a Razer Gold Thailand server. Razer appreciates the report and the clear PoC...

Razer: [SSRF] Server-Side Request Forgery at https://sea-web.gold.razer.com/dev/simulator via notify_url Parameter

The tester discovered an SSRF that could have allowed the compromise of the web.gold.razer.com server, leading to a significant data breach. Razer thanks the tester for the excellent report...

Razer: [press.razer.com] Origin IP found, Cloudflare bypassed

The tester discovered that the press.razer.com site exposed its IP which could allow bypassing of anti-DDoS mechanisms. While minor, Razer does appreciate the report and the tester bringing this to our attention...

Razer: Reflected XSS on https://www.easytopup.in.th/store/product/return on parameter mref_id

The tester discovered a reflected XSS on Razer Gold Thailand's easytopup.in.th page. We appreciate the excellent POC and code analysis...

Razer: Improper access control on easytopup.in.th transaction page leads to user's information disclosure and may lead to account hijacking

The tester discovered a Razer Gold Thailand server was vulnerable to information disclosure due to the use of a predicable reference ID in application URLs which could lead to the ability obtain phone numbers. Razer thanks the tester for his clear report...

Razer: Access to support tickets and payment history, impersonate razer support staff

The tester discovered the mysupport.razer.com site was vulnerable to a authentication bypass that allowed access to support tickets. Razer thanks the tester for the detailed PoC and diligence in helping us secure our customer's information...

Razer: Aws bucket writable mobile.razer.com

The tester discovered an S3 bucked owned by Mobile that was writeable. No files were present but the permissions were incorrect and subsequently fixed. Razer appreciates the report...

Razer: Reflected XSS at http://promotion.molthailand.com/index.php via promotion_id parameter

The tester discovered a reflected XSS vulnerability on https://easytopup.in.th related to a URL parameter. This issue affected the Firefox browser. Razer thanks the tester for the report and the clear proof of concept...

Razer: User Access Control Bypass Via Razer elevated service ( RzKLService.exe ) which loads exe in misconfigured way.

The tester discovered a Cortex related service suffered from a code path vulnerability that could lead to escalation of privilege. Razer thanks the tester for his report and helping keep our users secure...

Razer: Reflected XSS at https://sea-web.gold.razer.com/cash-card/verify via channel parameter

The tester discovered that the sea-web.gold.razer.com server suffered from a reflected XSS vulnerability. Razer thanks the tester for his report...

Razer: SQL Injection at api.easy2pay.co/add-on/get-sig.php via partner_id Parameter

The tester discovered a SQL injection vulnerability that allowed the potential extraction of sensitive user information from the Razer Gold Thailand database. Razer thanks the tester for his PoC as well as working with the Triage and dev teams to clarify the issue and get it fixed...

Razer: dom based xss on [hello.merchant.razer.com]

The tester discovered a DOM based xss on a Razer Merchant Services status server, associated with an unneeded application. Razer Fintech appreciates the tester bringing this to their attention and the clear PoC...

Razer: Expired reCAPTCHA site key leads to Rate Limit Bypass and Email Enumeration

The tester discovered a configuration issue involving Google reCAPTCHA that would allow adversaries to enumerate valid email addresses for users. While minor, Razer appreciates the report and clear PoC...

Razer: [Razer Pay Mobile App] Broken access control allowing other user's bank account to be deleted

The Razer Pay MY backend API had an access control vulnerability which would allow a client to delete the account of other users by varying the ID. Although an adversary could not target a specific individual by name, they could affect the integrity of the Razer Pay system. This was fixed in...

Razer: Misconfigured Bucket [razer-assets2] https://assets2.razerzone.com/

The tester discovered an S3 bucket exposure at assets2.razerzone.com. We appreciate the tester bringing this to our attention...

Razer: Improper Authorization at https://api-my.pay.razer.com/v1/trxDetail?trxId=[Id] allowing unauthorised access to other user's transaction details

The tester determined that the Razer Pay backend server could be exploited to obtain transaction details from another user. Razer Fintech appreciates the detailed report and clear PoC...

Razer: Insecure Processing of XML leads to Denial of Service through Billion Laughs Attack

The tester discovered a Razer Gold Thailand server was vulnerable to a DoS attack / resource exhaustion related to an XML parser used on the server. Razer thanks the tester for his clear report/PoC...

Razer: [Razer Pay Mobile App] IDOR within /v1_IM/friends/queryDrawRedLog allowed unauthorised access to read logs

The tester determined the Razer Pay MY server was vulnerable to unauthorized access of certain log file information due to an exposed signature in the Razer Pay Android application. Razer Fintech appreciates the clear and detailed report...

Razer: [Razer Pay Android App] Multiple vulnerabilities chained to allow "RedPacket" money to be stolen by a 3rd party

The tester discovered that the Razer Pay Android app was subject to an issue that could allow an adversary to obtain information originally destined for another user originating from the server. Razer Fintech appreciates the especially detailed work on this issue and clear help in reproduction...

Razer: [Razer Pay] Broken Access Control at /v1/verifyPhone/ allows enumeration of usernames and ID information

The tester discovered an API endpoint with insufficient access control that could allow an adversary to obtain user name and phone number information. Razer Fintech thanks the tester for his clear PoC and diligence in helping us secure our customers' information...