Razer: Cookie based XSS on http://ftp1.thx.com

The ftp1.thx.com server, typically only used by THX employees and vendors, was subject to a minor XSS vulnerability. Razer thanks the tester for his diligence and clear report...

Razer: PHPInfo Page on www.razer.ru

The tester discovered a a PHP page disclosing information on a server out of scope of the bounty program. This was a low impact information disclosure of PHP version information. We appreciate the tester bringing this to our attention...

Razer: Store Cross-Site Scripting - www.razer.ru

The tester discovered a stored XSS vulnerability on a Razer affilated website. Although this server was not in scope, we appreciate the tester bringing this to our attention...

Razer: Through blocking the redirect in /* the attacker able to bypass Authentication To see Sensitive Data sush as Game Keys , Emails ,..

The rsa3027.razersynapse.com server suffered a SQLi vulnerability which allowed write access to the server in the context of Cortex Deals. This allowed access to game key information from giveaways and emails of users who claimed these giveaways. This vulnerability was reported 11/12 and closed b...

Razer: [IDOR] API endpoint leaking sensitive user information

Summary: Hi, the backend on the insider.razer.com website seems to be using XenForo. Some actions on the api.php have been left misconfigured by the developers, which lead to leaking of sensitive information. Steps To Reproduce: 1. Go to a random user's profile, say,...

Razer: Reflected XSS at https://pay.gold.razer.com escalated to account takeover

Summary: Due to the parameter err is injected to the body of the page without any sanitization a victim could be tricked to visit the page and get his account stolen. Steps To Reproduce: 1.Visit the specially crafted url Firefox | IE11...

Razer: Information disclosure at http://sea-s2s.molthailand.com/status.php

The tester discovered a Razer Gold TH server was transmitting sensitive information without proper encryption, leading to a potential MITM attack. Razer thanks the tester for his diligence and the clear report/PoC...

Razer: [razer-assets2] Listing of Amazon S3 Bucket accessible to any AWS cli

The tester determined that an S3 bucket had insecure permissions. No customer data was in danger, but thee was the potential for some Razer product collateral to be prematurely leaked, so Razer secured this bucket out of caution. Full writeup over at...

Razer: [pay.gold.razer.com] Stored XSS - Order payment

The tester discovered that the pay.gold.razer.com site suffered from a Stored XSS issue that could be used to steal a client id and key. The tester worked with team to provide multiple POCs to help them resolve the issue. Razer appreciates all the assistance from corraldev, which was above and...

Razer: Accessible Druid Monitor console on https://api.pay-staging.razer.com/

The tester discovered a monitoring application was available on a remotely accessible administrative console in the Razer Pay staging environment, which could have been used to leverage information that could have compromised the server. The Razer Pay team removed this and other similar servers...

Razer: Unauthenticated access to sensitive user information

The tester discovered that a THX server known primarily to THX employees was exposing several hundred records containing customer email addresses and in very few cases, a personal name. No other information was revealed. This issue was fixed shortly after the report. We appreciate @smalien's...

Razer: Payment PIN Verification Bypass

The tester originally reported a PIN bypass in the Razer Pay MY client and provided a video POC which was very helpful. This was fixed in client version 2.11. Razer Fintech appreciates the tester's assistance and patience helping us resolve this issue...

Razer: DLL Hijacking in Synapse 2 CrashSender1402.exe via version.dll

The tester determined that the Synapse 2 installed executable CrashSender1402.exe was subject to a DLL hijacking vulnerability. As this was no longer supported by the third party provider, Razer decided to remove this executable from future versions of Synapse 2...

Razer: 2FA doesn't work in "https://insider.razer.com"

Hello, I found 2FA bypass vulnerability in https://insider.razer.com and I found this feature not at all working after enabled 2FA. Please follow the below steps to reproduce the issue Steps to reproduce 1. Login to https://insider.razer.com with your credentials. 2. Next, go to Two-Step...

Razer: Insecure Logging - OWASP (2016-M2)

The tester discovered that the Razer Pay Android application was storing user data locally on the phone in the clear. An adversary would need access to the phone to obtain this information. The application was patched to avoid storing this information in version 2.10...

Razer: Misconfigured s3 Bucket exposure

Found a s3 bucket that belongs to razer and properly not configured. bucket name:- http://rzimageupload.s3.amazonaws.com/ Bucket Source:- https://api.razer.com Steps To reproduce:- 1. Go to https://api.razer.com and create a project . 2. In the project icon select an image from your computer. 3...

Razer: Race Condition in Oauth 2.0 flow can lead to malicious applications create multiple valid sessions

The tester discovered a flaw in the Razer ID authentication system that could allow multiple access tokens. This was a minor issue but could theoretically have led to extended access due to unexpired tokens. Razer thanks the tester for their diligence. Here is a write-up for similar bug:...

Razer: OTP token bypass in accessing user settings

The tester was able to determine that the OTP token used by Razer ID was not being properly verified against the specific user which would allow an adversary to replay their own OTP token against a different user. If the adversary also had been able to obtain the user's login and password through...

Razer US: Synapse 2.21 - DLL Hijacking vulnerability

Description of Vulnerability: When Razer Synapse starts on a Windows machine it tries to load a DLL RazerConfigNative.dll from the C:\ProgramData\Razer\Synapse\Devices directory. If a malicious attacker puts the malicious DLL in that directory, Razer Synapse will load it and run the code found in...

CVE-2019-13142

The RzSurroundVADStreamingService RzSurroundVADStreamingService.exe in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable located in %PROGRAMDATA%\Razer\Synapse\Devices\Razer Surround\Driver. The DACL on this folder allows any user to overwrite contents of files in this folder,...