evilqr

Evil QR Toolkit demonstrating another approach of a QRLJacking attack, allowing to perform remote account takeover, through sign-in QR code phishing. It consists of a browser extension used by the attacker to extract the sign-in QR code and a server application, which retrieves the sign-in QR cod...

PoC

PoC DARKNAVY의 PoC 코드 모음입니다. CVE-2025-43300 대상: iOS && macOS 버전: iOS 18.6.2 && macOS 14.7.8 이전 CVE-2025-6554 대상: Chrome 렌더러 버전: 138.0.7204.96 이전 CVE-2024-5274 대상: Chrome 렌더러 버전: 125.0.6422.112 이전 블로그 게시물: CVE-2024-5274: V8 파서의 사소한 결함, 재앙으로 이어지다 steam-2260570 대상: Steam 클라이언트 블로그 게시물: Steam 익스플로잇: C...

BrokenPipe

BrokenPipe - Steam Client Service LPE Vulnerability This is the single-script version. The original compiled C++ PoC is on the legacy branch. Thanks to John Hammond for the suggestion, subscribe to him! PoC video: YouTube John Hammond's breakdown: YouTube Greetz to @MSNIGHTMARE2000 for the inspo ...

HWID-SteamSpywareTerminator

SteamSpywareTerminator fuck you, burtonJ 작업 진행 중현재는 스레드 초기화만 로깅함인 라이브러리로, 일단 steam에 주입되면 CSteamEngine::CFillMachineInfoThread를 차단하는 것을 목표로 한다. 이는 하드 드라이브, 네트워크 어댑터, 광학 주변기기에 관한 암호화된 정보를 수집하는 숨겨진 스레드로, 모든 부계정을 차단하고 수천 달러를 잃게 만들려는 졸렬한 목적을 가지고 있다 그리고 나는 burtonJ의 월급을 위해 단 1센트도 더 내고 싶지 않다 리버스 엔지니어링...

mgo3-rce

MGO3 RCE 이 저장소는 CVE-2026-19874에 관한 정보를 포함합니다. 문서 데모 영상 타임라인 2026-06-26: 취약점 발견 2026-06-26: 코나미에 첫 연락 2026-07-01: 취약점이 코나미에 보고됨 2026-08-04: 취약점이 코나미에 의해 조용히 패치됨 https://steamdb.info/patchnotes/24176213/ 면책 조항 이 소프트웨어는 순전히 학술 연구 목적으로 제작되었습니다. 다른 시스템을 공격하는 데 사용하기 위한 것이 아닙니다. 프로젝트 관리자는 소프트웨어의 오용에 대해...

Linux Distros Unpatched Vulnerability : CVE-2026-90328

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size...

CVE-2026-90328

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

DEBIAN-CVE-2026-90328

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

AZL-102203 CVE-2026-90328 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

CVE-2026-90328

CVE-2026-90328 affects the Linux kernel 's HID Steam controller driver. The root cause is that FEATURE reports from the Steam Controller encode the message size within the report itself, but the driver previously trusted that the reported size matched the actual number of bytes read , without ver...

CVE-2026-90328 HID: steam: Reject short reads

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

CVE-2026-90328 HID: steam: Reject short reads

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

EUVD-2026-81989

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

CVE-2026-90328: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Prevent NULL pointer dereferencing in steamrecv,sendreport It is possible for a malicious device to fail to submit a Feature Report. The HID Steam driver currently does not handle this situation and dereferences the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/fence: Fixed an oops due to incorrect drmsched init/fini calls. Currently, amdgpu calls drmschedfini from the fence driver’s fini routine. Such a call is expected to occur only after the respective init function,...

CVE-2026-82183

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...

EUVD-2026-69861

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...

CVE-2026-82183

The OAuth Single Sign On WordPress plugin, in versions 6.25.0 through 7.0.0 , contains an improper authentication vulnerability. The plugin fails to verify the identity assertion returned during its Steam single sign-on flow . This flaw allows unauthenticated attackers to perform an unauthenticat...

CVE-2026-82183 OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...