CVE-2021-24476 Steam Group Viewer <= 2.1 - Authenticated Stored Cross-Site Scripting (XSS)

The Steam Group Viewer WordPress plugin through 2.1 does not sanitise or escape its "Steam Group Address" settings before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24476

CVE-2021-24476 concerns the WordPress plugin Steam Group Viewer (v2.1 and earlier). The vulnerability arises because the plugin does not sanitize/escape the“三Steam Group Address” setting before outputting it on pages, enabling an authenticated Stored Cross-Site Scripting (XSS) issue. The impact s...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Steam Group Viewer plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in WordPre...

CVE-2021-32795

ArchiSteamFarm is a C application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.3.1.0 a Denial of Service aka DoS vulnerability which allows attacker to remotely crash running ASF instance through sending a specifically-crafted Steam chat...

CVE-2021-32795

ArchiSteamFarm is a C application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.3.1.0 a Denial of Service aka DoS vulnerability which allows attacker to remotely crash running ASF instance through sending a specifically-crafted Steam chat...

CVE-2021-32795

ArchiSteamFarm (ASF) is affected by CVE-2021-32795, a DoS that allows a remote attacker to crash a v4.x ASF instance by sending a specially crafted Steam chat message. The attacker does not need authentication and must know ASF’s CommandPrefix; many deployments use the default. The issue is fixed...

CVE-2021-32795 Denial of Service via Steam chat in ArchiSteamFarm

ArchiSteamFarm is a C application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.3.1.0 a Denial of Service aka DoS vulnerability which allows attacker to remotely crash running ASF instance through sending a specifically-crafted Steam chat...

JustArchiNET ArchiSteamFarm 输入验证错误漏洞

ArchiSteamFarm is a C application whose main purpose is to idle Steam cards from multiple accounts simultaneously. An input validation error vulnerability exists in JustArchiNET ArchiSteamFarm. No information about this vulnerability is available at this time, so stay tuned to CNNVD or vendor...

Do cybercriminals play cyber games in quarantine? A look one year later

Last year, we decided to take a look at how the pandemic influenced the gaming industry and what new threats gamers could be facing. What we found was that, with the transition to remote work and remote learning, the number of blocked attempts to visit malicious game-related websites or follow...

Is it game over for VR advergaming?

We’ve been warning about advergaming—the combination of virtual reality VR and ads—for years on the Labs Blog. I’ve given a few talks on the subject too, and how ad networks will slowly work their way into enclosed spaces formerly reserved for your head. They still might, but thanks to a recent...

Steam Group Viewer <= 2.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise or escape its "Steam Group Address" settings before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue PoC Enter the following payload in the "Steam Group Adrdess" setting of the plugin: "...

Rockstar Games: Social Club Account Takeover Via RGL And Steam/Epic Linked Account

In this report, the researcher discovered and demonstrated a method to hijack access to a Social Club account via a previously-linked Epic Games or Steam account. To perform the attack, the attacker first needed access to a Steam or Epic Games account with entitlement to a game with Social Club...

Valve: Buffer overrun in Steam SILK voice decoder

Vulnerability The SteamWorks SDK has a function available named DecompressVoice, which takes as input some compressed voice data, and returns the raw audio data. The format for the input voice data is as follows: 8 bytes - steamid 1 byte - payload type 2 bytes - payload size 4 bytes - CRC checksu...

Valve Steam Buffer Overflow Vulnerability

Valve Steam is a suite of game distribution management platforms from Valve Corporation in the United States. The platform provides digital rights management, multiplayer, streaming, and social networking services. A buffer overflow vulnerability exists in Valve Steam version 2021-04-10 and earli...

Exploit for Classic Buffer Overflow in Valvesoftware Steam_Client

CVE-2021-30481 CVE details: h...

CVE-2021-30481

Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click...

CVE-2021-30481

Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click...

Buffer overflow

Valve Steam through 2021-04-10, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click...

CVE-2021-30481

CVE-2021-30481 affects Valve Steam (with Source engine) up to around April 2021. A buffer overflow triggered by a Steam invite after one click allows remote authenticated code execution, via the installed Source engine game. Public Red Hat, CNVD, CNNVD and other records corroborate the vulnerabil...

CVE-2021-30481

Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click...