Design/Logic Flaw

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

CVE-2017-17877

The CVE-2017-17877 entry concerns Valve Steam Link (build 643). When the SSH daemon is enabled for local development, the device becomes publicly reachable via IPv6 TCP port 22 over the internet by default, enabling remote access by guessing 24 bits of the MAC address and attempting a root login....

CVE-2017-17877

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

CVE-2017-17878

CVE-2017-17878 affects Valve Steam Link build 643. The root password handling truncates passwords longer than 8 characters due to the default DES algorithm (CONFIG_FEATURE_DEFAULT_PASSWD_ALGO="des"). The issue is documented across multiple sources (NVD entry, Red Hat CVEs, and related disclosures...

CVE-2017-17878

An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES aka the CONFIGFEATUREDEFAULTPASSWDALGO="des" setting...

steam-accounts.com XSS vulnerability

Open Bug Bounty ID: OBB-369953 Description| Value ---|--- Affected Website:| steam-accounts.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Chea...

Rockstar Games: Stored XSS on profile page via Steam display name

The researcher was able to demonstrate a XSS vulnerability by using their Steam nickname as the payload vector. This was due to insufficient filtering on Linked Account name fields. We pushed out an update that replaces suspicious Linked Account names with a generic string in order to prevent...

Don’t let these gaming threats give you a Game Over

With EGX, the biggest gaming event in the UK opening its doors today, we thought it'd be timely to remind you of some of the threats currently facing gamers. No matter what type of game, client, or system you use, there's always something waiting to try and give you a bad day where the safety of...

steam-accounts.com XSS vulnerability

Vulnerable URL: https://steam-accounts.com/?s=';prompt'OPENBUGBOUNTY'//"";prompt/OPENBUGBOUNTY/...

Steam Profile Integration 2.0.11 SQL Injection

Exploit Title: IPS Community Suite - Steam Profile Integration 2.0.11 and below SQL injection Google Dork: inurl:tab=nodesteamsteamprofile Date: 13/03/2017 Exploit Author: DrWhat Vendor Homepage: https://invisionpower.com/files/file/8170-steam-profile-integration/ Software Link:...

Steam Profile Integration 2.0.11 - SQL injection

Exploit Title: IPS Community Suite - Steam Profile Integration 2.0.11 and below SQL injection Google Dork: inurl:tab=nodesteamsteamprofile Date: 13/03/2017 Exploit Author: DrWhat Vendor Homepage: https://invisionpower.com/files/file/8170-steam-profile-integration/ Software Link:...

Valve Patches Trivial XSS Bug in Steam

Valve Corp., has patched a cross-site scripting vulnerability on its popular Steam gaming platform that could be exploited by viewing a maliciously crafted profile. The flaw could allow an attacker to carry out phishing attacks or execute malicious scripts just by opening a crafted profile page. ...

CVE-2016-5237

Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and possibly gain privileges as demonstrated by a Trojan horse Steam.exe file...

CVE-2016-5237

Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and possibly gain privileges as demonstrated by a Trojan horse Steam.exe file...

CVE-2016-5237

Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and possibly gain privileges as demonstrated by a Trojan horse Steam.exe file...

Code injection

Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and possibly gain privileges as demonstrated by a Trojan horse Steam.exe file...

CVE-2016-5237

Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and possibly gain privileges as demonstrated by a Trojan horse Steam.exe file...

CVE-2016-5237

CVE-2016-5237 affects Valve Steam client 3.42.16.13 on Windows, where weak filesystem permissions in the Steam program directory allow BUILTIN\Users to modify files, enabling local privilege escalation and potential code execution (exploits exist in Exploit-DB and related references). No official...

Steam - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Steam published at the 'play' market has multiple vulnerabilities...

steam-accounts.com XSS vulnerability

Vulnerable URL: https://steam-accounts.com/?s=%27;alert/XSSPOSED///%27;alert/XSSPOSED///%22;alert/XSSPOSED///%22;alert/XSSPOSED///--%3E%3C/sCRipT%3E%22%3E%27%3E%3CsCRipT%3Ealert/XSSPOSED/%3C/sCRipT%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerabili...