ReDoS at wiki.cs.money graphQL endpoint (AND probably a kind of command injection) #1000567 Valid Denial of Service Medium 2020-10-27 $250 15 Pixel Flood Attack leads to Application level DoS Analysed #970760 Valid Denial of Service Low 2020-11-05 $200 26 Bypass Filter on link of build Analysed #990838 Valid No weakness recorded Low 2020-09-28 – 28 Content Spoofing/Text Injection in https://support.cs.money and JS file not minified and uglyfied which makes it clearly readable Analysed #997198 Valid Input Validation and Logic Low 2020-11-12 – 28 Cookie poisoning leads to DOS and Privacy Violation Analysed #1067809 Valid Information Disclosure High 2021-02-25 $700 30 Site-wide CSRF on Safari due to CORS misconfiguration (not localhost) Analysed #975983 Valid Cross-Site Request Forgery Medium 2020-10-27 $300 33 Application DOS via specially crafted payload on 3d.cs.money Analysed #993582 Valid No weakness recorded Medium 2020-10-01 – 36 Bypass restrict of member subscription to use custom background in https://3d.cs.money without prime subscription Analysed #989415 Valid No weakness recorded Medium 2020-09-28 – 48 Attacker can generate cancelled transctions in a user's transaction history using only Steam ID Analysed #1021776 Valid Access Control Medium 2021-02-03 $300 66 Able to blocking users with 2fa from login into their accounts by just knowing the SteamID Analysed #1179232 Valid Input Validation and Logic Medium 2023-12-14 $300 70 Отправка писем с произвольным текстом/кликабельными ссылками любому зарегистрированному пользователю с указанной почтой, зная только steamid Analysed #993711 Valid Input Validation and Logic Critical 2020-12-20 – 74 Authentication Bypass to (CVE-2023-2982) Analysed #2269989 Valid Authentication Low 2023-12-08 $100 74 Html injection on subscription email Analysed #1108504 Valid Injection and Smuggling Medium 2024-01-23 $300 77 IDOR in https://3d.cs.money/ Analysed #990878 Valid Insecure Direct Object Reference Medium 2020-09-28 – 127 [cs.money] Open Redirect Leads to Account Takeover Analysed #905607 Valid Authentication Medium 2020-09-30 – 357 Blind XSS on image upload Analysed #1010466 Valid Cross-site Scripting Critical 2020-12-26 $1,000 450