Image Injection Vulnerability on /bully/screens #661646 Valid Information Disclosure – 2020-06-24 – 3 Referer Referer Header Leakage in language changer may lead to FB token theft #870062 Valid Information Disclosure – 2020-06-24 – 3 Image injection /br/games/info may lead to phishing attacks or FB OAuth theft. #510388 Valid Information Disclosure – 2020-06-24 – 5 Dom based XSS on www.rockstargames.com/GTAOnline/features/freemode #799739 Valid Cross-site Scripting – 2020-06-24 – 5 Ability to post comments to a crew even after getting kicked out #197153 Valid Misconfiguration and Insecure Design – 2017-08-08 $500 6 SSLv3 POODLE Vulnerability #210331 Valid Misconfiguration and Insecure Design – 2017-04-09 – 6 Image injection on /screenshot-viewer/responsive/image ( FIX BYPASS) #505259 Valid Information Disclosure – 2020-06-24 – 6 image injection /screenshot-viewer/responsive/image (ANOTHER FIX BYPASS) #506126 Valid Information Disclosure – 2020-06-24 – 6 DOM based XSS on /GTAOnline/de/news/article via "returnUrl" parameter #508475 Valid Cross-site Scripting – 2020-06-24 – 6 CSRF Vulnerabiliy on Facebook Linkage Page Allows Full Account takerover of Socialclub Accounts. #653254 Valid Cross-Site Request Forgery – 2020-06-24 – 6 Control characters incorrectly handled on Crew Status Update #232499 Valid Command and Code Injection – 2017-06-23 $250 7 insecure redirect in https://www.rockstargames.com #253975 Valid Misconfiguration and Insecure Design – 2020-06-12 – 7 Image Injection vulnerability affecting www.rockstargames.com/careers may lead to Facebook OAuth Theft #491654 Valid Information Disclosure – 2020-06-24 – 7 Profile bio at rockstar is accepting control characters #214763 Valid Injection and Smuggling – 2017-05-23 – 8 flash injection in http://www.rockstargames.com/IV/imgPlayer/imageEmbed.swf #241231 Valid Injection and Smuggling – 2017-08-25 – 8 Image Injection on /bully/anniversaryedition may lead to OAuth token theft. #498358 Valid Information Disclosure – 2020-06-24 – 8 dom based xss in https://www.rockstargames.com/GTAOnline/ #254343 Valid Cross-site Scripting – 2017-08-21 – 9 Image Injection on `/bully/anniversaryedition` may lead to FB's OAuth Token Theft. #659784 Valid Information Disclosure – 2020-06-24 – 9 Modifying Sprunk vs eCola crew data #1680818 Valid Insecure Direct Object Reference – 2022-09-06 – 9 Your support community suffers from angularjs injection and must be fixed immediately [CRITICAL] #274264 Valid Command and Code Injection – 2018-04-10 – 10 Referer Leakge in language changer may lead to FB token theft. #809691 Valid Cross-Site Request Forgery – 2020-06-24 – 10 RDR2 game service method allows adding any player to a new Posse without consent #1029594 Valid Misconfiguration and Insecure Design – 2021-02-23 – 10 Stored XSS on support.rockstargames.com #265274 Valid Cross-site Scripting – 2017-10-30 $1,000 11 Leak IP internal #271700 Valid Information Disclosure – 2018-02-05 – 11 Found CSRF Vulnerability in https://support.rockstargames.com/ #423602 Valid Cross-Site Request Forgery – 2018-10-16 $150 11 Flash injection vulnerability on /IV/imgPlayer/imageEmbed.swf #485382 Valid Cross-site Scripting – 2020-06-24 – 11 dom based xss in http://www.rockstargames.com/GTAOnline/ (Fix bypass) #261571 Valid Cross-site Scripting – 2017-08-24 – 12 Full path Disclosure in Rockstargames.com██████████ #210572 Not checked yet Information Disclosure – – – 13 Source Code Disclosure (CGI) #211418 Valid Information Disclosure – 2017-03-17 $150 13 DOM BASED XSS ON https://www.rockstargames.com/GTAOnline/features #479612 Valid Cross-site Scripting – 2020-06-12 – 13 Warehouse dom based xss may lead to Social Club Account Taker Over. #663312 Valid Cross-site Scripting – 2020-06-11 – 13 Image Injection on www.rockstargames.com/screenshot-viewer/responsive/image may allow facebook oauth token theft. #497655 Valid Information Disclosure – 2020-06-12 – 14 Image Injection vulnerability in www.rockstargames.com/IV/screens/1280x720Image.html #784101 Valid Cross-Site Request Forgery – 2020-06-24 – 14 csrf in https://www.rockstargames.com/reddeadonline/feedback/submit.json #796295 Valid Cross-Site Request Forgery – 2020-07-07 – 14 Control Character Injection In Messages #210994 Valid Authentication – 2017-05-23 – 15 Client-side Template Injection in Search, user email/token leak and maybe sandbox escape #271960 Valid Command and Code Injection – 2018-05-01 – 15 Dom based xss on /reddeadredemption2/br/videos #488108 Valid Cross-site Scripting – 2020-06-24 – 16 Open redirect affecting m.rockstargames.com/ #781718 Valid Open Redirect – 2020-06-12 – 16 Reflected XSS in reddeadredemption Site located at www.rockstargames.com/reddeadredemption #149673 Valid Cross-site Scripting – 2017-09-25 – 17 SocialClub's Facebook OAuth Theft through Warehouse XSS. #316948 Valid Cross-Site Request Forgery – 2018-04-23 – 17 Dom based xss on https://www.rockstargames.com/ via `returnUrl` parameter #505157 Valid Cross-site Scripting – 2020-06-12 – 17 Table and Column Exposure #218898 Valid Information Disclosure – 2018-05-10 $150 18 Stored XSS via Send crew invite #272997 Valid Cross-site Scripting – 2017-12-28 – 18 Comments Denial of Service in socialclub.rockstargames.com #214370 Valid Command and Code Injection – 2017-09-11 – 19 Stored XSS with CRLF injection via post message to user feed #263191 Valid Cross-site Scripting – 2017-09-18 – 19 [IMP] - Blind XSS in the admin panel for reviewing comments #197337 Valid Cross-site Scripting – 2017-03-17 $650 20 phpinfo() on graph.rockstargames.com exposes sensitive information #1082774 Valid Information Disclosure – 2021-01-21 – 20 Reflected XSS via Double Encoding #246505 Valid Cross-site Scripting – 2017-09-01 $500 22 Information Disclosure in https://www.rockstargames.com/search #808832 Valid SQL Injection – 2020-06-11 – 22 Minor Account Privacy can Set to Everyone. #883731 Valid Insecure Direct Object Reference – 2021-03-02 – 22