Vulnerability in GoldSource Engine allows to upload and run an arbitrary DLL on client #508894 Valid Other weaknesses – 2020-03-25 – 11 [GoldSrc] Remote Code Execution using malicious WAD list in BSP file #675710 Valid Memory Corruption – 2021-05-04 $750 11 CSRF | Ban or unban users in broadcast's chat #381237 Valid Cross-Site Request Forgery – 2019-01-07 – 12 Add apps to packages 0, 61, 62 with /store/ajaxpackagemerge #972243 Valid Access Control – 2020-09-09 – 12 Unfiltered input allows for XSS in "Playtime Item Grants" fields #353334 Valid Cross-site Scripting – 2018-05-24 – 13 XSS @ store.steampowered.com via agecheck path name #406704 Valid Cross-site Scripting – 2019-01-07 $750 14 Malformed .WAV triggers an Access Violation on GoldSRC (hl.exe) #495789 Valid Memory Corruption – 2020-02-27 – 14 ajaxgetachievementsforgame is not guarded for unreleased apps #835087 Valid Information Disclosure – 2020-07-30 $750 14 Aapp name leakage on economy history page #349681 Valid Information Disclosure – 2018-05-24 – 16 Reflected XSS on help.steampowered.com #390429 Valid Cross-site Scripting – 2019-01-07 – 16 Potential buffer overflow in demoplayer module of GoldSource Engine #440758 Valid Memory Corruption – 2020-02-27 – 17 Steam Deck Single Click Root Remote Code Execution #1974296 Informative No weakness recorded – 2023-08-01 $750 18 resetreportedcount & updatetags doesn't verify appid param #351106 Valid Authentication – 2018-07-02 $750 19 RCE on partner.steampowered.com #518348 Not checked yet Command and Code Injection – – – 19 Malformed BSP in GoldSrc Engine may cause shellcode injection #458929 Valid Memory Corruption – 2020-03-25 – 21 Suspended users can bypass UGC upload ban #354660 Valid Access Control – 2018-07-02 $500 22 Comment restriction in subsection "Workshop" of domain "steamcommunity.com" can be bypassed using IDOR #365504 Valid Insecure Direct Object Reference – 2019-01-07 – 22 GetGlobalAchievementPercentagesForApp is missing the same release checks as GetSchemaForGame #541020 Valid Information Disclosure – 2020-02-19 – 22 [CS 1.6] Map cycle abuse allows arbitrary file read/write #590279 Valid Access Control – 2021-02-22 $750 22 [GoldSrc] RCE via 'spk' Console Command #769014 Valid Memory Corruption – 2020-08-19 $350 23 Unauthorized updates to extended_info properties in /store/ajaxpackagesave #815547 Valid Access Control – 2020-09-09 – 23 Privilege Escalation vulnerability in steam's Remote Play feature leads to arbitrary kernel-mode driver installation #852091 Valid Access Control – 2021-09-21 – 23 GetReports works for hubs you don't have access to #350937 Valid Information Disclosure – 2018-05-30 $750 24 [GoldSrc] RCE via malformed BSP file #763403 Valid Memory Corruption – 2020-08-19 $450 24 Deleting other people's comments on ModeratorMessages #357952 Valid Authentication – 2019-01-23 $500 25 GoldSrc: Buffer Overflow in DELTA_ParseDelta function leads to RCE #484745 Valid Memory Corruption – 2021-05-04 $3,000 26 unlock self-lock by brute force #410221 Valid Authentication – 2019-01-23 $900 27 code injection, steam chat client #411329 Valid Command and Code Injection – 2019-01-07 $750 28 LFI in pChart php library #288298 Valid File and Path Handling – 2018-05-09 – 29 Malformed Skybox .TGA in Half-Life (GoldSRC) leads to Access Violation #351016 Valid Memory Corruption – 2018-08-28 – 30 Malformed map detailed texture files in GoldSrc games lead to Remote Code Execution #505173 Valid Memory Corruption – 2019-09-17 $350 30 /applications/dpc_(get|post) provide full access to api.steampowered.com with the Dota2 API key #674800 Not checked yet Server-Side Request Forgery – – – 30 Hidden scheduled partner events are propagated to Steam clients in CMsgClientClanState #780167 Valid Information Disclosure – 2020-03-20 – 31 Reflected XSS in www.dota2.com #292457 Valid Cross-site Scripting – 2018-05-09 – 32 Xss was found by exploiting the URL markdown on http://store.steampowered.com #313250 Valid Cross-site Scripting – 2018-05-09 $1,000 32 Buffer overflows in demo parsing #350119 Valid Memory Corruption – 2018-08-28 – 33 Read Access to all comments on unauthorized forums' discussions! IDOR! #308610 Valid Insecure Direct Object Reference – 2018-05-09 $500 34 Signedness issue in ClassInfo message handler leads to RCE on CS:GO client #876719 Valid Memory Corruption – 2021-05-27 $7,500 35 Stored XSS in the guide's GameplayVersion (www.dota2.com) #380045 Valid Cross-site Scripting – 2019-01-07 $750 36 Web API key registration allows registering multiple keys by reusing `request_id` #2270633 Valid No weakness recorded – 2023-12-12 – 40 Arbitrary file creation with semi-controlled content (leads to DoS, EoP and others) at Steam Windows Client #682774 Valid File and Path Handling – 2019-09-26 $1,250 41 SQL injection in /errors/viewbuild/ #690349 Not checked yet SQL Injection – – – 41 Stored XXS @ https://steamcommunity.com/search/users/#text= via Profile Name #351171 Valid Cross-site Scripting – 2018-05-24 $750 42 WG call injection in /economy/contextcommand #652649 Not checked yet Command and Code Injection – – – 47 Shell command injection in https://partner.steamgames.com/bundles/savestore/ via overwriting asset_path_identifier #926169 Valid Command and Code Injection Critical 2024-07-30 – 47 [CS:GO] Unchecked texture file name with TEXTUREFLAGS_DEPTHRENDERTARGET can lead to Remote Code Execution #550625 Valid Memory Corruption – 2021-05-06 $2,500 48 Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of item_image_small and item_image_large #840243 Not checked yet Command and Code Injection – – – 53 Link filter protection bypass #291750 Valid Open Redirect – 2018-05-09 – 55 Buffer overflow In hl.exe's launch -game argument allows an attacker to execute arbitrary code locally or from browser #832750 Valid Memory Corruption – 2020-08-19 – 55 Add any depot to your app and access its contents without decryption key; via /apps/setcommonredists #1018368 Valid Access Control High 2024-07-30 – 56