RCE on Steam Client via buffer overflow in Server Info Analysed #470520 Valid Memory Corruption – 2019-03-15 – 1,289 Getting all the CD keys of any game Analysed #391217 Valid Access Control – 2018-10-31 $20,000 638 XSS in steam react chat client Analysed #409850 Valid Cross-site Scripting – 2019-01-07 $7,500 499 Modify in-flight data to payment provider Smart2Pay Analysed #1295844 Valid Input Validation and Logic – 2021-08-10 $7,500 443 Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect Message Analysed #631956 Valid Command and Code Injection – 2019-10-08 – 420 SQL Injection in report_xml.php through countryFilter[] parameter Analysed #383127 Valid SQL Injection – 2018-07-27 $25,000 410 Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injection Analysed #397545 Valid Memory Corruption – 2020-02-27 – 321 Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exe Analysed #542180 Valid Memory Corruption – 2020-03-25 $10,000 268 Unchecked weapon id in WeaponList message parser on client leads to RCE #513154 Valid Memory Corruption – 2019-09-17 $3,000 229 OOB reads in network message handlers leads to RCE #807772 Valid Memory Corruption – 2021-05-04 $7,500 219 RCE on CS:GO client using unsanitized entity ID in EntityMsg message #584603 Valid Memory Corruption – 2021-05-27 $9,000 209 Buffer overrun in Steam SILK voice decoder #1180252 Valid Memory Corruption – 2021-09-13 $7,500 196 [Portal 2] Remote Code Execution via voice packets #733267 Valid Memory Corruption – 2021-05-10 $5,000 173 [Half-Life 1] Malformed map name leads to memory corruption and code execution #402566 Valid Memory Corruption – 2020-09-22 $1,500 163 Malformed .BSP Access Violation in CS:GO can lead to Remote Code Execution #351014 Valid Memory Corruption – 2018-07-19 – 154 MySQL username and password leaked in developer.valvesoftware.com via source code dislosure #291057 Valid Authentication – 2018-05-07 – 123 [help.steampowered.com] Account takeover bruteforcing SteamGuard #407971 Valid Input Validation and Logic – 2019-01-23 $2,500 112 ISteamAssets gives partners control over unrelated community market transactions #577584 Valid Access Control – 2019-05-23 – 109 Specially Crafted Closed Captions File can lead to Remote Code Execution in CS:GO and other Source Games #463286 Valid Memory Corruption – 2021-05-05 $7,500 109 Malformed save files (.sav) allow to write files with arbitrary extensions and content in GoldSrc-based games. #458842 Valid Other weaknesses – 2020-02-24 $1,500 99 Malformed .MDL triggers an Access Violation on GoldSRC (hl.exe) #495793 Valid Memory Corruption – 2019-10-09 – 90 Access to microtransaction sales data for lots of apps from 2014 to present at /valvefinance/sanity/ #975212 Valid Access Control – 2021-09-21 – 88 ImageMagick GIF coder vulnerability leading to memory disclosure #315256 Valid Information Disclosure – 2018-07-02 – 86 [steam client] Opening a specific steam:// url overwrites files at an arbitrary location #667242 Valid Memory Corruption – 2020-09-22 $750 80 Arbitrary File Write as SYSTEM from unprivileged user #583184 Informative Access Control – 2020-01-15 $1,250 71 CS:GO Server -> Client RCE through OOB access in CSVCMsg_SplitScreen + Info leak in HTTP download #1070835 Valid Memory Corruption – 2021-05-17 $7,500 66 Malformed playlist.txt in GoldSrc games leads to Access Violation & arbitrary code execution #504951 Valid Memory Corruption – 2019-09-17 $1,000 62 Big Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover) #1079561 Valid Information Disclosure – 2021-09-21 – 60 Steam chat - trade offer presentation vulnerability #745447 Valid Input Validation and Logic – 2020-02-19 – 60 [Source Engine] Material path truncation leads to Remote Code Execution #544096 Valid Input Validation and Logic – 2021-05-06 $2,500 60 Shell command injection in https://partner.steamgames.com/admin/game/publish/ via screenshot URL #949361 Valid Command and Code Injection Critical 2024-07-30 – 59 https://srcds.valve.net/find/ is leaking server config / API keys #1168557 Valid Information Disclosure High 2024-08-06 – 56 Add any depot to your app and access its contents without decryption key; via /apps/setcommonredists #1018368 Valid Access Control High 2024-07-30 – 56 Buffer overflow In hl.exe's launch -game argument allows an attacker to execute arbitrary code locally or from browser #832750 Valid Memory Corruption – 2020-08-19 – 55 Link filter protection bypass #291750 Valid Open Redirect – 2018-05-09 – 55 Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of item_image_small and item_image_large #840243 Not checked yet Command and Code Injection – – – 53 [CS:GO] Unchecked texture file name with TEXTUREFLAGS_DEPTHRENDERTARGET can lead to Remote Code Execution #550625 Valid Memory Corruption – 2021-05-06 $2,500 48 Shell command injection in https://partner.steamgames.com/bundles/savestore/ via overwriting asset_path_identifier #926169 Valid Command and Code Injection Critical 2024-07-30 – 47 WG call injection in /economy/contextcommand #652649 Not checked yet Command and Code Injection – – – 47 Stored XXS @ https://steamcommunity.com/search/users/#text= via Profile Name #351171 Valid Cross-site Scripting – 2018-05-24 $750 42 SQL injection in /errors/viewbuild/ #690349 Not checked yet SQL Injection – – – 41 Arbitrary file creation with semi-controlled content (leads to DoS, EoP and others) at Steam Windows Client #682774 Valid File and Path Handling – 2019-09-26 $1,250 41 Web API key registration allows registering multiple keys by reusing `request_id` #2270633 Valid No weakness recorded – 2023-12-12 – 40 Stored XSS in the guide's GameplayVersion (www.dota2.com) #380045 Valid Cross-site Scripting – 2019-01-07 $750 36 Signedness issue in ClassInfo message handler leads to RCE on CS:GO client #876719 Valid Memory Corruption – 2021-05-27 $7,500 35 Read Access to all comments on unauthorized forums' discussions! IDOR! #308610 Valid Insecure Direct Object Reference – 2018-05-09 $500 34 Buffer overflows in demo parsing #350119 Valid Memory Corruption – 2018-08-28 – 33 Xss was found by exploiting the URL markdown on http://store.steampowered.com #313250 Valid Cross-site Scripting – 2018-05-09 $1,000 32 Reflected XSS in www.dota2.com #292457 Valid Cross-site Scripting – 2018-05-09 – 32 Hidden scheduled partner events are propagated to Steam clients in CMsgClientClanState #780167 Valid Information Disclosure – 2020-03-20 – 31