RCE on Steam Client via buffer overflow in Server Info Analysed #470520 Valid Memory Corruption Critical 2019-03-15 – 1,289 Getting all the CD keys of any game Analysed #391217 Valid Access Control Critical 2018-10-31 $20,000 638 XSS in steam react chat client Analysed #409850 Valid Cross-site Scripting Critical 2019-01-07 $7,500 499 Modify in-flight data to payment provider Smart2Pay Analysed #1295844 Valid Input Validation and Logic Critical 2021-08-10 $7,500 443 Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect Message Analysed #631956 Valid Command and Code Injection Critical 2019-10-08 – 420 SQL Injection in report_xml.php through countryFilter[] parameter Analysed #383127 Valid SQL Injection Critical 2018-07-27 $25,000 410 Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injection Analysed #397545 Valid Memory Corruption High 2020-02-27 – 321 Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exe Analysed #542180 Valid Memory Corruption Critical 2020-03-25 $10,000 268 Unchecked weapon id in WeaponList message parser on client leads to RCE Analysed #513154 Valid Memory Corruption Critical 2019-09-17 $3,000 229 OOB reads in network message handlers leads to RCE Analysed #807772 Valid Memory Corruption Critical 2021-05-04 $7,500 219 RCE on CS:GO client using unsanitized entity ID in EntityMsg message Analysed #584603 Valid Memory Corruption Critical 2021-05-27 $9,000 209 Buffer overrun in Steam SILK voice decoder #1180252 Valid Memory Corruption Critical 2021-09-13 $7,500 196 [Portal 2] Remote Code Execution via voice packets Analysed #733267 Valid Memory Corruption Critical 2021-05-10 $5,000 173 [Half-Life 1] Malformed map name leads to memory corruption and code execution Analysed #402566 Valid Memory Corruption High 2020-09-22 $1,500 163 Malformed .BSP Access Violation in CS:GO can lead to Remote Code Execution Analysed #351014 Valid Memory Corruption Critical 2018-07-19 – 154 MySQL username and password leaked in developer.valvesoftware.com via source code dislosure Analysed #291057 Valid Authentication Medium 2018-05-07 – 123 [help.steampowered.com] Account takeover bruteforcing SteamGuard Analysed #407971 Valid Input Validation and Logic High 2019-01-23 $2,500 112 ISteamAssets gives partners control over unrelated community market transactions Analysed #577584 Valid Access Control High 2019-05-23 – 109 Specially Crafted Closed Captions File can lead to Remote Code Execution in CS:GO and other Source Games Analysed #463286 Valid Memory Corruption Critical 2021-05-05 $7,500 109 Malformed save files (.sav) allow to write files with arbitrary extensions and content in GoldSrc-based games. Analysed #458842 Valid Other weaknesses High 2020-02-24 $1,500 99 Malformed .MDL triggers an Access Violation on GoldSRC (hl.exe) Analysed #495793 Valid Memory Corruption High 2019-10-09 – 90 Access to microtransaction sales data for lots of apps from 2014 to present at /valvefinance/sanity/ Analysed #975212 Valid Access Control Critical 2021-09-21 – 88 ImageMagick GIF coder vulnerability leading to memory disclosure Analysed #315256 Valid Information Disclosure Medium 2018-07-02 – 86 [steam client] Opening a specific steam:// url overwrites files at an arbitrary location Analysed #667242 Valid Memory Corruption Medium 2020-09-22 $750 80 CS:GO Server -> Client RCE through OOB access in CSVCMsg_SplitScreen + Info leak in HTTP download Analysed #1070835 Valid Memory Corruption Critical 2021-05-17 $7,500 66 Malformed playlist.txt in GoldSrc games leads to Access Violation & arbitrary code execution Analysed #504951 Valid Memory Corruption High 2019-09-17 $1,000 62 Big Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover) Analysed #1079561 Valid Information Disclosure High 2021-09-21 – 60 Steam chat - trade offer presentation vulnerability Analysed #745447 Valid Input Validation and Logic Medium 2020-02-19 – 60 [Source Engine] Material path truncation leads to Remote Code Execution Analysed #544096 Valid Input Validation and Logic High 2021-05-06 $2,500 60 Shell command injection in https://partner.steamgames.com/admin/game/publish/ via screenshot URL Analysed #949361 Valid Command and Code Injection Critical 2024-07-30 – 59 https://srcds.valve.net/find/ is leaking server config / API keys Analysed #1168557 Valid Information Disclosure High 2024-08-06 – 56 Add any depot to your app and access its contents without decryption key; via /apps/setcommonredists Analysed #1018368 Valid Access Control High 2024-07-30 – 56 Buffer overflow In hl.exe's launch -game argument allows an attacker to execute arbitrary code locally or from browser Analysed #832750 Valid Memory Corruption High 2020-08-19 – 55 Link filter protection bypass Analysed #291750 Valid Open Redirect Medium 2018-05-09 – 55 Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of item_image_small and item_image_large Analysed #840243 Valid Command and Code Injection Critical 2024-07-30 – 53 [CS:GO] Unchecked texture file name with TEXTUREFLAGS_DEPTHRENDERTARGET can lead to Remote Code Execution #550625 Valid Memory Corruption High 2021-05-06 $2,500 48 Shell command injection in https://partner.steamgames.com/bundles/savestore/ via overwriting asset_path_identifier #926169 Valid Command and Code Injection Critical 2024-07-30 – 47 WG call injection in /economy/contextcommand #652649 Valid Command and Code Injection Critical 2024-07-30 – 47 Stored XXS @ https://steamcommunity.com/search/users/#text= via Profile Name #351171 Valid Cross-site Scripting Medium 2018-05-24 $750 42 SQL injection in /errors/viewbuild/ #690349 Valid SQL Injection Critical 2024-07-30 – 41 Arbitrary file creation with semi-controlled content (leads to DoS, EoP and others) at Steam Windows Client #682774 Valid File and Path Handling Medium 2019-09-26 $1,250 41 Web API key registration allows registering multiple keys by reusing `request_id` #2270633 Valid No weakness recorded Low 2023-12-12 – 40 Stored XSS in the guide's GameplayVersion (www.dota2.com) #380045 Valid Cross-site Scripting Medium 2019-01-07 $750 36 Signedness issue in ClassInfo message handler leads to RCE on CS:GO client #876719 Valid Memory Corruption Critical 2021-05-27 $7,500 35 Read Access to all comments on unauthorized forums' discussions! IDOR! #308610 Valid Insecure Direct Object Reference Medium 2018-05-09 $500 34 Buffer overflows in demo parsing #350119 Valid Memory Corruption Medium 2018-08-28 – 33 Xss was found by exploiting the URL markdown on http://store.steampowered.com #313250 Valid Cross-site Scripting Medium 2018-05-09 $1,000 32 Reflected XSS in www.dota2.com #292457 Valid Cross-site Scripting Medium 2018-05-09 – 32 Hidden scheduled partner events are propagated to Steam clients in CMsgClientClanState #780167 Valid Information Disclosure Medium 2020-03-20 – 31 /applications/dpc_(get|post) provide full access to api.steampowered.com with the Dota2 API key #674800 Valid Server-Side Request Forgery High 2024-07-30 – 30