CVE-2023-38312 | High | 7.5 | 2023-10-15 | A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the… |
CVE-2023-35855 | Critical | 9.8 | 2023-06-19 | A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile co… |
CVE-2023-30382 | High | 7.3 | 2023-05-23 | A buffer overflow in the component hl.exe of Valve Half-Life up to 5433873 allows attackers to execute arbitrary code and escalate privileges by supplying craf… |
CVE-2021-30481 | High | 8.0 | 2021-04-10 | Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow… |
CVE-2020-6017 | Critical | 9.8 | 2020-12-03 | Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long unreliable segments in function SNP_ReceiveUnreliableSegment() when configured… |
CVE-2020-6018 | Critical | 9.8 | 2020-12-02 | Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long encrypted messages in function AES_GCM_DecryptContext::Decrypt() when compiled… |
CVE-2020-6016 | Critical | 9.8 | 2020-11-18 | Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveUnreliableSegment()… |
CVE-2020-6019 | High | 7.5 | 2020-11-13 | Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBase::Received_Data()… |
CVE-2020-15530 | High | 7.8 | 2020-07-05 | An issue was discovered in Valve Steam Client 2.10.91.91. The installer allows local users to gain NT AUTHORITY\SYSTEM privileges because some parts of %PROGRA… |
CVE-2020-12242 | High | 7.8 | 2020-04-27 | Valve Source allows local users to gain privileges by writing to the /tmp/hl2_relaunch file, which is later executed in the context of a different user account. |
CVE-2020-9005 | High | 7.8 | 2020-02-17 | meshsystem.dll in Valve Dota 2 through 2020-02-17 allows remote attackers to achieve code execution or denial of service by creating a gaming server with a cra… |
CVE-2020-7952 | High | 7.8 | 2020-01-27 | rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and invitin… |
CVE-2020-7951 | High | 7.8 | 2020-01-27 | meshsystem.dll in Valve Dota 2 before 7.23e allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a v… |
CVE-2020-7950 | High | 7.8 | 2020-01-27 | meshsystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a v… |
CVE-2020-7949 | High | 7.8 | 2020-01-27 | schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a… |
CVE-2019-17180 | High | 7.8 | 2019-10-04 | Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modifications on Windows in t… |
CVE-2019-15943 | High | 8.8 | 2019-09-19 | vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming se… |
CVE-2019-15944 | Medium | 5.3 | 2019-09-05 | In Counter-Strike: Global Offensive before 8/29/2019, community game servers can display unsafe HTML in a disconnection message. |
CVE-2019-15316 | High | 7.0 | 2019-08-21 | Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of Crea… |
CVE-2019-15315 | High | 7.8 | 2019-08-21 | Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of… |
CVE-2019-14743 | Medium | 6.6 | 2019-08-07 | In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local… |
CVE-2018-12270 | Medium | 5.4 | 2019-05-20 | In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the client, which may trick users into visiting… |
CVE-2017-17878 | Critical | 9.8 | 2017-12-27 | An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES (aka the CONFIG_… |
CVE-2017-17877 | Critical | 9.8 | 2017-12-27 | An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port… |
CVE-2016-5237 | Medium | 4.8 | 2017-01-23 | Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and possibly gain privi… |
CVE-2015-7985 | | | 2015-11-24 | Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to gain privileges via a Trojan horse ste… |
CVE-2015-4016 | | | 2015-05-20 | The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response to a broadcast packet. |
CVE-2013-7128 | | | 2013-12-17 | Valve Bug Reporter in the valve-bugreporter package 2.10+bsos1 in Valve SteamOS Beta stores cleartext credentials in a .valve-bugreporter.cfg file upon a Remem… |
CVE-2008-7203 | | | 2009-09-11 | Valve Software Half-Life Counter-Strike 1.6 allows remote attackers to cause a denial of service (crash) via multiple crafted login packets. |