浏览报告
23 份报告 · 本页赏金 $3,450 · 清除筛选
Authentication Bypass to (CVE-2023-2982)身份认证CS Money低危$1002023-12-08Previously created sessions continue being valid after MFA activation身份认证CS Money低危—2021-05-18Able to blocking users with 2fa from login into their accounts by just knowing the SteamID访问控制CS Money低危$3002023-12-14Html injection on subscription email注入与走私CS Money低危$3002024-01-23Blind Based SQL Injection in 3d.sc.moneySQL 注入CS Money未评级—2021-04-16Origin IP found, Cloudflare bypassed业务逻辑CS Money低危—2021-03-30Able to upload backgrounds before entering 2FA身份认证CS Money低危—2021-02-03Cookie poisoning leads to DOS and Privacy Violation信息泄露CS Money中危$7002021-02-25Attacker can generate cancelled transctions in a user's transaction history using only Steam ID访问控制CS Money低危$3002021-02-03Blind XSS on image upload跨站脚本CS Money高危$1,0002020-12-26ReDoS at wiki.cs.money graphQL endpoint (AND probably a kind of command injection)拒绝服务CS Money低危$2502020-10-27Content Spoofing/Text Injection in https://support.cs.money and JS file not minified and uglyfied which makes it clearly readable信息泄露CS Money低危—2020-11-12Manipulate Uneditable Messages in Support业务逻辑CS Money中危—2020-10-27Improper authentication in the load sell inventory page身份认证CS Money未评级—2020-10-08Отправка писем с произвольным текстом/кликабельными ссылками любому зарегистрированному пользователю с указанной почтой, зная только steamid访问控制CS Money高危—2020-12-20Application DOS via specially crafted payload on 3d.cs.money其他弱点CS Money低危—2020-10-01Server-side denial of service via large payload sent to wiki.cs.money/graphql拒绝服务CS Money未评级—#993005IDOR in https://3d.cs.money/不安全的直接对象引用CS Money低危—2020-09-28Bypass Filter on link of build业务逻辑CS Money低危—2020-09-28Bypass restrict of member subscription to use custom background in https://3d.cs.money without prime subscription业务逻辑CS Money低危—2020-09-28Site-wide CSRF on Safari due to CORS misconfiguration (not localhost)跨站请求伪造CS Money低危$3002020-10-27Pixel Flood Attack leads to Application level DoS拒绝服务CS Money低危$2002020-11-05[cs.money] Open Redirect Leads to Account Takeover身份认证CS Money低危—2020-09-30