Filtered by vendor Valvesoftware
Subscribe
Total
29 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-38312 | 1 Valvesoftware | 1 Counter-strike | 2023-10-19 | N/A | 7.5 HIGH |
| A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the underlying server via the motdfile console variable. | |||||
| CVE-2023-35855 | 1 Valvesoftware | 1 Counter-strike | 2023-06-30 | N/A | 9.8 CRITICAL |
| A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile console variable. | |||||
| CVE-2023-30382 | 1 Valvesoftware | 1 Half-life | 2023-05-31 | N/A | 7.3 HIGH |
| A buffer overflow in the component hl.exe of Valve Half-Life up to 5433873 allows attackers to execute arbitrary code and escalate privileges by supplying crafted parameters. | |||||
| CVE-2020-6019 | 1 Valvesoftware | 1 Game Networking Sockets | 2022-11-03 | 5.0 MEDIUM | 7.5 HIGH |
| Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBase::Received_Data(), leading to an exception thrown from libprotobuf and resulting in a crash. | |||||
| CVE-2020-6016 | 1 Valvesoftware | 1 Game Networking Sockets | 2022-10-21 | 10.0 HIGH | 9.8 CRITICAL |
| Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveUnreliableSegment(), leading to a Heap-Based Buffer Underflow and a free() of memory not from the heap, resulting in a memory corruption and probably even a remote code execution. | |||||
| CVE-2020-6018 | 1 Valvesoftware | 1 Game Networking Sockets | 2022-04-12 | 7.5 HIGH | 9.8 CRITICAL |
| Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long encrypted messages in function AES_GCM_DecryptContext::Decrypt() when compiled using libsodium, leading to a Stack-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code execution. | |||||
| CVE-2020-6017 | 1 Valvesoftware | 1 Game Networking Sockets | 2022-04-12 | 7.5 HIGH | 9.8 CRITICAL |
| Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long unreliable segments in function SNP_ReceiveUnreliableSegment() when configured to support plain-text messages, leading to a Heap-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code execution. | |||||
| CVE-2015-7985 | 1 Valvesoftware | 1 Steam Client | 2022-02-07 | 7.2 HIGH | N/A |
| Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to gain privileges via a Trojan horse steam.exe file. | |||||
| CVE-2015-4016 | 1 Valvesoftware | 1 Steam Client | 2022-02-07 | 5.0 MEDIUM | N/A |
| The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response to a broadcast packet. | |||||
| CVE-2018-12270 | 1 Valvesoftware | 1 Steam Client | 2022-02-07 | 5.8 MEDIUM | 5.4 MEDIUM |
| In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the client, which may trick users into visiting unintended web sites. | |||||
| CVE-2020-9005 | 1 Valvesoftware | 1 Dota 2 | 2022-02-07 | 6.8 MEDIUM | 7.8 HIGH |
| meshsystem.dll in Valve Dota 2 through 2020-02-17 allows remote attackers to achieve code execution or denial of service by creating a gaming server with a crafted map, and inviting a victim to this server. A GetValue call is mishandled. | |||||
| CVE-2021-30481 | 1 Valvesoftware | 1 Steam Client | 2022-02-07 | 6.0 MEDIUM | 9.0 CRITICAL |
| Valve Steam through 2021-04-10, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click. | |||||
| CVE-2020-15530 | 1 Valvesoftware | 1 Steam Client | 2021-07-21 | 7.2 HIGH | 7.8 HIGH |
| An issue was discovered in Valve Steam Client 2.10.91.91. The installer allows local users to gain NT AUTHORITY\SYSTEM privileges because some parts of %PROGRAMFILES(X86)%\Steam and/or %COMMONPROGRAMFILES(X86)%\Steam have weak permissions during a critical time window. An attacker can make this time window arbitrarily long by using opportunistic locks. | |||||
| CVE-2020-12242 | 1 Valvesoftware | 1 Source | 2021-07-21 | 7.2 HIGH | 7.8 HIGH |
| Valve Source allows local users to gain privileges by writing to the /tmp/hl2_relaunch file, which is later executed in the context of a different user account. | |||||
| CVE-2020-7951 | 1 Valvesoftware | 1 Dota 2 | 2021-07-21 | 6.8 MEDIUM | 7.8 HIGH |
| meshsystem.dll in Valve Dota 2 before 7.23e allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is affected by memory corruption. | |||||
| CVE-2019-14743 | 2 Microsoft, Valvesoftware | 2 Windows, Steam Client | 2020-08-24 | 7.2 HIGH | 6.6 MEDIUM |
| In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local users to gain NT AUTHORITY\SYSTEM access. | |||||
| CVE-2019-15943 | 1 Valvesoftware | 1 Counter-strike\ | 2020-08-24 | 6.8 MEDIUM | 8.8 HIGH |
| vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is mishandled during a memset call. | |||||
| CVE-2019-15316 | 2 Microsoft, Valvesoftware | 2 Windows, Steam Client | 2020-08-24 | 6.9 MEDIUM | 7.0 HIGH |
| Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition. | |||||
| CVE-2019-15315 | 2 Microsoft, Valvesoftware | 2 Windows, Steam Client | 2020-08-24 | 7.2 HIGH | 7.8 HIGH |
| Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch. | |||||
| CVE-2020-7952 | 1 Valvesoftware | 1 Dota 2 | 2020-01-29 | 6.8 MEDIUM | 7.8 HIGH |
| rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is affected by memory corruption. | |||||