Browse / Razer

Razer

See its reports on the map

What gets reported to Razer

• Access Control19
• Cross-site Scripting14
• SQL Injection12
• Information Disclosure8
• Code Execution3
• Authentication2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. 🐞 OS Command Injection at https://sea-web.gold.razer.com/lab/ws-lookup via IP parameterOS Command Injection
   $2,000676 votes
2. SQL injection at https://sea-web.gold.razer.com/ajax-get-status.php via txid parameterSQL Injection
   $2,000580 votes
3. SQL Injection in https://api-my.pay.razer.com/inviteFriend/getInviteHistoryLogSQL Injection
   $2,000528 votes
4. OTP token bypass in accessing user settingsImproper Authentication - Generic
   $1,000339 votes
5. [Razer Pay Mobile App] Broken access control allowing other user's bank account to be deletedImproper Authorization
   $1,000311 votes
6. Reflected XSS at https://pay.gold.razer.com escalated to account takeoverCross-site Scripting (XSS) - Reflected
   $750287 votes
7. SQL Injection at https://sea-web.gold.razer.com/lab/cash-card-incomplete-translog-resend via period-hour ParameterSQL Injection
   $2,000240 votes
8. [api.easy2pay.co] SQL Injection at fortumo via TransID parameter [Bypassing Signature Validation🔥]SQL Injection
   $4,000232 votes
9. Admin Management - Login Using Default Password - Leads to Image Upload Backdoor/ShellImproper Access Control - Generic
   $200199 votes
10. Through blocking the redirect in /* the attacker able to bypass Authentication To see Sensitive Data sush as Game Keys , Emails ,..Improper Access Control - Generic
    $1,000196 votes
11. Unauthenticated access to sensitive user informationImproper Privilege Management
    $500184 votes
12. SQLi at https://sea-web.gold.razer.com/demo-th/purchase-result.php via orderid ParameterSQL Injection
    $2,000183 votes
13. [IDOR] API endpoint leaking sensitive user informationImproper Access Control - Generic
    $375172 votes
14. Misconfigured s3 Bucket exposureImproper Access Control - Generic
    $500168 votes
15. Accessible Druid Monitor console on https://api.pay-staging.razer.com/Information Disclosure
    $1,500126 votes
16. SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter. SQL Injection
    $2,000122 votes
17. SQL Injection at api.easy2pay.co/add-on/get-sig.php via partner_id ParameterSQL Injection
    $2,000119 votes
18. HTML injection in support.razer.com [IE only]Improper Handling of URL Encoding (Hex Encoding)
    $250109 votes
19. DOM XSS at https://www.thx.com in IE/Edge browserCross-site Scripting (XSS) - DOM
    $250102 votes
20. [Razer Pay Android App] Multiple vulnerabilities chained to allow "RedPacket" money to be stolen by a 3rd partyImproper Authorization
    $1,00084 votes
21. [pay.gold.razer.com] Stored XSS - Order paymentCross-site Scripting (XSS) - Stored
    $1,50081 votes
22. Blind SQL Injection at http://easytopup.in.th/es-services/mps.php via serial_no parameterSQL Injection
    $1,00080 votes
23. 2FA doesn't work in "https://insider.razer.com"Improper Authorization
    $20072 votes
24. SQL injection at https://sea-web.gold.razer.com/demo-th/goto-e2p-web-api.php via Multiple ParametersSQL Injection
    $2,00071 votes
25. Blind SQL Injection(Time Based Payload) in https://www.easytopup.in.th/store/game/digimon-master via CheckuserForm[user_id]SQL Injection
    $1,00068 votes
26. [SSRF] Server-Side Request Forgery at https://sea-web.gold.razer.com/dev/simulator via notify_url ParameterServer-Side Request Forgery (SSRF)
    $2,00060 votes
27. Payment PIN Verification BypassImproper Access Control - Generic
    $1,00057 votes
28. Reflected XSS at http://promotion.molthailand.com/index.php via promotion_id parameterCross-site Scripting (XSS) - Reflected
    $25055 votes
29. Insecure Logging - OWASP (2016-M2)Insecure Storage of Sensitive Information
    $40045 votes
30. Improper access control on easytopup.in.th transaction page leads to user's information disclosure and may lead to account hijackingImproper Access Control - Generic
    $1,00041 votes
31. Improper Authorization at https://api-my.pay.razer.com/v1/trxDetail?trxId=[Id] allowing unauthorised access to other user's transaction detailsImproper Authorization
    $50040 votes
32. dom based xss on [hello.merchant.razer.com]Cross-site Scripting (XSS) - DOM
    $50036 votes
33. Cookie based XSS on http://ftp1.thx.comCross-site Scripting (XSS) - Reflected
    $37531 votes
34. [razer-assets2] Listing of Amazon S3 Bucket accessible to any AWS cli Information Disclosure
    $25027 votes
35. Expired reCAPTCHA site key leads to Rate Limit Bypass and Email EnumerationImproper Restriction of Authentication Attempts
    $20026 votes
36. DLL Hijacking in Synapse 2 CrashSender1402.exe via version.dllCode Injection
    $75026 votes
37. IDOR in eform.molpay.com leads to see other users application forms with private dataInsecure Direct Object Reference (IDOR)
    $50021 votes
38. Insecure Processing of XML leads to Denial of Service through Billion Laughs AttackDenial of Service
    $37521 votes
39. Insecure HostnameVerifier within WebView of Razer Pay Android (TLS Vulnerability)Improper Certificate Validation
    $75020 votes
40. Subdomain takeover at iosota.razersynapse.com via Amazon S3Privilege Escalation
    $20018 votes
41. Request Smuggling vulnerability due a vulnerable skipper reverse proxy running in the environment.HTTP Request Smuggling
    $37518 votes
42. Reflected XSS on molpay.com with cloudflare bypassCross-site Scripting (XSS) - Reflected
    $37517 votes
43. [press.razer.com] Origin IP found, Cloudflare bypassedImproper Access Control - Generic
    $20017 votes
44. Reflected XSS on https://www.easytopup.in.th/store/product/return on parameter mref_idCross-site Scripting (XSS) - Reflected
    $25017 votes
45. PHPInfo Page on www.razer.ruInformation Disclosure
    17 votes
46. Access to support tickets and payment history, impersonate razer support staffImproper Handling of Insufficient Permissions or Privileges
    $1,50016 votes
47. AWS subdomain Takeover at estore.razersynapse.comPrivilege Escalation
    $25015 votes
48. https://zest.co.th/zestlinepay/checkproduct API endpoint suffers from Boolean-based SQL injectionSQL Injection
    15 votes
49. Reflected XSS at https://sea-web.gold.razer.com/cash-card/verify via channel parameterCross-site Scripting (XSS) - Reflected
    $50015 votes
50. Subdomain takeover at ftp.thx.comPrivilege Escalation
    $25015 votes
51. [api.easy2pay.co] SQL Injection in cashcard via card_no parameter ⭐️Bypassing IP whitelist⭐️SQL Injection
    14 votes
52. Leftover back-end system on www.zest.co.th allows an unauthorized attacker to generate Razer Gold Pin for freeImproper Authorization
    $37514 votes
53. Source Code DisclosureInformation Disclosure
    $20012 votes
54. Helpdesk takeover (subdomain takeover) in razerzone.com domain via unclaimed Zendesk instanceMisconfiguration
    $25012 votes
55. Post Based Reflected XSS on [https://investor.razer.com/s/ir_contact.php]Cross-site Scripting (XSS) - Reflected
    $37512 votes
56. [Razer Pay Mobile App] IDOR within /v1_IM/friends/queryDrawRedLog allowed unauthorised access to read logsInsecure Direct Object Reference (IDOR)
    $50012 votes
57. THX Tuneup Survey feedback disclosure via Google cached content for apps.thx.comInformation Disclosure
    $20012 votes
58. DOM-based XSS on https://zest.co.th/zestlinepay/Cross-site Scripting (XSS) - DOM
    $20010 votes
59. Reflected XSS in eform.molpay.comCross-site Scripting (XSS) - Reflected
    $3759 votes
60. Aws bucket writable mobile.razer.comImproper Authorization
    $2509 votes
61. Misconfigured Bucket [razer-assets2] https://assets2.razerzone.com/Information Disclosure
    $2509 votes
62. Information disclosure at http://sea-s2s.molthailand.com/status.phpInformation Disclosure
    $3758 votes
63. Race Condition in Oauth 2.0 flow can lead to malicious applications create multiple valid sessionsConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
    $2508 votes
64. [Razer Pay] Broken Access Control at /v1/verifyPhone/ allows enumeration of usernames and ID informationImproper Access Control - Generic
    $5006 votes
65. Store Cross-Site Scripting - www.razer.ruCross-site Scripting (XSS) - Stored
    $2005 votes
66. User Access Control Bypass Via Razer elevated service ( RzKLService.exe ) which loads exe in misconfigured way.Code Injection
    $7503 votes
67. RXSS at https://api.easy2pay.co/inquiry.php via txid parameter.Cross-site Scripting (XSS) - Reflected
    $2502 votes