CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43795 – Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria
https://notcve.org/view.php?id=CVE-2021-43795
Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path. Armeria es un framework de microservicios de código abierto. • https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284 https://github.com/line/armeria/pull/3855 https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41011
https://notcve.org/view.php?id=CVE-2021-41011
LINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities under certain conditions. This is usually impossible, but in combination with a server-side bug, attackers could get this information. El cliente de LINE para iOS versiones anteriores a 11.15.0, podría exponer una información de autenticación de un determinado servicio a entidades externas bajo determinadas condiciones. Esto es normalmente imposible, pero en combinación con un bug del lado del servidor, los atacantes podrían conseguir esta información • https://hackerone.com/reports/1279524 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38388
https://notcve.org/view.php?id=CVE-2021-38388
Central Dogma allows privilege escalation with mirroring to the internal dogma repository that has a file managing the authorization of the project. Central Dogma permite una escalada de privilegios con mirroring al repositorio interno de dogma que presenta un archivo que administra la autorización del proyecto • https://github.com/line/centraldogma/pull/621 • CWE-862: Missing Authorization •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36216
https://notcve.org/view.php?id=CVE-2021-36216
LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection. LINE para Windows versión 6.2.1.2289 y anteriores, permite una ejecución de código arbitrario por medio de una inyección de DLL maliciosa • https://hackerone.com/reports/950688 • CWE-427: Uncontrolled Search Path Element •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36215
https://notcve.org/view.php?id=CVE-2021-36215
LINE client for iOS 10.21.3 and before allows address bar spoofing due to inappropriate address handling. El cliente de LINE para iOS versión 10.21.3 y anteriores, permite una suplantación de la barra de direcciones debido a un manejo inapropiado de las mismas • https://hackerone.com/reports/1082991 •