CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-43297
https://notcve.org/view.php?id=CVE-2023-43297
02 Oct 2023 — An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. Un problema en animal-art-lab v13.6.1 permite a los atacantes enviar notificaciones manipuladas mediante la fuga del token de acceso al canal. • https://github.com/syz913/CVE-reports/blob/main/CVE-2023-43297.md • CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-38493 – Paths contain matrix variables bypass decorators
https://notcve.org/view.php?id=CVE-2023-38493
25 Jul 2023 — Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of the matrix variables. If an attacker sends a specially crafted request, the request may bypass the authorizer. Version 1.24.3 contains a patch for this issue. • https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-methods/matrix-variables.html • CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41568
https://notcve.org/view.php?id=CVE-2022-41568
29 Nov 2022 — LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat. El cliente LINE para iOS anterior a 12.17.0 podría fallar al compartir una clave compartida no válida de e2ee en el chat grupal. • https://hackerone.com/reports/1701642 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29505
https://notcve.org/view.php?id=CVE-2022-29505
27 Apr 2022 — Due to build misconfiguration in openssl dependency, LINE for Windows before 7.8 is vulnerable to DLL injection that could lead to privilege escalation. Debido a una configuración errónea en la dependencia de openssl, LINE para Windows versiones anteriores sa 7.8. es vulnerable a una inyección de DLL que podría conllevar a una escalada de privilegios • https://hackerone.com/reports/1423049 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-22820
https://notcve.org/view.php?id=CVE-2022-22820
20 Jan 2022 — Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipient by sending specially crafted gif image in LINE for Windows before 7.4. Debido a una falta de comprobaciones de archivos multimedia antes de la renderización, era posible que un atacante causara un consumo anormal de CPU para el destinatario del mensaje mediante el envío de una imagen gif especialmente diseñada en LINE para Windows versiones anteriores a 7.4 • https://hackerone.com/reports/1357400 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43795 – Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria
https://notcve.org/view.php?id=CVE-2021-43795
02 Dec 2021 — Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation o... • https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41011
https://notcve.org/view.php?id=CVE-2021-41011
22 Sep 2021 — LINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities under certain conditions. This is usually impossible, but in combination with a server-side bug, attackers could get this information. El cliente de LINE para iOS versiones anteriores a 11.15.0, podría exponer una información de autenticación de un determinado servicio a entidades externas bajo determinadas condiciones. Esto es normalmente imposible, pero en combinación con un bug del lado d... • https://hackerone.com/reports/1279524 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38388
https://notcve.org/view.php?id=CVE-2021-38388
08 Sep 2021 — Central Dogma allows privilege escalation with mirroring to the internal dogma repository that has a file managing the authorization of the project. Central Dogma permite una escalada de privilegios con mirroring al repositorio interno de dogma que presenta un archivo que administra la autorización del proyecto • https://github.com/line/centraldogma/pull/621 • CWE-862: Missing Authorization •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36216
https://notcve.org/view.php?id=CVE-2021-36216
08 Sep 2021 — LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection. LINE para Windows versión 6.2.1.2289 y anteriores, permite una ejecución de código arbitrario por medio de una inyección de DLL maliciosa • https://hackerone.com/reports/950688 • CWE-427: Uncontrolled Search Path Element •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36215
https://notcve.org/view.php?id=CVE-2021-36215
08 Sep 2021 — LINE client for iOS 10.21.3 and before allows address bar spoofing due to inappropriate address handling. El cliente de LINE para iOS versión 10.21.3 y anteriores, permite una suplantación de la barra de direcciones debido a un manejo inapropiado de las mismas • https://hackerone.com/reports/1082991 •