Naver vulnerabilities, page 2
31 vulnerabilities
Known vulnerabilities in Naver products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 18 products.
RoutineCVE-2021-33591naver · naver comic viewer +1 morenaver naver comic viewerAn exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted HTML page.CVSS8.8HighEPSS1.59%PrioritiseCVE-2020-9753naver corporation · whale browser installer +1 morenaver corporation whale browser installerWhale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.CVSS9.1CriticalEPSS1.07%PrioritiseCVE-2020-9752naver corporation · naver cloud explorer +1 morenaver corporation naver cloud explorerNaver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through its named pipe.CVSS9.8CriticalEPSS1.15%PrioritiseCVE-2020-9751naver corporation · naver cloud explorer +1 morenaver corporation naver cloud explorerNaver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the attacker's server and execute it during the upgrade.CVSS9.1CriticalEPSS0.48%PrioritiseCVE-2019-13157naver corporation · naver vaccine +1 morenaver corporation naver vaccinensGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive.CVSS7.5HighEPSS1.65%PrioritiseCVE-2019-13156naver corporation · ndrive +1 morenaver corporation ndriveNDrive(1.2.2).sys in Naver Cloud Explorer has a stack-based buffer overflow, which allows attackers to cause a denial of service when reading data from IOCTL handle.CVSS7.5HighEPSS1.04%RoutineCVE-2016-5060naver · ngrindernaver ngrinderMultiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) description, (2) email, or (3) username parameter to user/save.CVSS6.1MediumEPSS1.85%RoutineCVE-2014-6980naver · line_playnaver line_playThe LINE PLAY (aka jp.naver.lineplay.android) application 2.3.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.CVSS5.4MediumEPSS0.27%RoutineCVE-2012-5183naver · loctouchnaver loctouchThe Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files.CVSS2.6LowEPSS0.99%RoutineCVE-2012-5182naver · loctouchnaver loctouchThe Loctouch application 3.4.6 and earlier for Android does not properly handle implicit intents, which allows attackers to obtain sensitive information about logged locations via a crafted application.CVSS4.3MediumEPSS1.00%RoutineCVE-2012-4005naver · nhn_japan_naver_linenaver nhn_japan_naver_lineThe NHN Japan NAVER LINE application before 2.5.5 for Android does not properly handle implicit intents, which allows remote attackers to obtain sensitive message information via a crafted application.CVSS5.0MediumEPSS1.35%