| CVE-2026-1513 | MÉDIO6.1 | billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding. | 28/01/2026 |
| CVE-2026-23769 | MÉDIO6.1 | lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset rule files. | 16/01/2026 |
| CVE-2026-23768 | MÉDIO6.1 | lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension. | 16/01/2026 |
| CVE-2025-49223 | CRÍTICO9.8 | billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. | 04/06/2025 |
| CVE-2024-28216 | MÉDIO5.4 | nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery. | 07/03/2024 |
| CVE-2024-28215 | ALTO7.5 | nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery. | 07/03/2024 |
| CVE-2024-28214 | BAIXO2.7 | nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker. | 07/03/2024 |
| CVE-2024-28213 | CRÍTICO9.8 | nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization. | 07/03/2024 |
| CVE-2024-28212 | CRÍTICO9.8 | nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization. | 07/03/2024 |
| CVE-2024-28211 | CRÍTICO9.8 | nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker. | 07/03/2024 |
| CVE-2023-25632 | MÉDIO5.5 | The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature. | 27/11/2023 |
| CVE-2021-33592 | CRÍTICO9.8 | NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in filename parameter can be the cause of bypassing code signing check function. | 19/07/2021 |
| CVE-2021-33591 | ALTO8.8 | An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted HTML page. | 28/05/2021 |
| CVE-2020-9753 | CRÍTICO9.1 | Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer. | 20/05/2020 |
| CVE-2020-9752 | CRÍTICO9.8 | Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through its named pipe. | 23/03/2020 |
| CVE-2020-9751 | CRÍTICO9.1 | Naver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the attacker's server and execute it during the upgrade. | 03/03/2020 |
| CVE-2019-13157 | ALTO7.5 | nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive. | 22/11/2019 |
| CVE-2016-5060 | MÉDIO6.1 | Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) description, (2) email, or (3) username parameter to user/save. | 13/12/2016 |
| CVE-2014-6980 | MÉDIO5.4 | The LINE PLAY (aka jp.naver.lineplay.android) application 2.3.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | 16/10/2014 |
| CVE-2012-5183 | BAIXO2.6 | The Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files. | 26/12/2012 |