Vulnerabilidades de LY Corporation
CVEs publicadas que afetam produtos de LY Corporation: 5 registro(s), com severidade, exploração e correções.
CVE-2026-11748
Média · 6.9
CWE-90 22/06/2026
LDAP Injection em LY Corporation Central Dogma
A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate the filter to cause authentication confusion and enumerate the directory structure.
CVE-2026-11746
Crítica · 9.4
CWE-798 22/06/2026
centraldogma-server com segredo padrão embutido na replicação ZooKeeper (CVE-2026-11746)
Uma vulnerabilidade foi identificada no centraldogma-server em versões anteriores à 0.84.0, nas quais, ao habilitar a replicação ZooKeeper sem definir replication.secret, o servidor passa silenciosamente a usar um segredo fixo no código, de conhecimento público. Essa credencial padrão autentica o ensemble ZooKeeper embutido, permitindo que um atacante com acesso à rede leia o log de replicação completo ou entre no quórum e execute comandos arbitrários replicados por todo o cluster.
CVE-2026-11745
Alta · 8.8
CWE-322 22/06/2026
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to…
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.
CVE-2026-11752
Média · 5.9
19/06/2026
A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where…
A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local files and environment variables on the xDS client host.
CVE-2026-3861
Média · 6.5
CWE-451 16/04/2026
LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app…
LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily inoperable.