Linecorp
93 CVEs across 14 Linecorp products. Browse Linecorp vulnerabilities, severities, and proof-of-concept exploits.
Linecorp products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3861 | Medium | 6.5 | 2026-04-16 | LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level di… |
CVE-2025-14023 | Low | 3.1 | 2025-12-15 | LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could… |
CVE-2025-14022 | High | 7.7 | 2025-12-15 | LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK inter… |
CVE-2025-14021 | Medium | 4.3 | 2025-12-15 | The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaS… |
CVE-2025-14020 | Medium | 5.4 | 2025-12-15 | LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is… |
CVE-2025-14019 | Low | 3.4 | 2025-12-15 | LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen war… |
CVE-2025-11222 | Medium | 6.1 | 2025-12-04 | Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted UR… |
CVE-2024-5739 | Medium | 6.1 | 2024-06-12 | The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS (UXSS) vulnerability. This vulnerability allows for cross-site scripti… |
CVE-2024-1735 | Critical | 9.1 | 2024-02-26 | A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users… |
CVE-2024-1143 | Critical | 9.3 | 2024-02-02 | Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentic… |
CVE-2023-48129 | Medium | 5.4 | 2024-01-26 | An issue in kimono-oldnew mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48135 | Medium | 5.4 | 2024-01-26 | An issue in mimasaka_farm mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48133 | Medium | 5.4 | 2024-01-26 | An issue in angel coffee mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48132 | Medium | 5.4 | 2024-01-26 | An issue in kosei entertainment esportsstudioLegends mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the chann… |
CVE-2023-48131 | Medium | 5.4 | 2024-01-26 | An issue in CHIGASAKI BAKERY mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48130 | Medium | 5.4 | 2024-01-26 | An issue in GINZA CAFE mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48128 | Medium | 5.4 | 2024-01-26 | An issue in UNITED BOXING GYM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48127 | Medium | 5.4 | 2024-01-26 | An issue in myGAKUYA mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48126 | Medium | 5.4 | 2024-01-26 | An issue in Luxe Beauty Clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-44001 | Medium | 5.4 | 2024-01-24 | An issue in Ailand clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-44000 | Medium | 5.4 | 2024-01-24 | An issue in Otakara lapis totuka mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43999 | Medium | 5.4 | 2024-01-24 | An issue in COLORFUL_laundry mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43998 | Medium | 5.4 | 2024-01-24 | An issue in Books-futaba mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43997 | Medium | 5.4 | 2024-01-24 | An issue in Yoruichi hobby base mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43996 | Medium | 5.4 | 2024-01-24 | An issue in Q co ltd mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43995 | Medium | 5.4 | 2024-01-24 | An issue in picot.golf mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43994 | Medium | 5.4 | 2024-01-24 | An issue in Cleaning_makotoya mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43993 | Medium | 5.4 | 2024-01-24 | An issue in smaregi_app_market mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43992 | Medium | 5.4 | 2024-01-24 | An issue in STOCKMAN GROUP mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43991 | Medium | 5.4 | 2024-01-24 | An issue in PRIMA CLINIC mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43990 | Medium | 5.4 | 2024-01-24 | An issue in cherub-hair mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43989 | Medium | 5.4 | 2024-01-24 | An issue in mokumoku chohu mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43988 | Medium | 5.4 | 2024-01-24 | An issue in nature fitness saijo mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-45559 | High | 8.2 | 2024-01-03 | An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. |
CVE-2023-45561 | Medium | 5.3 | 2024-01-02 | An issue in A-WORLD OIRASE BEER_waiting Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. |
CVE-2023-43305 | High | 8.2 | 2023-12-08 | An issue in studio kent mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43304 | High | 8.2 | 2023-12-07 | An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43303 | High | 8.2 | 2023-12-07 | An issue in craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token (via… |
CVE-2023-43302 | High | 8.2 | 2023-12-07 | An issue in sanTas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43301 | High | 8.2 | 2023-12-07 | An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43300 | High | 8.2 | 2023-12-07 | An issue in urban_project mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43299 | Medium | 5.3 | 2023-12-07 | An issue in DA BUTCHERS mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43298 | Medium | 5.3 | 2023-12-07 | An issue in SCOL Members Card mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48134 | High | 7.5 | 2023-11-16 | nagayama_copabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. |
CVE-2023-47373 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47372 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47370 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47368 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47369 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications. |
CVE-2023-47367 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47366 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47365 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47364 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims |
CVE-2023-47363 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-38849 | High | 7.5 | 2023-10-25 | An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38848 | High | 7.5 | 2023-10-25 | An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38847 | High | 7.5 | 2023-10-25 | An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38846 | High | 7.5 | 2023-10-25 | An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38845 | High | 7.5 | 2023-10-25 | An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-39740 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39739 | High | 8.2 | 2023-10-25 | The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39737 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39736 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39735 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39734 | High | 8.2 | 2023-10-25 | The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broa… |
CVE-2023-39733 | High | 8.2 | 2023-10-25 | The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39732 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-5554 | Medium | 4.8 | 2023-10-12 | Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.16.0. |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-43297 | Medium | 5.4 | 2023-10-02 | An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. |
CVE-2023-38493 | High | 7.5 | 2023-07-25 | Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or… |
CVE-2022-41568 | High | 7.5 | 2022-11-29 | LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat. |
CVE-2022-29505 | High | 7.8 | 2022-04-27 | Due to build misconfiguration in openssl dependency, LINE for Windows before 7.8 is vulnerable to DLL injection that could lead to privilege escalation. |
CVE-2022-22820 | Medium | 5.5 | 2022-01-20 | Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipient by sending speci… |
CVE-2021-43795 | High | 7.5 | 2021-12-02 | Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted direc… |
CVE-2021-41011 | High | 7.5 | 2021-09-22 | LINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities under certain conditions. This is usually… |
CVE-2021-38388 | High | 8.8 | 2021-09-08 | Central Dogma allows privilege escalation with mirroring to the internal dogma repository that has a file managing the authorization of the project. |
CVE-2021-36216 | High | 7.8 | 2021-09-08 | LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection. |
CVE-2021-36215 | Medium | 5.3 | 2021-09-08 | LINE client for iOS 10.21.3 and before allows address bar spoofing due to inappropriate address handling. |
CVE-2021-36214 | Medium | 6.1 | 2021-07-13 | LINE client for iOS before 10.16.3 allows cross site script with specific header in WebView. |
CVE-2019-16771 | Medium | 4.8 | 2019-12-06 | Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP heade… |
CVE-2019-6010 | High | 7.8 | 2019-09-19 | Integer overflow vulnerability in LINE(Android) from 4.4.0 to the version before 9.15.1 allows remote attackers to cause a denial of service (DoS) condition or… |
CVE-2019-6007 | High | 8.8 | 2019-09-12 | Integer overflow vulnerability in apng-drawable 1.0.0 to 1.6.0 allows an attacker to cause a denial of service (DoS) condition or execute arbitrary code via un… |
CVE-2018-0650 | High | 7.4 | 2018-09-07 | The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacke… |
CVE-2018-13446 | High | 7.0 | 2018-08-16 | An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runtime manipulation tha… |
CVE-2018-13435 | High | 7.0 | 2018-08-16 | An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that fo… |
CVE-2018-13434 | Medium | 6.3 | 2018-08-16 | An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypas… |
CVE-2018-0609 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified di… |
CVE-2018-0518 | Medium | 5.9 | 2018-02-23 | LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain s… |
CVE-2016-4850 | High | 8.1 | 2017-04-20 | LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code. |
CVE-2016-4831 | High | 7.8 | 2016-07-12 | Untrusted search path vulnerability in LINE and LINE Installer 4.7.0 and earlier on Windows allows local users to gain privileges via a Trojan horse DLL in an… |
CVE-2016-1156 | Medium | 5.7 | 2016-02-19 | LINE 4.3.0.724 and earlier on Windows and 4.3.1 and earlier on OS X allows remote authenticated users to cause a denial of service (application crash) via a cr… |
CVE-2013-7144 | | 2014-08-16 | LINE 3.2.1.83 and earlier on Windows and 3.2.1 and earlier on OS X does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacker… |