Naver Ngrinder
7 CVEs affecting Naver Ngrinder. Latest disclosed: 2024-03-07. Critical: 3, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-28213 | Critical | 9.8 | 2024-03-07 | nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsa… |
CVE-2024-28212 | Critical | 9.8 | 2024-03-07 | nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization. |
CVE-2024-28211 | Critical | 9.8 | 2024-03-07 | nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote… |
CVE-2024-28215 | High | 7.5 | 2024-03-07 | nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information discl… |
CVE-2016-5060 | Medium | 6.1 | 2016-12-13 | Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) descriptio… |
CVE-2024-28216 | Medium | 5.4 | 2024-03-07 | nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information discl… |
CVE-2024-28214 | Low | 2.7 | 2024-03-07 | nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker. |