42 matches found
CVE-2026-93147
In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...
CVE-2026-93147 s390/bpf: Replace ly instruction with llgf
In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...
CVE-2026-93147
CVE-2026-93147 affects the Linux kernel on the s390 architecture within the BPF (Berkeley Packet Filter) subsystem. The root cause is that the ly instruction loads the 32-bit value cpu_nr into the 64-bit register BPF_REG_0 without zeroing the upper 32 bits, leaving stale data that can corrupt sub...
EUVD-2026-82255
In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...
LY Yahoo! Shopping App 安全漏洞
LY Yahoo! Shopping App is a shopping mobile application from LY Japan. A security vulnerability exists in LY Yahoo! Shopping App versions prior to 14.15.0, which stems from improper handling of the custom URL scheme and could lead to users becoming victims of phishing attacks...
CLSA-2025-1750697072 glibc: Fix of CVE-2025-4802
CVE-2025-4802: fix issue of untrusted LDLIBRARYPATH environment variable vulnerability by restricting loading of dynamically shared libraries in statically compiled setuid binaries...
PT-2024-34833 · Unknown · Huly Platform
Name of the Vulnerable Software and Affected Versions: Platform.Ly Official versions 1.1.3 and earlier Description: A Cross-Site Request Forgery CSRF issue allows Stored Cross Site Scripting XSS in the affected software. This means an attacker could potentially trick a user into performing...
WordPress Platform.ly Official plugin <= 1.1.3 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Platform.ly Official versions = 1.1.3...
LY Corporation: Client-Side Path Traversal on LINE Developers Console
The LINE Developers Console had a Client-Side Path Traversal vulnerability that led to an effective CSRF. The operations that could be enforced with the CSRF were limited...
Armeria-saml improperly handles SAML messages
Overview Armeria-saml provided by LY Corporation contains an issue in handling SAML messages CWE-304, CVE-2024-1735. LY Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact Authentication may be bypassed by receiving a specially crafted SAML...
JVN#23528780: "Yahoo! JAPAN" App vulnerable to cross-site scripting
"Yahoo! JAPAN" App provided by LY Corporation contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the WebView of "Yahoo! JAPAN" App via other app installed on the user's device. Solution Update the application Update the application to the latest...
LY Corporation: XSS on LINE CAREERS
The recruitment portal of LINE Plus Corporation had a reflected XSS vulnerability that occurred via the query parameter companyNm, allowing potential execution of JavaScript code on the client side...
Arbitrary Code Execution
LilyPond is vulnerable to Arbitrary Code Execution. An attacker can bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope by injecting and executing malicious code through the .ly file...
LY Corporation: Reflected XSS on https://travel.line.me
A reflected cross-site scripting vulnerability was identified in the search feature of the travel platform at https://travel.line.me. JavaScript code in the search parameters was reflected back to the user...
LY Corporation: iOS group chat denial of service
Vulnerability description not provided...
LY Corporation: Stored XSS Via Filename On https://partners.line.me/
An XSS vulnerability was found on the file upload feature of "partners.line.me". Attackers could upload a file with an XSS payload in the filename, which was not properly escaped by the server. This allowed for DOM-based XSS to be embedded in HTML. The uploaded files were stored for a limited tim...
LY Corporation: Bot setting information leakage in OpenChat room
Due to the bug in the authority verification process, it could be possible for the non-admin users to see settings details for Line OpenChat Admin Bot, such as saved scheduled messages and auto-responses...
LY Corporation: Access to images and videos in drafts on LINE BLOG
On LINE BLOG, sequential ID is assigned to each image/video when uploaded, and the ID is converted to actual URL on preview/publish. Due to the bug in the attachment ownership verification process, it could be possible for an attacker to view unpublished images/videos in other users' drafts by...
LY Corporation: Missing authentication in buddy group API of LINE TIMELINE
Due to the bug in authentication logic in LINE TIMELINE buddy group API, it could be possible for an attacker to obtain the authority of another person by manipulating API request headers, which would allow an attacker to inquire and modify the buddy group and buddy group list of another user...