Ly Corporation
Monthly
Man-in-the-middle exposure in LINE's Armeria (armeria-xds module) versions prior to 1.41.0, where TLS peer (certificate) verification on xDS-managed upstream connections can be silently disabled, causing the client to trust unauthenticated or spoofed upstreams. Any attacker positioned on the network path between an armeria-xds client and its xDS-configured upstream service can intercept, read, and tamper with traffic that operators believe is protected by TLS. Reported by LY-Corporation; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
DLL hijacking in the LINE for Windows installer (LineInst.exe) enables arbitrary code execution when a victim runs the installer after an attacker has pre-positioned a malicious Msftedit.dll in the same directory. All LINE for Windows versions prior to 26.4.0 load this Microsoft Rich Edit control library via a relative path, bypassing Windows secure DLL loading practices and allowing the installer's current directory - commonly a user-writable location such as Downloads - to shadow the legitimate System32 copy. No public exploit code has been identified and no active exploitation has been confirmed; the vulnerability is transient, existing only during the installation phase and not in the running application.
Code injection in the LINE Android app (prior to version 26.7.2) allows an attacker who controls a LINE profile to embed malicious script content in profile templates, which executes with the app's full privileges when a victim views that profile. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact against the vulnerable system, with network-accessible, zero-privilege exploitation requiring only passive victim interaction. Critically, LY Corporation has deployed a server-side mitigation that protects even unpatched Android clients; no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Cluster-wide remote code execution in LY Corporation's centraldogma-server prior to 0.84.0 occurs when ZooKeeper replication is enabled without explicitly configuring replication.secret, causing the embedded ZooKeeper ensemble to authenticate using a hard-coded, publicly known fallback credential. An adjacent attacker with network reachability to the replication ports can read the entire replication log or join the quorum to issue arbitrary replicated commands. No public exploit identified at time of analysis, but the issue is a default-credential failure that is trivial to weaponize once discovered.
Man-in-the-middle attacks against LY Corporation's Central Dogma server can compromise mirrored Git repositories in versions of the centraldogma-server-mirror-git module prior to 0.84.0, because the embedded SSH client accepts any host key presented over git+ssh:// connections. An on-path attacker between Central Dogma and the upstream Git server can impersonate that server, inject malicious commits, and silently poison every downstream consumer that reads from the mirror. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
LDAP injection in Central Dogma's Apache Shiro-based authentication module exposes unauthenticated remote attackers to authentication confusion and Active Directory enumeration. The SearchFirstActiveDirectoryRealm component in centraldogma-server-auth-shiro versions prior to 0.84.0 inserts the login username directly into an LDAP search filter without escaping metacharacters, allowing filter logic manipulation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or preconditions are required beyond reaching the login endpoint. No public exploit or CISA KEV listing has been identified at time of analysis.
Man-in-the-middle exposure in LINE's Armeria (armeria-xds module) versions prior to 1.41.0, where TLS peer (certificate) verification on xDS-managed upstream connections can be silently disabled, causing the client to trust unauthenticated or spoofed upstreams. Any attacker positioned on the network path between an armeria-xds client and its xDS-configured upstream service can intercept, read, and tamper with traffic that operators believe is protected by TLS. Reported by LY-Corporation; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
DLL hijacking in the LINE for Windows installer (LineInst.exe) enables arbitrary code execution when a victim runs the installer after an attacker has pre-positioned a malicious Msftedit.dll in the same directory. All LINE for Windows versions prior to 26.4.0 load this Microsoft Rich Edit control library via a relative path, bypassing Windows secure DLL loading practices and allowing the installer's current directory - commonly a user-writable location such as Downloads - to shadow the legitimate System32 copy. No public exploit code has been identified and no active exploitation has been confirmed; the vulnerability is transient, existing only during the installation phase and not in the running application.
Code injection in the LINE Android app (prior to version 26.7.2) allows an attacker who controls a LINE profile to embed malicious script content in profile templates, which executes with the app's full privileges when a victim views that profile. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact against the vulnerable system, with network-accessible, zero-privilege exploitation requiring only passive victim interaction. Critically, LY Corporation has deployed a server-side mitigation that protects even unpatched Android clients; no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Cluster-wide remote code execution in LY Corporation's centraldogma-server prior to 0.84.0 occurs when ZooKeeper replication is enabled without explicitly configuring replication.secret, causing the embedded ZooKeeper ensemble to authenticate using a hard-coded, publicly known fallback credential. An adjacent attacker with network reachability to the replication ports can read the entire replication log or join the quorum to issue arbitrary replicated commands. No public exploit identified at time of analysis, but the issue is a default-credential failure that is trivial to weaponize once discovered.
Man-in-the-middle attacks against LY Corporation's Central Dogma server can compromise mirrored Git repositories in versions of the centraldogma-server-mirror-git module prior to 0.84.0, because the embedded SSH client accepts any host key presented over git+ssh:// connections. An on-path attacker between Central Dogma and the upstream Git server can impersonate that server, inject malicious commits, and silently poison every downstream consumer that reads from the mirror. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
LDAP injection in Central Dogma's Apache Shiro-based authentication module exposes unauthenticated remote attackers to authentication confusion and Active Directory enumeration. The SearchFirstActiveDirectoryRealm component in centraldogma-server-auth-shiro versions prior to 0.84.0 inserts the login username directly into an LDAP search filter without escaping metacharacters, allowing filter logic manipulation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or preconditions are required beyond reaching the login endpoint. No public exploit or CISA KEV listing has been identified at time of analysis.