Skip to content
Noroxi

NAVER records

25 published records for vendor naver.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
6
With a fix record
12%
Median publish → KEV
No record has entered KEV

Records by year

  1. 16
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

25 records
  • CVE-2021-33592
    40Plan

    NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file.

    CriticalCVSS 9.8No exploitEPSS 2%

    naver · toolbarJul 19, 2021

  • CVE-2024-28213
    39Monitor

    nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbi

    CriticalCVSS 9.8No exploitEPSS 1%

    naver · ngrinderMar 7, 2024

  • CVE-2020-9752
    39Monitor

    Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through i

    CriticalCVSS 9.8No exploitEPSS 1%

    naver · cloud explorerMar 22, 2020

  • CVE-2024-28212
    39Monitor

    nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.

    CriticalCVSS 9.8No exploitEPSS 1%

    naver · ngrinderMar 7, 2024

  • CVE-2025-49223
    39Monitor

    billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    naver · billboard.jsJun 3, 2025

  • CVE-2024-28211
    39Monitor

    nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI

    CriticalCVSS 9.8No exploitEPSS 0%

    naver · ngrinderMar 7, 2024

  • CVE-2024-40618
    38Monitor

    Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in

    CriticalCVSS 9.6No exploitEPSS 0%

    naver · naver whale browserJul 10, 2024

  • CVE-2020-9753
    36Monitor

    Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.

    CriticalCVSS 9.1No exploitEPSS 1%

    naver · whale browser installerMay 19, 2020

  • CVE-2020-9751
    36Monitor

    Naver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the attacker's server and execute it during the up

    CriticalCVSS 9.1No exploitEPSS 0%

    naver · cloud explorerMar 3, 2020

  • CVE-2021-33591
    35Monitor

    An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted H

    HighCVSS 8.8No exploitEPSS 1%

    naver · comic viewerMay 28, 2021

  • CVE-2022-24077
    31Monitor

    Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection.

    HighCVSS 7.8No exploitEPSS 0%

    naver · cloud explorerJun 13, 2022

  • CVE-2019-13157
    30Monitor

    nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename withi

    HighCVSS 7.5No exploitEPSS 1%

    naver · vaccineNov 21, 2019

  • CVE-2019-13156
    30Monitor

    NDrive(1.2.2).sys in Naver Cloud Explorer has a stack-based buffer overflow, which allows attackers to cause a denial of service when readin

    HighCVSS 7.5No exploitEPSS 1%

    naver · cloud explorerSep 3, 2019

  • CVE-2024-28215
    30Monitor

    nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause o

    HighCVSS 7.5No exploitEPSS 0%

    naver · ngrinderMar 7, 2024

  • CVE-2016-5060
    25Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via

    MediumCVSS 6.1No exploitEPSS 1%

    naver · ngrinderDec 13, 2016

  • CVE-2026-23768
    24Monitor

    lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListen

    MediumCVSS 6.1No exploitEPSS 0%

    naver · lucy-xss-filterJan 16, 2026

  • CVE-2026-23769
    24Monitor

    lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigure

    MediumCVSS 6.1No exploitEPSS 0%

    naver · lucy-xss-filterJan 16, 2026

  • CVE-2026-1513
    24Monitor

    billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.

    MediumCVSS 6.1No exploitEPSS 0%

    naver · billboard.jsJan 27, 2026

  • CVE-2023-25632
    22Monitor

    The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature.

    MediumCVSS 5.5No exploitEPSS 0%

    naver · whale browserNov 27, 2023

  • CVE-2024-28216
    21Monitor

    nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause o

    MediumCVSS 5.4No exploitEPSS 0%

    naver · ngrinderMar 7, 2024

  • CVE-2014-6980
    21Monitor

    The LINE PLAY (aka jp.naver.lineplay.android) application 2.3.1.1 for Android does not verify X.509 certificates from SSL servers, which all

    MediumCVSS 5.4No exploitEPSS 0%

    naver · line playOct 16, 2014

  • CVE-2012-4005
    20Monitor

    The NHN Japan NAVER LINE application before 2.5.5 for Android does not properly handle implicit intents, which allows remote attackers to ob

    MediumCVSS 5.0No exploitEPSS 1%

    naver · nhn japan naver lineAug 7, 2012

  • CVE-2012-5182
    17Monitor

    The Loctouch application 3.4.6 and earlier for Android does not properly handle implicit intents, which allows attackers to obtain sensitive

    MediumCVSS 4.3No exploitEPSS 0%

    naver · loctouchDec 26, 2012

  • CVE-2012-5183
    10Monitor

    The Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted

    LowCVSS 2.6No exploitEPSS 0%

    naver · loctouchDec 26, 2012

  • CVE-2024-28214
    10Monitor

    nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.

    LowCVSS 2.7No exploitEPSS 0%

    naver · ngrinderMar 7, 2024