Vulnerabilites related to navercorp - whale
Vulnerability from fkie_nvd
Published
2022-03-17 06:15
Modified
2024-11-21 06:49
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files.
References
cve@navercorp.comhttps://cve.naver.com/detail/cve-2022-24075Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2022-24075Vendor Advisory
Impacted products
Vendor Product Version
navercorp whale *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "47138F1B-655D-4459-905C-7BFA3A326DC5",
              "versionEndExcluding": "3.12.129.18",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files."
    },
    {
      "lang": "es",
      "value": "Whale browser versiones anteriores a 3.12.129.18, permit\u00eda que las extensiones sustituyeran a archivos JavaScript del sitio web del visualizador de HWP que pod\u00edan acceder a archivos locales de HWP. Cuando eran abiertos archivos HWP, el script sustituido pod\u00eda leer los archivos"
    }
  ],
  "id": "CVE-2022-24075",
  "lastModified": "2024-11-21T06:49:46.480",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-17T06:15:06.950",
  "references": [
    {
      "source": "cve@navercorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2022-24075"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2022-24075"
    }
  ],
  "sourceIdentifier": "cve@navercorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ],
      "source": "cve@navercorp.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-03-17 06:15
Modified
2024-11-21 06:49
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises.
References
cve@navercorp.comhttps://cve.naver.com/detail/cve-2022-24074Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2022-24074Vendor Advisory
Impacted products
Vendor Product Version
navercorp whale *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "47138F1B-655D-4459-905C-7BFA3A326DC5",
              "versionEndExcluding": "3.12.129.18",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises."
    },
    {
      "lang": "es",
      "value": "Whale Bridge, una extensi\u00f3n por defecto en el navegador Whale versiones anteriores a 3.12.129.18, permit\u00eda recibir cualquier petici\u00f3n SendMessage desde el propio script de contenido que pod\u00eda conllevar a el control de Whale Bridge si el proceso de renderizado es comprometido"
    }
  ],
  "id": "CVE-2022-24074",
  "lastModified": "2024-11-21T06:49:46.380",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-17T06:15:06.887",
  "references": [
    {
      "source": "cve@navercorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2022-24074"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2022-24074"
    }
  ],
  "sourceIdentifier": "cve@navercorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ],
      "source": "cve@navercorp.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-07-03 15:29
Modified
2024-11-21 04:12
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank page, which allows an attacker to display a malicious web page with a fake domain name.
References
cve@mitre.orghttps://cve.naver.com/detail/cve-2018-7635.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2018-7635.htmlThird Party Advisory
Impacted products
Vendor Product Version
navercorp whale *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "18C45428-F89F-4284-BAD5-094B21EC1C00",
              "versionEndExcluding": "1.0.41.8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser\u0027s address bar when visiting a blank page, which allows an attacker to display a malicious web page with a fake domain name."
    },
    {
      "lang": "es",
      "value": "Whale Browser en versiones anteriores a la 1.0.41.8 no muestra informaci\u00f3n de URL, solo un t\u00edtulo de una p\u00e1gina web en la barra de direcciones del navegador cuando se visita una p\u00e1gina en blanco, lo que permite a un atacante mostrar una p\u00e1gina web maliciosa con un nombre de dominio falso."
    }
  ],
  "id": "CVE-2018-7635",
  "lastModified": "2024-11-21T04:12:26.790",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-07-03T15:29:00.220",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2018-7635.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2018-7635.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-11-02 07:15
Modified
2024-11-21 06:09
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing.
References
cve@navercorp.comhttps://cve.naver.com/detail/cve-2021-43059Broken Link, Not Applicable
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2021-43059Broken Link, Not Applicable
Impacted products
Vendor Product Version
navercorp whale *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:iphone_os:*:*",
              "matchCriteriaId": "549F9B1E-B0BF-40BB-B8C6-D693393A2F52",
              "versionEndExcluding": "1.14.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing."
    },
    {
      "lang": "es",
      "value": "Whale browser para iOS versiones anteriores a 1.14.0 presenta un problema de inconsistencia en la interfaz de usuario que permite a un atacante ofuscar la barra de direcciones, que puede conllevar a una suplantaci\u00f3n de la barra de direcciones"
    }
  ],
  "id": "CVE-2021-33593",
  "lastModified": "2024-11-21T06:09:09.720",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-11-02T07:15:07.220",
  "references": [
    {
      "source": "cve@navercorp.com",
      "tags": [
        "Broken Link",
        "Not Applicable"
      ],
      "url": "https://cve.naver.com/detail/cve-2021-43059"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Not Applicable"
      ],
      "url": "https://cve.naver.com/detail/cve-2021-43059"
    }
  ],
  "sourceIdentifier": "cve@navercorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-451"
        }
      ],
      "source": "cve@navercorp.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-08-02 13:29
Modified
2024-11-21 03:45
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name.
References
cve@navercorp.comhttps://cve.naver.com/detail/cve-2018-12448.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2018-12448.htmlVendor Advisory
Impacted products
Vendor Product Version
navercorp whale *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "34165235-7B35-456E-8762-E3E89E49A19C",
              "versionEndExcluding": "1.3.48.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser\u0027s address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name."
    },
    {
      "lang": "es",
      "value": "Whale Browser en versiones anteriores a la 1.3.48.4 no muestra informaci\u00f3n de la URL; solo un t\u00edtulo de p\u00e1gina web en la barra de direcciones del navegador al visitar una p\u00e1gina que no es HTTP. Esto permite que un atacante muestre una p\u00e1gina web maliciosa con un nombre de dominio falso."
    }
  ],
  "id": "CVE-2018-12448",
  "lastModified": "2024-11-21T03:45:14.387",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-08-02T13:29:00.267",
  "references": [
    {
      "source": "cve@navercorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2018-12448.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2018-12448.html"
    }
  ],
  "sourceIdentifier": "cve@navercorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "cve@navercorp.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-03-17 06:15
Modified
2024-11-21 06:49
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool.
References
cve@navercorp.comhttps://cve.naver.com/detail/cve-2022-24072Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2022-24072Vendor Advisory
Impacted products
Vendor Product Version
navercorp whale *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "47138F1B-655D-4459-905C-7BFA3A326DC5",
              "versionEndExcluding": "3.12.129.18",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool."
    },
    {
      "lang": "es",
      "value": "La API devtools en Whale browser versiones anteriores a 3.12.129.18, permit\u00eda a desarrolladores de extensiones inyectar JavaScript arbitrario en la p\u00e1gina web de la tienda de extensiones por medio de devtools.inspectedWindow, conllevando a una descarga y carga de extensiones cuando los usuarios abr\u00edan la herramienta para desarrolladores"
    }
  ],
  "id": "CVE-2022-24072",
  "lastModified": "2024-11-21T06:49:46.170",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-17T06:15:06.627",
  "references": [
    {
      "source": "cve@navercorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2022-24072"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2022-24072"
    }
  ],
  "sourceIdentifier": "cve@navercorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "cve@navercorp.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-01-08 03:29
Modified
2024-11-21 03:15
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
The Installer in Whale allows DLL hijacking.
References
cve@mitre.orghttps://bugbounty.whale.naver.com/en/halloffameIssue Tracking
cve@mitre.orghttps://cve.naver.com/detail/cve-2017-15913.html
af854a3a-2127-422b-91ae-364da2661108https://bugbounty.whale.naver.com/en/halloffameIssue Tracking
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2017-15913.html
Impacted products
Vendor Product Version
navercorp whale -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7BDBAD1-1D8D-458F-9573-8A3DF95779D2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Installer in Whale allows DLL hijacking."
    },
    {
      "lang": "es",
      "value": "El instalador en Whale permite que se produzca un ataque de secuestro de DLL."
    }
  ],
  "id": "CVE-2017-15913",
  "lastModified": "2024-11-21T03:15:26.713",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-01-08T03:29:00.203",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://bugbounty.whale.naver.com/en/halloffame"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://cve.naver.com/detail/cve-2017-15913.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://bugbounty.whale.naver.com/en/halloffame"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://cve.naver.com/detail/cve-2017-15913.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-10-11 13:29
Modified
2024-11-21 03:45
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking.
References
cve@navercorp.comhttps://cve.naver.com/detail/cve-2018-12449Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2018-12449Vendor Advisory
Impacted products
Vendor Product Version
navercorp whale *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "49389CDD-96E7-4154-81AA-13B041DCB0DD",
              "versionEndIncluding": "0.4.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking."
    },
    {
      "lang": "es",
      "value": "El instalador del navegador Whale en versiones 0.4.3.0 y anteriores permite el secuestro de DLL."
    }
  ],
  "id": "CVE-2018-12449",
  "lastModified": "2024-11-21T03:45:14.500",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-10-11T13:29:00.297",
  "references": [
    {
      "source": "cve@navercorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2018-12449"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2018-12449"
    }
  ],
  "sourceIdentifier": "cve@navercorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ],
      "source": "cve@navercorp.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-03-17 06:15
Modified
2024-11-21 06:49
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Summary
The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.
References
cve@navercorp.comhttps://cve.naver.com/detail/cve-2022-24073Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2022-24073Vendor Advisory
Impacted products
Vendor Product Version
navercorp whale *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "47138F1B-655D-4459-905C-7BFA3A326DC5",
              "versionEndExcluding": "3.12.129.18",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store."
    },
    {
      "lang": "es",
      "value": "La API de peticiones Web en Whale browser versiones anteriores a 3.12.129.18 permit\u00eda denegar el acceso a la tienda de extensiones o redirigir a cualquier URL cuando los usuarios acced\u00edan a la tienda"
    }
  ],
  "id": "CVE-2022-24073",
  "lastModified": "2024-11-21T06:49:46.273",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.8,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-17T06:15:06.827",
  "references": [
    {
      "source": "cve@navercorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2022-24073"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2022-24073"
    }
  ],
  "sourceIdentifier": "cve@navercorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-648"
        }
      ],
      "source": "cve@navercorp.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-01-28 11:15
Modified
2024-11-21 06:49
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Summary
A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal APIs.
References
cve@navercorp.comhttps://cve.naver.com/detail/cve-2022-24071Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2022-24071Vendor Advisory
Impacted products
Vendor Product Version
navercorp whale *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:iphone_os:*:*",
              "matchCriteriaId": "549F9B1E-B0BF-40BB-B8C6-D693393A2F52",
              "versionEndExcluding": "1.14.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal APIs."
    },
    {
      "lang": "es",
      "value": "Una extensi\u00f3n incorporada en Whale browser versiones anteriores a 3.12.129.46, permite a atacantes comprometer el proceso de renderizado, lo que podr\u00eda conllevar a un control de las API internas del navegador"
    }
  ],
  "id": "CVE-2022-24071",
  "lastModified": "2024-11-21T06:49:46.060",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-01-28T11:15:08.290",
  "references": [
    {
      "source": "cve@navercorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2022-24071"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2022-24071"
    }
  ],
  "sourceIdentifier": "cve@navercorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-648"
        }
      ],
      "source": "cve@navercorp.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-06-27 02:15
Modified
2024-11-21 05:41
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.
References
cve@navercorp.comhttps://cve.naver.com/detail/cve-2020-9754.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2020-9754.htmlVendor Advisory
Impacted products
Vendor Product Version
navercorp whale *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0FE3C89-6E05-4348-8F00-CE4FFB9C4D5F",
              "versionEndExcluding": "1.10.6.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode."
    },
    {
      "lang": "es",
      "value": "La aplicaci\u00f3n m\u00f3vil del navegador NAVER Whale versiones anteriores a 1.10.6.2 permite al atacante omitir su funci\u00f3n de desbloqueo del navegador por medio del modo inc\u00f3gnito"
    }
  ],
  "id": "CVE-2020-9754",
  "lastModified": "2024-11-21T05:41:13.317",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-06-27T02:15:06.977",
  "references": [
    {
      "source": "cve@navercorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2020-9754.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2020-9754.html"
    }
  ],
  "sourceIdentifier": "cve@navercorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "cve@navercorp.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-06-16 01:29
Modified
2024-11-21 04:15
Severity ?
8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7. This vulnerability can be used for persistent privilege escalation if it's available to create an executable file with System privilege by other vulnerable applications.
References
cve@mitre.orghttps://cve.naver.com/detail/cve-2018-9859.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cve.naver.com/detail/cve-2018-9859.htmlVendor Advisory
Impacted products
Vendor Product Version
navercorp whale *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:navercorp:whale:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF559417-F851-4010-9D9F-39B056DCF13B",
              "versionEndExcluding": "1.0.40.7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7. This vulnerability can be used for persistent privilege escalation if it\u0027s available to create an executable file with System privilege by other vulnerable applications."
    },
    {
      "lang": "es",
      "value": "La ruta del servicio de actualizaci\u00f3n Whale no ten\u00eda comillas en NAVER Whale en versiones anteriores a la 1.0.40.7. Esta vulnerabilidad puede emplearse para el escalado de privilegios persistente si est\u00e1 disponible para crear un archivo ejecutable con privilegios System por parte de otras aplicaciones vulnerables."
    }
  ],
  "id": "CVE-2018-9859",
  "lastModified": "2024-11-21T04:15:49.410",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-06-16T01:29:09.680",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2018-9859.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cve.naver.com/detail/cve-2018-9859.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2017-15913 (GCVE-0-2017-15913)
Vulnerability from cvelistv5
Published
2018-01-08 03:00
Modified
2024-08-05 20:04
Severity ?
CWE
  • n/a
Summary
The Installer in Whale allows DLL hijacking.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:04:50.389Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugbounty.whale.naver.com/en/halloffame"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2017-15913.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-01-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Installer in Whale allows DLL hijacking."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-15T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugbounty.whale.naver.com/en/halloffame"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cve.naver.com/detail/cve-2017-15913.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-15913",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Installer in Whale allows DLL hijacking."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugbounty.whale.naver.com/en/halloffame",
              "refsource": "CONFIRM",
              "url": "https://bugbounty.whale.naver.com/en/halloffame"
            },
            {
              "name": "https://cve.naver.com/detail/cve-2017-15913.html",
              "refsource": "CONFIRM",
              "url": "https://cve.naver.com/detail/cve-2017-15913.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-15913",
    "datePublished": "2018-01-08T03:00:00",
    "dateReserved": "2017-10-25T00:00:00",
    "dateUpdated": "2024-08-05T20:04:50.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24071 (GCVE-0-2022-24071)
Vulnerability from cvelistv5
Published
2022-01-28 10:04
Modified
2024-08-03 03:59
Severity ?
CWE
  • CWE-648 - Incorrect Use of Privileged APIs
Summary
A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal APIs.
References
Impacted products
Vendor Product Version
NAVER NAVER Whale browser Version: unspecified   < 3.12.129.46
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:59:23.786Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2022-24071"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NAVER Whale browser",
          "vendor": "NAVER",
          "versions": [
            {
              "lessThan": "3.12.129.46",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Young Min Kim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal APIs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-648",
              "description": "CWE-648: Incorrect Use of Privileged APIs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-01-28T10:04:53",
        "orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
        "shortName": "naver"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cve.naver.com/detail/cve-2022-24071"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@navercorp.com",
          "ID": "CVE-2022-24071",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "NAVER Whale browser",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "3.12.129.46"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NAVER"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Young Min Kim"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal APIs."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-648: Incorrect Use of Privileged APIs"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cve.naver.com/detail/cve-2022-24071",
              "refsource": "CONFIRM",
              "url": "https://cve.naver.com/detail/cve-2022-24071"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
    "assignerShortName": "naver",
    "cveId": "CVE-2022-24071",
    "datePublished": "2022-01-28T10:04:53",
    "dateReserved": "2022-01-27T00:00:00",
    "dateUpdated": "2024-08-03T03:59:23.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24073 (GCVE-0-2022-24073)
Vulnerability from cvelistv5
Published
2022-03-17 05:20
Modified
2024-08-03 03:59
Severity ?
CWE
  • CWE-648 - Incorrect Use of Privileged APIs
Summary
The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.
References
Impacted products
Vendor Product Version
NAVER NAVER Whale browser Version: unspecified   < 3.12.129.46
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:59:23.677Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2022-24073"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NAVER Whale browser",
          "vendor": "NAVER",
          "versions": [
            {
              "lessThan": "3.12.129.46",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Young Min Kim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-648",
              "description": "CWE-648: Incorrect Use of Privileged APIs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-17T05:20:14",
        "orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
        "shortName": "naver"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cve.naver.com/detail/cve-2022-24073"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@navercorp.com",
          "ID": "CVE-2022-24073",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "NAVER Whale browser",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "3.12.129.46"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NAVER"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Young Min Kim"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-648: Incorrect Use of Privileged APIs"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cve.naver.com/detail/cve-2022-24073",
              "refsource": "CONFIRM",
              "url": "https://cve.naver.com/detail/cve-2022-24073"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
    "assignerShortName": "naver",
    "cveId": "CVE-2022-24073",
    "datePublished": "2022-03-17T05:20:14",
    "dateReserved": "2022-01-27T00:00:00",
    "dateUpdated": "2024-08-03T03:59:23.677Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-9754 (GCVE-0-2020-9754)
Vulnerability from cvelistv5
Published
2022-06-27 01:40
Modified
2024-08-04 10:43
Severity ?
CWE
  • CWE-284 - Improper Access Control
Summary
NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.
References
Impacted products
Vendor Product Version
NAVER NAVER Whale browser Version: unspecified   < 1.10.6.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:43:04.600Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2020-9754.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NAVER Whale browser",
          "vendor": "NAVER",
          "versions": [
            {
              "lessThan": "1.10.6.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jaeyong Bae(jdragon.bae@gmail.com)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-27T01:40:09",
        "orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
        "shortName": "naver"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cve.naver.com/detail/cve-2020-9754.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@navercorp.com",
          "ID": "CVE-2020-9754",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "NAVER Whale browser",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.10.6.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NAVER"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Jaeyong Bae(jdragon.bae@gmail.com)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-284: Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cve.naver.com/detail/cve-2020-9754.html",
              "refsource": "CONFIRM",
              "url": "https://cve.naver.com/detail/cve-2020-9754.html"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
    "assignerShortName": "naver",
    "cveId": "CVE-2020-9754",
    "datePublished": "2022-06-27T01:40:09",
    "dateReserved": "2020-03-02T00:00:00",
    "dateUpdated": "2024-08-04T10:43:04.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-9859 (GCVE-0-2018-9859)
Vulnerability from cvelistv5
Published
2018-06-15 21:00
Modified
2024-08-05 07:24
Severity ?
CWE
  • n/a
Summary
The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7. This vulnerability can be used for persistent privilege escalation if it's available to create an executable file with System privilege by other vulnerable applications.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:24:56.265Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2018-9859.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-06-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7. This vulnerability can be used for persistent privilege escalation if it\u0027s available to create an executable file with System privilege by other vulnerable applications."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-15T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cve.naver.com/detail/cve-2018-9859.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-9859",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7. This vulnerability can be used for persistent privilege escalation if it\u0027s available to create an executable file with System privilege by other vulnerable applications."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cve.naver.com/detail/cve-2018-9859.html",
              "refsource": "CONFIRM",
              "url": "https://cve.naver.com/detail/cve-2018-9859.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-9859",
    "datePublished": "2018-06-15T21:00:00",
    "dateReserved": "2018-04-09T00:00:00",
    "dateUpdated": "2024-08-05T07:24:56.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-12448 (GCVE-0-2018-12448)
Vulnerability from cvelistv5
Published
2018-08-02 13:00
Modified
2024-08-05 08:38
Severity ?
CWE
Summary
Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name.
References
Impacted products
Vendor Product Version
NAVER Corporation Whale Browser Version: unspecified   < 1.3.48.4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:38:05.941Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2018-12448.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Whale Browser",
          "vendor": "NAVER Corporation",
          "versions": [
            {
              "lessThan": "1.3.48.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "YongShao (Zhiyong Feng) of Mobike Security Team"
        }
      ],
      "datePublic": "2018-08-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser\u0027s address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-02T12:57:01",
        "orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
        "shortName": "naver"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cve.naver.com/detail/cve-2018-12448.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@navercorp.com",
          "ID": "CVE-2018-12448",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Whale Browser",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_value": "1.3.48.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NAVER Corporation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "YongShao (Zhiyong Feng) of Mobike Security Team"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser\u0027s address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cve.naver.com/detail/cve-2018-12448.html",
              "refsource": "MISC",
              "url": "https://cve.naver.com/detail/cve-2018-12448.html"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
    "assignerShortName": "naver",
    "cveId": "CVE-2018-12448",
    "datePublished": "2018-08-02T13:00:00",
    "dateReserved": "2018-06-15T00:00:00",
    "dateUpdated": "2024-08-05T08:38:05.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-33593 (GCVE-0-2021-33593)
Vulnerability from cvelistv5
Published
2021-11-02 06:20
Modified
2024-08-03 23:50
Severity ?
CWE
  • CWE-451 - User Interface (UI) Misrepresentation of Critical Information
Summary
Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing.
References
Impacted products
Vendor Product Version
NAVER NAVER Whale browser Version: unspecified   < 1.14.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:50:43.208Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2021-43059"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NAVER Whale browser",
          "vendor": "NAVER",
          "versions": [
            {
              "lessThan": "1.14.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "YoKo Kho from Telkom Indonesia"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-451",
              "description": "CWE-451: User Interface (UI) Misrepresentation of Critical Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-02T06:20:09",
        "orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
        "shortName": "naver"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cve.naver.com/detail/cve-2021-43059"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@navercorp.com",
          "ID": "CVE-2021-33593",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "NAVER Whale browser",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.14.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NAVER"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "YoKo Kho from Telkom Indonesia"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-451: User Interface (UI) Misrepresentation of Critical Information"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cve.naver.com/detail/cve-2021-43059",
              "refsource": "CONFIRM",
              "url": "https://cve.naver.com/detail/cve-2021-43059"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
    "assignerShortName": "naver",
    "cveId": "CVE-2021-33593",
    "datePublished": "2021-11-02T06:20:09",
    "dateReserved": "2021-05-27T00:00:00",
    "dateUpdated": "2024-08-03T23:50:43.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24074 (GCVE-0-2022-24074)
Vulnerability from cvelistv5
Published
2022-03-17 05:20
Modified
2024-08-03 03:59
Severity ?
CWE
  • CWE-668 - Exposure of Resource to Wrong Sphere
Summary
Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises.
References
Impacted products
Vendor Product Version
NAVER NAVER Whale browser Version: unspecified   < 3.12.129.46
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:59:23.649Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2022-24074"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NAVER Whale browser",
          "vendor": "NAVER",
          "versions": [
            {
              "lessThan": "3.12.129.46",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Young Min Kim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-668",
              "description": "CWE-668: Exposure of Resource to Wrong Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-17T05:20:16",
        "orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
        "shortName": "naver"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cve.naver.com/detail/cve-2022-24074"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@navercorp.com",
          "ID": "CVE-2022-24074",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "NAVER Whale browser",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "3.12.129.46"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NAVER"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Young Min Kim"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-668: Exposure of Resource to Wrong Sphere"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cve.naver.com/detail/cve-2022-24074",
              "refsource": "CONFIRM",
              "url": "https://cve.naver.com/detail/cve-2022-24074"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
    "assignerShortName": "naver",
    "cveId": "CVE-2022-24074",
    "datePublished": "2022-03-17T05:20:16",
    "dateReserved": "2022-01-27T00:00:00",
    "dateUpdated": "2024-08-03T03:59:23.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24075 (GCVE-0-2022-24075)
Vulnerability from cvelistv5
Published
2022-03-17 05:20
Modified
2024-08-03 03:59
Severity ?
CWE
  • CWE-552 - Files or Directories Accessible to External Parties
Summary
Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files.
References
Impacted products
Vendor Product Version
NAVER NAVER Whale browser Version: unspecified   < 3.12.129.46
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:59:23.602Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2022-24075"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NAVER Whale browser",
          "vendor": "NAVER",
          "versions": [
            {
              "lessThan": "3.12.129.46",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Young Min Kim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552: Files or Directories Accessible to External Parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-17T05:20:17",
        "orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
        "shortName": "naver"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cve.naver.com/detail/cve-2022-24075"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@navercorp.com",
          "ID": "CVE-2022-24075",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "NAVER Whale browser",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "3.12.129.46"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NAVER"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Young Min Kim"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-552: Files or Directories Accessible to External Parties"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cve.naver.com/detail/cve-2022-24075",
              "refsource": "CONFIRM",
              "url": "https://cve.naver.com/detail/cve-2022-24075"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
    "assignerShortName": "naver",
    "cveId": "CVE-2022-24075",
    "datePublished": "2022-03-17T05:20:17",
    "dateReserved": "2022-01-27T00:00:00",
    "dateUpdated": "2024-08-03T03:59:23.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-7635 (GCVE-0-2018-7635)
Vulnerability from cvelistv5
Published
2018-07-03 15:00
Modified
2024-08-05 06:31
Severity ?
CWE
  • n/a
Summary
Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank page, which allows an attacker to display a malicious web page with a fake domain name.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:31:05.065Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2018-7635.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-06-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser\u0027s address bar when visiting a blank page, which allows an attacker to display a malicious web page with a fake domain name."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-07-03T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cve.naver.com/detail/cve-2018-7635.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-7635",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser\u0027s address bar when visiting a blank page, which allows an attacker to display a malicious web page with a fake domain name."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cve.naver.com/detail/cve-2018-7635.html",
              "refsource": "MISC",
              "url": "https://cve.naver.com/detail/cve-2018-7635.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-7635",
    "datePublished": "2018-07-03T15:00:00",
    "dateReserved": "2018-03-02T00:00:00",
    "dateUpdated": "2024-08-05T06:31:05.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-12449 (GCVE-0-2018-12449)
Vulnerability from cvelistv5
Published
2018-10-11 13:00
Modified
2024-08-05 08:38
Severity ?
CWE
Summary
The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking.
References
Impacted products
Vendor Product Version
NAVER Corporation Whale Browser Installer Version: unspecified   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:38:06.398Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2018-12449"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Whale Browser Installer",
          "vendor": "NAVER Corporation",
          "versions": [
            {
              "lessThanOrEqual": "0.4.3.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Kushal Arvind Shah of Fortinet\u0027s FortiGuard Labs"
        }
      ],
      "datePublic": "2018-10-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T12:57:01",
        "orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
        "shortName": "naver"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cve.naver.com/detail/cve-2018-12449"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@navercorp.com",
          "ID": "CVE-2018-12449",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Whale Browser Installer",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "0.4.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NAVER Corporation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Kushal Arvind Shah of Fortinet\u0027s FortiGuard Labs"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-426"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cve.naver.com/detail/cve-2018-12449",
              "refsource": "CONFIRM",
              "url": "https://cve.naver.com/detail/cve-2018-12449"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
    "assignerShortName": "naver",
    "cveId": "CVE-2018-12449",
    "datePublished": "2018-10-11T13:00:00",
    "dateReserved": "2018-06-15T00:00:00",
    "dateUpdated": "2024-08-05T08:38:06.398Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24072 (GCVE-0-2022-24072)
Vulnerability from cvelistv5
Published
2022-03-17 05:20
Modified
2024-08-03 03:59
Severity ?
CWE
  • CWE-269 - Improper Privilege Management
Summary
The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool.
References
Impacted products
Vendor Product Version
NAVER NAVER Whale browser Version: unspecified   < 3.12.129.46
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:59:23.580Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cve.naver.com/detail/cve-2022-24072"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NAVER Whale browser",
          "vendor": "NAVER",
          "versions": [
            {
              "lessThan": "3.12.129.46",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Young Min Kim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-17T05:20:13",
        "orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
        "shortName": "naver"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cve.naver.com/detail/cve-2022-24072"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@navercorp.com",
          "ID": "CVE-2022-24072",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "NAVER Whale browser",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "3.12.129.46"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NAVER"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Young Min Kim"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-269: Improper Privilege Management"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cve.naver.com/detail/cve-2022-24072",
              "refsource": "CONFIRM",
              "url": "https://cve.naver.com/detail/cve-2022-24072"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6",
    "assignerShortName": "naver",
    "cveId": "CVE-2022-24072",
    "datePublished": "2022-03-17T05:20:13",
    "dateReserved": "2022-01-27T00:00:00",
    "dateUpdated": "2024-08-03T03:59:23.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}