Browse / LY Corporation

LY Corporation

See its reports on the map

Attack surface: 6,222 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to LY Corporation

• Access Control11
• Cross-site Scripting6
• Server-Side Request Forgery5
• Misconfiguration3
• Information Disclosure3
• Authentication3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Request smuggling on admin-official.line.me could lead to account takeoverHTTP Request Smuggling · high
   565 votes
2. Able to Become Admin for Any LINE Official AccountPrivilege Escalation · critical
   493 votes
3. Reflected XSS in OAUTH2 login flow Cross-site Scripting (XSS) - Reflected · medium
   $1,990489 votes
4. Arbitrary Code Execution via npm misconfiguration – installing internal libraries from the public registryCode Injection · critical
   $11,500288 votes
5. Spring Actuator endpoints publicly available and broken authenticationMisconfiguration · critical
   $12,500234 votes
6. Path traversal in filename in LINE Mac clientPath Traversal · high
   175 votes
7. Spring Actuator endpoints publicly available, leading to account takeoverMisconfiguration · critical
   $5,000143 votes
8. SSRF on music.line.me through getXML.phpServer-Side Request Forgery (SSRF) · high
   $4,500135 votes
9. LINE Profile ID leaks in OpenChatInformation Disclosure · high
   $3,000101 votes
10. DOM-based XSS on mobile.line.meCross-site Scripting (XSS) - DOM · high
    93 votes
11. Insufficient access control on all BCRM instances leading to the ability to create admin accounts using the APIImproper Access Control - Generic · high
    88 votes
12. Improper authorization allows disclosing users' notification data in Notification channel serverImproper Authorization · high
    $2,00078 votes
13. CORS misconfiguration leads to users information disclosure at https://studyroom.line.meInformation Disclosure · medium
    73 votes
14. Client-Side Path Traversal on LINE Developers ConsoleCross-Site Request Forgery (CSRF) · medium
    61 votes
15. File sizes may be manipulated into negative numbers when uploadingBusiness Logic Errors · medium
    $50059 votes
16. Get-based SSRF limited to HTTP protocol on https://resizer.line-apps.com/formServer-Side Request Forgery (SSRF) · medium
    $1,35056 votes
17. Missing ownership check in 2FA for secondary client loginImproper Authentication - Generic · critical
    52 votes
18. Missing authentication in buddy group API of LINE TIMELINEImproper Authentication - Generic · medium
    $3,00047 votes
19. page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token CompromiseOpen Redirect · high
    $1,00043 votes
20. iOS group chat denial of serviceUse of a Broken or Risky Cryptographic Algorithm · low
    $30042 votes
21. Stored XSS via SVG Upload in chat.line.bizCross-site Scripting (XSS) - Stored · low
    $10040 votes
22. Path traversal in a Tomcat serverInformation Disclosure
    37 votes
23. Webview in LINE client for iOS will render application/octet-stream files as HTMLImproper Access Control - Generic · medium
    $50037 votes
24. Reflected XSS on https://travel.line.meCross-site Scripting (XSS) - Reflected · low
    $10036 votes
25. Webview address bar spoofing in LINE client for iOSPhishing · low
    36 votes
26. See drafts and post articles if the account owner hasn't set password (livedoor CMS plugin)Improper Authentication - Generic · critical
    35 votes
27. Improper Access Control in LINE Timeline API that returns a list of hidden friendsImproper Access Control - Generic · medium
    $1,34735 votes
28. Path traversal in ZIP extract routine on LINE AndroidPath Traversal · medium
    $47533 votes
29. Blind SSRF in social-plugins.line.meServer-Side Request Forgery (SSRF) · medium
    $10033 votes
30. Bot setting information leakage in OpenChat roomImproper Access Control - Generic · low
    29 votes
31. Debugging panel exposureImproper Access Control - Generic · low
    29 votes
32. Developer uploaded files missing authentication on LINE GAME Developers site(gdc.game.line.me)Improper Access Control - Generic · high
    28 votes
33. XSS on LINE CAREERSCross-site Scripting (XSS) - Reflected · low
    27 votes
34. Stored XSS Via Filename On https://partners.line.me/Cross-site Scripting (XSS) - Stored · low
    $10025 votes
35. DoS of LINE client for Android via message containing multiple unicode characters (0x0e & 0x0f)Uncontrolled Resource Consumption · medium
    23 votes
36. Password reset by malicious input on air.line.meImproper Access Control - Generic
    23 votes
37. Use of unreleased features in programming education service (https://entry.line.me)Business Logic Errors · medium
    21 votes
38. Access to images and videos in drafts on LINE BLOGImproper Access Control - Generic · medium
    19 votes
39. Deleting someone else's profile image with a GraphQL query in programming education service (https://entry.line.me)Insecure Direct Object Reference (IDOR) · medium
    16 votes
40. SSRF restricted to HTTP/HTML on LINE Social Plugins (https://social-plugins.line.me/)Server-Side Request Forgery (SSRF) · medium
    15 votes
41. Theft of arbitrary files in LINE Lite client for AndroidImproper Access Control - Generic · medium
    12 votes
42. SSRF occurrence in website preview used by LINE Official Account Manager (https://manager.line.biz)Server-Side Request Forgery (SSRF) · low
    $10011 votes