CVE-2018-0650

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Metrics

CVSS 3.0 7.4/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
LINE MUSIC CORPORATION	LINE MUSIC for Android	version 3.1.0 to versions prior to 3.6.5

References

http://jvn.jp/en/jp/JVN16933564/index.htmlThird Party Advisory
https://linecorp.com/en/security/article/182Vendor Advisory
https://play.google.com/store/apps/details?id=jp.linecorp.linemusic.android&hl=enThird Party Advisory
http://jvn.jp/en/jp/JVN16933564/index.htmlThird Party Advisory
https://linecorp.com/en/security/article/182Vendor Advisory
https://play.google.com/store/apps/details?id=jp.linecorp.linemusic.android&hl=enThird Party Advisory

Timeline

Published: Sep 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-06519.8Buffer overflow in the license management function of YOKOGAWA products (iDefine for ProSafe-RS R1.16.3 and earlier, STARDOM VDS R7.50 and e CVE-2018-06524.8Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTM CVE-2018-06536.1Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki pag CVE-2018-06546.1Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the moda CVE-2018-06554.8Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTM CVE-2018-06567.8Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privile CVE-2018-06574.8Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payme CVE-2018-06587.2Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier CVE-2018-06595.5Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create or overwrite existing CVE-2018-06603.3Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via sp CVE-2018-06618.8Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E fir CVE-2018-06626.8Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E fir