CVE-2015-0870

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in hb.cgi in Nishishi Factory Fumy News Clipper 2.x before 2.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN33735535/995592/index.htmlVendor Advisory
http://jvn.jp/en/jp/JVN33735535/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000010Vendor Advisory
http://www.nishishi.com/cgi/newsclip/20150130.htmlPatch, Vendor Advisory
http://jvn.jp/en/jp/JVN33735535/995592/index.htmlVendor Advisory
http://jvn.jp/en/jp/JVN33735535/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000010Vendor Advisory
http://www.nishishi.com/cgi/newsclip/20150130.htmlPatch, Vendor Advisory

Timeline

Published: Feb 1, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-08714.3Cross-site scripting (XSS) vulnerability in Mrs. Shiromuku Perl CGI shiromuku(u1)GUESTBOOK 1.62 and earlier allows remote attackers to injec CVE-2015-08734.3Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlTreeBBS 2.30 and earlier allows remote attackers to inject arbitrary web CVE-2015-08745.9Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive CVE-2015-08751.8The Ogaki Kyoritsu Bank Smartphone Passbook application 1.0.0 for Android creates a log file containing input data from the user, which allo CVE-2015-08764.3Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Comm CVE-2015-08777.5Unrestricted file upload vulnerability in app/lib/mlf.pl in C-BOARD Moyuku before 1.03b3 allows remote attackers to execute arbitrary code b CVE-2015-08785.8Directory traversal vulnerability in CREAR AL-Mail32 before 1.13d allows remote attackers to write to arbitrary files via a crafted filename CVE-2015-08794.3CREAR AL-Mail32 before 1.13d allows remote attackers to cause a denial of service (application crash) via a (1) CON, (2) AUX, or (3) NUL dev CVE-2015-08806.8Buffer overflow in CREAR AL-Mail32 before 1.13d allows remote attackers to execute arbitrary code via a long filename of an attachment.CVE-2015-08814.3CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitt CVE-2015-08824.3Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja thro CVE-2015-08836.8SYNCK GRAPHICA Mailform Pro CGI 4.1.4 and 4.1.5, when the mailauth module is enabled, does not properly send e-mail messages, which allows r