CVE-2015-2980

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The Yodobashi application 1.2.1.0 and earlier for Android allows remote attackers to execute arbitrary Java methods, and consequently obtain sensitive information or execute OS commands, via a crafted HTML document.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-78 CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN70465405/995407/index.html
http://jvn.jp/en/jp/JVN70465405/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000110Vendor Advisory
http://jvn.jp/en/jp/JVN70465405/995407/index.html
http://jvn.jp/en/jp/JVN70465405/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000110Vendor Advisory

Timeline

Published: Aug 8, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-29815.9The Yodobashi App for Android 1.2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attack CVE-2015-29824.3Cross-site scripting (XSS) vulnerability in jquery.lightbox-0.5.min.js in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.CVE-2015-29836.8Cross-site request forgery (CSRF) vulnerability in admin.php in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.0.1 Free a CVE-2015-29845.0I-O DATA DEVICE WN-G54/R2 routers with firmware before 1.03 and NP-BBRS routers allow remote attackers to cause a denial of service (SSDP re CVE-2015-29854.3Cross-site scripting (XSS) vulnerability in guide-park.com BBS X102 1.03 allows remote attackers to inject arbitrary web script or HTML via CVE-2015-29864.3Cross-site scripting (XSS) vulnerability in rakuto.net hitSuji (rktSNS2) 0.2.2b allows remote attackers to inject arbitrary web script or HT CVE-2015-29872.6Type74 ED before 4.0 misuses 128-bit ECB encryption for small files, which makes it easier for attackers to obtain plaintext data via differ CVE-2015-29887.4Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to execute man-in-the-middl CVE-2015-29894.3Cross-site scripting (XSS) vulnerability in index.php in LEMON-S PHP Twit BBS allows remote attackers to inject arbitrary web script or HTML CVE-2015-29904.0Directory traversal vulnerability in zhtml.cgi in NEOJAPAN desknet NEO 2.0R1.0 through 2.5R1.4 allows remote authenticated users to read arb CVE-2015-29916.8Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data.CVE-2015-29926.1Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.