CVE-2015-7775

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-1197.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN49285177/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000084Vendor Advisory
https://support.cybozu.com/ja-jp/article/8893Patch, Vendor Advisory
http://jvn.jp/en/jp/JVN49285177/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000084Vendor Advisory
https://support.cybozu.com/ja-jp/article/8893Patch, Vendor Advisory

Timeline

Published: Jun 19, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-77764.3Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to tra CVE-2015-77774.3Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web CVE-2015-77785.9Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks.CVE-2015-77806.5Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.CVE-2015-77817.5ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions.CVE-2015-77826.1Cross-site scripting (XSS) vulnerability in Let's PHP! Frame high-speed chat before 2015-09-22 allows remote attackers to inject arbitrary w CVE-2015-77836.1Cross-site scripting (XSS) vulnerability in Let's PHP! p++BBS before 4.10 allows remote attackers to inject arbitrary web script or HTML via CVE-2015-77844.3SQL injection vulnerability in the BOKUBLOCK (1) BbAdminViewsControl213 plugin before 1.1 and (2) BbAdminViewsControl plugin before 2.1 for CVE-2015-77855.9GANMA! App for iOS does not verify SSL certificates.CVE-2015-77866.1Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Se CVE-2015-77874.3ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase via unspecified vector CVE-2015-77887.3ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute arbitrary commands via unspecified vectors.