CVE-2015-7776

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2016-1196.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN53542912/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000085Vendor Advisory
https://support.cybozu.com/ja-jp/article/8757Patch, Vendor Advisory
https://support.cybozu.com/ja-jp/article/8897Patch, Vendor Advisory
https://support.cybozu.com/ja-jp/article/8951Patch, Vendor Advisory
https://support.cybozu.com/ja-jp/article/8982Patch, Vendor Advisory
http://jvn.jp/en/jp/JVN53542912/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000085Vendor Advisory
https://support.cybozu.com/ja-jp/article/8757Patch, Vendor Advisory
https://support.cybozu.com/ja-jp/article/8897Patch, Vendor Advisory
https://support.cybozu.com/ja-jp/article/8951Patch, Vendor Advisory
https://support.cybozu.com/ja-jp/article/8982Patch, Vendor Advisory

Timeline

Published: Jun 19, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-77774.3Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web CVE-2015-77785.9Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks.CVE-2015-77806.5Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.CVE-2015-77817.5ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions.CVE-2015-77826.1Cross-site scripting (XSS) vulnerability in Let's PHP! Frame high-speed chat before 2015-09-22 allows remote attackers to inject arbitrary w CVE-2015-77836.1Cross-site scripting (XSS) vulnerability in Let's PHP! p++BBS before 4.10 allows remote attackers to inject arbitrary web script or HTML via CVE-2015-77844.3SQL injection vulnerability in the BOKUBLOCK (1) BbAdminViewsControl213 plugin before 1.1 and (2) BbAdminViewsControl plugin before 2.1 for CVE-2015-77855.9GANMA! App for iOS does not verify SSL certificates.CVE-2015-77866.1Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Se CVE-2015-77874.3ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase via unspecified vector CVE-2015-77887.3ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute arbitrary commands via unspecified vectors.CVE-2015-77894.3ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to cause a denial of service via unspecified vectors.