CVE-2016-1197
published 2016-06-19CVE-2016-1197: Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified…
PriorityP423medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.01%
58.7th percentile
Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7775.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cybozu | garoon | — | — |
| cybozu | garoon | — | — |
| cybozu | garoon | — | — |
| cybozu | garoon | — | — |
| cybozu | garoon | — | — |
| gnu | cpio | >= 0 < 2.11+dfsg-1ubuntu1.2 | 2.11+dfsg-1ubuntu1.2 |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv1.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6f76-qjwv-mhw5: Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4
ghsa_unreviewed·2022-05-17·CVSS 6.1
CVE-2015-7775 [MEDIUM] CWE-79 GHSA-6f76-qjwv-mhw5: Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4
Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-1197.
GHSA
GHSA-54g6-2943-6chg: Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4
ghsa_unreviewed·2022-05-17·CVSS 5.4
CVE-2016-1197 [MEDIUM] CWE-79 GHSA-54g6-2943-6chg: Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4
Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7775.
OSV
cpio vulnerabilities
osv·2016-02-22·CVSS 1.9
CVE-2015-1197 cpio vulnerabilities
cpio vulnerabilities
Alexander Cherepanov discovered that GNU cpio incorrectly handled symbolic
links when used with the --no-absolute-filenames option. If a user or
automated system were tricked into extracting a specially-crafted cpio
archive, a remote attacker could possibly use this issue to write arbitrary
files. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
(CVE-2015-1197)
Gustavo Grieco discovered that GNU cpio incorrectly handled memory when
extracting archive files. If a user or automated system were tricked into
extracting a specially-crafted cpio archive, a remote attacker could use
this issue to cause GNU cpio to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2016-2037)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2016-06-19
Published