CVE-2010-2029

CVE-2010-2029 affects Cybozu Office products (notably Cybozu Office Ktai and Cybozu dotSales). The issue is an authentication bypass caused by improper restriction of the login page, enabling remote attackers to bypass login using the user’s mobile ID and potentially view or modify sensitive data...

Multiple Cybozu products vulnerable to authentication bypass

Overview Multiple Cybozu products contain an authentication bypass vulnerability. Multiple Cybozu products contain an issue in which the login page for mobile devices is not properly restrcited, leading to an authentication bypass vulnerability. As a result, an attacker may impersonate a user of ...

JVN#87730223 Multiple Cybozu products vulnerable to authentication bypass

Multiple Cybozu products contain an issue in which the login page for mobile devices is not properly restrcited, leading to an authentication bypass vulnerability. As a result, an attacker may impersonate a user of a Cybozu product. Impact A remote attacker may view or modify information stored b...

Multiple Cybozu products vulnerable to cross-site scripting

Overview Multiple Cybozu products are vulnerable to cross-site scripting. Multiple products groupware etc. provided by Cybozu, Inc. contain a cross-site scripting vulnerablility. This vulnerability is different from JVN50342989, and JVN90712589. Takeshi Terada of Mitsui Bussan Secure Directions,...

JVN#23108985: Multiple Cybozu products vulnerable to cross-site scripting

Multiple products groupware etc. provided by Cybozu, Inc. contain a cross-site scripting vulnerablility. This vulnerability is different from JVN50342989, and JVN90712589. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest versi...

CVE-2008-6744

Cross-site request forgery CSRF vulnerability in Cybozu Office 6, Cybozu Dezie before 6.01.0, and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cybozu Office 6, Cybozu Dezie before 6.01.0, and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2008-6744

CVE-2008-6744 describes a Cross-Site Request Forgery (CSRF) in Cybozu products, notably Cybozu Office 6, Cybozu Dezie prior to 6.0(1.0), and Cybozu Garoon 2.0.0 through 2.1.3. The issue allows an attacker to hijack a user’s authenticated session to alter configuration settings when a logged-in us...

CVE-2008-6744

Cross-site request forgery CSRF vulnerability in Cybozu Office 6, Cybozu Dezie before 6.01.0, and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Session fixation

Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page...

Cross site scripting

Cross-site scripting XSS vulnerability in the RSS reader in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed...

CVE-2008-6569

Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page...

CVE-2008-6570

Cross-site scripting XSS vulnerability in the RSS reader in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed...

CVE-2008-6569

Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page...

CVE-2008-6570

CVE-2008-6570 describes an XSS vulnerability in Cybozu Garoon’s RSS reader (versions 2.0.0–2.1.3). A crafted RSS feed could inject arbitrary JavaScript/HTML, potentially executing in the victim’s browser. Root cause: insufficient sanitization/unescaped content in RSS feed handling. Impact is user...

CVE-2008-6570

Cross-site scripting XSS vulnerability in the RSS reader in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed...

CVE-2008-6569

Cybozu Garoon 2.0.0–2.1.3 is affected by a session-fixation vulnerability that can allow a remote attacker to impersonate a logged-in user by supplying a session ID on login. Root cause is session handling during authentication, leading to session hijacking. Impact stated across connected sources...

Cybozu Garoon vulnerable to arbitrary script execution

Overview Cybozu Garoon, a groupware from Cybozu, contains a vulnerability that allows an attacker to execute an arbitrary script when a user views RSS feed. Yoshiki Kawada of LAC Little eArth Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the vendors under Information...

Cybozu Garoon session fixation vulnerability

Overview Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability. Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability which may allow an attacker to impersonate a user when the user logs into Cybozu Garoon using a session ID provided by the...

Multiple Cybozu products vulnerable to cross-site request forgery

Overview Multiple Cybozu products contain a cross-site request forgery vulnerability. Daiki Fukumori of Secure Sky Technology, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership. Impact If a user views a malicious w...