CVE-2016-1213

The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites...

CVE-2016-1216

Cross-site scripting XSS vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2...

CVE-2016-1216

Cross-site scripting XSS vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2...

Cross site scripting

Cross-site scripting XSS vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2...

Design/Logic Flaw

Cybozu Garoon before 4.2.2 does not properly restrict access...

CVE-2016-1215

Cross-site scripting XSS vulnerability in the "User details" function in Cybozu Garoon before 4.2.2...

CVE-2016-1213

The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites...

CVE-2016-1216

Cross-site scripting XSS vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2...

CVE-2016-1220

Cybozu Garoon before 4.2.2 does not properly restrict access...

CVE-2016-1216

CVE-2016-1216 is a cross-site scripting vulnerability in the Cybozu Garoon product, specifically in the "New appointment" function. Public sources (NVD, JVN, CVE listings) confirm the issue affects Cybozu Garoon prior to 4.2.2, with user input handling in the New appointment flow enabling script ...

CVE-2016-1220

CVE-2016-1220 affects Cybozu Garoon up to version 4.2.1 (before 4.2.2). The issue is an improper access restriction that can allow a user to obtain product settings information (access privilege bypass). Mitigation is to upgrade to version 4.2.2 or later (patched release).

CVE-2016-1218

Cybozu Garoon contains an SQL injection vulnerability in the Messages function affecting versions 3.0.0 through 4.2.1, prior to 4.2.2. The underlying issue allows an authenticated attacker to obtain or alter data in the database. Documented by multiple sources (NVD entry CVE-2016-1218; JVN/JVNDB ...

CVE-2016-1218

SQL injection vulnerability in Cybozu Garoon before 4.2.2...

CVE-2016-1215

Cross-site scripting XSS vulnerability in the "User details" function in Cybozu Garoon before 4.2.2...

CVE-2016-1213

CVE-2016-1213 affects Cybozu Garoon up to version 4.2.1 (before 4.2.2). The vulnerability is an open redirect in the Scheduler function that lets an attacker cause a user to be redirected to an arbitrary website, enabling phishing risks. Public sources in the connected documents consistently desc...

CVE-2016-1217

CVE-2016-1217 is a cross-site scripting (XSS) vulnerability in Cybozu Garoon, exploitable via the "Check available times" function before version 4.2.2. The issue allows arbitrary script execution in the logged-in user’s browser and affects Garoon releases up to 4.2.1 (and related CVEs 1214–1216 ...

CVE-2016-1217

Cross-site scripting XSS vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2...

CVE-2016-1214

Cross-site scripting XSS vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2...

CVE-2016-1215

Cybozu Garoon contains an XSS vulnerability in the "User details" function (CVE-2016-1215). Multiple connected sources confirm this as part of a set of CVEs affecting Garoon up to version 4.2.2. Affected ranges include Cybozu Garoon 4.2.0–4.2.1 (CVE-2016-1214, 1215, 1216) and Cybozu Garoon 3.0.0–...

CVE-2016-1214

CVE-2016-1214 affects Cybozu Garoon, where the vulnerability is a cross-site scripting (XSS) flaw in the "Response request" function present before Garoon 4.2.2. The impact is that an arbitrary script can be executed in the logged-in user’s browser. This CVE is documented with explicit affected s...