CVE-2008-6570

CVE-2008-6570 describes an XSS vulnerability in Cybozu Garoon’s RSS reader (versions 2.0.0–2.1.3). A crafted RSS feed could inject arbitrary JavaScript/HTML, potentially executing in the victim’s browser. Root cause: insufficient sanitization/unescaped content in RSS feed handling. Impact is user...

CVE-2008-6569

Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page...

CVE-2008-6569

Cybozu Garoon 2.0.0–2.1.3 is affected by a session-fixation vulnerability that can allow a remote attacker to impersonate a logged-in user by supplying a session ID on login. Root cause is session handling during authentication, leading to session hijacking. Impact stated across connected sources...

CVE-2008-6570

Cross-site scripting XSS vulnerability in the RSS reader in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed...

Cybozu Garoon vulnerable to arbitrary script execution

Overview Cybozu Garoon, a groupware from Cybozu, contains a vulnerability that allows an attacker to execute an arbitrary script when a user views RSS feed. Yoshiki Kawada of LAC Little eArth Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the vendors under Information...

Cybozu Garoon session fixation vulnerability

Overview Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability. Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability which may allow an attacker to impersonate a user when the user logs into Cybozu Garoon using a session ID provided by the...

JVN#18405927 Multiple Cybozu products vulnerable to cross-site request forgery

Multiple Cybozu products contain a cross-site request forgery vulnerability. Impact If a user views a malicious web page while logged onto the Cybozu web interface, the user's schedules and other configuration settings may be altered. Solution Update the Software Apply the latest updates provided...

JVN#18700809 Cybozu Garoon session fixation vulnerability

Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability which may allow an attacker to impersonate a user when the user logs into Cybozu Garoon using a session ID provided by the attacker. Impact A remote attacker impersonating a logged in user may execute arbitrary code...

JVN#52363223: Cybozu Garoon vulnerable to arbitrary script execution

Cybozu Garoon, a groupware from Cybozu, contains a vulnerability that allows an attacker to execute an arbitrary script when a user views RSS feed. Impact An arbitrary script could be executed on the user's web browser. Solution Update the Software Apply the latest update provided by the vendor...

JVN#50342989 Multiple Cybozu products vulnerable to cross-site scripting

Multiple Cybozu products are vulnerable to cross-site scripting. This vulnerability is different from JVN90712589. Impact An arbitrary script can be executed on the user's web browser. Solution Update the Software Apply the latest updates provided by the vendor. Products Affected Cybozu Office 6....

JVN#90712589 Multiple Cybozu products vulnerable to cross-site scripting

Multiple Cybozu products are vulnerable to cross-site scripting. This vulnerability is different from JVN50342989. Impact An arbitrary script can be executed on the user's web browser. Solution Update the Software Apply the latest updates provided by the vendor. Products Affected Cybozu Office 6....

Cybozu Garoon SQL注入漏洞

Cybozu Garoon是一款基于PHP的WEB应用程序。 Cybozu Garoon不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是由于多个脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Cybozu Garoon 2.1 http://garoon.cybozu.co.jp/ http://www.example.com/scripts/cbgrn/grn.exe/todo/index?cid=SQL...

CVE-2006-4491

Directory traversal vulnerability in Cybozu Collaborex, AG before 1.21.5, AG Pocket before 5.20.8, Mailwise before 3.00.3, and Garoon 1 before 1.54.1 allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2006-4491

Directory traversal vulnerability in Cybozu Collaborex, AG before 1.21.5, AG Pocket before 5.20.8, Mailwise before 3.00.3, and Garoon 1 before 1.54.1 allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2006-4491

Summary: Cybozu products (Collaborex, AG before 1.2(1.5); AG Pocket before 5.2(0.8); Mailwise before 3.0(0.3); Garoon 1 before 1.5(4.1)) are vulnerable to a directory traversal flaw that allows remote authenticated users to read arbitrary files via unspecified vectors. Impact: partial confidentia...

CVE-2006-4444

Multiple SQL injection vulnerabilities in Cybozu Garoon 2.1.0 for Windows allow remote authenticated users to execute arbitrary SQL commands via the 1 tid parameter in the a todo/view aka TODO List View, b todo/modify aka TODO List Modify, or c todo/delete functionality; the 2 pid parameter in th...

CVE-2006-4444

Multiple SQL injection vulnerabilities in Cybozu Garoon 2.1.0 for Windows allow remote authenticated users to execute arbitrary SQL commands via the 1 tid parameter in the a todo/view aka TODO List View, b todo/modify aka TODO List Modify, or c todo/delete functionality; the 2 pid parameter in th...

CVE-2006-4444

CVE-2006-4444 affects Cybozu Garoon 2.1.0 for Windows with multiple SQL injection vulnerabilities exploitable by remote authenticated users to execute arbitrary SQL commands via parameters: tid in todo/view/modify/delete; pid in workflow/view/print; uid in schedule/user_view, phonemessage/add/his...

[Full-disclosure] [vuln.sg] Cybozu Garoon 2 SQL Injection Vulnerabilities

vuln.sg Vulnerability Research Advisory Cybozu Garoon 2 SQL Injection Vulnerabilities by Tan Chew Keong Release Date: 2006-08-28 Summary ------- Some SQL injection vulnerabilities have been found in Cybozu Garoon 2. When exploited by a logon user, the vulnerabilities allow manipulation of SQL...

Cybuzu Garoon 2.1.0 - Multiple SQL Injections

Cybuzu Garoon 2.1.0 - Multiple SQL Injections Cybozu Garoon 2 SQL Injection Vulnerabilities by Tan Chew Keong Release Date: 2006-08-28 Summary Some SQL injection vulnerabilities have been found in Cybozu Garoon 2. When exploited by a logon user, the vulnerabilities allow manipulation of SQL...