JVN#31230946: Cybozu Garoon API access restriction bypass vulnerability

Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an access restriction bypass vulnerability when using APIs. Impact Users who can log in to the system may delete schedule information that they do not have permission to edit. Solution Update the Software Update to the...

JVN#90519014: Cybozu Garoon Phone Messages vulnerable to denial-of-service (DoS)

Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains a denial-of-service DoS vulnerability in the Phone Messages function. Impact Processing input from a user who can log in to the system may cause denial-of-service DoS condition on the server by consuming high system...

CVE-2014-0820

Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2014-0817

Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors...

CVE-2014-0821

SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931...

Code injection

Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors...

Directory traversal

Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors...

Sql injection

SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931...

CVE-2014-0817

Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors...

CVE-2014-0820

Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2014-0821

SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931...

CVE-2014-0817

CVE-2014-0817 affects Cybozu Garoon 2.x (up to 2.5.4) and 3.x (up to 3.7 SP3). The issue is improper session management that enables remote authenticated users to impersonate arbitrary accounts via unspecified vectors. Impact as described across multiple sources: an authenticated user could imper...

CVE-2014-0820

CVE-2014-0820 describes a directory traversal vulnerability in Cybozu Garoon’s download feature. Affected versions are Garoon 2.x up to 2.5.4 and 3.x up to 3.7 SP3. The issue allows remote authenticated users to read arbitrary server files via unspecified vectors. The connected documents indicate...

CVE-2014-0821

CVE-2014-0821 describes a SQL injection in Cybozu Garoon’s file download feature. Affected: Cybozu Garoon 2.0–2.5.4 and 3.x up to 3.7 SP3; vulnerability allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Root cause: injection in the download process (not ...

PT-2014-3867

SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931...

PT-2014-3863

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.x through 2.5.4 Cybozu Garoon versions 3.x through 3.7 SP3 Description The issue is related to improper session management, which allows remote authenticated users to impersonate arbitrary users. Recommendations For...

PT-2014-3866

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.x through 2.5.4 Cybozu Garoon versions 3.x through 3.7 SP3 Description A directory traversal issue exists in the download feature, allowing remote authenticated users to read arbitrary files. Recommendations For Cybozu...

CVE-2014-0817: Undefined Security Weakness

Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors...

CVE-2014-0821: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931...

CVE-2014-0820: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors...