CVE-2022-29484

The CVE-2022-29484 issue affects Cybozu Garoon 4.0.0 to 5.9.0. root cause: an authorization/operation restriction bypass in Space that enables a remote authenticated attacker to delete Space data. Impact: potential deletion of Space data; authenticated access required; no user interaction needed....

CVE-2022-29471

Summary: CVE-2022-29471 is a browse restriction bypass vulnerability in Cybozu Garoon Bulletin that can allow a logged-in, remote attacker to obtain bulletin data. The issue is a violation of access controls (CWE-284) in Bulletin handling. Affected products/versions (per connected docs): Cybozu G...

CVE-2022-29471

Browse restriction bypass vulnerability in Bulletin of Cybozu Garoon allows a remote authenticated attacker to obtain the data of Bulletin...

CVE-2022-29467

CVE-2022-29467 affects Cybozu Garoon 4.2.0–5.5.1. An authenticated remote attacker can disclose address data due to an information-disclosure vulnerability (CWE-200). Affected components are the Address information handling areas; impact is exposure of some address data. The issue is addressed by...

CVE-2022-29467

Address information disclosure vulnerability in Cybozu Garoon 4.2.0 to 5.5.1 allows a remote authenticated attacker to obtain some data of Address...

CVE-2022-28718

Operation restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.5.1 allow a remote authenticated attacker to alter the data of Bulletin...

CVE-2022-28718

CVE-2022-28718 affects Cybozu Garoon, specifically the Bulletin module. The issue is an Operation restriction bypass that allows a remote authenticated attacker to alter Bulletin data. Affected versions are Cybozu Garoon 4.0.0 through 5.5.1 (and related ranges listed in the JVN/NVD records). Impa...

CVE-2022-28713

Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the product...

CVE-2022-28713

CVE-2022-28713 describes an improper authentication vulnerability in the Scheduler component of Cybozu Garoon, allowing a remote attacker to obtain some Facility Information data without logging in. Affected software: Cybozu Garoon versions 4.0.0 through 5.5.1 (per multiple connected sources) wit...

CVE-2022-28692

CVE-2022-28692 concerns Cybozu Garoon’s Scheduler component, with an improper input validation flaw in versions 4.0.0–5.5.1. The issue can allow a remote authenticated attacker to alter Scheduler data. Affected product: Cybozu Garoon (Scheduler). Root cause: input validation weakness in Scheduler...

CVE-2022-28692

Improper input validation vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Scheduler...

CVE-2022-27807

CVE-2022-27807 is an improper input validation vulnerability in Cybozu Garoon, specifically in the Link component, that allows a remote authenticated attacker to disable the ability to add Categories. Affected versions span Cybozu Garoon 4.0.0 through 5.5.1 (per multiple sources); other entries e...

CVE-2022-27803

Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Space...

CVE-2022-27803

CVE-2022-27803 is an improper input validation vulnerability in Cybozu Garoon Space, affecting Garoon 4.0.0 through 5.5.1. An authenticated remote attacker could alter Space data due to input validation weaknesses. Public sources (NVD, JVN, Red Hat, CNVD/CNNVD) corroborate the vulnerability and a...

CVE-2022-27661

CVE-2022-27661 is an operation restriction bypass vulnerability in Cybozu Garoon workflows. A remote authenticated attacker can alter Workflow data in Cybozu Garoon versions 4.0.0 through 5.5.1. Multiple connected sources (NVD, Red Hat, JVN, JVN DB, CNVD, CNNVD, PRION) confirm the issue and ident...

CVE-2022-27661

Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Workflow...

CVE-2022-27627

Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on the logged-in user's web browser...

CVE-2022-27627

CVE-2022-27627 is a cross-site scripting vulnerability in Cybozu Garoon’s Organization’s Information that can allow a logged-in user to have arbitrary script executed in their browser. Affected versions include Cybozu Garoon 4.10.2 to 5.5.1 (and related ranges listed across sources), with the roo...

CVE-2022-26368

CVE-2022-26368 is a vulnerability in Cybozu Garoon's Cabinet component (versions 4.0.0 to 5.5.1) described as a browse restriction bypass and operation restriction bypass (CWE-285). The issue allows a remote authenticated attacker to alter and/or obtain data stored in Cabinet. It is associated wi...

CVE-2022-26368

Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter and/or obtain the data of Cabinet...