Design/Logic Flaw

Operational restrictions bypass vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Portal without the appropriate privilege...

Cross site scripting

Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors...

CVE-2021-20771

Cross-site scripting vulnerability in some functions of E-Mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote attacker to inject an arbitrary script via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to inject an arbitrary script via unspecified vectors...

CVE-2021-20758

Cross-site request forgery CSRF vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to hijack the authentication of administrators and perform an arbitrary operation via unspecified vectors...

CVE-2021-20775

Cybozu Garoon is affected by CVE-2021-20775 due to an improper input validation vulnerability that allows a remote authenticated attacker to obtain data from Comment and Space without the viewing privilege. Affected versions are Cybozu Garoon 4.10.0 through 5.5.0. The issue is categorized as an i...

CVE-2021-20774

CVE-2021-20774 is a cross-site scripting vulnerability in Cybozu Garoon. The issue affects Cybozu Garoon 4.0.0 through 5.5.0, specifically in some E-mail related functions, allowing a remote authenticated attacker to inject arbitrary scripts via unspecified vectors in the logged-in user’s browser...

CVE-2021-20774

Cross-site scripting vulnerability in some functions of E-mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors...

CVE-2021-20773

There is a vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.0, which may allow a remote authenticated attacker to delete the route information Workflow without the appropriate privilege...

CVE-2021-20773

The CVE-2021-20773 vulnerability affects Cybozu Garoon 4.0.0 through 5.5.0. It allows a remote authenticated attacker to delete Workflow route information without the appropriate privileges, as described across multiple sources (e.g., Red Hat, NVD, JVN, CVE records). Affected components are tied ...

CVE-2021-20772

CVE-2021-20772 is an information disclosure vulnerability in Cybozu Garoon (Bulletin module) affecting versions 4.10.0 to 5.5.0. It allows an authenticated remote attacker to obtain the title of a Bulletin without the viewing privilege, indicating a bypass of access controls for bulletin data. Th...

CVE-2021-20772

Information disclosure vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the title of Bulletin without the viewing privilege...

CVE-2021-20771

Cross-site scripting vulnerability in some functions of E-Mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote attacker to inject an arbitrary script via unspecified vectors...

CVE-2021-20771

CVE-2021-20771 is a cross-site scripting vulnerability in Cybozu Garoon’s E-mail/Group Mail component. Connected documents specify affected versions: Cybozu Garoon 4.0.0 through 5.5.0. The root cause is an XSS issue in some E-mail-related functions, enabling a remote attacker to inject arbitrary ...

CVE-2021-20770

CVE-2021-20770 is a Cross-Site Scripting vulnerability affecting Cybozu Garoon, specifically in the Message module, with versions 4.6.0 through 5.0.2. The issue allows a remote authenticated attacker to inject arbitrary scripts via unspecified vectors in the logged-in user’s browser. The consolid...

CVE-2021-20770

Cross-site scripting vulnerability in Message of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors...

CVE-2021-20769

CVE-2021-20769 is a reported cross-site scripting vulnerability in Cybozu Garoon’s Bulletin (CWE-79). A remote authenticated attacker could inject arbitrary scripts in the context of a logged‑in user via unspecified vectors, affecting Cybozu Garoon versions 4.6.0 to 5.0.2 (and related CyVDB entri...

CVE-2021-20769

Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors...

CVE-2021-20768

Operational restrictions bypass vulnerability in Scheduler and MultiReport of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to delete the data of Scheduler and MultiReport without the appropriate privilege...

CVE-2021-20768

The CVE-2021-20768 issue affects Cybozu Garoon 4.0.0 to 5.0.2. It is an operational restrictions bypass vulnerability that allows a remote authenticated attacker to delete data in Scheduler and MultiReport without proper privileges. Connected sources corroborate the affected product range and the...