CVE-2019-5939

CVE-2019-5939 is a Cross-site scripting vulnerability in Cybozu Garoon (Portal) affecting versions 4.0.0–4.10.1. The issue arises from insufficient validation of client-side data in the web app, enabling remote attackers to inject scripts. Exploitation is described as a browser-script impact; the...

CVE-2019-5943

Cybozu Garoon (Cybozu Garoon 4.0.0 to 4.10.1) contains an access-control bypass vulnerability that allows remote authenticated attackers to view information without proper view privileges via the Bulletin and Cabinet components. The issue enables bypassing view restrictions for resources across t...

CVE-2019-5938

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Mail'...

CVE-2019-5943

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to view the information without view privileges via the application 'Bulletin' and the application 'Cabinet'...

CVE-2019-5934

SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.0 allows attacker with administrator rights to execute arbitrary SQL commands via the Log Search function of application 'logging'...

CVE-2019-5944

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the contents of application 'Address' without modify privileges via the application 'Address'...

CVE-2019-5944

CVE-2019-5944 affects Cybozu Garoon 4.0.0 to 4.10.1. A remote authenticated attacker can bypass access restrictions and alter contents of the application “Address” without modify privileges via the application “Address.” Multiple sources corroborate the issue as a privilege/access-control flaw en...

CVE-2019-5945

Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authentication of Cybozu Garoon...

CVE-2019-5940

Cybozu Garoon 4.x (4.0.0–4.10.1) is affected by Cross-site scripting via the Scheduler component (CVE-2019-5940). The vulnerability enables remote attackers to inject script/HTML into a user’s browser, constituting an XSS risk. Connected sources corroborate multiple related CVEs affecting Garoon ...

CVE-2019-5931

Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors...

CVE-2019-5928

CVE-2019-5928 is a cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 that can be triggered through the Customize Item function, allowing an attacker to cause arbitrary script execution in a user’s browser. Technical details across sources indicate the issue stems from insuf...

CVE-2019-5929

CVE-2019-5929 concerns a Cross-site scripting vulnerability in Cybozu Garoon, specifically in the Memo component, in versions 4.0.0 through 4.6.3. The root cause is described (by CNVD and related records) as a lack of proper validation of client-side data in the web application, enabling remote a...

CVE-2019-5930

CVE-2019-5930 affects Cybozu Garoon 4.0.0–4.6.3. Root cause: bypass of access restrictions in the Management of Basic System, enabling remote attackers to browse unauthorized pages. Impact: unauthorized page access due to broken access control. Exploitation details are not provided beyond the des...

CVE-2019-5932

CVE-2019-5932 is a cross-site scripting vulnerability in Cybozu Garoon, affecting versions 4.6.0–4.6.3, exploitable via the Portal application by remote authenticated attackers to inject script/HTML. The root cause is described as insufficient validation of client-side data in Garoon’s portal/web...

CVE-2019-5929

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the application 'Memo'...

CVE-2019-5928

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via Customize Item function...

CVE-2019-5930

Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application 'Management of Basic System'...

CVE-2019-5932

Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Portal'...

PT-2019-17878

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 4.0.0 through 4.10.1 Description A cross-site scripting issue allows remote authenticated attackers to inject arbitrary web script or HTML via the user information. Recommendations For versions 4.0.0 through 4.10.1, upda...

PT-2019-17886

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 4.2.4 through 4.10.1 Description The issue allows remote attackers to obtain users' credential information via the authentication of Cybozu Garoon. Recommendations For versions 4.2.4 through 4.10.1, update to a version...