CVE-2016-1220

Cybozu Garoon before 4.2.2 does not properly restrict access...

CVE-2016-1213

CVE-2016-1213 affects Cybozu Garoon up to version 4.2.1 (before 4.2.2). The vulnerability is an open redirect in the Scheduler function that lets an attacker cause a user to be redirected to an arbitrary website, enabling phishing risks. Public sources in the connected documents consistently desc...

CVE-2016-1218

SQL injection vulnerability in Cybozu Garoon before 4.2.2...

CVE-2016-1215

Cross-site scripting XSS vulnerability in the "User details" function in Cybozu Garoon before 4.2.2...

CVE-2016-1217

CVE-2016-1217 is a cross-site scripting (XSS) vulnerability in Cybozu Garoon, exploitable via the "Check available times" function before version 4.2.2. The issue allows arbitrary script execution in the logged-in user’s browser and affects Garoon releases up to 4.2.1 (and related CVEs 1214–1216 ...

CVE-2016-1217

Cross-site scripting XSS vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2...

CVE-2016-1215

Cybozu Garoon contains an XSS vulnerability in the "User details" function (CVE-2016-1215). Multiple connected sources confirm this as part of a set of CVEs affecting Garoon up to version 4.2.2. Affected ranges include Cybozu Garoon 4.2.0–4.2.1 (CVE-2016-1214, 1215, 1216) and Cybozu Garoon 3.0.0–...

CVE-2016-1214

Cross-site scripting XSS vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2...

CVE-2016-1214

CVE-2016-1214 affects Cybozu Garoon, where the vulnerability is a cross-site scripting (XSS) flaw in the "Response request" function present before Garoon 4.2.2. The impact is that an arbitrary script can be executed in the logged-in user’s browser. This CVE is documented with explicit affected s...

CVE-2016-1219

Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use...

CVE-2016-1219

Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use...

Authentication flaw

Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use...

CVE-2016-1219

Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use...

CVE-2016-1219

CVE-2016-1219 : In Cybozu Garoon, versions prior to 4.2.2 expose an authentication bypass vulnerability related to API usage that lets remote attackers bypass login authentication. The main affected product is Cybozu Garoon (versions up to 4.2.1). The reported impact is remote authentication bypa...

Cybozu Garoon SQL Injection Vulnerability (CNVD-2017-02504)

Cybozu Garoon is a portal OA office system. A SQL injection vulnerability exists in Cybozu Garoon, which allows remote attackers to submit specially crafted SQL queries to manipulate or obtain database data...

Cybozu Garoon fails to restrict access permission in the mail function

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an access restriction flaw in the mail function. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact A user may alter the order of the mail folders. Solution...

Cybozu Garoon fails to restrict access permission in Workflow and the function "MultiReport"

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an access restriction flaw in Workflow and the function "MultiReport". Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact A user may alter or delete...

Cybozu Garoon vulnerable to information disclosure

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an information disclosure vulnerability. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact Token used for cross-site request forgery CSRF protection may be...

Cybozu Garoon vulnerable to SQL injection

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an SQL injection vulnerability. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early...

Cybozu Garoon fails to restrict access permission in the Phone Messages function

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an access restriction flaw in the Phone Messages function Yuji Tounai reported this vulnerability to Cybozu, Inc., and Cybozu, Inc. reported it to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC...