CVE-2018-0550

Cybozu Garoon 3.5.0 to 4.6.1 allows remote authenticated attackers to bypass access restriction to view the closed title of "Cabinet" via unspecified vectors...

CVE-2018-0548

Cybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction to view the closed title of "Space" via unspecified vectors...

Design/Logic Flaw

Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to view or alter an access privilege of a folder and/or notification settings via unspecified vectors...

Sql injection

SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2018-0533

Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authentication via unspecified vectors...

CVE-2018-0548

Cybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction to view the closed title of "Space" via unspecified vectors...

CVE-2018-0549

Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0550

Cybozu Garoon 3.5.0 to 4.6.1 allows remote authenticated attackers to bypass access restriction to view the closed title of "Cabinet" via unspecified vectors...

CVE-2018-0530

CVE-2018-0530 is a SQL injection vulnerability in Cybozu Garoon, affecting versions 3.5.0 through 4.2.6. It enables remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors in the application address component. The issue is documented across multiple sources (NVD, ...

CVE-2018-0548

CVE-2018-0548 is a Space browse restriction bypass in Cybozu Garoon 4.0.0–4.6.0 that lets an authenticated user view the closed title in Space via unspecified vectors. The impact is that a logged-in user may access restricted Space information. The mitigation is to update Cybozu Garoon to the lat...

CVE-2018-0550

Cybozu Garoon vulnerability CVE-2018-0550 affects versions 3.5.0 to 4.6.1. An authenticated remote attacker can bypass access restrictions to view the closed title of the Cabinet (via unspecified vectors). The issue is documented under CVE-2018-0550 and is listed among multiple related vulnerabil...

CVE-2018-0551

CVE-2018-0551 is a stored cross-site scripting vulnerability affecting Cybozu Garoon versions 3.0.0 to 4.6.1, specifically in the Rich Text component of the Space app. The underlying issue allows an authenticated user to inject arbitrary script/HTML via unspecified vectors, with potential to exec...

CVE-2018-0549

CVE-2018-0549 is a stored cross-site scripting (CWE-79) vulnerability in Cybozu Garoon 3.0.0–4.6.0. The issue affects the Rich text feature in the Message component, allowing remote authenticated attackers to inject arbitrary web scripts/HTML via unspecified vectors, potentially affecting users w...

CVE-2018-0532

CVE-2018-0532 affects Cybozu Garoon 3.0.0–4.2.6. Remote authenticated attackers could bypass login/access restrictions to alter data in the Standard database via unspecified vectors. Impact: unauthorized modification of setting data by a logged-in admin. Remediation per vendor: update to the late...

CVE-2018-0551

Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0530

SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2018-0531

Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to view or alter an access privilege of a folder and/or notification settings via unspecified vectors...

CVE-2018-0532

Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors...

CVE-2018-0551: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2018-8907

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.0.0 through 4.6.0 Description A cross-site scripting issue allows remote authenticated attackers to inject arbitrary web script or HTML. Recommendations For Cybozu Garoon versions 3.0.0 through 4.6.0, update to a versi...