CVE-2017-2254: Improper Input Validation

Cybozu Garoon 3.5.0 to 4.2.5 allows an attacker to cause a denial of service in the application menu's edit function via specially crafted input...

CVE-2017-2255

Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Space"...

CVE-2017-2258

Directory traversal vulnerability in Cybozu Garoon 4.2.4 to 4.2.5 allows an attacker to read arbitrary files via Garoon SOAP API "WorkflowHandleApplications"...

CVE-2017-2258

CVE-2017-2258 affects Cybozu Garoon 4.2.4–4.2.5 and is a directory traversal in the Garoon SOAP API “WorkflowHandleApplications” (CWE-22) that can allow an attacker to read arbitrary files. This vulnerability is documented across multiple feeds (NVD, CVE lists, OpenVAS) with a reported impact of ...

CVE-2017-2254

Cybozu Garoon 3.5.0 to 4.2.5 allows an attacker to cause a denial of service in the application menu's edit function via specially crafted input...

CVE-2017-2257

CVE-2017-2257 : Cybozu Garoon versions 3.0.0 to 4.2.5 are affected by a cross-site scripting vulnerability in the mail function, allowing an attacker to inject arbitrary web script or HTML. Multiple connected sources (NVD listing and OpenVAS entry for Cybozu Garoon 3.0.0 – 4.2.5) corroborate this...

CVE-2017-2257

Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via mail function...

CVE-2017-2254

CVE-2017-2254 affects Cybozu Garoon versions 3.5.0 to 4.2.5. The vulnerability is a denial-of-service in the application menu’s edit function triggered by specially crafted input. Underlying cause and exact exploit vector are not elaborated in the provided documents beyond noting a DoS condition....

CVE-2017-2255

CVE-2017-2255 affects Cybozu Garoon versions 3.7.0 to 4.2.5 and is a stored XSS in the Rich text function of the Space app. Public sources (NVD, JVN/OpenVAS) confirm the vulnerability is a client-side script injection that could execute in an authenticated user’s browser. The connected OpenVAS en...

CVE-2017-2256

CVE-2017-2256 affects Cybozu Garoon 3.0.0 to 4.2.5, with a stored cross-site scripting (XSS) vulnerability in the Rich text functionality of the Memo application that can cause arbitrary script execution in the user’s browser. The issue is documented across multiple sources (NVD/NVD CVE entry; JV...

CVE-2017-2256

Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Memo"...

PT-2017-15303

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.0.0 through 4.2.5 Description A cross-site scripting issue allows an attacker to inject arbitrary web script or HTML via the mail function. Recommendations For Cybozu Garoon versions 3.0.0 through 4.2.5, update to a...

PT-2017-15304

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 4.2.4 through 4.2.5 Description A directory traversal issue exists, allowing an attacker to read arbitrary files through the Garoon SOAP API, specifically via "WorkflowHandleApplications". Recommendations For Cybozu Garo...

PT-2017-15300

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.5.0 through 4.2.5 Description The issue allows an attacker to cause a denial of service in the application menu's edit function via specially crafted input. Recommendations For Cybozu Garoon versions 3.5.0 through 4.2....

PT-2017-15301

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.7.0 through 4.2.5 Description A cross-site scripting issue exists, allowing an attacker to inject arbitrary web script or HTML via the Rich text function of the application Space. Recommendations For Cybozu Garoon...

PT-2017-15302

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.0.0 through 4.2.5 Description A cross-site scripting issue exists, allowing an attacker to inject arbitrary web script or HTML via the Rich text function of the application Memo. Recommendations For Cybozu Garoon...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2017-25383)

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin boards, document management, and other functions, and supports free switching among three languages Chinese, Japanese, and English. A cross-site scripting...

Cybozu Garoon Directory Traversal Vulnerability (CNVD-2017-25382)

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin boards, document management, and other functions, and supports free switching among three languages Chinese, Japanese, and English. A directory traversal...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2017-25385)

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin boards, document management, and other functions, and supports free switching among three languages Chinese, Japanese, and English. A cross-site scripting...

Cybozu Garoon Denial of Service Vulnerability (CNVD-2017-25386)

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin boards, document management, and other functions, and supports free switching among three languages Chinese, Japanese, and English. A denial of service vulnerabilit...