JVN#67595539: Cybozu Garoon multiple cross-site scripting vulnerabilities

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains multiple cross-site scripting vulnerabilities. Cross-site scripting in the "Response request" function - CVE-2016-1214 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score:...

JVN#67266823: Cybozu Garoon vulnerable to open redirect

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an open redirect vulnerability in the "Scheduler" function. Impact When accessing a specially crafted URL, a user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack...

Cybozu Garoon 3.x < 4.2.0 Information Disclosure and XSS Vulnerabilities

Cybozu Garoon is prone to information disclosure and cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Cybozu Garoon 3.x < 4.2.1 Multiple Vulnerabilities

Cybozu Garoon is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cybozu:garoon"; ifdescription...

CVE-2016-1193

Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors...

CVE-2016-1193

Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors...

CVE-2016-1190

Cybozu Garoon 3.1 through 4.2 allows remote authenticated users to bypass intended restrictions on MultiReport reading via unspecified vectors...

CVE-2016-1190

Cybozu Garoon 3.1 through 4.2 allows remote authenticated users to bypass intended restrictions on MultiReport reading via unspecified vectors...

CVE-2016-1189

Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors...

CVE-2016-1189

Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors...

Design/Logic Flaw

Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors...

Information disclosure

Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors...

Design/Logic Flaw

Cybozu Garoon 3.1 through 4.2 allows remote authenticated users to bypass intended restrictions on MultiReport reading via unspecified vectors...

Code injection

Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to send spoofed e-mail messages via unspecified vectors...

CVE-2016-1188

Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to send spoofed e-mail messages via unspecified vectors...

CVE-2016-1193

CVE-2016-1193 affects Cybozu Garoon 3.7–4.2. A vulnerability in the mail functionality allows information disclosure: by sending a specially crafted email, a remote attacker can cause a user to read sensitive email data. The connected sources specify an information-disclosure vulnerability via th...

CVE-2016-1193

Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors...

CVE-2016-1188

CVE-2016-1188 affects Cybozu Garoon 3.x to 4.2.x before 4.2.1. It is described in the connected JVN as an operation restriction bypass in the mail function, enabling remote authenticated users to send spoofed e‑mail messages via unspecified vectors. Affected versions include Cybozu Garoon 3.0–4.2...

CVE-2016-1189

CVE-2016-1189 affects Cybozu Garoon 3.x and 4.x up to but not including 4.2.1, where remote authenticated users can bypass access restrictions on Portlets (read/create/modify) via unspecified vectors. The connected sources corroborate a portlet access restriction bypass vulnerability in Garoon’s ...

CVE-2016-1190

CVE-2016-1190 affects Cybozu Garoon 3.x (3.1–4.2). The vulnerability is an access restriction bypass in the MultiReport function that enables remote authenticated users to view restricted reports. Root cause: bypass of access controls (vector unspecified in the Initial docs but described as a byp...