JVN#37121456: Cybozu Garoon vulnerable to cross-site scripting

Cybozu Garoon is a groupware. Cybozu Garoon contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the logged in user's web browser. Solution Update the Software Update to the latest version according to the information provided by the developer. Products...

JVN#32218514: Cybozu Garoon vulnerable to open redirect

Cybozu Garoon is a groupware. Cybozu Garoon contains an open redirect vulnerability. Impact When accessing a specially crafted URL, a user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack. Solution Update the Software Update to the latest...

JVN#25765762: Cybozu Garoon vulnerable to information disclosure

Cybozu Garoon is a groupware. Cybozu Garoon contains an information disclosure vulnerability in the mail function. Impact By sending a specially crafted email, an attacker may be convinced that the user read the email. Solution Update the Software Update to the latest version according to the...

Cybozu Garoon Code Injection Vulnerability

Cybozu Garoon is a portal type OA office system of Cybozu Japan. A code injection vulnerability exists in Cybozu Garoon. A remote attacker can exploit this vulnerability to execute arbitrary PHP code...

Cybozu Garoon RSS Reader Component Code Injection Vulnerability

Cybozu Garoon is a portal OA office system from Cybozu Japan, and RSS Reader is one of the RSS reader components. A security vulnerability exists in the Cybozu Garoon RSS Reader component. The vulnerability can be exploited by remote attackers to execute arbitrary PHP code...

CVE-2015-5647

The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866...

CVE-2015-5646

Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867...

Code injection

The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866...

CVE-2015-5647

The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866...

CVE-2015-5647

The CVE-2015-5647 entry concerns Cybozu Garoon’s RSS Reader component, which (in Cybozu Garoon 3.x up to 3.7.5 and 4.x up to 4.0.3) is vulnerable to remote authenticated PHP code execution via unspecified vectors (CyVDB-866). The connected records confirm this is a code-injection vulnerability af...

CVE-2015-5646

Summary: CVE-2015-5646 affects Cybozu Garoon 3.0.0–4.0.3, with remote authenticated PHP code execution via unspecified vectors. The vulnerability is documented across multiple sources (CVE/NVD, JVNDB/JVN, CNVD) and tied to CyVDB-863 and CyVDB-867. Affected versions: Garoon 3.x (up to 3.7.5) and 4...

CVE-2015-5646

Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867...

PT-2015-7010

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.x through 3.7.5 Cybozu Garoon versions 4.x through 4.0.3 Description The issue in the RSS Reader component allows remote authenticated users to execute arbitrary PHP code. Recommendations For Cybozu Garoon versions 3.x...

PT-2015-7009

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.x through 3.7.5 Cybozu Garoon versions 4.x through 4.0.3 Description The issue allows remote authenticated users to execute arbitrary PHP code. Recommendations For versions 3.x through 3.7.5, update to a version later...

CVE-2015-5646: Improper Control of Generation of Code

Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867...

CVE-2015-5647: Improper Control of Generation of Code

The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866...

Cybozu Garoon Restriction Bypass Vulnerability

Cybozu Garoon is a portal OA office system. Cybozu Garoon failed to properly process authentication requests, allowing remote attackers to perform LDAP injection attacks to bypass established login restrictions or obtain sensitive information...

Design/Logic Flaw

Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration...

CVE-2015-5649

Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration...

CVE-2015-5649

Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration...