Design/Logic Flaw

The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2014-1994

Cross-site scripting XSS vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1987

The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2014-1992

Cross-site scripting XSS vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1995

Cross-site scripting XSS vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1996

Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, via an API call...

CVE-2014-1992

CVE-2014-1992 describes a cross-site scripting (XSS) vulnerability in the Messages function of Cybozu Garoon. Affected are Cybozu Garoon versions 3.1.x, 3.5.x, and 3.7.x prior to 3.7 SP4, potentially allowing remote authenticated users to inject arbitrary scripts/HTML via unspecified vectors. Cur...

CVE-2014-1993

The CVE-2014-1993 issue affects Cybozu Garoon 2.x–3.x prior to 3.7 SP4, where the Portlets subsystem allows remote authenticated users to bypass access restrictions via unspecified vectors. Affected products/versions include Cybozu Garoon 2.0.0 to 3.7 Service Pack 3, with a fix delivered in 3.7 S...

CVE-2014-1994

CVE-2014-1994 describes a cross-site scripting (XSS) vulnerability in the Notices portlet of Cybozu Garoon (2.x and 3.x) prior to 3.7 SP4 . The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. The underlying impact is an XSS session concern f...

CVE-2014-1995

CVE-2014-1995 is a reported XSS in Cybozu Garoon’s Map search. Affected: Cybozu Garoon 2.x–3.x (up to 3.7 SP3 per JVN) with vulnerability in the Map search function that may allow remote authenticated users to inject arbitrary script via unspecified vectors (CWE-79). Impact: arbitrary script exec...

CVE-2014-1996

CVE-2014-1996 affects Cybozu Garoon 3.7 up to Service Pack 3. A vulnerability in Garoon’s API access control (CWE-264) allows remote authenticated users to bypass restrictions and either execute arbitrary code or cause a DoS. The issue is tied to the API layer and is exploitable through API calls...

CVE-2014-1993

The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors...

CVE-2014-1987: Improper Neutralization of Special Elements used in an OS Command

The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors...

PT-2014-4413

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.1.x through 3.7.x before 3.7 SP4 Description A cross-site scripting XSS issue exists in the Messages functionality, allowing remote authenticated users to inject arbitrary web script or HTML. This can be achieved via...

PT-2014-4416

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.x through 3.x before 3.7 SP4 Description A cross-site scripting XSS issue exists in the Map search functionality, allowing remote authenticated users to inject arbitrary web script or HTML. This can be achieved via...

PT-2014-4408

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.1.0 through 3.7 SP3 Description The issue allows remote attackers to execute arbitrary commands. The estimated number of potentially affected devices and details about real-world incidents are not specified...

CVE-2014-1992: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1994: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-4415

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.x through 3.x before 3.7 SP4 Description A cross-site scripting XSS issue exists in the Notices portlet, allowing remote authenticated users to inject arbitrary web script or HTML. This can be achieved via unspecified...

PT-2014-4414

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.x through 3.x before 3.7 SP4 Description The issue allows remote authenticated users to bypass intended access restrictions. Recommendations For Cybozu Garoon versions 2.x through 3.x before 3.7 SP4, update to version...