CVE-2014-1988

The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service resource consumption via unspecified vectors...

CVE-2014-1989

Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls...

CVE-2014-1988

The CVE-2014-1988 vulnerability affects Cybozu Garoon’s Phone Messages feature (versions 2.0.0–3.7 SP2). Remote authenticated users can cause a denial-of-service via unspecified vectors, consuming server resources and impacting availability. Exploitation details are not provided in the sources, o...

CVE-2014-1989

Cybozu Garoon vulnerability CVE-2014-1989: Cybozu Garoon versions 3.0–3.7 SP3 contain an API access restriction bypass that allows users who can log in to delete schedule information they are not permitted to edit. Root cause described as an API access restriction bypass; impact is remote authent...

PT-2014-4410

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.0 through 3.7 SP3 Description The issue allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls. Recommendations For versions 3.0 through 3.7...

CVE-2014-1989: Undefined Security Weakness

Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls...

CVE-2014-1988: Undefined Security Weakness

The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service resource consumption via unspecified vectors...

PT-2014-4409

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.0.0 through 3.7 SP2 Description The issue affects the Phone Messages feature, allowing remote authenticated users to cause a denial of service due to resource consumption via unspecified vectors. Recommendations For...

Cybozu Garoon Phone Messages vulnerable to denial-of-service (DoS)

Overview Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains a denial-of-service DoS vulnerability in the Phone Messages function. Impact Processing input from a user who can log in to the system may cause denial-of-service DoS condition on the server by consuming high...

Cybozu Garoon API access restriction bypass vulnerability

Overview Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an access restriction bypass vulnerability when using APIs. Impact Users who can log in to the system may delete schedule information that they do not have permission to edit. Solution Update the Software Updat...

JVN#31230946: Cybozu Garoon API access restriction bypass vulnerability

Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an access restriction bypass vulnerability when using APIs. Impact Users who can log in to the system may delete schedule information that they do not have permission to edit. Solution Update the Software Update to the...

JVN#90519014: Cybozu Garoon Phone Messages vulnerable to denial-of-service (DoS)

Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains a denial-of-service DoS vulnerability in the Phone Messages function. Impact Processing input from a user who can log in to the system may cause denial-of-service DoS condition on the server by consuming high system...

CVE-2014-0820

Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2014-0817

Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors...

CVE-2014-0821

SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931...

Code injection

Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors...

Directory traversal

Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors...

Sql injection

SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931...

CVE-2014-0817

Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors...

CVE-2014-0820

Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors...