CVE-2019-5975

DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2019-5975

DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2019-5977

Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via the application 'E-Mail'...

CVE-2019-5976

Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors...

Cross site scripting

DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors...

Sql injection

SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

Open redirect

Open redirect vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the application 'Scheduler'...

Design/Logic Flaw

Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via the application 'E-Mail'...

CVE-2019-5991

The CVE-2019-5991 entry concerns Cybozu Garoon versions 4.0.0–4.10.3 with an SQL injection vulnerability in the Todo portlet processing. Public sources (JVN, CNVD, CVE records) describe that remote authenticated attackers may execute arbitrary SQL commands via unspecified vectors, potentially obt...

CVE-2019-5975

DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2019-5977

Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via the application 'E-Mail'...

CVE-2019-5991

SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2019-5976

CVE-2019-5976 affects Cybozu Garoon 4.0.0–4.10.2. An attacker with administrative privileges can cause a denial-of-service by altering session authentication data (DoS condition). Affected product/version details come from multiple sources (NVD/Red Hat/JVN). Mitigation: Update to the latest versi...

CVE-2019-5976

Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors...

CVE-2019-5978

Open redirect vulnerability (CVE-2019-5978) in Cybozu Garoon Scheduler affects Cybozu Garoon 4.0.0 to 4.10.2. An attacker can redirect users to arbitrary websites via a crafted URL, enabling phishing risks. Root cause: open redirect in Scheduler. Impact is limited to user redirection; no other co...

CVE-2019-5975

CVE-2019-5975 affects Cybozu Garoon 4.6.0–4.10.2 with a DOM-based cross-site scripting vulnerability in the Portal component (CWE-79). Root cause: insufficient input validation allows an authenticated user to cause arbitrary script/HTML execution in the user’s browser via unspecified vectors. Imp...

CVE-2019-5977

CVE-2019-5977 is a mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2, where a user with authenticated access can alter mail headers via the E-mail feature. Connected sources confirm the affected product/version range and the vulnerability type (mail header injection) with remed...

Cybozu Garoon vulnerable to SQL injection

Overview Cybozu Garoon provided by Cybozu, Inc. contains an SQL injection vulnerability CWE-89 in the processing of Todo portlet. Shoji Baba reported this vulnerability to Cybozu, Inc., and Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/C...

JVN#71877187: Cybozu Garoon vulnerable to SQL injection

Cybozu Garoon provided by Cybozu, Inc. contains an SQL injection vulnerability CWE-89 in the processing of Todo portlet. Impact A user who can login to the product may obtain or alter information stored in the database. Solution Apply the Patch Apply the patch according to the information provide...