1514 matches found
CVE-2019-5937
CVE-2019-5937 affects Cybozu Garoon 4.0.0–4.10.1. The vulnerability is a cross-site scripting (XSS) flaw in the user information path, allowing remote authenticated attackers to inject arbitrary web script or HTML via user information. Impact is that an attacker can execute scripts in a victim’s ...
CVE-2019-5933
CVE-2019-5933 affects Cybozu Garoon 4.0.0 to 4.10.0. The vulnerability allows remote authenticated attackers to bypass access restrictions and view the Bulletin Board without proper view privileges via the Bulletin application. The root cause is an access-control bypass in the Bulletin feature, e...
CVE-2019-5939
CVE-2019-5939 is a Cross-site scripting vulnerability in Cybozu Garoon (Portal) affecting versions 4.0.0–4.10.1. The issue arises from insufficient validation of client-side data in the web app, enabling remote attackers to inject scripts. Exploitation is described as a browser-script impact; the...
CVE-2019-5935
CVE-2019-5935 concerns Cybozu Garoon 4.0.0 to 4.10.1, where remote authenticated attackers could bypass access control and change user information without privileges via the Item function of User Information. The issue’s impact is that a user who can log in may alter user data without proper auth...
CVE-2019-5938
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Mail'...
CVE-2019-5943
Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to view the information without view privileges via the application 'Bulletin' and the application 'Cabinet'...
CVE-2019-5934
Summary: CVE-2019-5934 is a SQL injection vulnerability in Cybozu Garoon, affecting versions 4.0.0 through 4.10.0, exploitable by an attacker with administrator rights via the Log Search function in the logging component. The underlying issue is an injection flaw in the Log Search path, allowing ...
CVE-2019-5938
CVE-2019-5938 is a stored cross-site scripting vulnerability in Cybozu Garoon’s Mail application, affecting Cybozu Garoon 4.0.0 to 4.10.1. The issue allows remote attackers to inject arbitrary web script or HTML via the Mail component. Exploitation details are not provided in the connected docume...
CVE-2019-5936
Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privileges via the application 'Work Flow'...
CVE-2019-5942
Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to obtain files without access privileges via the Multiple Files Download function of application 'Cabinet'...
CVE-2019-5939
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Portal'...
CVE-2019-5940
Cybozu Garoon 4.x (4.0.0–4.10.1) is affected by Cross-site scripting via the Scheduler component (CVE-2019-5940). The vulnerability enables remote attackers to inject script/HTML into a user’s browser, constituting an XSS risk. Connected sources corroborate multiple related CVEs affecting Garoon ...
CVE-2019-5944
Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the contents of application 'Address' without modify privileges via the application 'Address'...
CVE-2019-5934
SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.0 allows attacker with administrator rights to execute arbitrary SQL commands via the Log Search function of application 'logging'...
CVE-2019-5941
Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the Report without access privileges via the application 'Multi Report'...
CVE-2019-5930
CVE-2019-5930 affects Cybozu Garoon 4.0.0–4.6.3. Root cause: bypass of access restrictions in the Management of Basic System, enabling remote attackers to browse unauthorized pages. Impact: unauthorized page access due to broken access control. Exploitation details are not provided beyond the des...
CVE-2019-5930
Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application 'Management of Basic System'...
CVE-2019-5932
CVE-2019-5932 is a cross-site scripting vulnerability in Cybozu Garoon, affecting versions 4.6.0–4.6.3, exploitable via the Portal application by remote authenticated attackers to inject script/HTML. The root cause is described as insufficient validation of client-side data in Garoon’s portal/web...