1544 matches found
CVE-2017-2145
Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectors...
CVE-2017-2146
Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.4 allows remote attackers to inject arbitrary web script or HTML via application menu...
CVE-2017-2144
Cybozu Garoon versions 3.0.0–4.2.4 are affected by multiple CVEs (CVE-2017-2144, CVE-2017-2145, CVE-2017-2146) per sources in CVE/NVD listings and OpenVAS. CVE-2017-2144 (improper access restriction) may allow a logged-in attacker to lock another user’s files via a specially crafted page. CVE-201...
CVE-2017-2146
CVE-2017-2146 is a cross-site scripting vulnerability in Cybozu Garoon version 3.0.0 through 4.2.4. The issue allows a remote attacker to inject arbitrary web script or HTML via the application menu, potentially causing arbitrary script execution in the logged-in user’s browser. Affected products...
CVE-2017-2145
CVE-2017-2145: Cybozu Garoon 4.0.0–4.2.4 is affected by a session-fixation vulnerability. An attacker can perform arbitrary operations via unspecified vectors, potentially with the logged-in user’s privileges. Affected product: Cybozu Garoon (versions 4.0.0–4.2.4). Exploitation details are not fu...
Cybozu Garoon vulnerable to cross-site scripting
Overview Cybozu Garoon provided by Cybozu, Inc. contains a cross-site scripting in the application menu. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact An arbitrary script may be executed on the logged-in user's web browser. Solution Upda...
Cybozu Garoon vulnerable to session fixation
Overview Cybozu Garoon provided by Cybozu, Inc. contains a session fixation. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact A remote unauthenticated attacker may perform unintended operation with the logged-in user's privilege. Solution...
Cybozu Garoon fails to restrict access permission
Overview Cybozu Garoon provided by Cybozu, Inc. contains an improper access restriction. Jun Kokatsu of KDDI Singapore Dubai Branch reported vulnerability to Cybozu, Inc., and Cybozu, Inc. reported it to JPCERT/CC to notify users of its solution through JVN. Impact When a logged-in user accesses ...
JVN#43534286: Multiple vulnerabilities in Cybozu Garoon
Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. Improper access restriction CWE-284 - CVE-2017-2144 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L| Base Score: 5.4 CVSS v2| AV:N/AC:H/Au:N/C:N/I:P/A:P| Base Score: 4.0...
Cybozu Garoon 3.0.0 - 4.2.2 Multiple Vulnerabilities
Cybozu Garoon is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cybozu:garoon"; ifdescription...
CVE-2016-4906
Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to inject arbitrary web script or HTML via "Messages" function of Cybozu Garoon Keitai...
Cross site request forgery (csrf)
Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors...
CVE-2016-7801
Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors...
Sql injection
SQL injection vulnerability in the Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via "MultiReport" function...
Authentication flaw
Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters via unspecified vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to hijack the authentication of a logged in user to force a logout via unspecified vectors...
CVE-2016-4908
Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors...
CVE-2016-7803
SQL injection vulnerability in the Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via "MultiReport" function...
