PT-2013-5912

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7 SP1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. Recommendations For versions prior to 3.7 SP1, update to version 3.7 SP1 or later to resolve the issue...

CVE-2013-6902: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Space function in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2013-6185

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.2 Description The issue is related to a cross-site scripting XSS vulnerability in the system-administration component. This allows remote authenticated users to inject arbitrary web script or HTML via...

PT-2013-5913

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7 SP1 Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, via unspecified vectors. Recommendations For versions prior to 3.7 SP1, update to version 3.7 SP1...

PT-2013-6171

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.0 Description A cross-site scripting XSS issue exists in the Space function of Cybozu Garoon, specifically when used with Firefox, allowing remote attackers to inject arbitrary web script or HTML...

CVE-2013-6900: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the system-administration component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2013-5914

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.1 through 3.5 SP5 Description The issue is related to a CRLF injection vulnerability. When Phone Messages forwarding is enabled, remote authenticated users can inject arbitrary e-mail headers via unspecified vectors...

PT-2013-6173

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.0 Description A cross-site scripting XSS issue exists in the schedule component of Cybozu Garoon, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors when using Internet...

PT-2013-6175

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.0 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors when using Internet Explorer or Firefox. Recommendations For...

PT-2013-6181

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.2 Description A cross-site scripting XSS issue exists in the bulletin-board component, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified vectors when using Internet...

CVE-2013-6911: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6002: Undefined Security Weakness

The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service CPU consumption via unspecified vectors...

Cybozu Garoon vulnerable to session fixation

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains a session fixation vulnerability. Impact A remote, unauthenticated attacker may impersonate a registered user. As a result, information may be disclosed or altered. Solution Update the Software Update to the...

Cybozu Garoon vulnerable to mail header injection

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains a mail header injection vulnerability in the Phone Messages function. Impact If the function that forwards Phone Messages to an email address is configured, the header of the email to be forwarded may be altered...

Cybozu Garoon vulnerable to SQL injection

Overview Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains a SQL injection vulnerability in the Space function. Impact A user who can log in to the product may execute an arbitrary SQL command in the database that the product is referencing. Solution Update the Softwar...

Multiple cross-site scripting vulnerabilities in Cybozu Garoon

Overview Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains multiple cross-site scripting vulnerabilities. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provid...

JVN#82375148: Cybozu Garoon vulnerable to SQL injection

Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains a SQL injection vulnerability in the Space function. Impact A user who can log in to the product may execute an arbitrary SQL command in the database that the product is referencing. Solution Update the Software Update ...

JVN#94245330: Cybozu Garoon vulnerable to denial-of-service (DoS)

Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains a denial-of-service DoS vulnerability. Impact A denial-of-service DoS attack via Garoon 3 Keitai may cause high CPU usage on the server. Solution Update the Software Update to the latest version according to the...

JVN#87729477: Cybozu Garoon vulnerable to session fixation

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains a session fixation vulnerability. Impact A remote, unauthenticated attacker may impersonate a registered user. As a result, information may be disclosed or altered. Solution Update the Software Update to the latest versi...

JVN#84221103: Cybozu Garoon vulnerable to mail header injection

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains a mail header injection vulnerability in the Phone Messages function. Impact If the function that forwards Phone Messages to an email address is configured, the header of the email to be forwarded may be altered. Solutio...