CVE-2019-5941

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the Report without access privileges via the application 'Multi Report'...

CVE-2019-5939

CVE-2019-5939 is a Cross-site scripting vulnerability in Cybozu Garoon (Portal) affecting versions 4.0.0–4.10.1. The issue arises from insufficient validation of client-side data in the web app, enabling remote attackers to inject scripts. Exploitation is described as a browser-script impact; the...

CVE-2019-5940

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Scheduler'...

CVE-2019-5935

CVE-2019-5935 concerns Cybozu Garoon 4.0.0 to 4.10.1, where remote authenticated attackers could bypass access control and change user information without privileges via the Item function of User Information. The issue’s impact is that a user who can log in may alter user data without proper auth...

CVE-2019-5942

Summary of CVE-2019-5942 : Cybozu Garoon versions 4.0.0–4.10.1 are affected by a vulnerability in the Cabinet module’s Multiple Files Download function that allows remote authenticated attackers to bypass access controls and obtain files without proper privileges. Public documents from NVD and Re...

CVE-2019-5936

CVE-2019-5936 is a directory traversal vulnerability in Cybozu Garoon (Work Flow) affecting versions 4.0.0 through 4.10.1. The root cause is improper path filtering, enabling remote authenticated attackers to obtain files outside the permitted directory. Impact reported includes unauthorized file...

CVE-2019-5937

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or HTML via the user information...

CVE-2019-5943

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to view the information without view privileges via the application 'Bulletin' and the application 'Cabinet'...

CVE-2019-5944

CVE-2019-5944 affects Cybozu Garoon 4.0.0 to 4.10.1. A remote authenticated attacker can bypass access restrictions and alter contents of the application “Address” without modify privileges via the application “Address.” Multiple sources corroborate the issue as a privilege/access-control flaw en...

CVE-2019-5940

Cybozu Garoon 4.x (4.0.0–4.10.1) is affected by Cross-site scripting via the Scheduler component (CVE-2019-5940). The vulnerability enables remote attackers to inject script/HTML into a user’s browser, constituting an XSS risk. Connected sources corroborate multiple related CVEs affecting Garoon ...

CVE-2019-5938

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Mail'...

CVE-2019-5937

CVE-2019-5937 affects Cybozu Garoon 4.0.0–4.10.1. The vulnerability is a cross-site scripting (XSS) flaw in the user information path, allowing remote authenticated attackers to inject arbitrary web script or HTML via user information. Impact is that an attacker can execute scripts in a victim’s ...

CVE-2019-5944

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the contents of application 'Address' without modify privileges via the application 'Address'...

CVE-2019-5933

Cybozu Garoon 4.0.0 to 4.10.0 allows remote authenticated attackers to bypass access restriction to view the Bulletin Board without view privileges via the application 'Bulletin'...

CVE-2019-5942

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to obtain files without access privileges via the Multiple Files Download function of application 'Cabinet'...

CVE-2019-5938

CVE-2019-5938 is a stored cross-site scripting vulnerability in Cybozu Garoon’s Mail application, affecting Cybozu Garoon 4.0.0 to 4.10.1. The issue allows remote attackers to inject arbitrary web script or HTML via the Mail component. Exploitation details are not provided in the connected docume...

CVE-2019-5939

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Portal'...

CVE-2019-5934

SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.0 allows attacker with administrator rights to execute arbitrary SQL commands via the Log Search function of application 'logging'...

CVE-2019-5945

Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authentication of Cybozu Garoon...

CVE-2019-5945

CVE-2019-5945 affects Cybozu Garoon versions 4.2.4 through 4.10.1, where an information disclosure vulnerability in the authentication flow may allow remote attackers to obtain users’ credential information. The issue is documented in NVD and Red Hat advisory entries, with the OpenVAS entry also ...