CVE-2014-1995

Cross-site scripting XSS vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1987: Improper Neutralization of Special Elements used in an OS Command

The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2014-1993: Undefined Security Weakness

The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors...

CVE-2014-1996: Undefined Security Weakness

Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, via an API call...

PT-2014-4416

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.x through 3.x before 3.7 SP4 Description A cross-site scripting XSS issue exists in the Map search functionality, allowing remote authenticated users to inject arbitrary web script or HTML. This can be achieved via...

PT-2014-4408

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.1.0 through 3.7 SP3 Description The issue allows remote attackers to execute arbitrary commands. The estimated number of potentially affected devices and details about real-world incidents are not specified...

CVE-2014-1994: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-4414

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.x through 3.x before 3.7 SP4 Description The issue allows remote authenticated users to bypass intended access restrictions. Recommendations For Cybozu Garoon versions 2.x through 3.x before 3.7 SP4, update to version...

CVE-2014-1992: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-4413

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.1.x through 3.7.x before 3.7 SP4 Description A cross-site scripting XSS issue exists in the Messages functionality, allowing remote authenticated users to inject arbitrary web script or HTML. This can be achieved via...

CVE-2014-1995: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-4417

Name of the Vulnerable Software and Affected Versions Cybozu Garoon version 3.7 before SP4 Description The issue allows remote authenticated users to bypass intended access restrictions. This can lead to the execution of arbitrary code or cause a denial of service via an API call. Recommendations...

PT-2014-4415

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.x through 3.x before 3.7 SP4 Description A cross-site scripting XSS issue exists in the Notices portlet, allowing remote authenticated users to inject arbitrary web script or HTML. This can be achieved via unspecified...

Cybozu Garoon vulnerable to cross-site scritping

Overview Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an issue in the function "Messages", which may result in a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of a user that is logged on. Solution Update t...

Cybozu Garoon vulnerable to access restriction bypass

Overview Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an issue in the function "Portlets", which may result in an access restriction bypass vulnerability CWE-264. Impact Portlets may be altered by another Cybozu Garoon user. Solution Update the Software Update to...

Cybozu Garoon vulnerable to cross-site scritping

Overview Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an issue in the function "Notices portlet", which may result in a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of a user that is logged on. Solution...

Cybozu Garoon vulnerable to cross-site scritping

Overview Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an issue in the function "Map search", which may result in a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of a user that is logged on. Solution Update...

Cybozu Garoon 3 API access restriction bypass vulnerability

Overview Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an access restriction bypass vulnerability CWE-264 when using Garoon APIs. Impact A remote attacker may cause a denial-of-service DoS or execute arbitrary code. Solution Update the Software Update to the latest...

Cybozu Garoon CGI vulnerable to remote command execution

Overview Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon CGI contains a remote command execution vulnerability. Masaaki Chida of GREE, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impac...

JVN#75990997: Cybozu Garoon vulnerable to access restriction bypass

Cybozu Garoon provided by Cybozu, Inc. is a groupware. Cybozu Garoon contains an issue in the function "Portlets", which may result in an access restriction bypass vulnerability CWE-264. Impact Portlets may be altered by another Cybozu Garoon user. Solution Update the Software Update to the lates...