Authentication flaw

Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in Application Menu...

Authentication flaw

Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in the affected product via the API...

Authorization

Improper authorization vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to alter the application's data via the applications 'E-mail' and 'Messages'...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function...

Input validation

Improper input validation vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows a remote authenticated attacker to alter the application's data via the applications 'Workflow' and 'MultiReport'...

Cross site scripting

Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 5.0.0 allows remote attackers to inject arbitrary web script or HTML via the applications 'Messages' and 'Bulletin Board'...

Cross site scripting

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the application 'E-mail'...

CVE-2020-5568

Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 5.0.0 allows remote attackers to inject arbitrary web script or HTML via the applications 'Messages' and 'Bulletin Board'...

CVE-2020-5568

CVE-2020-5568 is a cross-site scripting vulnerability in Cybozu Garoon, affecting versions 4.6.0 through 5.0.0. The flaw allows remote attackers to inject arbitrary web script or HTML via the Messages and Bulletin Board applications. The underlying issue is an XSS weakness in these components, en...

CVE-2020-5567

CVE-2020-5567 affects Cybozu Garoon 4.0.0–4.10.3 (Application Menu). The root cause is improper authentication (CWE-287) in the Application Menu, allowing remote attackers to obtain data. Impact per sources: data disclosure from the Application Menu; CVSS metrics show high risk (v3 base 7.5, v2 b...

CVE-2020-5566

Improper authorization vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to alter the application's data via the applications 'E-mail' and 'Messages'...

CVE-2020-5566

Cybozu Garoon 4.0.0–4.10.3 contains an improper authorization vulnerability (CWE-285) that allows remote authenticated attackers to alter data via the E-mail and Messages applications. Affected component: Cybozu Garoon core with access to E-mail and Messages; root cause is improper authorization ...

CVE-2020-5567

Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in Application Menu...

CVE-2020-5564

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the application 'E-mail'...

CVE-2020-5564

CVE-2020-5564 affects Cybozu Garoon (v4.0.0–4.10.3). It is a cross-site scripting vulnerability in the E-mail component that allows a remote attacker to inject arbitrary web script or HTML via the E-mail application. The issue is caused by improper handling of input in the E-mail feature, enablin...

CVE-2020-5565

CVE-2020-5565 affects Cybozu Garoon 4.0.0–4.10.3. The connected JVN entry documents an Input validation bypass in the Workflow and MultiReport applications (CWE-20), allowing a remote authenticated attacker to alter the product’s data. Root cause: improper input validation in the targeted compone...

CVE-2020-5565

Improper input validation vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows a remote authenticated attacker to alter the application's data via the applications 'Workflow' and 'MultiReport'...

CVE-2020-5562

CVE-2020-5562 is an SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3. A remote attacker with administrative privileges can trigger arbitrary HTTP requests to external web servers via the product’s V-CUBE Meeting function. The flaw is rooted in how the V-CUBE Meeting feature handles outbound req...

CVE-2020-5563

CVE-2020-5563 is an authentication-by-pass vulnerability in Cybozu Garoon, affecting versions 4.0.0 through 4.10.3. According to multiple sources, a remote attacker can obtain data via the product’s API due to improper authentication in the API used to specify fields (authentication bypass). Impa...

CVE-2020-5562

Server-side request forgery SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function...