CVE-2019-5940

Cybozu Garoon 4.x (4.0.0–4.10.1) is affected by Cross-site scripting via the Scheduler component (CVE-2019-5940). The vulnerability enables remote attackers to inject script/HTML into a user’s browser, constituting an XSS risk. Connected sources corroborate multiple related CVEs affecting Garoon ...

CVE-2019-5933

Cybozu Garoon 4.0.0 to 4.10.0 allows remote authenticated attackers to bypass access restriction to view the Bulletin Board without view privileges via the application 'Bulletin'...

CVE-2019-5939

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Portal'...

CVE-2019-5935

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to change user information without access privileges via the Item function of User Information...

CVE-2019-5934

Summary: CVE-2019-5934 is a SQL injection vulnerability in Cybozu Garoon, affecting versions 4.0.0 through 4.10.0, exploitable by an attacker with administrator rights via the Log Search function in the logging component. The underlying issue is an injection flaw in the Log Search path, allowing ...

CVE-2019-5945

Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authentication of Cybozu Garoon...

CVE-2019-5943

Cybozu Garoon (Cybozu Garoon 4.0.0 to 4.10.1) contains an access-control bypass vulnerability that allows remote authenticated attackers to view information without proper view privileges via the Bulletin and Cabinet components. The issue enables bypassing view restrictions for resources across t...

CVE-2019-5945

CVE-2019-5945 affects Cybozu Garoon versions 4.2.4 through 4.10.1, where an information disclosure vulnerability in the authentication flow may allow remote attackers to obtain users’ credential information. The issue is documented in NVD and Red Hat advisory entries, with the OpenVAS entry also ...

CVE-2019-5933

CVE-2019-5933 affects Cybozu Garoon 4.0.0 to 4.10.0. The vulnerability allows remote authenticated attackers to bypass access restrictions and view the Bulletin Board without proper view privileges via the Bulletin application. The root cause is an access-control bypass in the Bulletin feature, e...

CVE-2019-5941

CVE-2019-5941 affects Cybozu Garoon 4.0.0 to 4.10.1. A privilege/access-control flaw in the Multi Report functionality allows remote authenticated attackers to bypass access restrictions and alter the Report without proper access privileges. Impact is the unauthorized modification of reports for ...

CVE-2019-5936

Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privileges via the application 'Work Flow'...

CVE-2019-5930

Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application 'Management of Basic System'...

CVE-2019-5928

CVE-2019-5928 is a cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 that can be triggered through the Customize Item function, allowing an attacker to cause arbitrary script execution in a user’s browser. Technical details across sources indicate the issue stems from insuf...

CVE-2019-5932

Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Portal'...

CVE-2019-5929

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the application 'Memo'...

CVE-2019-5931

Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors...

CVE-2019-5931

CVE-2019-5931 affects Cybozu Garoon 4.0.0 to 4.6.3. The vulnerability allows an authenticated attacker to alter information with privileges by invoking the installer via unspecified vectors. This is the primary impact described in multiple sources (NVD/Red Hat/JVN). The case details do not specif...

CVE-2019-5928

Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via Customize Item function...

CVE-2019-5932

CVE-2019-5932 is a cross-site scripting vulnerability in Cybozu Garoon, affecting versions 4.6.0–4.6.3, exploitable via the Portal application by remote authenticated attackers to inject script/HTML. The root cause is described as insufficient validation of client-side data in Garoon’s portal/web...

CVE-2019-5929

CVE-2019-5929 concerns a Cross-site scripting vulnerability in Cybozu Garoon, specifically in the Memo component, in versions 4.0.0 through 4.6.3. The root cause is described (by CNVD and related records) as a lack of proper validation of client-side data in the web application, enabling remote a...