Cybozu Office vulnerable to cross-site scripting

Overview Cybozu Office is a groupware. Cybozu Office contains a cross-site scripting vulnerability in the function to customize the top page. Motoki Nishio of VALTES CO.,LTD. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

PT-2013-5147

Name of the Vulnerable Software and Affected Versions Cybozu Office versions prior to 9.3.1 Description A cross-site scripting XSS issue exists in the top-page customization feature, allowing remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized...

CVE-2013-4703: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the top-page customization feature in Cybozu Office before 9.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...