CVE-2006-4491

Summary: Cybozu products (Collaborex, AG before 1.2(1.5); AG Pocket before 5.2(0.8); Mailwise before 3.0(0.3); Garoon 1 before 1.5(4.1)) are vulnerable to a directory traversal flaw that allows remote authenticated users to read arbitrary files via unspecified vectors. Impact: partial confidentia...

CVE-2014-5314

CVE-2014-5314 maps to a buffer overflow in Cybozu Office, Cybozu Mailwise and Cybozu Dezie that allows remote authenticated users to execute arbitrary code via email messages. OpenVAS entries and JVN/CVE references confirm affected product families and versions: Cybozu Office up to 10.0.x (pre-10...

CVE-2018-0558

Cybozu Mailwise 5.0.0–5.4.1 contains a reflected cross-site scripting (CWE-79) vulnerability in System settings, enabling injection of arbitrary script or HTML and potential session-local impact. The issue is confirmed across multiple sources (CVE-2018-0558 and related records). Attack vectors ar...

CVE-2011-1334

CVE-2011-1334 is a cross-site scripting vulnerability affecting Cybozu Office 6, Cybozu Garoon 2.0.0–2.1.3, Cybozu Dezie before 6.1, Cybozu MailWise before 3.1, and Cybozu Collaborex before 1.5. The flaw allows remote attackers to inject arbitrary script/HTML via vectors related to downloading gr...

CVE-2016-4842

CVE-2016-4842 affects Cybozu Mailwise prior to 5.4.0. A vulnerability in the mail view page can disclose that a user read a specific email when a specially crafted message is opened, enabling information disclosure from remote attackers. Affected versions are 5.0.0 through 5.3.2. The root cause r...

CVE-2016-4844

CVE-2016-4844 : Cybozu Mailwise is vulnerable to clickjacking in versions before 5.4.0. Several sources (NVD entry for CVE-2016-4844 and OpenVAS/JS references) specify vulnerable ranges such as 5.0.0–5.3.2 and indicate that an attacker could trick authenticated users into unintended actions by lo...

CVE-2013-2305

CVE-2013-2305 is a CSRF vulnerability affecting Cybozu Office (pre-8.1.6, and 9.x pre-9.3.0), Cybozu Dezie (pre-8.0.7), and Cybozu Mailwise (pre-5.0.4). The issue allows remote attackers to hijack the authentication of arbitrary users to execute password-change requests. Root cause is cross-site ...

CVE-2016-4843

CVE-2016-4843 affects Cybozu Mailwise prior to 5.4.0. The issue is an information-disclosure vulnerability: an unauthenticated remote attacker could obtain sensitive cookie/session information due to exposure on the CGI environment variables display page. Impact is partial confidentiality loss of...

CVE-2020-5572

The CVE-2020-5572 entry applies to Cybozu’s Android app Mailwise for Android, specifically versions 1.0.0 through 1.0.1. It is described as an information disclosure vulnerability that allows an attacker to obtain credential information registered in the product via unspecified vectors. The conne...

CVE-2013-4698

Cybozu Mailwise 5.0.4 and 5.0.5 are affected by an information-disclosure vulnerability where remote authenticated users can view contents of other emails by reading Subject header lines in their own mailbox. Root cause: improper handling of Subject headers enables cross-email visibility in oppor...

CVE-2018-0557

CVE-2018-0557 affects Cybozu Mailwise versions 5.0.0–5.4.1. The vulnerability is a Stored cross-site scripting (CWE-79) in the E-mail Details Screen, allowing a remote attacker to inject arbitrary web script or HTML via unspecified vectors. Impact is that an arbitrary script may be executed in th...

CVE-2016-4841

Cybozu Mailwise is affected by CVE-2016-4841: versions 5.0.0 through 5.3.2 are vulnerable to email header injection when sending messages. The root cause is improper handling of email headers, allowing a remote attacker to inject arbitrary headers via crafted requests. Public references indicate ...

CVE-2018-0702

The CVE-2018-0702 issue affects Cybozu Mailwise 5.0.0–5.4.5, where a directory traversal vulnerability (CWE-22) could be exploited by a remote attacker to delete arbitrary files on the server. Root cause is due to insecure handling of HTTP request parameters in Mailwise, as documented by multiple...

CVE-2018-0559

CVE-2018-0559 concerns Cybozu Mailwise 5.0.0–5.4.1 with a reflected cross-site scripting flaw in the Address field (CWE-79). The vulnerability allows an attacker to inject scripts that may execute in the logged-in user’s browser; impact is described as arbitrary script execution on the user’s bro...