CVE-2018-16171

CVE-2018-16171 affects Cybozu Remote Service, vulnerable in 3.0.0 to 3.1.8, due to a directory traversal in the client certificates registration function. This can lead to arbitrary Java code execution on the server. Affected products/versions: Cybozu Remote Service 3.0.0–3.1.8 (note: CVE-2018-16...

CVE-2018-16172

CVE-2018-16172 affects Cybozu Remote Service (versions 3.0.0–3.1.8). The issue is an improper countermeasure against clickjacking on the client certificates management screen, which could allow a remote attacker to trick a user into deleting the user’s registered client certificate. Impact descri...

CVE-2018-16170

CVE-2018-16170 is a directory traversal vulnerability in Cybozu Remote Service, affecting Windows installations of Cybozu Remote Service 3.0.0 to 3.1.8. The issue allows remote authenticated attackers to read arbitrary files via unspecified vectors. Impact reported includes potential server file ...

CVE-2021-20797

CVE-2021-20797 is a cross-site script inclusion vulnerability in the Cybozu Remote Service management UI (CWE-829) affecting Cybozu Remote Service versions around 3.1.8 (and 3.1.9 per related documentation). The issue allows a remote authenticated attacker to obtain information stored in the prod...

CVE-2021-20805

CVE-2021-20805 is a cross-site scripting vulnerability in Cybozu Remote Service, affecting version 3.1.7 through 3.1.9. The issue resides in the management screen and allows a remote authenticated attacker to inject arbitrary scripts via unspecified vectors. The impact described across sources is...

CVE-2021-20807

The CVE-2021-20807 issue is a cross-site scripting vulnerability in the Cybozu Remote Service management screen (versions 3.0.0–3.1.9). The underlying flaw enables an attacker to inject arbitrary scripts via unspecified vectors, potentially affecting users authenticated to the product and execute...

CVE-2022-26838

Summary of CVE-2022-26838 : A path traversal vulnerability exists in Cybozu Remote Service 3.1.2 within the Importing Mobile Device Data component. The issue allows a remote authenticated attacker to cause a denial-of-service (DoS). Multiple authoritative sources describe the same condition, citi...

CVE-2021-20806

CVE-2021-20806 is an open redirect vulnerability in Cybozu Remote Service, affecting versions 3.0.0 through 3.1.9. The CVE allows remote attackers to redirect users to arbitrary websites, enabling phishing attacks via unspecified vectors. Multiple connected sources corroborate the issue and enume...

CVE-2018-16169

Cybozu Remote Service vulnerable from version 3.0.0 to 3.1.0 to upload and execute arbitrary Java code on the server via the logo setting screen (CVE-2018-16169). The issue enables remote authenticated attackers to run Java code, with impact described as remote code execution on the server. The C...

CVE-2014-1983

CVE-2014-1983 affects Cybozu Remote Service Manager up to 3.1.0 (and 2.3.0 and earlier); it allows remote attackers to cause a denial of service by triggering CPU consumption via unspecified vectors. Some sources note an incomplete fix leading to a related CVE-2014-7266 that involves algorithmic ...

CVE-2021-20798

CVE-2021-20798 is a cross-site scripting vulnerability in the Cybozu Remote Service management screen (versions 3.1.8–3.1.9). An authenticated remote attacker can inject arbitrary scripts into the UI, potentially affecting the user’s browser session. The issue affects Cybozu Remote Service 3.1.8 ...

CVE-2021-20803

The CVE-2021-20803 entry concerns Cybozu Remote Service. Affected software: Cybozu Remote Service versions 3.1.8 through 3.1.9. Issue: an operation restriction bypass in the management screen enables a remote authenticated attacker to alter data shown in the management interface. Impact is descri...

CVE-2021-20796

The CVE-2021-20796 entry describes a path-traversal vulnerability in Cybozu Remote Service, affecting Cybozu Remote Service versions 3.1.8 (and related entries up to 3.1.9 for other CVEs). The vulnerability resides in the management screen and allows a remote authenticated attacker to upload an a...

CVE-2014-1984

CVE-2014-1984 describes a session-fixation vulnerability in Cybozu Remote Service Manager’s management screen. The flaw affects Remote Service Manager versions 2.3.0 and 3.x prior to 3.1.1, allowing a remote, unauthenticated attacker to hijack web sessions and impersonate a registered user via un...

CVE-2021-20804

CVE-2021-20804 affects Cybozu Remote Service 3.1.8–3.1.9. A remote authenticated attacker can cause a denial-of-service condition via unspecified vectors. Public references in multiple databases corroborate the DoS impact. The mitigation is to update to the latest Cybozu Remote Service version pe...

CVE-2021-20800

CVE-2021-20800: Cross-site scripting in the Cybozu Remote Service management screen (3.1.8). An authenticated remote attacker can inject scripts via unspecified vectors, potentially affecting users logged into the product. Affected: Cybozu Remote Service 3.1.8 (and related entries indicate 3.1.8–...

CVE-2021-20802

CVE-2021-20802 affects Cybozu Remote Service versions 3.1.8–3.1.9 and is an HTTP header injection vulnerability (CWE-113) that can let a remote attacker alter information stored in the product. The issue is documented across multiple sources (NVD, JVN, Red Hat, CNVD, CNVD, etc.). The confirmed im...

CVE-2021-20801

Cybozu Remote Service (Cybozu Remote Service 3.1.8–3.1.9) contains an XML External Entity (XXE) vulnerability exploitable by a remote authenticated attacker. The issue, which affects only when using Mozilla Firefox, can allow access to information stored in the product. CVE-2021-20801 is document...

CVE-2021-20795

CVE-2021-20795 : Cybozu Remote Service has a CSRF vulnerability in the management screen that could allow an attacker to hijack an administrator’s session and perform unintended operations. Affected products are Cybozu Remote Service 3.1.8 to 3.1.9. Remediation per the package advisories is to up...

CVE-2021-20799

CVE-2021-20799 affects Cybozu Remote Service, specifically the management UI in versions 3.1.8 through 3.1.9. A cross-site scripting (XSS) vulnerability allows a remote authenticated attacker to inject arbitrary scripts via unspecified vectors, potentially affecting the logged-in user’s browser s...

CVE-2016-7815

CVE-2016-7815 affects Cybozu Remote Service Manager (RSM) versions 3.0.0 through 3.1.4. The root cause is failure to verify client certificates, potentially allowing remote attackers to access internal systems on the network. Impact is access to internal web systems that should be inaccessible fr...

CVE-2014-7266

CVE-2014-7266 affects Cybozu Remote Service Manager (versions 2.3.0 and 3.x up to 3.1.2). It is an algorithmic complexity DoS vulnerability caused by an incomplete fix for CVE-2014-1983, allowing remote attackers to trigger colliding hash-table keys and cause CPU exhaustion. The DoS impact is a d...