Cybozu Garoon 3.5 Service Pack 2

CPE Details

Cybozu Garoon 3.5 Service Pack 2
cybozu
garoon
3.5
2021-11-24
18h28 +00:00
2021-12-08
13h26 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:cybozu:garoon:3.5:sp2:*:*:*:*:*:*

Informations

Vendor

cybozu

Product

garoon

Version

3.5

Update

sp2

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2018-16178 2019-01-09 21h00 +00:00 Cybozu Garoon 3.0.0 to 4.10.0 allows remote attackers to bypass access restriction to view information available only for a sign-on user via Single sign-on function.
7.5
High
CVE-2018-0531 2018-04-16 11h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to view or alter an access privilege of a folder and/or notification settings via unspecified vectors.
4.3
Medium
CVE-2018-0532 2018-04-16 11h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors.
2.7
Low
CVE-2018-0533 2018-04-16 11h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authentication via unspecified vectors.
4.9
Medium
CVE-2018-0549 2018-04-16 11h00 +00:00 Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
5.4
Medium
CVE-2018-0551 2018-04-16 11h00 +00:00 Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
5.4
Medium
CVE-2016-1213 2017-04-20 16h00 +00:00 The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites.
6.1
Medium
CVE-2016-1214 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1215 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1216 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1217 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1218 2017-04-20 16h00 +00:00 SQL injection vulnerability in Cybozu Garoon before 4.2.2.
8.8
High
CVE-2016-1220 2017-04-20 16h00 +00:00 Cybozu Garoon before 4.2.2 does not properly restrict access.
4.3
Medium
CVE-2016-1219 2017-04-20 15h00 +00:00 Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use.
9.8
Critical
CVE-2014-0817 2014-02-27 00h00 +00:00 Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.
4.9
CVE-2014-0820 2014-02-27 00h00 +00:00 Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors.
4
CVE-2014-0821 2014-02-27 00h00 +00:00 SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931.
6.5
CVE-2013-6006 2013-12-28 01h00 +00:00 Cybozu Garoon 3.5 through 3.7 SP2 allows remote attackers to bypass Keitai authentication via a modified user ID in a request.
5.8
CVE-2013-6929 2013-12-28 01h00 +00:00 SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input.
6.5
CVE-2013-6001 2013-12-05 10h00 +00:00 SQL injection vulnerability in the Space function in Cybozu Garoon before 3.7 SP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
6.5
CVE-2013-6002 2013-12-05 10h00 +00:00 The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
5
CVE-2013-6003 2013-12-05 10h00 +00:00 CRLF injection vulnerability in Cybozu Garoon 3.1 through 3.5 SP5, when Phone Messages forwarding is enabled, allows remote authenticated users to inject arbitrary e-mail headers via unspecified vectors.
3.5
CVE-2013-6004 2013-12-05 10h00 +00:00 Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors.
6.8
CVE-2013-6900 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-6901 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-6902 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-6903 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-6904 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in a note component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-6905 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-6906 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon before 3.7.0, when Internet Explorer 6 through 8 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-6907 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 2.x and 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-6908 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-6909 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in a report component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-6910 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in Ajax components in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2013-6911 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
3.5
CVE-2013-6912 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2, when Internet Explorer 6 through 9 is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
3.5
CVE-2013-6913 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
3.5
CVE-2013-6914 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
3.5
CVE-2013-6915 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
3.5
CVE-2013-6916 2013-12-05 10h00 +00:00 Cross-site scripting (XSS) vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.