Cybozu Garoon 3.5.3

CPE Details

Cybozu Garoon 3.5.3
cybozu
garoon
3.5.3
2013-02-14
17h04 +00:00
2014-04-29
17h37 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:cybozu:garoon:3.5.3:*:*:*:*:*:*:*

Informations

Vendor

cybozu

Product

garoon

Version

3.5.3

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2018-16178 2019-01-09 21h00 +00:00 Cybozu Garoon 3.0.0 to 4.10.0 allows remote attackers to bypass access restriction to view information available only for a sign-on user via Single sign-on function.
7.5
High
CVE-2018-0673 2018-11-15 14h00 +00:00 Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vectors.
8.1
High
CVE-2018-0607 2018-07-26 15h00 +00:00 SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
8.8
High
CVE-2018-0530 2018-04-16 11h00 +00:00 SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
8.8
High
CVE-2018-0531 2018-04-16 11h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to view or alter an access privilege of a folder and/or notification settings via unspecified vectors.
4.3
Medium
CVE-2018-0532 2018-04-16 11h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors.
2.7
Low
CVE-2018-0533 2018-04-16 11h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authentication via unspecified vectors.
4.9
Medium
CVE-2018-0549 2018-04-16 11h00 +00:00 Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
5.4
Medium
CVE-2018-0550 2018-04-16 11h00 +00:00 Cybozu Garoon 3.5.0 to 4.6.1 allows remote authenticated attackers to bypass access restriction to view the closed title of "Cabinet" via unspecified vectors.
4.3
Medium
CVE-2018-0551 2018-04-16 11h00 +00:00 Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
5.4
Medium
CVE-2017-2254 2017-08-28 18h00 +00:00 Cybozu Garoon 3.5.0 to 4.2.5 allows an attacker to cause a denial of service in the application menu's edit function via specially crafted input
4.9
Medium
CVE-2017-2256 2017-08-28 18h00 +00:00 Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Memo".
5.4
Medium
CVE-2017-2257 2017-08-28 18h00 +00:00 Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via mail function.
6.1
Medium
CVE-2017-2144 2017-07-07 11h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.4 may allow an attacker to lock another user's file through a specially crafted page.
5.4
Medium
CVE-2017-2146 2017-07-07 11h00 +00:00 Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.4 allows remote attackers to inject arbitrary web script or HTML via application menu.
4.8
Medium
CVE-2016-4906 2017-06-09 14h00 +00:00 Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to inject arbitrary web script or HTML via "Messages" function of Cybozu Garoon Keitai.
6.1
Medium
CVE-2016-4907 2017-06-09 14h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors.
8.8
High
CVE-2016-4908 2017-06-09 14h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors.
4.3
Medium
CVE-2016-4909 2017-06-09 14h00 +00:00 Cross-site request forgery (CSRF) vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to hijack the authentication of a logged in user to force a logout via unspecified vectors.
4.3
Medium
CVE-2016-4910 2017-06-09 14h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters via unspecified vectors.
4.3
Medium
CVE-2016-7801 2017-06-09 14h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors.
4.3
Medium
CVE-2016-7802 2017-06-09 14h00 +00:00 Directory traversal vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to read arbitrary files via unspecified vectors.
6.5
Medium
CVE-2016-7803 2017-06-09 14h00 +00:00 SQL injection vulnerability in the Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via "MultiReport" function.
8.8
High
CVE-2017-2091 2017-04-28 14h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone messages via unspecified vectors.
4.3
Medium
CVE-2017-2092 2017-04-28 14h00 +00:00 Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
5.4
Medium
CVE-2017-2093 2017-04-28 14h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.3 allow remote attackers to obtain tokens used for CSRF protection via unspecified vectors.
4.3
Medium
CVE-2017-2094 2017-04-28 14h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete information via unspecified vectors.
4.3
Medium
CVE-2017-2095 2017-04-28 14h00 +00:00 Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in the mail function leading to an alteration of the order of mail folders via unspecified vectors.
4.3
Medium
CVE-2016-1213 2017-04-20 16h00 +00:00 The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites.
6.1
Medium
CVE-2016-1214 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1215 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1216 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1217 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1218 2017-04-20 16h00 +00:00 SQL injection vulnerability in Cybozu Garoon before 4.2.2.
8.8
High
CVE-2016-1220 2017-04-20 16h00 +00:00 Cybozu Garoon before 4.2.2 does not properly restrict access.
4.3
Medium
CVE-2016-1219 2017-04-20 15h00 +00:00 Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use.
9.8
Critical
CVE-2016-1188 2016-06-25 19h00 +00:00 Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to send spoofed e-mail messages via unspecified vectors.
6.5
Medium
CVE-2016-1189 2016-06-25 19h00 +00:00 Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors.
8.1
High
CVE-2016-1190 2016-06-25 19h00 +00:00 Cybozu Garoon 3.1 through 4.2 allows remote authenticated users to bypass intended restrictions on MultiReport reading via unspecified vectors.
6.5
Medium
CVE-2015-7776 2016-06-19 18h00 +00:00 Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2016-1196.
4.3
Medium
CVE-2016-1191 2016-06-19 18h00 +00:00 Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified vectors.
5.3
Medium
CVE-2016-1196 2016-06-19 18h00 +00:00 Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address Book information via an API call, a different vulnerability than CVE-2015-7776.
4.3
Medium
CVE-2016-1195 2016-06-19 13h00 +00:00 Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
7.4
High
CVE-2015-5646 2015-10-12 08h00 +00:00 Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867.
8.5
CVE-2015-5647 2015-10-12 08h00 +00:00 The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866.
8.5
CVE-2015-5649 2015-10-08 18h00 +00:00 Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privileges.
7
CVE-2014-1987 2014-07-20 08h00 +00:00 The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors.
10
CVE-2014-1992 2014-07-20 08h00 +00:00 Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
3.5
CVE-2014-1993 2014-07-20 08h00 +00:00 The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
4
CVE-2014-1994 2014-07-20 08h00 +00:00 Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
3.5
CVE-2014-1995 2014-07-20 08h00 +00:00 Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
3.5
CVE-2014-1988 2014-05-02 08h00 +00:00 The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors.
3.5
CVE-2014-1989 2014-05-02 08h00 +00:00 Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls.
6
CVE-2014-0817 2014-02-27 00h00 +00:00 Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.
4.9
CVE-2014-0820 2014-02-27 00h00 +00:00 Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors.
4
CVE-2014-0821 2014-02-27 00h00 +00:00 SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931.
6.5
CVE-2013-6930 2014-01-29 01h00 +00:00 SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2.5.4, 3.0.0 through 3.0.3, 3.5.0 through 3.5.5, and 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6929.
6.5
CVE-2013-6006 2013-12-28 01h00 +00:00 Cybozu Garoon 3.5 through 3.7 SP2 allows remote attackers to bypass Keitai authentication via a modified user ID in a request.
5.8
CVE-2013-6001 2013-12-05 10h00 +00:00 SQL injection vulnerability in the Space function in Cybozu Garoon before 3.7 SP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
6.5
CVE-2013-6002 2013-12-05 10h00 +00:00 The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
5
CVE-2013-0701 2013-02-14 11h00 +00:00 SQL injection vulnerability in Cybozu Garoon 2.5.0 through 3.5.3 allows remote authenticated users to execute arbitrary SQL commands by leveraging a logging privilege.
6
CVE-2013-0702 2013-02-14 11h00 +00:00 Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 3.5.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.