Cybozu Garoon 2.5.2

CPE Details

Cybozu Garoon 2.5.2
cybozu
garoon
2.5.2
2014-02-27
15h55 +00:00
2014-04-29
17h37 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:cybozu:garoon:2.5.2:*:*:*:*:*:*:*

Informations

Vendor

cybozu

Product

garoon

Version

2.5.2

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2016-1213 2017-04-20 16h00 +00:00 The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites.
6.1
Medium
CVE-2016-1214 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1215 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1216 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1217 2017-04-20 16h00 +00:00 Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2.
6.1
Medium
CVE-2016-1218 2017-04-20 16h00 +00:00 SQL injection vulnerability in Cybozu Garoon before 4.2.2.
8.8
High
CVE-2016-1220 2017-04-20 16h00 +00:00 Cybozu Garoon before 4.2.2 does not properly restrict access.
4.3
Medium
CVE-2016-1219 2017-04-20 15h00 +00:00 Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use.
9.8
Critical
CVE-2014-1993 2014-07-20 08h00 +00:00 The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
4
CVE-2014-1994 2014-07-20 08h00 +00:00 Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
3.5
CVE-2014-1995 2014-07-20 08h00 +00:00 Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
3.5
CVE-2014-1988 2014-05-02 08h00 +00:00 The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors.
3.5
CVE-2014-0817 2014-02-27 00h00 +00:00 Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.
4.9
CVE-2014-0820 2014-02-27 00h00 +00:00 Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors.
4
CVE-2014-0821 2014-02-27 00h00 +00:00 SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931.
6.5
CVE-2013-6930 2014-01-29 01h00 +00:00 SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2.5.4, 3.0.0 through 3.0.3, 3.5.0 through 3.5.5, and 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6929.
6.5
CVE-2013-6001 2013-12-05 10h00 +00:00 SQL injection vulnerability in the Space function in Cybozu Garoon before 3.7 SP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
6.5
CVE-2013-6002 2013-12-05 10h00 +00:00 The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
5