Login Request a demo
Unscored severity · published Jun 29, 2011
CVE-2011-1333
Cross-site scripting (XSS) vulnerability in Cybozu Office 6 and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via vectors…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Cybozu Office 6 and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to "downloading graphic files from the bulletin board system."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
Garoon · Cybozu
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +5 more · source: NVD
OF
Office · Cybozu
6 · source: NVD
Affected product
GA
Garoon
Cybozu
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1333
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1333
Patch
http://cybozu.co.jp/products/dl/notice/detail/0019.html
jvn.jp
http://jvn.jp/en/jp/JVN80877328/index.html
jvndb.jvn.jp
http://jvndb.jvn.jp/jvndb/JVNDB-2011-000045
Vendor Advisory
http://secunia.com/advisories/45063
www.osvdb.org
http://www.osvdb.org/73327
www.securityfocus.com
http://www.securityfocus.com/bid/48446
More from Garoon
9.8
CVE-2019-5945
Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authentication of Cybozu Garoon
9.8
CVE-2016-1219
Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use
9.0
CVE-2024-31401
Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the…
8.8
CVE-2018-0607
SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to execute arbitrary SQL commands via…
8.8
CVE-2018-0530
SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors