GA
Product
Garoon
198
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 20Medium 126Low 2
Watch
Add Garoon to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-2257 | 6.1 | Aug 29 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via mail function Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +23 more |
| CVE-2016-4906 | 6.1 | Jun 9 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to inject arbitrary web script or HTML via "Messages" function of Cybozu Garoon Keitai Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +21 more |
| CVE-2016-1217 | 6.1 | Apr 20 | Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2 Affected: through 4.2.1 |
| CVE-2016-1216 | 6.1 | Apr 20 | Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2 Affected: through 4.2.1 |
| CVE-2016-1215 | 6.1 | Apr 20 | Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2 Affected: through 4.2.1 |
| CVE-2016-1214 | 6.1 | Apr 20 | Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2 Affected: through 4.2.1 |
| CVE-2016-1213 | 6.1 | Apr 20 | The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites Affected: through 4.2.1 |
| CVE-2016-1197 | 6.1 | Jun 19 | Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.2.0 |
| CVE-2026-22881 | 5.4 | Feb 2 | Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords Affected: 5.15.0 before 6.0.3 |
| CVE-2024-39457 | 5.4 | Jul 19 | Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview Affected: 6.0.0 before 6.0.2 |
| CVE-2024-31403 | 5.4 | Jun 11 | Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data of Memo Affected: 5.5.0 before 6.0.1 |
| CVE-2022-26368 | 5.4 | Jul 4 | Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter and/or obtain… Affected: 4.0.0 through 5.5.1 |
| CVE-2021-20774 | 5.4 | Aug 18 | Cross-site scripting vulnerability in some functions of E-mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote authenticated attacker to inject an arbitrary script via unspecified… Affected: 4.0.0 through 5.5.0 |
| CVE-2021-20770 | 5.4 | Aug 18 | Cross-site scripting vulnerability in Message of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors Affected: 4.6.0 through 5.0.2 |
| CVE-2021-20769 | 5.4 | Aug 18 | Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors Affected: 4.6.0 through 5.0.2 |
| CVE-2021-20767 | 5.4 | Aug 18 | Cross-site scripting vulnerability in Full Text Search of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors Affected: 4.0.0 through 5.0.2 |
| CVE-2021-20753 | 5.4 | Aug 18 | Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors Affected: 4.0.0 through 5.0.2 |
| CVE-2019-5975 | 5.4 | Sep 12 | DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 4.6.0 through 4.10.2 |
| CVE-2019-5947 | 5.4 | May 17 | Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Cabinet' Affected: 4.6.0 through 4.10.1 |
| CVE-2019-5937 | 5.4 | May 17 | Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or HTML via the user information Affected: 4.0.0 through 4.10.1 |
| CVE-2019-5936 | 5.4 | May 17 | Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privileges via the application 'Work Flow' Affected: 4.0.0 through 4.10.1 |
| CVE-2018-0551 | 5.4 | Apr 16 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 3.0.0 through 4.6.1 |
| CVE-2018-0549 | 5.4 | Apr 16 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 3.0.0 through 4.6.0 |
| CVE-2017-2256 | 5.4 | Aug 29 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Memo" Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +23 more |
| CVE-2017-2255 | 5.4 | Aug 29 | Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Space" Affected: 3.7.0; 3.7.1; 3.7.2; 3.7.3; 3.7.4; 3.7.5; +9 more |
| CVE-2017-2145 | 5.4 | Jul 7 | Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectors Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.2.0; 4.2.1; +3 more |
| CVE-2017-2144 | 5.4 | Jul 7 | Cybozu Garoon 3.0.0 to 4.2.4 may allow an attacker to lock another user's file through a specially crafted page Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +19 more |
| CVE-2017-2092 | 5.4 | Apr 28 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +22 more |
| CVE-2015-7775 | 5.4 | Jun 19 | Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different… Affected: 4.0.3 |
| CVE-2022-28713 | 5.3 | Jul 4 | Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the… Affected: 4.10.0 through 5.5.1 |
| CVE-2021-20764 | 5.3 | Aug 18 | Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to alter the data of Attaching Files Affected: 4.0.0 through 5.0.2 |
| CVE-2020-5563 | 5.3 | Apr 28 | Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in the affected product via the API Affected: 4.0.0 through 4.10.3 |
| CVE-2016-1191 | 5.3 | Jun 19 | Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified vectors Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +19 more |
| CVE-2024-31397 | 4.9 | Jun 11 | Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2 Affected: 5.0.0 before 5.15.2 |
| CVE-2020-5588 | 4.9 | Jun 30 | Path traversal vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to obtain unintended information via unspecified vectors Affected: 5.0.0; 5.0.1 |
| CVE-2020-5562 | 4.9 | Apr 28 | Server-side request forgery (SSRF) vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to… Affected: 4.6.0 through 4.6.3 |
| CVE-2019-5976 | 4.9 | Sep 12 | Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors Affected: 4.0.0 through 4.10.2 |
| CVE-2018-0533 | 4.9 | Apr 16 | Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authentication via unspecified vectors Affected: 3.0.0 through 4.2.6 |
| CVE-2017-2254 | 4.9 | Aug 29 | Cybozu Garoon 3.5.0 to 4.2.5 allows an attacker to cause a denial of service in the application menu's edit function via specially crafted input Affected: 3.5.0; 3.5.1; 3.5.2; 3.5.3; 3.5.4; 3.5.5; +15 more |
| CVE-2022-29513 | 4.8 | Jul 4 | Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary… Affected: 4.10.0 through 5.5.1 |
| CVE-2020-5586 | 4.8 | Jun 30 | Cross-site scripting vulnerability in Cybozu Garoon 4.10.3 to 5.0.1 allows attacker with administrator rights to inject an arbitrary script via unspecified vectors Affected: 4.10.3 through 5.0.1 |
| CVE-2020-5585 | 4.8 | Jun 30 | Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to inject an arbitrary script via unspecified vectors Affected: 5.0.0 through 5.0.1 |
| CVE-2019-5932 | 4.8 | May 17 | Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Portal' Affected: 4.6.0 through 4.6.3 |
| CVE-2017-2146 | 4.8 | Jul 7 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.4 allows remote attackers to inject arbitrary web script or HTML via application menu Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +23 more |
| CVE-2024-31402 | 4.3 | Jun 11 | Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared To-Dos Affected: 5.0.0 through 5.15.2 |
| CVE-2024-31398 | 4.3 | Jun 11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.2 Affected: 5.0.0 through 5.15.2 |
| CVE-2024-31404 | 4.3 | Jun 11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view the data of Scheduler Affected: 5.5.0 before 6.0.1 |
| CVE-2023-27384 | 4.3 | May 23 | Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacker to alter the data of MultiReport Affected: 5.15.0 |
| CVE-2023-27304 | 4.3 | May 23 | Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker to alter the data of Message and/or… Affected: 4.6.0 through 5.9.2 |
| CVE-2022-31472 | 4.3 | Jul 11 | Browse restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to obtain the data of Cabinet Affected: 4.0.0 through 5.5.1 |