GA
Product
Garoon
198
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 20Medium 126Low 2
Watch
Add Garoon to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-0532 | 2.7 | Apr 16 | Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors Affected: 3.0.0 through 4.2.6 |
| CVE-2015-5647 | – | Oct 12 | The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +18 more |
| CVE-2015-5646 | – | Oct 12 | Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867 Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +18 more |
| CVE-2015-5649 | – | Oct 8 | Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +17 more |
| CVE-2014-1996 | – | Jul 20 | Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, via an API call Affected: 3.7; 3.7; 3.7; 3.7.0 |
| CVE-2014-1995 | – | Jul 20 | Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web… Affected: 2.0.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.5.0; +21 more |
| CVE-2014-1994 | – | Jul 20 | Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or… Affected: 2.0.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.5.0; +21 more |
| CVE-2014-1993 | – | Jul 20 | The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors Affected: 2.0.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.5.0; +21 more |
| CVE-2014-1992 | – | Jul 20 | Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject… Affected: 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.5.0; 3.5.1; +7 more |
| CVE-2014-1987 | – | Jul 20 | The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors Affected: 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.5.0; 3.5.1; +7 more |
| CVE-2014-1989 | – | May 2 | Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +14 more |
| CVE-2014-1988 | – | May 2 | The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors Affected: 2.0.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.5.0; +23 more |
| CVE-2014-0821 | – | Feb 27 | SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands… Affected: 2.0; 2.0; 2.0; 2.0; 2.0; 2.0; +34 more |
| CVE-2014-0820 | – | Feb 27 | Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via… Affected: 2.0; 2.0; 2.0; 2.0; 2.0; 2.0; +34 more |
| CVE-2014-0817 | – | Feb 27 | Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified… Affected: 2.0; 2.0; 2.0; 2.0; 2.0; 2.0; +34 more |
| CVE-2013-6931 | – | Jan 29 | SQL injection vulnerability in the API in Cybozu Garoon 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different… Affected: 3.7.0; 3.7.1; 3.7.2 |
| CVE-2013-6930 | – | Jan 29 | SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2.5.4, 3.0.0 through 3.0.3, 3.5.0… Affected: 2.0; 2.0; 2.0; 2.0; 2.0; 2.0; +34 more |
| CVE-2013-6929 | – | Dec 28 | SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input Affected: through 3.7; 3.7; 3.7 |
| CVE-2013-6006 | – | Dec 28 | Cybozu Garoon 3.5 through 3.7 SP2 allows remote attackers to bypass Keitai authentication via a modified user ID in a request Affected: 3.5; 3.5; 3.5; 3.5; 3.5; 3.5; +4 more |
| CVE-2013-6916 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, allows remote… Affected: through 3.7; 2.0; 2.0; 2.0; 2.0; 2.0; +34 more |
| CVE-2013-6915 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or… Affected: through 3.7; 2.0; 2.0; 2.0; 2.0; 2.0; +25 more |
| CVE-2013-6914 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via… Affected: through 3.7; 2.0; 2.0; 2.0; 2.0; 2.0; +25 more |
| CVE-2013-6913 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote authenticated users to inject arbitrary… Affected: through 3.7; 2.0; 2.0; 2.0; 2.0; 2.0; +25 more |
| CVE-2013-6912 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2, when Internet Explorer 6 through 9 is used, allows remote authenticated users to… Affected: through 3.7; 2.0; 2.0; 2.0; 2.0; 2.0; +25 more |
| CVE-2013-6911 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is used, allows remote authenticated… Affected: through 3.7; 2.0; 2.0; 2.0; 2.0; 2.0; +34 more |
| CVE-2013-6910 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in Ajax components in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 3.5; 2.0; 2.0; 2.0; 2.0; 2.0; +23 more |
| CVE-2013-6909 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in a report component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 3.5; 2.0; 2.0; 2.0; 2.0; 2.0; +23 more |
| CVE-2013-6908 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 3.0; 3.0; 3.0; 3.0; 3.1; 3.1; +8 more |
| CVE-2013-6907 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 2.x and 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 3.5; 2.0; 2.0; 2.0; 2.0; 2.0; +23 more |
| CVE-2013-6906 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon before 3.7.0, when Internet Explorer 6 through 8 is used, allows remote attackers to inject arbitrary… Affected: through 3.5; 2.0; 2.0; 2.0; 2.0; 2.0; +23 more |
| CVE-2013-6905 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary… Affected: through 3.5; 2.0; 2.0; 2.0; 2.0; 2.0; +34 more |
| CVE-2013-6904 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in a note component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary… Affected: through 3.5; 2.0; 2.0; 2.0; 2.0; 2.0; +34 more |
| CVE-2013-6903 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject… Affected: through 3.5; 2.0; 2.0; 2.0; 2.0; 2.0; +34 more |
| CVE-2013-6902 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 3.5; 2.0; 2.0; 2.0; 2.0; 2.0; +23 more |
| CVE-2013-6901 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML… Affected: through 3.5; 2.0; 2.0; 2.0; 2.0; 2.0; +23 more |
| CVE-2013-6900 | – | Dec 5 | Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 3.5; 2.0; 2.0; 2.0; 2.0; 2.0; +23 more |
| CVE-2013-6004 | – | Dec 5 | Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors Affected: through 3.7; 2.0; 2.0; 2.0; 2.0; 2.0; +25 more |
| CVE-2013-6003 | – | Dec 5 | CRLF injection vulnerability in Cybozu Garoon 3.1 through 3.5 SP5, when Phone Messages forwarding is enabled, allows remote authenticated users to inject arbitrary e-mail headers… Affected: 3.1; 3.1; 3.1; 3.1; 3.5; 3.5; +4 more |
| CVE-2013-6002 | – | Dec 5 | The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors Affected: through 3.7; 2.0; 2.0; 2.0; 2.0; 2.0; +24 more |
| CVE-2013-6001 | – | Dec 5 | SQL injection vulnerability in the Space function in Cybozu Garoon before 3.7 SP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors Affected: through 3.7; 2.0; 2.0; 2.0; 2.0; 2.0; +24 more |
| CVE-2013-0702 | – | Feb 14 | Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 3.5.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +7 more |
| CVE-2013-0701 | – | Feb 14 | SQL injection vulnerability in Cybozu Garoon 2.5.0 through 3.5.3 allows remote authenticated users to execute arbitrary SQL commands by leveraging a logging privilege Affected: 2.5.0; 3.5.3 |
| CVE-2011-1334 | – | Jun 29 | Cross-site scripting (XSS) vulnerability in Cybozu Office 6, Cybozu Garoon 2.0.0 through 2.1.3, Cybozu Dezie before 6.1, Cybozu MailWise before 3.1, and Cybozu Collaborex before… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +5 more |
| CVE-2011-1333 | – | Jun 29 | Cross-site scripting (XSS) vulnerability in Cybozu Office 6 and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via vectors… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +5 more |
| CVE-2011-1332 | – | Jun 29 | Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +5 more |
| CVE-2008-6570 | – | Mar 31 | Cross-site scripting (XSS) vulnerability in the RSS reader in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +5 more |
| CVE-2008-6569 | – | Mar 31 | Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +5 more |
| CVE-2006-4444 | – | Aug 29 | Multiple SQL injection vulnerabilities in Cybozu Garoon 2.1.0 for Windows allow remote authenticated users to execute arbitrary SQL commands via the (1) tid parameter in the (a)… Affected: 2.1.0_for_windows |