OF
Product
Office
71
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 4Medium 60Low 1
Watch
Add Office to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-1151 | 8.8 | Feb 17 | Multiple cross-site request forgery (CSRF) vulnerabilities in Cybozu Office 9.9.0 through 10.3.0 allow remote attackers to hijack the authentication of arbitrary users Affected: 9.9.0; 10.0.0; 10.0.1; 10.0.2; 10.1.0; 10.1.2; +2 more |
| CVE-2018-0704 | 7.5 | Jan 9 | Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen Affected: 10.0.0 through 10.8.1 |
| CVE-2018-0703 | 7.5 | Jan 9 | Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests Affected: 10.0.0 through 10.8.1 |
| CVE-2015-8483 | 7.4 | Feb 17 | Open redirect vulnerability in Cybozu Office 10.2.0 through 10.3.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +9 more |
| CVE-2024-39817 | 6.5 | Aug 6 | Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view data that the user… Affected: 10.0.0 before 10.8.7 |
| CVE-2022-32453 | 6.5 | Aug 18 | HTTP header injection vulnerability in Cybozu Office 10.0.0 to 10.8.5 may allow a remote attacker to obtain and/or alter the data of the product via unspecified vectors Affected: 10.0.0 through 10.8.5 |
| CVE-2021-20631 | 6.5 | Mar 18 | Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to alter the data of Custom App via unspecified vectors Affected: 10.0.0 through 10.8.4 |
| CVE-2021-20626 | 6.5 | Mar 18 | Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the data of Workflow via… Affected: 10.0.0 through 10.8.4 |
| CVE-2021-20624 | 6.5 | Mar 18 | Improper access control vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of Scheduler… Affected: 10.0.0 through 10.8.4 |
| CVE-2019-6022 | 6.5 | Dec 26 | Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to alter arbitrary files via the 'Customapp' function Affected: 10.0.0 through 10.8.3 |
| CVE-2016-4871 | 6.5 | Apr 17 | Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +10 more |
| CVE-2016-4869 | 6.5 | Apr 17 | Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +10 more |
| CVE-2016-1153 | 6.5 | Feb 17 | customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service via unspecified vectors, a different vulnerability than… Affected: 9.9.0; 10.3.0 |
| CVE-2015-8489 | 6.5 | Feb 17 | customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service (excessive database locking) via a crafted CSV file, a different… Affected: 9.9.0; 10.0.0; 10.0.1; 10.0.2; 10.1.0; 10.1.2; +2 more |
| CVE-2018-0567 | 6.3 | Jun 26 | Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors Affected: 10.0.0 through 10.8.0 |
| CVE-2022-33151 | 6.1 | Aug 18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows remote attackers to inject an arbitrary script via unspecified vectors Affected: 10.0.0 through 10.8.5 |
| CVE-2022-30604 | 6.1 | Aug 18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors Affected: 10.0.0 through 10.8.5 |
| CVE-2022-29487 | 6.1 | Aug 18 | Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors Affected: 10.0.0 through 10.8.5 |
| CVE-2022-28715 | 6.1 | Aug 18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors Affected: 10.0.0 through 10.8.5 |
| CVE-2021-20629 | 6.1 | Mar 18 | Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors Affected: 10.0.0 through 10.8.4 |
| CVE-2021-20628 | 6.1 | Mar 18 | Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors Affected: 10.0.0 through 10.8.4 |
| CVE-2021-20627 | 6.1 | Mar 18 | Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors Affected: 10.0.0 through 10.8.4 |
| CVE-2018-0565 | 6.1 | Jun 26 | Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 10.0.0 through 10.8.0 |
| CVE-2018-0527 | 6.1 | Jun 26 | Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 10.0.0 through 10.7.0 |
| CVE-2016-1150 | 6.1 | Feb 17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different… Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +9 more |
| CVE-2016-1149 | 6.1 | Feb 17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different… Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +9 more |
| CVE-2015-7798 | 6.1 | Feb 17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different… Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +9 more |
| CVE-2015-7797 | 6.1 | Feb 17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different… Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +9 more |
| CVE-2015-7796 | 6.1 | Feb 17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different… Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +9 more |
| CVE-2015-7795 | 6.1 | Feb 17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different… Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +9 more |
| CVE-2017-2114 | 5.4 | Apr 28 | Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 10.1.0; 10.1.2; 10.2.0; 10.3.0; 10.4.0; 10.5.0 |
| CVE-2016-4870 | 5.4 | Apr 17 | Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the Schedule function Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +10 more |
| CVE-2016-1152 | 5.4 | Feb 17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions, and read or write to plan data, via unspecified vectors, a different… Affected: 9.9.0; 10.0.0; 10.0.1; 10.0.2; 10.1.0; 10.1.2; +2 more |
| CVE-2015-8486 | 5.4 | Feb 17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary report titles via unspecified vectors, a different… Affected: 9.9.0; 10.0.0; 10.0.1; 10.0.2; 10.1.0; 10.1.2; +2 more |
| CVE-2015-8485 | 5.4 | Feb 17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary posting titles via unspecified vectors, a different… Affected: 9.9.0; 10.0.0; 10.0.1; 10.0.2; 10.1.0; 10.1.2; +2 more |
| CVE-2015-8484 | 5.4 | Feb 17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions via unspecified vectors, a different vulnerability than… Affected: 9.9.0; 10.0.0; 10.0.1; 10.0.2; 10.1.0; 10.1.2; +2 more |
| CVE-2022-30693 | 5.3 | Aug 18 | Information disclosure vulnerability in the system configuration of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to obtain the data of the product via unspecified… Affected: 10.0.0 through 10.8.5 |
| CVE-2016-4866 | 4.8 | Apr 17 | Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Project function Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +10 more |
| CVE-2016-4865 | 4.8 | Apr 17 | Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Customapp function Affected: 9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +10 more |
| CVE-2022-33311 | 4.3 | Aug 18 | Browse restriction bypass vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Address Book via unspecified… Affected: 10.0.0 through 10.8.5 |
| CVE-2022-32583 | 4.3 | Aug 18 | Operation restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Scheduler via unspecified… Affected: 10.0.0 through 10.8.5 |
| CVE-2022-32544 | 4.3 | Aug 18 | Operation restriction bypass vulnerability in Project of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Project via unspecified vectors Affected: 10.0.0 through 10.8.5 |
| CVE-2022-32283 | 4.3 | Aug 18 | Browse restriction bypass vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Cabinet via unspecified vectors Affected: 10.0.0 through 10.8.5 |
| CVE-2022-29891 | 4.3 | Aug 18 | Browse restriction bypass vulnerability in Custom Ap of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Custom App via unspecified… Affected: 10.0.0 through 10.8.5 |
| CVE-2022-25986 | 4.3 | Aug 18 | Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Scheduler Affected: 10.0.0 through 10.8.5 |
| CVE-2021-20634 | 4.3 | Mar 18 | Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Custom App… Affected: 10.0.0 through 10.8.4 |
| CVE-2021-20633 | 4.3 | Mar 18 | Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Cabinet via… Affected: 10.0.0 through 10.8.4 |
| CVE-2021-20632 | 4.3 | Mar 18 | Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of… Affected: 10.0.0 through 10.8.4 |
| CVE-2021-20630 | 4.3 | Mar 18 | Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Phone… Affected: 10.0.0 through 10.8.4 |
| CVE-2021-20625 | 4.3 | Mar 18 | Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of… Affected: 10.0.0 through 10.8.4 |