Cybozu
330 CVEs across 21 Cybozu products. Browse Cybozu vulnerabilities, severities, and proof-of-concept exploits.
Cybozu products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22888 | High | 7.5 | 2026-02-02 | Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking ac… |
CVE-2026-22881 | Medium | 5.4 | 2026-02-02 | Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords. |
CVE-2026-20711 | Medium | 6.1 | 2026-02-02 | Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords. |
CVE-2024-39817 | Medium | 6.5 | 2024-08-06 | Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view d… |
CVE-2024-39457 | Medium | 5.4 | 2024-07-19 | Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview. If this vulnerability is exploited, an arbitrary script may be execu… |
CVE-2024-31402 | Medium | 4.3 | 2024-06-11 | Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared To-Dos. |
CVE-2024-31399 | Medium | 6.5 | 2024-06-11 | Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, processing a crafted m… |
CVE-2024-31398 | Medium | 4.3 | 2024-06-11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to t… |
CVE-2024-31397 | Medium | 4.9 | 2024-06-11 | Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product with… |
CVE-2024-31404 | Medium | 4.3 | 2024-06-11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view th… |
CVE-2024-31403 | Medium | 5.4 | 2024-06-11 | Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data of Memo. |
CVE-2024-31401 | Critical | 9.0 | 2024-06-11 | Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitr… |
CVE-2024-31400 | Medium | 6.5 | 2024-06-11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, unintended data may be lef… |
CVE-2024-23304 | High | 7.5 | 2024-02-06 | Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operation… |
CVE-2023-46278 | Medium | 6.5 | 2023-11-01 | Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume huge storage space or… |
CVE-2022-26838 | Medium | 6.5 | 2023-08-03 | Path traversal vulnerability in Importing Mobile Device Data of Cybozu Remote Service 3.1.2 allows a remote authenticated attacker to cause a denial-of-service… |
CVE-2023-27384 | Medium | 4.3 | 2023-05-23 | Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacker to alter the data of MultiReport. |
CVE-2023-27304 | Medium | 4.3 | 2023-05-23 | Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker to alter the data of… |
CVE-2023-26595 | Medium | 6.5 | 2023-05-23 | Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial of service condition. |
CVE-2022-44608 | High | 7.5 | 2022-12-07 | Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, w… |
CVE-2022-33311 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Address… |
CVE-2022-33151 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows remote attackers to inject an arbitrary script via unspe… |
CVE-2022-32583 | Medium | 4.3 | 2022-08-18 | Operation restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Scheduler… |
CVE-2022-32544 | Medium | 4.3 | 2022-08-18 | Operation restriction bypass vulnerability in Project of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Project via… |
CVE-2022-32453 | Medium | 6.5 | 2022-08-18 | HTTP header injection vulnerability in Cybozu Office 10.0.0 to 10.8.5 may allow a remote attacker to obtain and/or alter the data of the product via unspecifie… |
CVE-2022-32283 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Cabinet via u… |
CVE-2022-30693 | Medium | 5.3 | 2022-08-18 | Information disclosure vulnerability in the system configuration of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to obtain the data of the product v… |
CVE-2022-30604 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unsp… |
CVE-2022-29891 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Custom Ap of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Custom App… |
CVE-2022-29487 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2022-28715 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unsp… |
CVE-2022-25986 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Scheduler. |
CVE-2022-31472 | Medium | 4.3 | 2022-07-11 | Browse restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to obtain the data of Cabinet. |
CVE-2022-30943 | Medium | 4.3 | 2022-07-11 | Browsing restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the data of Bulletin. |
CVE-2022-30602 | High | 8.1 | 2022-07-11 | Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/… |
CVE-2022-29512 | Medium | 6.5 | 2022-07-11 | Exposure of sensitive information to an unauthorized actor issue in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacke… |
CVE-2022-29892 | Medium | 6.5 | 2022-07-04 | Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain… |
CVE-2022-29513 | Medium | 4.8 | 2022-07-04 | Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote authenticated attacker with an administrative privilege to exe… |
CVE-2022-29484 | High | 8.1 | 2022-07-04 | Operation restriction bypass vulnerability in Space of Cybozu Garoon 4.0.0 to 5.9.0 allows a remote authenticated attacker to delete the data of Space. |
CVE-2022-29471 | Medium | 4.3 | 2022-07-04 | Browse restriction bypass vulnerability in Bulletin of Cybozu Garoon allows a remote authenticated attacker to obtain the data of Bulletin. |
CVE-2022-29467 | Medium | 4.3 | 2022-07-04 | Address information disclosure vulnerability in Cybozu Garoon 4.2.0 to 5.5.1 allows a remote authenticated attacker to obtain some data of Address. |
CVE-2022-28718 | Medium | 4.3 | 2022-07-04 | Operation restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.5.1 allow a remote authenticated attacker to alter the data of Bulletin. |
CVE-2022-28713 | Medium | 5.3 | 2022-07-04 | Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information withou… |
CVE-2022-28692 | Medium | 4.3 | 2022-07-04 | Improper input validation vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Scheduler. |
CVE-2022-27807 | Medium | 4.3 | 2022-07-04 | Improper input validation vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to disable to add Categories. |
CVE-2022-27803 | Medium | 4.3 | 2022-07-04 | Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Space. |
CVE-2022-27661 | Medium | 4.3 | 2022-07-04 | Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Workflow. |
CVE-2022-27627 | Medium | 6.1 | 2022-07-04 | Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on th… |
CVE-2022-26368 | Medium | 5.4 | 2022-07-04 | Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to a… |
CVE-2022-26054 | Medium | 4.3 | 2022-07-04 | Operation restriction bypass vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Link. |
CVE-2022-26051 | Medium | 4.3 | 2022-07-04 | Operation restriction bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Portal. |
CVE-2021-20807 | Medium | 6.1 | 2021-10-13 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.0.0 to 3.1.9 allows a remote attacker to inject an arbitrary script via… |
CVE-2021-20806 | Medium | 6.1 | 2021-10-13 | Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attac… |
CVE-2021-20805 | Medium | 5.4 | 2021-10-13 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.7 to 3.1.9 allows a remote authenticated attacker to inject an arbitra… |
CVE-2021-20804 | Medium | 6.5 | 2021-10-13 | Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to cause a denial of service (DoS) condition via unspecified vectors. |
CVE-2021-20803 | Medium | 5.4 | 2021-10-13 | Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alter the data of the m… |
CVE-2021-20802 | Medium | 5.3 | 2021-10-13 | HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product. |
CVE-2021-20801 | Medium | 6.5 | 2021-10-13 | Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in t… |
CVE-2021-20800 | Medium | 5.4 | 2021-10-13 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to inject an arbitrary script… |
CVE-2021-20799 | Medium | 5.4 | 2021-10-13 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to inject an arbitra… |
CVE-2021-20798 | Medium | 5.4 | 2021-10-13 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to inject an arbitra… |
CVE-2021-20797 | Medium | 5.4 | 2021-10-13 | Cross-site script inclusion vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to obtain the informat… |
CVE-2021-20796 | Medium | 6.5 | 2021-10-13 | Directory traversal vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to upload an arbitrary file vi… |
CVE-2021-20795 | High | 8.8 | 2021-10-13 | Cross-site request forgery (CSRF) vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to hijack the authent… |
CVE-2021-20775 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and S… |
CVE-2021-20774 | Medium | 5.4 | 2021-08-18 | Cross-site scripting vulnerability in some functions of E-mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote authenticated attacker to inject an arbitrary sc… |
CVE-2021-20773 | Medium | 4.3 | 2021-08-18 | There is a vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.0, which may allow a remote authenticated attacker to delete the route information Workflow… |
CVE-2021-20772 | Medium | 4.3 | 2021-08-18 | Information disclosure vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the title of Bulletin withou… |
CVE-2021-20771 | Medium | 6.1 | 2021-08-18 | Cross-site scripting vulnerability in some functions of E-Mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote attacker to inject an arbitrary script via unspe… |
CVE-2021-20770 | Medium | 5.4 | 2021-08-18 | Cross-site scripting vulnerability in Message of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecif… |
CVE-2021-20769 | Medium | 5.4 | 2021-08-18 | Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspeci… |
CVE-2021-20768 | Medium | 4.3 | 2021-08-18 | Operational restrictions bypass vulnerability in Scheduler and MultiReport of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to delete the… |
CVE-2021-20767 | Medium | 5.4 | 2021-08-18 | Cross-site scripting vulnerability in Full Text Search of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via… |
CVE-2021-20766 | Medium | 6.1 | 2021-08-18 | Cross-site scripting vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2021-20765 | Medium | 6.1 | 2021-08-18 | Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2021-20764 | Medium | 5.3 | 2021-08-18 | Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to alter the data of Attaching Files. |
CVE-2021-20763 | Medium | 4.3 | 2021-08-18 | Operational restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Portal wit… |
CVE-2021-20762 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated to alter the data of E-mail without the appropr… |
CVE-2021-20761 | Low | 2.7 | 2021-08-18 | Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker with an administrative privilege to alter the data o… |
CVE-2021-20760 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of User Profil… |
CVE-2021-20759 | Medium | 4.3 | 2021-08-18 | Operational restrictions bypass vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Portal wi… |
CVE-2021-20758 | High | 8.0 | 2021-08-18 | Cross-site request forgery (CSRF) vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to hijack the authentication… |
CVE-2021-20757 | Medium | 4.3 | 2021-08-18 | Operational restrictions bypass vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Portal with… |
CVE-2021-20756 | Medium | 4.3 | 2021-08-18 | Viewing restrictions bypass vulnerability in Address of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Address witho… |
CVE-2021-20755 | Medium | 4.3 | 2021-08-18 | Viewing restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Portal without… |
CVE-2021-20754 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Workflow withou… |
CVE-2021-20753 | Medium | 5.4 | 2021-08-18 | Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspec… |
CVE-2021-20634 | Medium | 4.3 | 2021-03-18 | Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain th… |
CVE-2021-20633 | Medium | 4.3 | 2021-03-18 | Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the d… |
CVE-2021-20632 | Medium | 4.3 | 2021-03-18 | Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtai… |
CVE-2021-20631 | Medium | 6.5 | 2021-03-18 | Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to alter the data of Custom App via unspe… |
CVE-2021-20630 | Medium | 4.3 | 2021-03-18 | Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtai… |
CVE-2021-20629 | Medium | 6.1 | 2021-03-18 | Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. |
CVE-2021-20628 | Medium | 6.1 | 2021-03-18 | Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vect… |
CVE-2021-20627 | Medium | 6.1 | 2021-03-18 | Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vect… |
CVE-2021-20626 | Medium | 6.5 | 2021-03-18 | Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the d… |
CVE-2021-20625 | Medium | 4.3 | 2021-03-18 | Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alt… |
CVE-2021-20624 | Medium | 6.5 | 2021-03-18 | Improper access control vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter th… |
CVE-2020-5643 | Medium | 6.5 | 2020-11-06 | Improper input validation vulnerability in Cybozu Garoon 5.0.0 to 5.0.2 allows a remote authenticated attacker to delete some data of the bulletin board via un… |
CVE-2020-5588 | Medium | 4.9 | 2020-06-30 | Path traversal vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to obtain unintended information via unspecified vectors. |