Cybozu
Page 3 of 4 — Cybozu CVEs from a corpus of 330, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2094 | Medium | 4.3 | 2017-04-28 | Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete i… |
CVE-2017-2093 | Medium | 4.3 | 2017-04-28 | Cybozu Garoon 3.0.0 to 4.2.3 allow remote attackers to obtain tokens used for CSRF protection via unspecified vectors. |
CVE-2017-2092 | Medium | 5.4 | 2017-04-28 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified… |
CVE-2017-2091 | Medium | 4.3 | 2017-04-28 | Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone message… |
CVE-2016-7815 | Medium | 4.2 | 2017-04-28 | Remote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote attackers to gain access to systems on the network. |
CVE-2016-1187 | Medium | 6.8 | 2017-04-21 | Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates. |
CVE-2016-1186 | Medium | 5.9 | 2017-04-21 | Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates. |
CVE-2016-4841 | Medium | 4.3 | 2017-04-21 | Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers. |
CVE-2016-1194 | Medium | 6.5 | 2017-04-21 | Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service. |
CVE-2016-4844 | Medium | 4.3 | 2017-04-20 | Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks. |
CVE-2016-4843 | Medium | 6.5 | 2017-04-20 | Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information. |
CVE-2016-4842 | Medium | 4.3 | 2017-04-20 | Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read. |
CVE-2016-1220 | Medium | 4.3 | 2017-04-20 | Cybozu Garoon before 4.2.2 does not properly restrict access. |
CVE-2016-1218 | High | 8.8 | 2017-04-20 | SQL injection vulnerability in Cybozu Garoon before 4.2.2. |
CVE-2016-1217 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2. |
CVE-2016-1216 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2. |
CVE-2016-1215 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2. |
CVE-2016-1214 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2. |
CVE-2016-1213 | Medium | 6.1 | 2017-04-20 | The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites. |
CVE-2016-1219 | Critical | 9.8 | 2017-04-20 | Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use. |
CVE-2016-4874 | Low | 3.5 | 2017-04-17 | Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack. |
CVE-2016-4873 | Medium | 4.3 | 2017-04-17 | Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project function. |
CVE-2016-4872 | Medium | 4.3 | 2017-04-17 | Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb t… |
CVE-2016-4871 | Medium | 6.5 | 2017-04-17 | Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service. |
CVE-2016-4870 | Medium | 5.4 | 2017-04-17 | Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the Schedu… |
CVE-2016-4869 | Medium | 6.5 | 2017-04-17 | Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed. |
CVE-2016-4868 | Medium | 4.3 | 2017-04-17 | Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via s… |
CVE-2016-4867 | Medium | 4.3 | 2017-04-17 | Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized project information via the Project funct… |
CVE-2016-4866 | Medium | 4.8 | 2017-04-17 | Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the P… |
CVE-2016-4865 | Medium | 4.8 | 2017-04-17 | Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the C… |
CVE-2016-1193 | High | 7.5 | 2016-06-25 | Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors. |
CVE-2016-1190 | Medium | 6.5 | 2016-06-25 | Cybozu Garoon 3.1 through 4.2 allows remote authenticated users to bypass intended restrictions on MultiReport reading via unspecified vectors. |
CVE-2016-1189 | High | 8.1 | 2016-06-25 | Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspe… |
CVE-2016-1188 | Medium | 6.5 | 2016-06-25 | Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to send spoofed e-mail messages via unspecified vectors. |
CVE-2016-1196 | Medium | 4.3 | 2016-06-19 | Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address Book information v… |
CVE-2016-1192 | Medium | 4.3 | 2016-06-19 | Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a log file via unspe… |
CVE-2016-1191 | Medium | 5.3 | 2016-06-19 | Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified ve… |
CVE-2015-7776 | Medium | 4.3 | 2016-06-19 | Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a craf… |
CVE-2016-1197 | Medium | 6.1 | 2016-06-19 | Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vecto… |
CVE-2016-1195 | High | 7.4 | 2016-06-19 | Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing att… |
CVE-2015-7775 | Medium | 5.4 | 2016-06-19 | Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vector… |
CVE-2016-1185 | Low | 2.5 | 2016-04-25 | The Cybozu kintone mobile application 1.x before 1.0.6 for Android allows attackers to discover an authentication token via a crafted application. |
CVE-2016-1153 | Medium | 6.5 | 2016-02-17 | customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service via unspecified vectors, a different vulnerabili… |
CVE-2016-1152 | Medium | 5.4 | 2016-02-17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions, and read or write to plan data, via unspecified ve… |
CVE-2016-1151 | High | 8.8 | 2016-02-17 | Multiple cross-site request forgery (CSRF) vulnerabilities in Cybozu Office 9.9.0 through 10.3.0 allow remote attackers to hijack the authentication of arbitra… |
CVE-2016-1150 | Medium | 6.1 | 2016-02-17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified v… |
CVE-2016-1149 | Medium | 6.1 | 2016-02-17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified v… |
CVE-2015-8489 | Medium | 6.5 | 2016-02-17 | customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service (excessive database locking) via a crafted CSV f… |
CVE-2015-8488 | Medium | 4.3 | 2016-02-17 | Cybozu Office 10.3.0 allows remote attackers to read image files via a crafted e-mail message, a different vulnerability than CVE-2015-8487. |
CVE-2015-8487 | Medium | 4.3 | 2016-02-17 | Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different vulnerability than CVE-2015-8488. |
CVE-2015-8486 | Medium | 5.4 | 2016-02-17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary report titles via unspecified ve… |
CVE-2015-8485 | Medium | 5.4 | 2016-02-17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary posting titles via unspecified v… |
CVE-2015-8484 | Medium | 5.4 | 2016-02-17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions via unspecified vectors, a different vuln… |
CVE-2015-8483 | High | 7.4 | 2016-02-17 | Open redirect vulnerability in Cybozu Office 10.2.0 through 10.3.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attack… |
CVE-2015-7798 | Medium | 6.1 | 2016-02-17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified v… |
CVE-2015-7797 | Medium | 6.1 | 2016-02-17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified v… |
CVE-2015-7796 | Medium | 6.1 | 2016-02-17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified v… |
CVE-2015-7795 | Medium | 6.1 | 2016-02-17 | Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified v… |
CVE-2015-5647 | | 2015-10-12 | The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecifi… | |
CVE-2015-5646 | | 2015-10-12 | Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 an… | |
CVE-2015-5649 | | 2015-10-08 | Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection att… | |
CVE-2014-7266 | | 2015-02-01 | Algorithmic complexity vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x through 3.1.2 allows remote attackers to cause a denial of service… | |
CVE-2014-5314 | | 2014-11-24 | Buffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie 8 before 8.1.1 allows remote authenticated users to execute a… | |
CVE-2014-1996 | | 2014-07-20 | Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service… | |
CVE-2014-1995 | | 2014-07-20 | Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to injec… | |
CVE-2014-1994 | | 2014-07-20 | Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitra… | |
CVE-2014-1993 | | 2014-07-20 | The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vec… | |
CVE-2014-1992 | | 2014-07-20 | Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated user… | |
CVE-2014-1987 | | 2014-07-20 | The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors. | |
CVE-2014-1989 | | 2014-05-02 | Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API… | |
CVE-2014-1988 | | 2014-05-02 | The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via uns… | |
CVE-2014-1984 | | 2014-04-19 | Session fixation vulnerability in the management screen in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to hijack w… | |
CVE-2014-1983 | | 2014-04-19 | Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consump… | |
CVE-2014-0821 | | 2014-02-27 | SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arb… | |
CVE-2014-0820 | | 2014-02-27 | Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read… | |
CVE-2014-0817 | | 2014-02-27 | Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary use… | |
CVE-2013-6931 | | 2014-01-29 | SQL injection vulnerability in the API in Cybozu Garoon 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified… | |
CVE-2013-6930 | | 2014-01-29 | SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2.5.4, 3.0.0 through… | |
CVE-2013-6929 | | 2013-12-28 | SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input. | |
CVE-2013-6006 | | 2013-12-28 | Cybozu Garoon 3.5 through 3.7 SP2 allows remote attackers to bypass Keitai authentication via a modified user ID in a request. | |
CVE-2013-6005 | | 2013-12-13 | Cross-site scripting (XSS) vulnerability in Cybozu Dezie before 8.1.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to the… | |
CVE-2013-6916 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used… | |
CVE-2013-6915 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbit… | |
CVE-2013-6914 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script… | |
CVE-2013-6913 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote authenticated users… | |
CVE-2013-6912 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2, when Internet Explorer 6 through 9 is used, allows remote authe… | |
CVE-2013-6911 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is used, allows remot… | |
CVE-2013-6910 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in Ajax components in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via un… | |
CVE-2013-6909 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in a report component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via… | |
CVE-2013-6908 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML v… | |
CVE-2013-6907 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 2.x and 3.x before 3.7.0 allows remote attackers to inject arbitrary web script o… | |
CVE-2013-6906 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon before 3.7.0, when Internet Explorer 6 through 8 is used, allows remote attackers… | |
CVE-2013-6905 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers… | |
CVE-2013-6904 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in a note component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers… | |
CVE-2013-6903 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attack… | |
CVE-2013-6902 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via… | |
CVE-2013-6901 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0, when Firefox is used, allows remote attackers to inject arbitrary… | |
CVE-2013-6900 | | 2013-12-05 | Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web s… | |
CVE-2013-6004 | | 2013-12-05 | Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors. | |
CVE-2013-6003 | | 2013-12-05 | CRLF injection vulnerability in Cybozu Garoon 3.1 through 3.5 SP5, when Phone Messages forwarding is enabled, allows remote authenticated users to inject arbit… |