Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
201 results · page 4 of 5
Jun 19, 2016Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectorCVE-2016-1197 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7775.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2016Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attaCVE-2016-1195 · Other software · Cybozu · reported by vultures@jpcert.or.jpHigh 7.4
Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2016Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectorsCVE-2015-7775 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-1197.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2015The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecifieCVE-2015-5647 · Other software · Cybozu · reported by vultures@jpcert.or.jpHigh 8.5
The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2015Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 andCVE-2015-5646 · Other software · Cybozu · reported by vultures@jpcert.or.jpHigh 8.5
Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2015Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attaCVE-2015-5649 · Other software · Cybozu · reported by vultures@jpcert.or.jpHigh 7
Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privileges.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2014Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, CVE-2014-1996 · Other software · Cybozu · reported by vultures@jpcert.or.jpHigh 7.5
Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, via an API call.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2014Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to injectCVE-2014-1995 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2014Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrarCVE-2014-1994 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2014The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectCVE-2014-1993 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4
The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2014Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated usersCVE-2014-1992 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2014The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors.CVE-2014-1987 · Other software · Cybozu · reported by vultures@jpcert.or.jpHigh 10
The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2014Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API cCVE-2014-1989 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6
Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2014The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspCVE-2014-1988 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2014SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbiCVE-2014-0821 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.5
SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2014Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read aCVE-2014-0820 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4
Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2014Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary userCVE-2014-0817 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.9
Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2014SQL injection vulnerability in the API in Cybozu Garoon 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vCVE-2013-6931 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.5
SQL injection vulnerability in the API in Cybozu Garoon 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6929.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2014SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2.5.4, 3.0.0 through CVE-2013-6930 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.5
SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2.5.4, 3.0.0 through 3.0.3, 3.5.0 through 3.5.5, and 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6929.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2013SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input.CVE-2013-6929 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.5
SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2013Cybozu Garoon 3.5 through 3.7 SP2 allows remote attackers to bypass Keitai authentication via a modified user ID in a request.CVE-2013-6006 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 5.8
Cybozu Garoon 3.5 through 3.7 SP2 allows remote attackers to bypass Keitai authentication via a modified user ID in a request.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, aCVE-2013-6916 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrCVE-2013-6915 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script CVE-2013-6914 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote authenticated users CVE-2013-6913 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
Cross-site scripting (XSS) vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2, when Internet Explorer 6 through 9 is used, allows remote authenCVE-2013-6912 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2, when Internet Explorer 6 through 9 is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is used, allows remoteCVE-2013-6911 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
Cross-site scripting (XSS) vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in Ajax components in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unsCVE-2013-6910 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Ajax components in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in a report component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via CVE-2013-6909 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in a report component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML viCVE-2013-6908 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 2.x and 3.x before 3.7.0 allows remote attackers to inject arbitrary web script orCVE-2013-6907 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 2.x and 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon before 3.7.0, when Internet Explorer 6 through 8 is used, allows remote attackers CVE-2013-6906 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon before 3.7.0, when Internet Explorer 6 through 8 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers CVE-2013-6905 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in a note component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers tCVE-2013-6904 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in a note component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackeCVE-2013-6903 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via CVE-2013-6902 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0, when Firefox is used, allows remote attackers to inject arbitrary CVE-2013-6901 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web scCVE-2013-6900 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors.CVE-2013-6004 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.8
Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013CRLF injection vulnerability in Cybozu Garoon 3.1 through 3.5 SP5, when Phone Messages forwarding is enabled, allows remote authenticated users to inject arbitrCVE-2013-6003 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
CRLF injection vulnerability in Cybozu Garoon 3.1 through 3.5 SP5, when Phone Messages forwarding is enabled, allows remote authenticated users to inject arbitrary e-mail headers via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.CVE-2013-6002 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 5
The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2013SQL injection vulnerability in the Space function in Cybozu Garoon before 3.7 SP1 allows remote authenticated users to execute arbitrary SQL commands via unspecCVE-2013-6001 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.5
SQL injection vulnerability in the Space function in Cybozu Garoon before 3.7 SP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2013Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 3.5.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vecCVE-2013-0702 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 3.5.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2013SQL injection vulnerability in Cybozu Garoon 2.5.0 through 3.5.3 allows remote authenticated users to execute arbitrary SQL commands by leveraging a logging priCVE-2013-0701 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6
SQL injection vulnerability in Cybozu Garoon 2.5.0 through 3.5.3 allows remote authenticated users to execute arbitrary SQL commands by leveraging a logging privilege.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2011Cross-site scripting (XSS) vulnerability in Cybozu Office 6, Cybozu Garoon 2.0.0 through 2.1.3, Cybozu Dezie before 6.1, Cybozu MailWise before 3.1, and Cybozu CVE-2011-1334 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Cybozu Office 6, Cybozu Garoon 2.0.0 through 2.1.3, Cybozu Dezie before 6.1, Cybozu MailWise before 3.1, and Cybozu Collaborex before 1.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "downloading graphic files from the mail system."
- Product
- Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2011Cross-site scripting (XSS) vulnerability in Cybozu Office 6 and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTMLCVE-2011-1333 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Cybozu Office 6 and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to "downloading graphic files from the bulletin board system."
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2011Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vecCVE-2011-1332 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2008-6570.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2009Cross-site request forgery (CSRF) vulnerability in Cybozu Office 6, Cybozu Dezie before 6.0(1.0), and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers CVE-2008-6744 · Other software · Cybozu · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in Cybozu Office 6, Cybozu Dezie before 6.0(1.0), and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
- Product
- Cybozu Dezie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybozu.co.jpcybozu.co.jp
Mar 31, 2009Cross-site scripting (XSS) vulnerability in the RSS reader in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML vCVE-2008-6570 · Other software · Cybozu · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the RSS reader in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2009Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page.CVE-2008-6569 · Other software · Cybozu · reported by MITREMedium 6.8
Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.