Cybozu Garoon vulnerabilities

CVE-2020-5583 [MEDIUM] CVE-2020-5583: Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to o Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to obtain unauthorized Multi-Report's data via unspecified vectors.

CVE-2024-31400 [MEDIUM] CWE-922 CVE-2024-31400: Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, unintended data may be left in forwarded mail.

CVE-2013-0701 [MEDIUM] CWE-89 CVE-2013-0701: SQL injection vulnerability in Cybozu Garoon 2.5.0 through 3.5.3 allows remote authenticated users t SQL injection vulnerability in Cybozu Garoon 2.5.0 through 3.5.3 allows remote authenticated users to execute arbitrary SQL commands by leveraging a logging privilege.

CVE-2016-1191 [MEDIUM] CWE-22 CVE-2016-1191: Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 al Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified vectors.

CVE-2019-5936 [MEDIUM] CWE-22 CVE-2019-5936: Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attac Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privileges via the application 'Work Flow'.

CVE-2022-26368 [MEDIUM] CVE-2022-26368: Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter and/or obtain the data of Cabinet.

CVE-2016-1194 [MEDIUM] CWE-399 CVE-2016-1194: Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service. Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service.

CVE-2016-1188 [MEDIUM] CVE-2016-1188: Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to send spoofed e-mail mess Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to send spoofed e-mail messages via unspecified vectors.

CVE-2020-5587 [MEDIUM] CVE-2020-5587: Cybozu Garoon 4.0.0 to 5.0.1 allow remote authenticated attackers to obtain unintended information v Cybozu Garoon 4.0.0 to 5.0.1 allow remote authenticated attackers to obtain unintended information via unspecified vectors.

CVE-2015-5649 [HIGH] CWE-287 CVE-2015-5649: Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allo Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privileges.

CVE-2022-29892 [MEDIUM] CWE-20 CVE-2022-29892: Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote aut Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain functions and cause a denial-of-service (DoS).

CVE-2016-1213 [MEDIUM] CWE-601 CVE-2016-1213: The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites.

CVE-2017-2145 [MEDIUM] CWE-384 CVE-2017-2145: Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform ar Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectors.

CVE-2016-1195 [HIGH] CVE-2016-1195: Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to red Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.

CVE-2024-31403 [MEDIUM] CWE-863 CVE-2024-31403: Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data of Memo.

CVE-2020-5562 [MEDIUM] CWE-918 CVE-2020-5562: Server-side request forgery (SSRF) vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote att Server-side request forgery (SSRF) vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function.

CVE-2014-1989 [MEDIUM] CWE-264 CVE-2014-1989: Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restri Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls.

CVE-2021-20764 [MEDIUM] CWE-20 CVE-2021-20764: Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to alter the data of Attaching Files.

CVE-2022-28713 [MEDIUM] CWE-287 CVE-2022-28713: Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the product.

CVE-2018-0533 [MEDIUM] CVE-2018-0533: Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to a Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authentication via unspecified vectors.