Cybozu Inc Cybozu Garoon vulnerabilities

CVE-2022-29512 [MEDIUM] CWE-200 CVE-2022-29512: Exposure of sensitive information to an unauthorized actor issue in multiple applications of Cybozu Exposure of sensitive information to an unauthorized actor issue in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the data without the viewing privilege.

CVE-2020-5563 [MEDIUM] CWE-287 CVE-2020-5563: Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to ob Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in the affected product via the API.

CVE-2020-5583 [MEDIUM] CVE-2020-5583: Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to o Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to obtain unauthorized Multi-Report's data via unspecified vectors.

CVE-2024-31400 [MEDIUM] CWE-922 CVE-2024-31400: Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, unintended data may be left in forwarded mail.

CVE-2019-5936 [MEDIUM] CWE-22 CVE-2019-5936: Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attac Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privileges via the application 'Work Flow'.

CVE-2022-26368 [MEDIUM] CVE-2022-26368: Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter and/or obtain the data of Cabinet.

CVE-2020-5587 [MEDIUM] CVE-2020-5587: Cybozu Garoon 4.0.0 to 5.0.1 allow remote authenticated attackers to obtain unintended information v Cybozu Garoon 4.0.0 to 5.0.1 allow remote authenticated attackers to obtain unintended information via unspecified vectors.

CVE-2022-29892 [MEDIUM] CWE-20 CVE-2022-29892: Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote aut Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain functions and cause a denial-of-service (DoS).

CVE-2017-2145 [MEDIUM] CWE-384 CVE-2017-2145: Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform ar Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectors.

CVE-2024-31403 [MEDIUM] CWE-863 CVE-2024-31403: Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data of Memo.

CVE-2020-5562 [MEDIUM] CWE-918 CVE-2020-5562: Server-side request forgery (SSRF) vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote att Server-side request forgery (SSRF) vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function.

CVE-2021-20764 [MEDIUM] CWE-20 CVE-2021-20764: Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to alter the data of Attaching Files.

CVE-2022-28713 [MEDIUM] CWE-287 CVE-2022-28713: Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the product.

CVE-2018-0533 [MEDIUM] CVE-2018-0533: Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to a Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authentication via unspecified vectors.

CVE-2017-2258 [MEDIUM] CWE-22 CVE-2017-2258: Directory traversal vulnerability in Cybozu Garoon 4.2.4 to 4.2.5 allows an attacker to read arbitra Directory traversal vulnerability in Cybozu Garoon 4.2.4 to 4.2.5 allows an attacker to read arbitrary files via Garoon SOAP API "WorkflowHandleApplications".

CVE-2023-26595 [MEDIUM] CWE-400 CVE-2023-26595: Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote au Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial of service condition.

CVE-2024-31399 [MEDIUM] CWE-400 CVE-2024-31399: Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2. Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, processing a crafted mail may cause a denial-of-service (DoS) condition.

CVE-2026-20711 [MEDIUM] CWE-79 CVE-2026-20711: Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords.

CVE-2026-22881 [MEDIUM] CWE-79 CVE-2026-22881: Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, whic Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords.

CVE-2019-5930 [MEDIUM] CVE-2019-5930: Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthor Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application 'Management of Basic System'.