Garoon
by Cybozu
CVEs (201)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-5945 | Cri | 0.64 | 9.8 | 0.02 | May 17, 2019 | Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authentication of Cybozu Garoon. | ||
| CVE-2016-1219 | Cri | 0.64 | 9.8 | 0.03 | Apr 20, 2017 | Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use. | ||
| CVE-2024-31401 | Cri | 0.59 | 9.0 | 0.01 | Jun 11, 2024 | Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the web browser of the user who is logging in to the product. | ||
| CVE-2019-5931 | Hig | 0.57 | 8.7 | 0.01 | May 17, 2019 | Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors. | ||
| CVE-2018-0607 | Hig | 0.57 | 8.8 | 0.01 | Jul 26, 2018 | SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. | ||
| CVE-2018-0530 | Hig | 0.57 | 8.8 | 0.01 | Apr 16, 2018 | SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. | ||
| CVE-2016-7803 | Hig | 0.57 | 8.8 | 0.02 | Jun 9, 2017 | SQL injection vulnerability in the Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via "MultiReport" function. | ||
| CVE-2016-4907 | Hig | 0.57 | 8.8 | 0.01 | Jun 9, 2017 | Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors. | ||
| CVE-2016-1218 | Hig | 0.57 | 8.8 | 0.02 | Apr 20, 2017 | SQL injection vulnerability in Cybozu Garoon before 4.2.2. | ||
| CVE-2022-30602 | Hig | 0.53 | 8.1 | 0.01 | Jul 11, 2022 | Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/or delete the files. | ||
| CVE-2022-29484 | Hig | 0.53 | 8.1 | 0.01 | Jul 4, 2022 | Operation restriction bypass vulnerability in Space of Cybozu Garoon 4.0.0 to 5.9.0 allows a remote authenticated attacker to delete the data of Space. | ||
| CVE-2020-5580 | Hig | 0.53 | 8.1 | 0.01 | Jun 30, 2020 | Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to view and/or alter Single sign-on settings via unspecified vectors. | ||
| CVE-2018-0673 | Hig | 0.53 | 8.1 | 0.01 | Nov 15, 2018 | Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vectors. | ||
| CVE-2016-1189 | Hig | 0.53 | 8.1 | 0.01 | Jun 25, 2016 | Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors. | ||
| CVE-2021-20758 | Hig | 0.52 | 8.0 | 0.00 | Aug 18, 2021 | Cross-site request forgery (CSRF) vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to hijack the authentication of administrators and perform an arbitrary operation via unspecified vectors. | ||
| CVE-2026-22888 | Hig | 0.49 | 7.5 | 0.00 | Feb 2, 2026 | Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product. | ||
| CVE-2020-5584 | Hig | 0.49 | 7.5 | 0.01 | Jun 30, 2020 | Cybozu Garoon 4.0.0 to 5.0.1 allow remote attackers to obtain unintended information via unspecified vectors. | ||
| CVE-2020-5567 | Hig | 0.49 | 7.5 | 0.01 | Apr 28, 2020 | Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in Application Menu. | ||
| CVE-2019-5991 | Hig | 0.49 | 7.6 | 0.01 | Sep 12, 2019 | SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. | ||
| CVE-2018-16178 | Hig | 0.49 | 7.5 | 0.01 | Jan 9, 2019 | Cybozu Garoon 3.0.0 to 4.10.0 allows remote attackers to bypass access restriction to view information available only for a sign-on user via Single sign-on function. |
- risk 0.64cvss 9.8epss 0.02
Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authentication of Cybozu Garoon.
- risk 0.64cvss 9.8epss 0.03
Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use.
- risk 0.59cvss 9.0epss 0.01
Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the web browser of the user who is logging in to the product.
- risk 0.57cvss 8.7epss 0.01
Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors.
- risk 0.57cvss 8.8epss 0.01
SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
- risk 0.57cvss 8.8epss 0.01
SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
- risk 0.57cvss 8.8epss 0.02
SQL injection vulnerability in the Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via "MultiReport" function.
- risk 0.57cvss 8.8epss 0.01
Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors.
- risk 0.57cvss 8.8epss 0.02
SQL injection vulnerability in Cybozu Garoon before 4.2.2.
- risk 0.53cvss 8.1epss 0.01
Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/or delete the files.
- risk 0.53cvss 8.1epss 0.01
Operation restriction bypass vulnerability in Space of Cybozu Garoon 4.0.0 to 5.9.0 allows a remote authenticated attacker to delete the data of Space.
- risk 0.53cvss 8.1epss 0.01
Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to view and/or alter Single sign-on settings via unspecified vectors.
- risk 0.53cvss 8.1epss 0.01
Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vectors.
- risk 0.53cvss 8.1epss 0.01
Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors.
- risk 0.52cvss 8.0epss 0.00
Cross-site request forgery (CSRF) vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to hijack the authentication of administrators and perform an arbitrary operation via unspecified vectors.
- risk 0.49cvss 7.5epss 0.00
Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product.
- risk 0.49cvss 7.5epss 0.01
Cybozu Garoon 4.0.0 to 5.0.1 allow remote attackers to obtain unintended information via unspecified vectors.
- risk 0.49cvss 7.5epss 0.01
Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in Application Menu.
- risk 0.49cvss 7.6epss 0.01
SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
- risk 0.49cvss 7.5epss 0.01
Cybozu Garoon 3.0.0 to 4.10.0 allows remote attackers to bypass access restriction to view information available only for a sign-on user via Single sign-on function.
Page 1 of 11