Page 5 of 76 results (0.002 seconds)

CVSS: 8.1EPSS: 0%CPEs: 23EXPL: 0

CVE-2015-5649

https://notcve.org/view.php?id=CVE-2015-5649

08 Oct 2015 — Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privileges. Cybozu Garoon 3.x hasta la versión 3.7.5 y 4.x hasta la versión 4.0.3, no maneja correctamente peticiones de autenticación, lo que permite a usuarios remotos autenticados llevar a cabo ataques de inyección L... • http://jvn.jp/en/jp/JVN38369032/index.html • CWE-287: Improper Authentication •

CVSS: 10.0EPSS: 4%CPEs: 13EXPL: 0

CVE-2014-1987

https://notcve.org/view.php?id=CVE-2014-1987

20 Jul 2014 — The CGI component in Cybozu Garoon 3.1.0 through 3.7 SP3 allows remote attackers to execute arbitrary commands via unspecified vectors. El componente CGI en Cybozu Garoon 3.1.0 hasta 3.7 SP3 permite a atacantes remotos ejecutar comandos arbitrarios a través de vectores no especificados. • http://cs.cybozu.co.jp/information/gr20140421news01.php • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 5.4EPSS: 0%CPEs: 13EXPL: 0

CVE-2014-1992

https://notcve.org/view.php?id=CVE-2014-1992

20 Jul 2014 — Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en la funcionalidad Messages en Cybozu Garoon 3.1.x, 3.5.x y 3.7.x anterior a 3.7 SP4 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://cs.cybozu.co.jp/information/gr20140714up05.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.5EPSS: 0%CPEs: 27EXPL: 0

CVE-2014-1993

https://notcve.org/view.php?id=CVE-2014-1993

20 Jul 2014 — The Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to bypass intended access restrictions via unspecified vectors. El subsistema Portlets en Cybozu Garoon 2.x y 3.x anterior a 3.7 SP4 permite a usuarios remotos autenticados evadir las restricciones de acceso a través de vectores no especificados. • http://cs.cybozu.co.jp/information/gr20140714up04.php • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 5.4EPSS: 0%CPEs: 27EXPL: 0

CVE-2014-1994

https://notcve.org/view.php?id=CVE-2014-1994

20 Jul 2014 — Cross-site scripting (XSS) vulnerability in the Notices portlet in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en el portlet Notices en Cybozu Garoon 2.x y 3.x anterior a 3.7 SP4 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://cs.cybozu.co.jp/information/gr20140714up04.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 27EXPL: 0

CVE-2014-1995

https://notcve.org/view.php?id=CVE-2014-1995

20 Jul 2014 — Cross-site scripting (XSS) vulnerability in the Map search functionality in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en la funcionalidad Map Search en Cybozu Garoon 2.x y 3.x anterior a 3.7 SP4 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://cs.cybozu.co.jp/information/gr20140714up02.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.5EPSS: 0%CPEs: 29EXPL: 0

CVE-2014-1988

https://notcve.org/view.php?id=CVE-2014-1988

02 May 2014 — The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors. La funcionalidad Phone Messages en Cybozu Garoon 2.0.0 hasta 3.7 SP2 permite a usuarios remotos autenticados causar una denegación de servicio (consumo de recursos) a través de vectores no especificados. • http://jvn.jp/en/jp/JVN90519014/index.html •

CVSS: 6.5EPSS: 0%CPEs: 20EXPL: 0

CVE-2014-1989

https://notcve.org/view.php?id=CVE-2014-1989

02 May 2014 — Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls. Cybozu Garoon 3.0 hasta 3.7 SP3 permite a usuarios remotos autenticados evadir restricciones de acceso y eliminar información de planificación a través de llamadas API no especificadas. • http://jvn.jp/en/jp/JVN31230946/index.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.5EPSS: 0%CPEs: 50EXPL: 0

CVE-2014-0817

https://notcve.org/view.php?id=CVE-2014-0817

27 Feb 2014 — Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors. Cybozu Garoon 2.x hasta 2.5.4 y 3.x hasta 3.7 SP3 no maneja debidamente las sesiones, lo que permite a usuarios remotos autenticados suplantar usuarios arbitrarios a través de vectores no especificados. • http://cs.cybozu.co.jp/information/gr20140225up03.php • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.8EPSS: 0%CPEs: 50EXPL: 0

CVE-2014-0821

https://notcve.org/view.php?id=CVE-2014-0821

27 Feb 2014 — SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931. Vulnerabilidad de inyección SQL en la funcionalidad de descarga en Cybozu Garoon 2.x hasta 2.5.4 y 3.x hasta 3.7 SP3 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de vectores no especificados, una vulnerabil... • http://cs.cybozu.co.jp/information/gr20140225up04.php • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •