Cybozu vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-31401 Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitraCritical 9 · Jun 11, 2024
• CVE-2024-23304 Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operationsHigh 7.5 · Feb 6, 2024
• CVE-2022-44608 Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, whHigh 7.5 · Dec 6, 2022
• CVE-2022-30602 Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/oHigh 8.1 · Jul 10, 2022
• CVE-2022-29484 Operation restriction bypass vulnerability in Space of Cybozu Garoon 4.0.0 to 5.9.0 allows a remote authenticated attacker to delete the data of Space.High 8.1 · Jul 4, 2022
• CVE-2021-20795 Cross-site request forgery (CSRF) vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to hijack the authentiHigh 8.8 · Oct 13, 2021
• CVE-2021-20758 Cross-site request forgery (CSRF) vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to hijack the authentication oHigh 8 · Aug 18, 2021
• CVE-2020-5584 Cybozu Garoon 4.0.0 to 5.0.1 allow remote attackers to obtain unintended information via unspecified vectors.High 7.5 · Jun 30, 2020
• CVE-2020-5580 Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to view and/or alter Single sign-on settings via unspecified vecHigh 8.1 · Jun 30, 2020
• CVE-2020-5537 Cybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors.Critical 9.8 · May 25, 2020
• CVE-2020-5567 Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in Application Menu.High 7.5 · Apr 28, 2020
• CVE-2019-5945 Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authentication of Cybozu Garoon.Critical 9.8 · May 17, 2019
• CVE-2019-5934 SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.0 allows attacker with administrator rights to execute arbitrary SQL commands via the Log Search High 7.2 · May 17, 2019
• CVE-2019-5931 Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors.High 8.7 · May 17, 2019
• CVE-2018-16178 Cybozu Garoon 3.0.0 to 4.10.0 allows remote attackers to bypass access restriction to view information available only for a sign-on user via Single sign-on funcHigh 7.5 · Jan 9, 2019
• CVE-2018-16171 Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 allows remote attackers to execute Java code file on the server via unspecified vectorHigh 8.8 · Jan 9, 2019
• CVE-2018-16170 Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 for Windows allows remote authenticated attackers to read arbitrary files via unspecifHigh 8.1 · Jan 9, 2019
• CVE-2018-16169 Cybozu Remote Service 3.0.0 to 3.1.0 allows remote authenticated attackers to upload and execute Java code file on the server via unspecified vectors.High 8.8 · Jan 9, 2019
• CVE-2018-0705 Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8.1.2 allows remote attackers to read arbitrary files via HTTP requests.Critical 9.1 · Jan 9, 2019
• CVE-2018-0704 Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen.High 7.5 · Jan 9, 2019
• CVE-2018-0703 Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests.High 7.5 · Jan 9, 2019
• CVE-2018-0702 Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vectors.High 7.5 · Jan 9, 2019
• CVE-2018-0673 Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vectors.High 8.1 · Nov 15, 2018
• CVE-2018-0607 SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to execute arbitrary SQL High 8.8 · Jul 26, 2018
• CVE-2018-0530 SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.High 8.8 · Apr 16, 2018