Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,906 results · page 32 of 59
Sep 7, 2021Nextcloud Richdocuments is an open source collaborative office suite.CVE-2021-37629 · Other software · nextcloud · reported by GitHubMedium 5.3
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended that the Nextcloud Richdocuments app is upgraded to either 3.8.4 or 4.2.1 to resolve. For users unable to upgrade it is recommended that the Richdocuments application be disabled.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Nextcloud Richdocuments is an open source collaborative office suite.CVE-2021-37628 · Other software · nextcloud · reported by GitHubHigh 7.5
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features ("Upload Only" public link shares in Nextcloud) can be bypassed using the Nextcloud Richdocuments app. An attacker was able to read arbitrary files in such a share. It is recommended that the Nextcloud Richdocuments is upgraded to 3.8.4 or 4.2.1. If upgrading is not possible then it is recommended to disable the Richdocuments application.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted paCVE-2020-19703 · Other software · Dzzoffice · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Dzzoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021File Upload vulnerabilty in AikCms v2.0.0 in poster_edit.php because the background file management office does not verify the uploaded file.CVE-2020-18462 · Other software · Aikcms · reported by MITREHigh 7.2
File Upload vulnerabilty in AikCms v2.0.0 in poster_edit.php because the background file management office does not verify the uploaded file.
- Product
- Aikcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021Microsoft Office Remote Code Execution VulnerabilityCVE-2021-34478 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Aug 11, 2021Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during Office document conveCVE-2021-33793 · Other software · Foxitsoftware · reported by MITRECritical 9.8
Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during Office document conversion.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Aug 4, 2021An incorrect permission preservation vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a remote user to perform an CVE-2021-32465 · Other software · Trend Micro · reported by security@trendmicro.comHigh 8.8
An incorrect permission preservation vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a remote user to perform an attack and bypass authentication on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
- Product
- Trend Micro Apex One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Jul 27, 2021Nextcloud Richdocuments in an open source self hosted online office.CVE-2021-32748 · Other software · nextcloud · reported by GitHubMedium 4.3
Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Platform Interface") protocol to communicate with the Collabora Editor, the communication between these two services was not protected by a credentials or IP check. Whilst this does not result in gaining access to data that the user has not yet access to, it can result in a bypass of any enforced watermark on documents as described on the [Nextcloud Virtual Data Room](https://nextcloud.com/virtual-data-room/) website and [our documentation](https://portal.nextcloud.com/article/nextcloud-and-virtual-data-room-configuration-59.html). The Nextcloud Richdocuments releases 3.8.3 and 4.2.0 add an additional admin settings for an allowlist of IP addresses that can access the WOPI API. We recommend upgrading and configuring the allowlist to a list of Collabora servers. There is no known workaround. Note that this primarily results a bypass of any configured watermark or download protection using File Access Control. If you do not require or rely on these as a security feature no immediate action is required on your end.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021Collabora Online is a collaborative online office suite.CVE-2021-32745 · Other software · CollaboraOnline · reported by GitHubHigh 7.3
Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-5. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time. The issue is patched in Collabora Online 6.4.9-5. Collabora Online 4.2 is not affected.
- Product
- online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021Collabora Online is a collaborative online office suite.CVE-2021-32744 · Other software · CollaboraOnline · reported by GitHubCritical 9.8
Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gain access to files which are currently opened by other users in the Collabora Online editor. For successful exploitation the attacker is required to guess the file identifier - the predictability of this file identifier is dependent on external file-storage implementations (this is a potential "IDOR" - Insecure Direct Object Reference - vulnerability). Versions 4.2.17-1 and 6.4.9-5 contain patches for this issue. There is no known workaround except updating the Collabora Online application to one of the patched releases.
- Product
- online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2021Microsoft Office Online Server Spoofing VulnerabilityCVE-2021-34451 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.3
Microsoft Office Online Server Spoofing Vulnerability
- Product
- Microsoft Office Online Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Microsoft Office Security Feature Bypass VulnerabilityCVE-2021-34469 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Microsoft Office Security Feature Bypass Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 29, 2021There is a deserialization vulnerability in Huawei AnyOffice V200R006C10.CVE-2021-22439 · Other software · Huawei · reported by psirt@huawei.comHigh 8.1
There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfully exploiting this vulnerability, the attacker can execute remote malicious code injection and to control the device.
- Product
- Anyoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.CVE-2020-22210 · Other software · 74cms · reported by MITRECritical 9.8
SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
- Product
- 74cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021Microsoft Outlook Remote Code Execution VulnerabilityCVE-2021-31949 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.3
Microsoft Outlook Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 8, 2021Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2021-31941 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
Jun 8, 2021Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2021-31940 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 8, 2021Microsoft Excel Remote Code Execution VulnerabilityCVE-2021-31939 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Office Online Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
Jun 8, 2021Polaris Office v9.103.83.44230 is affected by a Uninitialized Pointer Vulnerability in PolarisOffice.exe and EngineDLL.dll that may cause a Remote Code ExecutioCVE-2021-34280 · Other software · Polarisoffice · reported by MITREHigh 7.8
Polaris Office v9.103.83.44230 is affected by a Uninitialized Pointer Vulnerability in PolarisOffice.exe and EngineDLL.dll that may cause a Remote Code Execution. To exploit the vulnerability, someone must open a crafted PDF file.
- Product
- Polaris Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2021-31180 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
May 11, 2021Microsoft Office Remote Code Execution VulnerabilityCVE-2021-31179 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
May 11, 2021Microsoft Office Information Disclosure VulnerabilityCVE-2021-31178 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Office Information Disclosure Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
May 11, 2021Microsoft Office Remote Code Execution VulnerabilityCVE-2021-31177 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
May 11, 2021Microsoft Office Remote Code Execution VulnerabilityCVE-2021-31176 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
May 11, 2021Microsoft Office Remote Code Execution VulnerabilityCVE-2021-31175 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
May 11, 2021Microsoft Excel Information Disclosure VulnerabilityCVE-2021-31174 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Excel Information Disclosure Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
May 11, 2021SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be diCVE-2021-27619 · Websites & servers · SAP SE · reported by cna@sap.comMedium 6.5
SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure.
- Product
- SAP Commerce (Backoffice Search)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
May 3, 2021In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating theCVE-2021-25631 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 8.8
In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an executable type.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpositive.securitylibreoffice.org
Apr 15, 2021The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks.CVE-2021-30245 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.
- Product
- Apache OpenOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Apr 14, 2021A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameteCVE-2021-28060 · Other software · Group-office · reported by MITREMedium 5.3
A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php.
- Product
- Group Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatihhcelik.blogspot.comfatihhcelik.github.io
Apr 14, 2021Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.CVE-2020-35419 · Other software · Group-office · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.
- Product
- Group Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatihhcelik.github.iofatihhcelik.github.io
Apr 14, 2021Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.CVE-2020-35418 · Other software · Group-office · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.
- Product
- Group Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatihhcelik.blogspot.comfatihhcelik.blogspot.com
Apr 13, 2021Microsoft Excel Information Disclosure VulnerabilityCVE-2021-28456 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Excel Information Disclosure Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Microsoft Excel Remote Code Execution VulnerabilityCVE-2021-28454 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
Apr 13, 2021Microsoft Outlook Memory Corruption VulnerabilityCVE-2021-28452 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Outlook Memory Corruption Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Microsoft Excel Remote Code Execution VulnerabilityCVE-2021-28451 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Microsoft Office Remote Code Execution VulnerabilityCVE-2021-28449 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to droCVE-2021-27602 · Websites & servers · SAP SE · reported by cna@sap.comCritical 9.9
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.
- Product
- SAP Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Apr 13, 2021An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of CVE-2021-28646 · Other software · Trend Micro · reported by security@trendmicro.comMedium 5.5
An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file on affected installations.
- Product
- Trend Micro Apex One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Apr 13, 2021An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate pCVE-2021-28645 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.8
An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
- Product
- Trend Micro Apex One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Apr 13, 2021An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service coulCVE-2021-25253 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.8
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
- Product
- Trend Micro Apex One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Apr 13, 2021An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a locaCVE-2021-25250 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.8
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
- Product
- Trend Micro Apex One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Mar 17, 2021Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain theCVE-2021-20634 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 4.3
Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Custom App via unspecified vectors.
- Product
- Cybozu Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Mar 17, 2021Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the daCVE-2021-20633 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 4.3
Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Cabinet via unspecified vectors.
- Product
- Cybozu Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Mar 17, 2021Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtainCVE-2021-20632 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 4.3
Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Bulletin Board via unspecified vectors.
- Product
- Cybozu Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Mar 17, 2021Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to alter the data of Custom App via unspecCVE-2021-20631 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to alter the data of Custom App via unspecified vectors.
- Product
- Cybozu Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Mar 17, 2021Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtainCVE-2021-20630 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 4.3
Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Phone Messages via unspecified vectors.
- Product
- Cybozu Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Mar 17, 2021Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors.CVE-2021-20629 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Cybozu Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Mar 17, 2021Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectoCVE-2021-20628 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs only when using Mozilla Firefox.
- Product
- Cybozu Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Mar 17, 2021Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectoCVE-2021-20627 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Cybozu Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.