Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
May 29, 2020Android App 'Mailwise for Android' 1.0.0 to 1.0.1 allows an attacker to obtain credential information registered in the product via unspecified vectors.CVE-2020-5572 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 4.6
Android App 'Mailwise for Android' 1.0.0 to 1.0.1 allows an attacker to obtain credential information registered in the product via unspecified vectors.
- Product
- Android App 'Mailwise for Android'
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Jan 9, 2019Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vectors.CVE-2018-0702 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpHigh 7.5
Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vectors.
- Product
- Cybozu Mailwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Jun 26, 2018Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address' via unspecified veCVE-2018-0559 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address' via unspecified vectors.
- Product
- Cybozu Mailwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.cybozu.com
Jun 26, 2018Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML in 'System settingCVE-2018-0558 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML in 'System settings' via unspecified vectors.
- Product
- Cybozu Mailwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.cybozu.com
Jun 26, 2018Stored cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'E-mail Details ScreeCVE-2018-0557 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Stored cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'E-mail Details Screen' via unspecified vectors.
- Product
- Cybozu Mailwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.cybozu.com
Apr 21, 2017Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers.CVE-2016-4841 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers.
- Product
- Mailwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2017Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks.CVE-2016-4844 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks.
- Product
- Mailwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2017Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information.CVE-2016-4843 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.5
Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information.
- Product
- Mailwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2017Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read.CVE-2016-4842 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read.
- Product
- Mailwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2014Buffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie 8 before 8.1.1 allows remote authenticated users to execute arCVE-2014-5314 · Other software · Cybozu · reported by vultures@jpcert.or.jpHigh 9
Buffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie 8 before 8.1.1 allows remote authenticated users to execute arbitrary code via e-mail messages.
- Product
- Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2013Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated users to obtain sensitive e-mail content intended for different persons in opportunistic circumstancCVE-2013-4698 · Other software · Cybozu · reported by vultures@jpcert.or.jpLow 3.5
Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated users to obtain sensitive e-mail content intended for different persons in opportunistic circumstances by reading Subject header lines within the user's own mailbox.
- Product
- Mailwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2013Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Mailwise before 5.0.4 CVE-2013-2305 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.8
Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Mailwise before 5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords.
- Product
- Cybozu Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2011Cross-site scripting (XSS) vulnerability in Cybozu Office 6, Cybozu Garoon 2.0.0 through 2.1.3, Cybozu Dezie before 6.1, Cybozu MailWise before 3.1, and Cybozu CVE-2011-1334 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Cybozu Office 6, Cybozu Garoon 2.0.0 through 2.1.3, Cybozu Dezie before 6.1, Cybozu MailWise before 3.1, and Cybozu Collaborex before 1.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "downloading graphic files from the mail system."
- Product
- Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2006Directory traversal vulnerability in Cybozu Collaborex, AG before 1.2(1.5), AG Pocket before 5.2(0.8), Mailwise before 3.0(0.3), and Garoon 1 before 1.5(4.1) alCVE-2006-4491 · Other software · Cybozu · reported by MITREMedium 4
Directory traversal vulnerability in Cybozu Collaborex, AG before 1.2(1.5), AG Pocket before 5.2(0.8), Mailwise before 3.0(0.3), and Garoon 1 before 1.5(4.1) allows remote authenticated users to read arbitrary files via unspecified vectors.
- Product
- Collaborex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.