| CVE-2016-7801 | 中危4.3 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors. | 09/06/2017 |
| CVE-2016-4910 | 中危4.3 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters via unspecified vectors. | 09/06/2017 |
| CVE-2016-4909 | 中危4.3 | Cross-site request forgery (CSRF) vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to hijack the authentication of a logged in user to force a logout via unspecified vectors. | 09/06/2017 |
| CVE-2016-4908 | 中危4.3 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors. | 09/06/2017 |
| CVE-2016-4907 | 高危8.8 | Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors. | 09/06/2017 |
| CVE-2016-4906 | 中危6.1 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to inject arbitrary web script or HTML via "Messages" function of Cybozu Garoon Keitai. | 09/06/2017 |
| CVE-2017-2095 | 中危4.3 | Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in the mail function leading to an alteration of the order of mail folders via unspecified vectors. | 28/04/2017 |
| CVE-2017-2094 | 中危4.3 | Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete information via unspecified vectors. | 28/04/2017 |
| CVE-2017-2093 | 中危4.3 | Cybozu Garoon 3.0.0 to 4.2.3 allow remote attackers to obtain tokens used for CSRF protection via unspecified vectors. | 28/04/2017 |
| CVE-2017-2092 | 中危5.4 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. | 28/04/2017 |
| CVE-2017-2091 | 中危4.3 | Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone messages via unspecified vectors. | 28/04/2017 |
| CVE-2016-1194 | 中危6.5 | Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service. | 21/04/2017 |
| CVE-2016-1220 | 中危4.3 | Cybozu Garoon before 4.2.2 does not properly restrict access. | 20/04/2017 |
| CVE-2016-1218 | 高危8.8 | SQL injection vulnerability in Cybozu Garoon before 4.2.2. | 20/04/2017 |
| CVE-2016-1217 | 中危6.1 | Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2. | 20/04/2017 |
| CVE-2016-1216 | 中危6.1 | Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2. | 20/04/2017 |
| CVE-2016-1215 | 中危6.1 | Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2. | 20/04/2017 |
| CVE-2016-1214 | 中危6.1 | Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2. | 20/04/2017 |
| CVE-2016-1213 | 中危6.1 | The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites. | 20/04/2017 |
| CVE-2016-1219 | 严重9.8 | Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use. | 20/04/2017 |