VendorsCybozuoffice9.3.1
Vulnerabilities

Cybozu Office 9.3.1

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

18CVEs
CVE-2015-8483
Open redirect vulnerability in Cybozu Office 10.2.0 through 10.3.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
Published 2016-02-17 · Modified
7.4EPSS 0.013
CVE-2016-4871
Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service.
Published 2017-04-17 · Modified
6.8EPSS 0.023
CVE-2016-4869
Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed.
Published 2017-04-17 · Modified
6.5EPSS 0.020
CVE-2015-7796
Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7797, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
Published 2016-02-17 · Modified
6.1EPSS 0.011
CVE-2015-7797
Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
Published 2016-02-17 · Modified
6.1EPSS 0.011
CVE-2015-7798
Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2016-1149, and CVE-2016-1150.
Published 2016-02-17 · Modified
6.1EPSS 0.011
CVE-2016-1149
Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, and CVE-2016-1150.
Published 2016-02-17 · Modified
6.1EPSS 0.011
CVE-2016-1150
Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, and CVE-2016-1149.
Published 2016-02-17 · Modified
6.1EPSS 0.011
CVE-2015-7795
Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
Published 2016-02-17 · Modified
6.1EPSS 0.011
CVE-2016-4870
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the Schedule function.
Published 2017-04-17 · Modified
5.4EPSS 0.010
CVE-2016-4866
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Project function.
Published 2017-04-17 · Modified
4.8EPSS 0.008
CVE-2016-4865
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Customapp function.
Published 2017-04-17 · Modified
4.8EPSS 0.008
CVE-2016-4868
Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted requests.
Published 2017-04-17 · Modified
4.3EPSS 0.015
CVE-2016-4867
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized project information via the Project function.
Published 2017-04-17 · Modified
4.3EPSS 0.014
CVE-2016-4872
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail.
Published 2017-04-17 · Modified
4.3EPSS 0.014
CVE-2016-4873
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project function.
Published 2017-04-17 · Modified
4.3EPSS 0.012
CVE-2015-8487
Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different vulnerability than CVE-2015-8488.
Published 2016-02-17 · Modified
4.3EPSS 0.012
CVE-2016-4874
Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack.
Published 2017-04-17 · Modified
3.5EPSS 0.010