Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to inject an arbitrary script via unspecified vectors.

Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to inject an arbitrary script via unspecified vectors.

Cybozu, Inc. has released security updates for Cybozu Garoon. * [CyVDB-2083] Vulnerability in Single sign-on settings to avoid viewing and operation privileges - CVE-2020-5580 * [CyVDB-2451] Path traversal vulnerability on the portal - CVE-2020-5581 * [CyVDB-2097] Vulnerability to bypass operation privileges on attachments - CVE-2020-5582 * [CyVDB-2289] Vulnerability in the Multi-Report to bypass view privileges - CVE-2020-5583 * [CyVDB-2305] Vulnerability to token-related information leakage - CVE-2020-5584 * [CyVDB-2308] Cross-site scripting vulnerability related to image asset functionality - CVE-2020-5585 * [CyVDB-2309] Cross-site scripting vulnerability in system configuration - CVE-2020-5586 * [CyVDB-2361] Vulnerability to token-related information leakage - CVE-2020-5587 * [CyVDB-2450] Path traversal vulnerability on the portal - CVE-2020-5588 Kanta Nishitani reported CVE-2020-5580 and CVE-2020-5584 vulnerabilities to Cybozu, Inc., and Cybozu, Inc. reported them to JPCERT/CC to notify users of the solutions through JVN. Tanghaifeng reported CVE-2020-5582 and CVE-2020-5583 vulnerabilities to Cybozu, Inc., and Cybozu, Inc. reported them to JPCERT/CC to notify users of the solutions through JVN. Yuji Tounai reported CVE-2020-5587 vulnerability to Cybozu, Inc., and Cybozu, Inc. reported it to JPCERT/CC to notify users of its solution through JVN. Cybozu, Inc. reported CVE-2020-5581, CVE-2020-5585, CVE-2020-5586 and CVE-2020-5588 vulnerabilities…