CVE-2016-1191

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified vectors.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN14749391/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000078Vendor Advisory
https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03Patch, Vendor Advisory
http://jvn.jp/en/jp/JVN14749391/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000078Vendor Advisory
https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03Patch, Vendor Advisory

Timeline

Published: Jun 19, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-11924.3Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a CVE-2016-11937.5Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors.CVE-2016-11946.5Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service.CVE-2016-11957.4Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and c CVE-2016-11964.3Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address CVE-2016-11976.1Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML vi CVE-2016-11985.9Photopt for Android before 2.0.1 does not verify SSL certificates.CVE-2016-11995.3The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrict CVE-2016-12006.3The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via uns CVE-2016-12018.8Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication o CVE-2016-12027.8Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module i CVE-2016-12038.1Improper file verification vulnerability in SaAT Netizen installer ver.1.2.0.424 and earlier, and SaAT Netizen ver.1.2.0.8 (Build427) and ea