CVE-2018-0528

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to access via unspecified vectors.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-287

Affected software

Vendor	Product	Versions
Cybozu, Inc.	Cybozu Office	10.0.0 to 10.7.0

References

http://jvn.jp/en/jp/JVN51737843/index.htmlThird Party Advisory
https://support.cybozu.com/ja-jp/article/9812Third Party Advisory
http://jvn.jp/en/jp/JVN51737843/index.htmlThird Party Advisory
https://support.cybozu.com/ja-jp/article/9812Third Party Advisory

Timeline

Published: Jun 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-05294.3Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to cause a denial of service via unspecified vectors.CVE-2018-05308.8SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via CVE-2018-05314.3Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to view or alter an access privilege of a fo CVE-2018-05322.7Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard databa CVE-2018-05334.9Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authenticat CVE-2018-05346.1Cross-site scripting vulnerability in ArsenoL Version 0.5 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.CVE-2018-05356.1Cross-site scripting vulnerability in PHP 2chBBS version bbs18c allows an attacker to inject arbitrary web script or HTML via unspecified ve CVE-2018-05366.1Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz.cgi.CVE-2018-05376.1Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz_op.cgi.CVE-2018-05386.1Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.CVE-2018-05399.8QQQ SYSTEMS version 2.24 allows an attacker to execute arbitrary commands via unspecified vectors.CVE-2018-05407.8Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified