- Top reward
- ¥2,000,000
- Top severity paid
- Not published
- Assets in scope
- 24
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to ¥2,000,000
- top reward, from ¥10,000.
- Report by email
- https://cy-bugbounty.cybozu.com/k
Rewards
What the company's own policy page says it pays.
The policy page does not state reward amounts that we could read. Check it before you test.
Scope
24 assets you may test, 7 excluded.
Domains 8
- cloud services
- cybozu.co.jp/customer/howtologin
- cybozu.com
- cybozu.dev/ja/garoon/docs/overview
- cybozu.dev/ja/kintone/docs
- kintone.cybozu.co.jp/try-kintone-app-builder
- kintone-sol.cybozu.co.jp/apps
- www.cybozu.com
Android apps 3
- https://play.google.com/store/apps/details?id=com.cybozu.garoon.mobile
- https://play.google.com/store/apps/details?id=com.cybozu.kintone.mobile
- https://play.google.com/store/apps/details?id=com.cybozu.office.mobile
APIs 3
- Garoon API
- https://cybozu.dev/ja/common/docs/user-api
- kintone API（REST API / JavaScript API）
iOS apps 3
- https://apps.apple.com/jp/app/kintone/id674312865
- https://apps.apple.com/us/app/garoon/id6444327172
- https://apps.apple.com/us/app/id1040053533
Wildcard domains 1
- *.cybozu.com
Products and areas 6
- Cloud edition Garoon Mobile
- Cybozu Office Mobile
- Cybozu Office Mobile *Japanese version only
- kintone Mobile
- Peripheral Services
- Service Introduction Web Sites
Out of scope (7)
- cybozu-dev.com
- garoon.cybozu.co.jp/support/package/download
- kintone.com
- mailwise.cybozu.co.jp/exist/package
- office.cybozu.co.jp/trial/download
- *.cybozu.co.jp
- *.kintone.com
Changes
Tracked since 12 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-22888 | Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product. | Medium 6.9 | 2 Feb 2026 |
| CVE-2026-20711 | Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords. | Medium 6.9 | 2 Feb 2026 |
| CVE-2026-22881 | Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords. | Medium 6.8 | 2 Feb 2026 |
| CVE-2024-39817 | Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view data that the user does not have access by conducting 'search' under certain conditions in Custom App. | Medium 6.5 | 6 Aug 2024 |
| CVE-2024-39457 | Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user’s web browser. | Medium 5.4 | 19 Jul 2024 |
| CVE-2024-31402 | Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared To-Dos. | Medium 4.3 | 11 Jun 2024 |
| CVE-2024-31397 | Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product with the administrative privilege may be able to cause a denial-of-service (DoS) condition. | Medium 4.9 | 11 Jun 2024 |
| CVE-2024-31398 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product may obtain information on the list of users. | Medium 4.3 | 11 Jun 2024 |
| CVE-2024-31399 | Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, processing a crafted mail may cause a denial-of-service (DoS) condition. | Medium 6.5 | 11 Jun 2024 |
| CVE-2024-31400 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, unintended data may be left in forwarded mail. | Medium 6.5 | 11 Jun 2024 |
| CVE-2024-31401 | Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the web browser of the user who is logging in to the product. | Critical 9.0 | 11 Jun 2024 |
| CVE-2024-31403 | Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data of Memo. | Medium 5.4 | 11 Jun 2024 |
| CVE-2024-31404 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view the data of Scheduler. | Medium 4.3 | 11 Jun 2024 |
| CVE-2024-23304 | Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operations. | High 7.5 | 6 Feb 2024 |
| CVE-2023-46278 | Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume huge storage space or cause significantly delayed communication. | Medium 6.5 | 1 Nov 2023 |
| CVE-2022-26838 | Path traversal vulnerability in Importing Mobile Device Data of Cybozu Remote Service 3.1.2 allows a remote authenticated attacker to cause a denial-of-service (DoS) condition. | Medium 6.5 | 3 Aug 2023 |
| CVE-2023-26595 | Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial of service condition. | Medium 6.5 | 23 May 2023 |
| CVE-2023-27304 | Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker to alter the data of Message and/or Bulletin. | Medium 4.3 | 23 May 2023 |
| CVE-2023-27384 | Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacker to alter the data of MultiReport. | Medium 4.3 | 23 May 2023 |
| CVE-2022-44608 | Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, which may result in a denial-of-service (DoS) condition. | High 7.5 | 7 Dec 2022 |
| CVE-2022-30604 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors. | Medium 6.1 | 18 Aug 2022 |
| CVE-2022-29891 | Browse restriction bypass vulnerability in Custom Ap of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Custom App via unspecified vectors. | Medium 4.3 | 18 Aug 2022 |
| CVE-2022-30693 | Information disclosure vulnerability in the system configuration of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to obtain the data of the product via unspecified vectors. | Medium 5.3 | 18 Aug 2022 |
| CVE-2022-32283 | Browse restriction bypass vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Cabinet via unspecified vectors. | Medium 4.3 | 18 Aug 2022 |
| CVE-2022-32453 | HTTP header injection vulnerability in Cybozu Office 10.0.0 to 10.8.5 may allow a remote attacker to obtain and/or alter the data of the product via unspecified vectors. | Medium 6.5 | 18 Aug 2022 |
| CVE-2022-32544 | Operation restriction bypass vulnerability in Project of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Project via unspecified vectors. | Medium 4.3 | 18 Aug 2022 |
| CVE-2022-32583 | Operation restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Scheduler via unspecified vectors. | Medium 4.3 | 18 Aug 2022 |
| CVE-2022-33151 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows remote attackers to inject an arbitrary script via unspecified vectors. | Medium 6.1 | 18 Aug 2022 |
| CVE-2022-33311 | Browse restriction bypass vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Address Book via unspecified vectors. | Medium 4.3 | 18 Aug 2022 |
| CVE-2022-25986 | Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Scheduler. | Medium 4.3 | 18 Aug 2022 |
| CVE-2022-28715 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors. | Medium 6.1 | 18 Aug 2022 |
| CVE-2022-29487 | Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors. | Medium 6.1 | 18 Aug 2022 |
| CVE-2022-29512 | Exposure of sensitive information to an unauthorized actor issue in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the data without the viewing privilege. | Medium 6.5 | 11 Jul 2022 |
| CVE-2022-30602 | Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/or delete the files. | High 8.1 | 11 Jul 2022 |
| CVE-2022-30943 | Browsing restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the data of Bulletin. | Medium 4.3 | 11 Jul 2022 |
| CVE-2022-31472 | Browse restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to obtain the data of Cabinet. | Medium 4.3 | 11 Jul 2022 |
| CVE-2022-28692 | Improper input validation vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Scheduler. | Medium 4.3 | 4 Jul 2022 |
| CVE-2022-28713 | Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the product. | Medium 5.3 | 4 Jul 2022 |
| CVE-2022-28718 | Operation restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.5.1 allow a remote authenticated attacker to alter the data of Bulletin. | Medium 4.3 | 4 Jul 2022 |
| CVE-2022-29467 | Address information disclosure vulnerability in Cybozu Garoon 4.2.0 to 5.5.1 allows a remote authenticated attacker to obtain some data of Address. | Medium 4.3 | 4 Jul 2022 |
| CVE-2022-29471 | Browse restriction bypass vulnerability in Bulletin of Cybozu Garoon allows a remote authenticated attacker to obtain the data of Bulletin. | Medium 4.3 | 4 Jul 2022 |
| CVE-2022-29484 | Operation restriction bypass vulnerability in Space of Cybozu Garoon 4.0.0 to 5.9.0 allows a remote authenticated attacker to delete the data of Space. | High 8.1 | 4 Jul 2022 |
| CVE-2022-29513 | Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary script. | Medium 4.8 | 4 Jul 2022 |
| CVE-2022-29892 | Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain functions and cause a denial-of-service (DoS). | Medium 6.5 | 4 Jul 2022 |
| CVE-2022-26051 | Operation restriction bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Portal. | Medium 4.3 | 4 Jul 2022 |
| CVE-2022-26054 | Operation restriction bypass vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Link. | Medium 4.3 | 4 Jul 2022 |
| CVE-2022-26368 | Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter and/or obtain the data of Cabinet. | Medium 5.4 | 4 Jul 2022 |
| CVE-2022-27627 | Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on the logged-in user's web browser. | Medium 6.1 | 4 Jul 2022 |
| CVE-2022-27661 | Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Workflow. | Medium 4.3 | 4 Jul 2022 |
| CVE-2022-27803 | Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Space. | Medium 4.3 | 4 Jul 2022 |
| CVE-2022-27807 | Improper input validation vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to disable to add Categories. | Medium 4.3 | 4 Jul 2022 |
| CVE-2021-20799 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. | Medium 5.4 | 13 Oct 2021 |
| CVE-2021-20800 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. | Medium 5.4 | 13 Oct 2021 |
| CVE-2021-20801 | Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in the product via unspecified vectors. This issue occurs only when using Mozilla Firefox. | Medium 6.5 | 13 Oct 2021 |
| CVE-2021-20802 | HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product. | Medium 5.3 | 13 Oct 2021 |
| CVE-2021-20803 | Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alter the data of the management screen. | Medium 5.4 | 13 Oct 2021 |
| CVE-2021-20804 | Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to cause a denial of service (DoS) condition via unspecified vectors. | Medium 6.5 | 13 Oct 2021 |
| CVE-2021-20805 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.7 to 3.1.9 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. | Medium 5.4 | 13 Oct 2021 |
| CVE-2021-20806 | Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | Medium 6.1 | 13 Oct 2021 |
| CVE-2021-20807 | Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.0.0 to 3.1.9 allows a remote attacker to inject an arbitrary script via unspecified vectors. | Medium 6.1 | 13 Oct 2021 |