SHIRASAGI vulnerabilities

An OS command injection vulnerability exists in SHIRASAGI. An authenticated attacker may execute arbitrary OS commands on the system running the product.

A cross-site scripting vulnerability exists in SHIRASAGI. An authenticated attacker may execute arbitrary script in a user's web browser when the user accesses a website using the affected product.

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.