CVE-2013-6914

CVE-2013-6914 concerns a Cross-site scripting (XSS) flaw in the calendar component of Cybozu Garoon (before 3.7.2). The vulnerability allows remote authenticated users to inject arbitrary script/HTML via unspecified vectors. Affected product: Cybozu Garoon 3.7 Service Pack 1 and earlier. Root cau...

CVE-2013-6913

Cross-site scripting XSS vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6912

CVE-2013-6912 affects Cybozu Garoon’s calendar component (Cybozu Garoon) prior to version 3.7.2. The vulnerability enables cross-site scripting (XSS) when used with Internet Explorer 6–9 and authenticated remote access, allowing injection of arbitrary web script/HTML via unspecified vectors. The ...

PT-2013-6184

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.2 Description A cross-site scripting XSS issue exists in the calendar component, allowing remote authenticated users to inject arbitrary web script or HTML. This can be achieved via unspecified vectors...

PT-2013-6176

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.0 Description A cross-site scripting XSS issue exists in the mail component of Cybozu Garoon, specifically when used with Internet Explorer 6 through 8. This allows remote attackers to inject arbitrary web...

PT-2013-6177

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.x through 3.x before 3.7.0 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized actions on behalf of the use...

PT-2013-6186

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors when using Internet Explorer 9 or 10 or Chrome. Recommendations...

PT-2013-6181

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.2 Description A cross-site scripting XSS issue exists in the bulletin-board component, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified vectors when using Internet...

PT-2013-6185

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.2 Description The issue is related to a cross-site scripting XSS vulnerability in the system-administration component. This allows remote authenticated users to inject arbitrary web script or HTML via...

PT-2013-5912

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7 SP1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. Recommendations For versions prior to 3.7 SP1, update to version 3.7 SP1 or later to resolve the issue...

PT-2013-5913

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7 SP1 Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, via unspecified vectors. Recommendations For versions prior to 3.7 SP1, update to version 3.7 SP1...

PT-2013-5914

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.1 through 3.5 SP5 Description The issue is related to a CRLF injection vulnerability. When Phone Messages forwarding is enabled, remote authenticated users can inject arbitrary e-mail headers via unspecified vectors...

PT-2013-6170

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.0 Description A cross-site scripting XSS issue exists in the system-administration component, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For...

PT-2013-6171

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.0 Description A cross-site scripting XSS issue exists in the Space function of Cybozu Garoon, specifically when used with Firefox, allowing remote attackers to inject arbitrary web script or HTML...

PT-2013-6179

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.0 Description A cross-site scripting XSS issue exists in the report component, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors. Recommendations...

PT-2013-6180

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.0 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors in the Ajax components. Recommendations F...

PT-2013-6178

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.0 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized actions on the affected system...

PT-2013-6175

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.0 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors when using Internet Explorer or Firefox. Recommendations For...

PT-2013-6182

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.2 Description A cross-site scripting XSS issue exists in the calendar component of Cybozu Garoon, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified vectors when using...

CVE-2013-6903: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...