CVE-2013-6001: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Space function in Cybozu Garoon before 3.7 SP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-6907: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a mail component in Cybozu Garoon 2.x and 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6902: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Space function in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6003: Improper Input Validation

CRLF injection vulnerability in Cybozu Garoon 3.1 through 3.5 SP5, when Phone Messages forwarding is enabled, allows remote authenticated users to inject arbitrary e-mail headers via unspecified vectors...

CVE-2013-6909: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a report component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6910: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Ajax components in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6002: Undefined Security Weakness

The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service CPU consumption via unspecified vectors...

CVE-2013-6911: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6901: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Space function in Cybozu Garoon before 3.7.0, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6906: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a mail component in Cybozu Garoon before 3.7.0, when Internet Explorer 6 through 8 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6916: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6915: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the system-administration component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6900: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the system-administration component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6004: Undefined Security Weakness

Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2013-6905: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6912: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a calendar component in Cybozu Garoon before 3.7.2, when Internet Explorer 6 through 9 is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6908: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a mail component in Cybozu Garoon 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6913: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6904: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in a note component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2013-5915

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 3.7.2 Description A session fixation issue allows remote attackers to hijack web sessions. The exact vectors used for the attack are not specified. Recommendations For versions prior to 3.7.2, update to version...