deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-5635
Published: 2013-11-30
Description: Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by entering password guesses within multiple Unlock.exe processes that are running simultaneously.
CVSS Score: 3.3 (LOW)
CWE: CWE-255
References: http://www.digitalsec.net/stuff/explt+advs/CheckPoint_EndPoint_EPM_Explorer.txt; https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk96589; http://www.digitalsec.net/stuff/explt+advs/CheckPoint_EndPoint_EPM_Explorer.txt
CVE: CVE-2013-5636
Published: 2013-11-30
Description: Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by overwriting DVREM.EPM with a copy of itself after each few password guesses.
CVSS Score: 3.3 (LOW)
CWE: CWE-255
References: http://www.digitalsec.net/stuff/explt+advs/CheckPoint_EndPoint_EPM_Explorer.txt; https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk96589; http://www.digitalsec.net/stuff/explt+advs/CheckPoint_EndPoint_EPM_Explorer.txt
CVE: CVE-2013-6918
Published: 2013-11-30
Description: The web interface on the Satechi travel router 1.5, when Wi-Fi is used for WAN access, exposes the console without authentication on the WAN IP address regardless of the "Web Management via WAN" setting, which allows remote attackers to bypass intended access restrictions via HTTP requests.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0123.html; http://archives.neohapsis.com/archives/bugtraq/2013-11/0123.html
CVE: CVE-2013-3708
Published: 2013-12-01
Description: The id1.GetPrinterURLList function in Novell iPrint Client before 5.93 allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.novell.com/support/kb/doc.php?id=7014184; https://bugzilla.novell.com/show_bug.cgi?id=848735; http://www.novell.com/support/kb/doc.php?id=7014184
CVE: CVE-2013-6718
Published: 2013-12-01
Description: The Advanced Management Module (AMM) with firmware 3.64B, 3.64C, and 3.64G for IBM BladeCenter systems allows remote attackers to discover account names and passwords via use of an unspecified interface.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://osvdb.org/100397; http://secunia.com/advisories/55921; http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm_bladecenter_advanced_management_module_account_information_exposure_cve_2013_6718
CVE: CVE-2013-2818
Published: 2013-12-01
Description: The DNP Master Driver in Alstom e-terracontrol 3.5, 3.6, and 3.7 allows physically proximate attackers to cause a denial of service (infinite loop and DNP3 service disruption) via crafted input over a serial line.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-282-01A; http://ics-cert.us-cert.gov/advisories/ICSA-13-282-01A
CVE: CVE-2013-3550
Published: 2013-12-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-0237.  Reason: This candidate is a reservation duplicate of CVE-2013-0237.  Notes: All CVE users should reference CVE-2013-0237 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-3707
Published: 2013-12-01
Description: The HTTPSTK service in the novell-nrm package before 2.0.2-297.305.302.3 in Novell Open Enterprise Server 2 (OES 2) Linux, and OES 11 Linux Gold and SP1, does not make the intended SSL_free and SSL_shutdown calls for the close of a TCP connection, which allows remote attackers to cause a denial of service (service crash) by establishing many TCP connections to port 8009.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.novell.com/support/kb/doc.php?id=7014063; http://www.novell.com/support/kb/doc.php?id=7014063
CVE: CVE-2012-0414
Published: 2013-12-02
Description: Cross-site scripting (XSS) vulnerability in the Spacewalk service in SUSE Manager 1.2 for SUSE Linux Enterprise (SLE) 11 SP1 allows remote attackers to inject arbitrary web script or HTML via an image name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5145796.html; https://bugzilla.novell.com/show_bug.cgi?id=761165; https://support.novell.com/security/cve/CVE-2012-0414.html
CVE: CVE-2012-0420
Published: 2013-12-02
Description: zypp-refresh-wrapper in SUSE Zypper before 1.3.20 and 1.6.x before 1.6.166 allows local users to create files in arbitrary directories, or possibly have unspecified other impact, via a pathname in the ZYPP_LOCKFILE_ROOT environment variable.
CVSS Score: 4.4 (MEDIUM)
References: https://bugzilla.novell.com/show_bug.cgi?id=770630; https://support.novell.com/security/cve/CVE-2012-0420.html; https://bugzilla.novell.com/show_bug.cgi?id=770630
CVE: CVE-2012-0425
Published: 2013-12-02
Description: LanItems.ycp in save_y2logs in yast2-network before 2.24.4 in SUSE YaST writes cleartext Wi-Fi credentials to the y2log log file, which allows context-dependent attackers to obtain sensitive information by reading the (1) WIRELESS_WPA_PASSWORD or (2) WIRELESS_CLIENT_KEY_PASSWORD field.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://bugzilla.novell.com/show_bug.cgi?id=752464; https://support.novell.com/security/cve/CVE-2012-0425.html; https://bugzilla.novell.com/show_bug.cgi?id=752464
CVE: CVE-2012-0426
Published: 2013-12-02
Description: Race condition in sap_suse_cluster_connector before 1.0.0-0.8.1 in SUSE Linux Enterprise for SAP Applications 11 SP2 allows local users to have an unspecified impact via vectors related to a tmp/ directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-362
References: http://download.novell.com/Download?buildid=DshQViDsMLE~; https://bugzilla.novell.com/show_bug.cgi?id=763793; https://bugzilla.novell.com/show_bug.cgi?id=777453
CVE: CVE-2012-0427
Published: 2013-12-02
Description: yast2-add-on-creator in SUSE inst-source-utils 2008.11.26 before 2008.11.26-0.9.1 and 2012.9.13 before 2012.9.13-0.8.1 allows local users to gain privileges via a crafted (1) file name or (2) directory name.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://download.novell.com/Download?buildid=tGCXHQR48E4~; https://bugzilla.novell.com/show_bug.cgi?id=604730; https://support.novell.com/security/cve/CVE-2012-0427.html
CVE: CVE-2012-0434
Published: 2013-12-02
Description: The server in Crowbar, as used in SUSE Cloud 1.0, uses weak permissions for the production.log file, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: https://bugzilla.novell.com/show_bug.cgi?id=784857; https://support.novell.com/security/cve/CVE-2012-0434.html; https://www.suse.com/support/update/announcement/2013/suse-ru-20130020-1.html
CVE: CVE-2012-6535
Published: 2013-12-02
Description: DjVuLibre before 3.5.25.3, as used in Evince, Sumatra PDF Reader, VuDroid, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted DjVu (aka .djv) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://technet.microsoft.com/security/msvr/msvr13-004; http://www.debian.org/security/2014/dsa-2844; http://www.ubuntu.com/usn/USN-2056-1
CVE: CVE-2013-4417
Published: 2013-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-4528
Published: 2013-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-4543
Published: 2013-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2013-6695
Published: 2013-12-02
Description: The RBAC implementation in Cisco Secure Access Control System (ACS) does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug ID CSCuj39274.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6695; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6695
CVE: CVE-2013-6696
Published: 2013-12-02
Description: Cisco Adaptive Security Appliance (ASA) Software does not properly handle errors during the processing of DNS responses, which allows remote attackers to cause a denial of service (device reload) via a malformed response, aka Bug ID CSCuj28861.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6696; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6696
CVE: CVE-2012-6150
Published: 2013-12-03
Description: The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.
CVSS Score: 3.6 (LOW)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html; http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00002.html
CVE: CVE-2013-6690
Published: 2013-12-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web interface in the Assurance component in Cisco Prime Collaboration allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs CSCui92643, CSCui94038, and CSCui94161.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/55954; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6690; http://tools.cisco.com/security/center/viewAlert.x?alertId=31998
CVE: CVE-2013-6703
Published: 2013-12-03
Description: The TLS/SSLv3 module on Cisco ONS 15454 controller cards allows remote attackers to cause a denial of service (card reset) via crafted (1) TLS or (2) SSLv3 packets, aka Bug ID CSCuh34787.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6703; http://www.securitytracker.com/id/1029422; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6703
CVE: CVE-2013-6704
Published: 2013-12-03
Description: Cisco IOS XE does not properly manage memory for TFTP UDP flows, which allows remote attackers to cause a denial of service (memory consumption) via TFTP (1) client or (2) server traffic, aka Bug IDs CSCuh09324 and CSCty42686.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6704; http://www.securitytracker.com/id/1029424; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6704
CVE: CVE-2013-6705
Published: 2013-12-03
Description: The IP Device Tracking (IPDT) feature in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (IPDT AVL corruption and device reload) via a crafted sequence of ARP packets, aka Bug ID CSCuh38133.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6705; http://www.securitytracker.com/id/1029423; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6705
CVE: CVE-2013-6937
Published: 2013-12-04
Description: Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the name attribute of the cols element in a .wstyle file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/29594; http://www.exploit-db.com/exploits/29594
CVE: CVE-2013-5449
Published: 2013-12-04
Description: Cross-site scripting (XSS) vulnerability in workingSet.jsp in IBM Eclipse Help System (IEHS), as used in the installable InfoCenter component in IBM FileNet Content Manager 4.5.1, 5.0.0, 5.1.0, and 5.2.0, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21657493; http://www.securityfocus.com/bid/64058; https://exchange.xforce.ibmcloud.com/vulnerabilities/88056
CVE: CVE-2013-6029
Published: 2013-12-04
Description: Stack-based buffer overflow in the AT&T Connect Participant Application before 9.5.51 on Windows allows remote attackers to execute arbitrary code via a malformed .SVT file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/346278; http://www.securityfocus.com/bid/64059; http://www.kb.cert.org/vuls/id/346278
CVE: CVE-2013-3519
Published: 2013-12-04
Description: lgtosync.sys in VMware Workstation 9.x before 9.0.3, VMware Player 5.x before 5.0.3, VMware Fusion 5.x before 5.0.4, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1, when a 32-bit Windows guest OS is used, allows guest OS users to gain guest OS privileges via an application that performs a crafted memory allocation.
CVSS Score: 7.9 (HIGH)
CWE: CWE-264
References: http://www.vmware.com/security/advisories/VMSA-2013-0014.html; http://www.vmware.com/security/advisories/VMSA-2013-0014.html
CVE: CVE-2013-6702
Published: 2013-12-04
Description: The management implementation on Cisco ONS 15454 controller cards with software 9.8 and earlier allows remote attackers to cause a denial of service (card reset) via crafted packets, aka Bug ID CSCtz50902.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6702; http://tools.cisco.com/security/center/viewAlert.x?alertId=31999; http://www.securitytracker.com/id/1029421
CVE: CVE-2013-6935
Published: 2013-12-04
Description: Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the SourcePath value in a .wcf file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/133899/Watermark-Master-Buffer-Overflow-SEH.html; http://www.exploit-db.com/exploits/29327; http://packetstormsecurity.com/files/133899/Watermark-Master-Buffer-Overflow-SEH.html
CVE: CVE-2013-6936
Published: 2013-12-04
Description: Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote attackers to execute arbitrary SQL commands via the (1) tooltip or (2) usertooltip parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/100030; http://packetstormsecurity.com/files/124091/MyBB-Ajaxfs-SQL-Injection.html; http://seclists.org/bugtraq/2013/Nov/102
CVE: CVE-2013-2825
Published: 2013-12-04
Description: The DNP3 service in the Outstation component on Elecsys Director Gateway devices with kernel 2.6.32.11ael1 and earlier allows remote attackers to cause a denial of service (CPU consumption and communication outage) via crafted input.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-337-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-337-01
CVE: CVE-2013-6945
Published: 2013-12-04
Description: The M2M Broker in OSEHRA VistA, as distributed before September 30, 2013, allows attackers to bypass authentication and authorization to perform doctor-only actions and read or modify patient records via unspecified vectors related to a "logic flaw."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.darkreading.com/vulnerability/anatomy-of-an-electronic-health-record-e/240164441/; http://www.osehra.org/blog/m2m-broker-security-patch; http://www.osehra.org/blog/vista-patch-available-osehra
CVE: CVE-2013-6000
Published: 2013-12-05
Description: Directory traversal vulnerability in Tattyan HP TOWN before 5_10_1 allows remote attackers to read arbitrary files via a .. (dot dot) in a request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN41703192/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000112; http://www2s.biglobe.ne.jp/~tatsuji/souko/Guidance1.html
CVE: CVE-2013-6001
Published: 2013-12-05
Description: SQL injection vulnerability in the Space function in Cybozu Garoon before 3.7 SP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN82375148/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000114
CVE: CVE-2013-6002
Published: 2013-12-05
Description: The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN94245330/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000115
CVE: CVE-2013-6003
Published: 2013-12-05
Description: CRLF injection vulnerability in Cybozu Garoon 3.1 through 3.5 SP5, when Phone Messages forwarding is enabled, allows remote authenticated users to inject arbitrary e-mail headers via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN84221103/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000116
CVE: CVE-2013-6004
Published: 2013-12-05
Description: Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN87729477/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000117
CVE: CVE-2013-6900
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6901
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6902
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6903
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6904
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in a note component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6905
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6906
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon before 3.7.0, when Internet Explorer 6 through 8 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6907
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 2.x and 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6908
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6909
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in a report component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6910
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in Ajax components in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6911
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113