rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-6818 
SAP NetWeaver Logviewer 6.30, when running on Windows, allows remote attackers to bypass intended access restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-6819 
Cross-site scripting (XSS) vulnerability in Performance Provider in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-6820 
Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-6821 
Directory traversal vulnerability in the Exportability Check Service in SAP NetWeaver allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-6822 
GRMGApp in SAP NetWeaver allows remote attackers to have unspecified impact and attack vectors, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-6823 
GRMGApp in SAP NetWeaver allows remote attackers to bypass intended access restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-6824 
Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-19T02:00:00.000Z
CVE-2013-6825 
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-10T14:00:00.000Z
CVE-2013-6826 
cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-19T19:00:00.000Z
CVE-2013-6827 
Absolute path traversal vulnerability in admin/viewmsg.php in PineApp Mail-SeCure allows remote attackers to read arbitrary files via a full pathname in the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-20T11:00:00.000Z
CVE-2013-6828 
admin/management.html in PineApp Mail-SeCure allows remote attackers to bypass authentication and perform a sys_usermng operation via the it parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-20T11:00:00.000Z
CVE-2013-6829 
admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-20T11:00:00.000Z
CVE-2013-6830 
admin/confnetworking.html in PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms allows remote attackers to execute arbitrary commands via shell metacharacters in the nsserver parameter during an nslookup operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-20T11:00:00.000Z
CVE-2013-6831 
PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms has a sudoers file that does not properly restrict user specifications, which allows local users to gain privileges via a sudo command that leverages access to the qmailq account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-20T11:00:00.000Z
CVE-2013-6832 
The nand_ioctl function in sys/dev/nand/nand_geom.c in the nand driver in the kernel in FreeBSD 10 and earlier does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-21T02:00:00.000Z
CVE-2013-6833 
The qls_eioctl function in sys/dev/qlxge/qls_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-21T02:00:00.000Z
CVE-2013-6834 
The ql_eioctl function in sys/dev/qlxgbe/ql_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-21T02:00:00.000Z
CVE-2013-6835 
TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T10:00:00.000Z
CVE-2013-6836 
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-19T02:00:00.000Z
CVE-2013-6837 
Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-19T02:00:00.000Z
CVE-2013-6838 
An unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive IVR Pro (VIP2000) 9.0.3 (rel903), when using OpenVZ and fallback customization, uses the same SSH private key across different customers' installations, which allows remote attackers to gain privileges by leveraging knowledge of this key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-28T00:00:00.000Z
CVE-2013-6839 
SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the orderby parameter to catalog/[id].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T15:00:00.000Z
CVE-2013-6840 
Siemens COMOS before 9.2.0.8.1, 10.0 before 10.0.3.1.40, and 10.1 before 10.1.0.0.2 allows local users to gain database privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-10T15:00:00.000Z
CVE-2013-6852 
Cross-site request forgery (CSRF) vulnerability in html/json.html on HP 2620 switches allows remote attackers to hijack the authentication of administrators for requests that change an administrative password via the setPassword method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-22T01:00:00.000Z
CVE-2013-6853 
Cross-site scripting (XSS) vulnerability in clickstream.js in Y! Toolbar plugin for FireFox 3.1.0.20130813024103 for Mac, and 2.5.9.2013418100420 for Windows, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is stored by the victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-26T01:00:00.000Z
CVE-2013-6858 
Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to (1) "Volumes" or (2) "Network Topology" page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T17:00:00.000Z
CVE-2013-6859 
SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 does not properly perform authorization, which allows remote authenticated users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-6860 
Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-6861 
Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows local users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-6862 
Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-6863 
SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-6864 
Directory traversal vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to affect confidentiality, integrity, and availability via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-6865 
SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka CR732989.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-6866 
SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka CR736689.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-6867 
Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 before 15.7 SP50 or 15.7 SP100 allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-6868 
SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows local users to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T18:00:00.000Z
CVE-2013-6869 
SQL injection vulnerability in the SRTT_GET_COUNT_BEFORE_KEY_RFC function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T19:00:00.000Z
CVE-2013-6870 
Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-25T19:00:00.000Z
CVE-2013-6872 
SQL injection vulnerability in managetimetracker.php in Collabtive before 1.2 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a projectpdf action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T15:00:00.000Z
CVE-2013-6873 
SQL injection vulnerability in Testa Online Test Management System (OTMS) 2.0.0.2 allows remote attackers to execute arbitrary SQL commands via the test_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-26T16:00:00.000Z
CVE-2013-6874 
Stack-based buffer overflow in Vortex Light Alloy before 4.7.4 allows remote attackers to execute arbitrary code via a long URL in a .m3u file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-26T16:00:00.000Z
CVE-2013-6875 
SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-26T16:00:00.000Z
CVE-2013-6876 
The (1) pty_init_terminal and (2) pipe_init_terminal functions in main.c in s3dvt 0.2.2 and earlier allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier.  NOTE: this vulnerability was fixed with commit ad732f00b411b092c66a04c359da0f16ec3b387, but the version number was not changed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-06T17:00:00.000Z
CVE-2013-6877 
Heap-based buffer overflow in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allows remote attackers to execute arbitrary code via a long string in the TRACKID element of an RMP file, a different vulnerability than CVE-2013-7260.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-19T22:00:00.000Z
CVE-2013-6878 
Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-22T18:20:37.000Z
CVE-2013-6879 
The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-22T18:20:31.000Z
CVE-2013-6880 
Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attacks via the HTTP Referer header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-22T17:37:13.000Z
CVE-2013-6881 
CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) sector size or (2) skip count fields for the forensic imaging task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-07T17:00:00.000Z
CVE-2013-6882 
Multiple cross-site scripting (XSS) vulnerabilities in CRU Ditto Forensic FieldStation with firmware 2013Oct15a and earlier allow (1) remote attackers to inject arbitrary web script or HTML via the username parameter in a login or (2) remote authenticated users to inject arbitrary web script or HTML via unspecified form fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-17T16:00:00.000Z
CVE-2013-6883 
Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to hijack the authentication of administrators for requests that modify the disk erase technique settings via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-17T16:00:00.000Z
CVE-2013-6884 
The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allows remote attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-07T17:00:00.000Z
CVE-2013-6885 
The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-29T02:00:00.000Z
CVE-2013-6886 
RealVNC VNC 5.0.6 on Mac OS X, Linux, and UNIX allows local users to gain privileges via a crafted argument to the (1) vncserver, (2) vncserver-x11, or (3) Xvnc helper.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-28T02:00:00.000Z
CVE-2013-6887 
OpenJPEG 1.5.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger NULL pointer dereferences, division-by-zero, and other errors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-27T20:00:00.000Z
CVE-2013-6888 
Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-07T17:00:00.000Z
CVE-2013-6889 
GNU Rush 1.7 does not properly drop privileges, which allows local users to read arbitrary files via the --lint option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2013-6890 
denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to cause a denial of service (incorrect block of IP addresses) via crafted login names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-23T22:00:00.000Z
CVE-2013-6891 
lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-26T01:00:00.000Z
CVE-2013-6892 
WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T18:00:00.000Z
CVE-2013-6900 
Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6901 
Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6902 
Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6903 
Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6904 
Cross-site scripting (XSS) vulnerability in a note component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6905 
Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6906 
Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon before 3.7.0, when Internet Explorer 6 through 8 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6907 
Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 2.x and 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6908 
Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 3.x before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6909 
Cross-site scripting (XSS) vulnerability in a report component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6910 
Cross-site scripting (XSS) vulnerability in Ajax components in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z
CVE-2013-6911 
Cross-site scripting (XSS) vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-05T11:00:00.000Z