# CVEs published 2013-12-05 29 CVEs were published on December 5, 2013: 0 critical, 0 high. Days are UTC. - [CVE-2013-3921](https://cve.now/CVE-2013-3921.md): Directory traversal vulnerability in Easytime Studio Easy File Manager 1.1 for iOS allows remote attackers to read arbitrary files via a ..% (no CVSS) - [CVE-2013-5108](https://cve.now/CVE-2013-5108.md): Multiple cross-site scripting (XSS) vulnerabilities in the xn function in RockMongo 1.1.5 and earlier allow remote attackers to inject arbit (no CVSS) - [CVE-2013-6267](https://cve.now/CVE-2013-6267.md): Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.11.9 allow remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2013-6341](https://cve.now/CVE-2013-6341.md): SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the language paramet (no CVSS) - [CVE-2013-6395](https://cve.now/CVE-2013-6395.md): Cross-site scripting (XSS) vulnerability in header.php in Ganglia Web 3.5.8 and 3.5.10 allows remote attackers to inject arbitrary web scrip (no CVSS) - [CVE-2013-6787](https://cve.now/CVE-2013-6787.md): SQL injection vulnerability in the check\_user\_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the no (no CVSS) - [CVE-2013-6804](https://cve.now/CVE-2013-6804.md): Cross-site scripting (XSS) vulnerability in the Search module before 1.1.1 for Jamroom allows remote attackers to inject arbitrary web scrip (no CVSS) - [CVE-2013-6000](https://cve.now/CVE-2013-6000.md): Directory traversal vulnerability in Tattyan HP TOWN before 5\_10\_1 allows remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2013-6001](https://cve.now/CVE-2013-6001.md): SQL injection vulnerability in the Space function in Cybozu Garoon before 3.7 SP1 allows remote authenticated users to execute arbitrary SQL (no CVSS) - [CVE-2013-6002](https://cve.now/CVE-2013-6002.md): The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. (no CVSS) - [CVE-2013-6003](https://cve.now/CVE-2013-6003.md): CRLF injection vulnerability in Cybozu Garoon 3.1 through 3.5 SP5, when Phone Messages forwarding is enabled, allows remote authenticated us (no CVSS) - [CVE-2013-6004](https://cve.now/CVE-2013-6004.md): Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors. (no CVSS) - [CVE-2013-6900](https://cve.now/CVE-2013-6900.md): Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.0 allows remote attackers to inj (no CVSS) - [CVE-2013-6901](https://cve.now/CVE-2013-6901.md): Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0, when Firefox is used, allows remote attackers (no CVSS) - [CVE-2013-6902](https://cve.now/CVE-2013-6902.md): Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web (no CVSS) - [CVE-2013-6903](https://cve.now/CVE-2013-6903.md): Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, a (no CVSS) - [CVE-2013-6904](https://cve.now/CVE-2013-6904.md): Cross-site scripting (XSS) vulnerability in a note component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allow (no CVSS) - [CVE-2013-6905](https://cve.now/CVE-2013-6905.md): Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allo (no CVSS) - [CVE-2013-6906](https://cve.now/CVE-2013-6906.md): Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon before 3.7.0, when Internet Explorer 6 through 8 is used, allo (no CVSS) - [CVE-2013-6907](https://cve.now/CVE-2013-6907.md): Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 2.x and 3.x before 3.7.0 allows remote attackers to inject arb (no CVSS) - [CVE-2013-6908](https://cve.now/CVE-2013-6908.md): Cross-site scripting (XSS) vulnerability in a mail component in Cybozu Garoon 3.x before 3.7.0 allows remote attackers to inject arbitrary w (no CVSS) - [CVE-2013-6909](https://cve.now/CVE-2013-6909.md): Cross-site scripting (XSS) vulnerability in a report component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web (no CVSS) - [CVE-2013-6910](https://cve.now/CVE-2013-6910.md): Cross-site scripting (XSS) vulnerability in Ajax components in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web sc (no CVSS) - [CVE-2013-6911](https://cve.now/CVE-2013-6911.md): Cross-site scripting (XSS) vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is (no CVSS) - [CVE-2013-6912](https://cve.now/CVE-2013-6912.md): Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2, when Internet Explorer 6 through 9 is used, (no CVSS) - [CVE-2013-6913](https://cve.now/CVE-2013-6913.md): Cross-site scripting (XSS) vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote (no CVSS) - [CVE-2013-6914](https://cve.now/CVE-2013-6914.md): Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject a (no CVSS) - [CVE-2013-6915](https://cve.now/CVE-2013-6915.md): Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.2 allows remote authenticated us (no CVSS) - [CVE-2013-6916](https://cve.now/CVE-2013-6916.md): Cross-site scripting (XSS) vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2013-12-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.