CVE-2013-6916: Cross-site scripting (XSS) vulnerability in the Yahoo!

Security readout for executives and security teams

This is a cross-site scripting issue in Cybozu Garoon before version 3.7.2 involving the bundled Yahoo! User Interface Library. If reachable by users with affected browsers, an attacker could inject script or HTML into the web application context. The sources do not provide severity scoring or exact attack vectors. Exposure is most likely in legacy Cybozu Garoon deployments older than 3.7.2, especially internet-facing or broadly accessible intranet instances used with the named browsers. Current exposure cannot be assessed from the provided affected-product metadata because it is incomplete. Treat this as a legacy exposure cleanup item unless an old Garoon instance is still reachable by untrusted users. If present, prioritize upgrade or isolation because XSS can undermine user sessions and trust in internal workflows. Mitigation focus: Identify any Cybozu Garoon deployments older than 3.7.2.; Upgrade affected Garoon instances to 3.7.2 or later where supported.; Review Cybozu and JVN advisories for vendor-specific remediation guidance..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.