# CVEs published 2014-07-03

26 CVEs were published on July 3, 2014: 0 critical, 1 high. Days are UTC.

- [CVE-2014-0247](https://cve.now/CVE-2014-0247.md): LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to… (no CVSS)
- [CVE-2014-0477](https://cve.now/CVE-2014-0477.md): The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to… (no CVSS)
- [CVE-2014-3497](https://cve.now/CVE-2014-3497.md): Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script… (no CVSS, swift)
- [CVE-2014-4168](https://cve.now/CVE-2014-4168.md): (1) iodined.c and (2) user.c in iodine before 0.7.0 allows remote attackers to bypass authentication by continuing execution after an… (no CVSS)
- [CVE-2014-4672](https://cve.now/CVE-2014-4672.md): The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the… (no CVSS, yiisoft/yii)
- [CVE-2014-0325](https://cve.now/CVE-2014-0325.md): Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of… (no CVSS)
- [CVE-2014-2965](https://cve.now/CVE-2014-2965.md): Cross-site scripting (XSS) vulnerability in auth-settings-x.php in SpamTitan before 6.04 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2014-3149](https://cve.now/CVE-2014-3149.md): Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded… (no CVSS)
- [CVE-2014-3538](https://cve.now/CVE-2014-3538.md): file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial… (no CVSS)
- [CVE-2014-3857](https://cve.now/CVE-2014-3857.md): Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control (formerly WinRoute Firewall) before 8.3.2 allow remote… (no CVSS)
- [CVE-2014-3920](https://cve.now/CVE-2014-3920.md): Cross-site request forgery (CSRF) vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2014-4002](https://cve.now/CVE-2014-4002.md): Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2014-4195](https://cve.now/CVE-2014-4195.md): Cross-site scripting (XSS) vulnerability in zero\_view\_article.php in ZeroCMS 1.0 allows remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2014-4716](https://cve.now/CVE-2014-4716.md): Cross-site request forgery (CSRF) vulnerability in Thomson TWG87OUIR allows remote attackers to hijack the authentication of unspecified… (no CVSS)
- [CVE-2014-4717](https://cve.now/CVE-2014-4717.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordPress allow remote… (no CVSS)
- [CVE-2014-4718](https://cve.now/CVE-2014-4718.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication… (no CVSS)
- [CVE-2014-4719](https://cve.now/CVE-2014-4719.md): Cross-site scripting (XSS) vulnerability in the login panel (svn/login/) in User-Friendly SVN (aka USVN) before 1.0.7 allows remote… (no CVSS)
- [CVE-2014-4608](https://cve.now/CVE-2014-4608.md): Multiple integer overflows in the lzo1x\_decompress\_safe function in lib/lzo/lzo1x\_decompress\_safe.c in the LZO decompressor in the Linux… (CVSS 7.3)
- [CVE-2014-4611](https://cve.now/CVE-2014-4611.md): Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4\_uncompress function in… (no CVSS)
- [CVE-2014-4652](https://cve.now/CVE-2014-4652.md): Race condition in the tlv handler functionality in the snd\_ctl\_elem\_user\_tlv function in sound/core/control.c in the ALSA control… (no CVSS)
- [CVE-2014-4653](https://cve.now/CVE-2014-4653.md): sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock… (no CVSS)
- [CVE-2014-4654](https://cve.now/CVE-2014-4654.md): The snd\_ctl\_elem\_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check… (no CVSS)
- [CVE-2014-4655](https://cve.now/CVE-2014-4655.md): The snd\_ctl\_elem\_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not… (no CVSS)
- [CVE-2014-4656](https://cve.now/CVE-2014-4656.md): Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users… (no CVSS)
- [CVE-2014-4667](https://cve.now/CVE-2014-4667.md): The sctp\_association\_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog… (no CVSS)
- [CVE-2014-4715](https://cve.now/CVE-2014-4715.md): Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2014-07-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.