# CVEs published 2014-07-01

68 CVEs were published on July 1, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3088](https://cve.now/CVE-2014-3088.md): stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-dat (no CVSS)
- [CVE-2013-3004](https://cve.now/CVE-2013-3004.md): Directory traversal vulnerability in BIRT-Report Viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.x and 7.2.x befor (no CVSS)
- [CVE-2013-3662](https://cve.now/CVE-2013-3662.md): Timbre SketchUp (formerly Google SketchUp) before 8 Maintenance 2 allows remote attackers to execute arbitrary code via a crafted color pale (no CVSS)
- [CVE-2013-3664](https://cve.now/CVE-2013-3664.md): Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color pa (no CVSS)
- [CVE-2013-7388](https://cve.now/CVE-2013-7388.md): Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689), allows remote attack (no CVSS)
- [CVE-2014-3477](https://cve.now/CVE-2014-3477.md): The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instea (CVSS 4.0)
- [CVE-2014-3491](https://cve.now/CVE-2014-3491.md): Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2014-3492](https://cve.now/CVE-2014-3492.md): Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attack (no CVSS)
- [CVE-2014-3494](https://cve.now/CVE-2014-3494.md): kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, whic (no CVSS)
- [CVE-2014-4513](https://cve.now/CVE-2014-4513.md): Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier fo (no CVSS)
- [CVE-2014-4515](https://cve.now/CVE-2014-4515.md): Cross-site scripting (XSS) vulnerability in mce\_anyfont/dialog.php in the AnyFont plugin 2.2.3 and earlier for WordPress allows remote attac (no CVSS)
- [CVE-2014-4516](https://cve.now/CVE-2014-4516.md): Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows re (no CVSS)
- [CVE-2014-4518](https://cve.now/CVE-2014-4518.md): Cross-site scripting (XSS) vulnerability in xd\_resize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows r (no CVSS)
- [CVE-2014-4520](https://cve.now/CVE-2014-4520.md): Cross-site scripting (XSS) vulnerability in phprack.php in the DMCA WaterMarker plugin before 1.1 for WordPress allows remote attackers to i (no CVSS)
- [CVE-2014-4521](https://cve.now/CVE-2014-4521.md): Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attacker (no CVSS)
- [CVE-2014-4528](https://cve.now/CVE-2014-4528.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromo (no CVSS)
- [CVE-2014-4533](https://cve.now/CVE-2014-4533.md): Cross-site scripting (XSS) vulnerability in ajax\_functions.php in the GEO Redirector plugin 1.0.1 and earlier for WordPress allows remote at (no CVSS)
- [CVE-2014-4538](https://cve.now/CVE-2014-4538.md): Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers t (no CVSS)
- [CVE-2014-4545](https://cve.now/CVE-2014-4545.md): Multiple cross-site scripting (XSS) vulnerabilities in pq\_dialog.php in the Pro Quoter plugin 1.0 and earlier for WordPress allow remote att (no CVSS)
- [CVE-2014-4556](https://cve.now/CVE-2014-4556.md): Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows re (no CVSS)
- [CVE-2014-4564](https://cve.now/CVE-2014-4564.md): Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and earlier for WordPress allows remote attackers to inj (no CVSS)
- [CVE-2014-4569](https://cve.now/CVE-2014-4569.md): Cross-site scripting (XSS) vulnerability in ls/vv\_login.php in the VideoWhisper Live Streaming Integration plugin 4.27.2 and earlier for Wor (no CVSS)
- [CVE-2014-4575](https://cve.now/CVE-2014-4575.md): Cross-site scripting (XSS) vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inj (no CVSS)
- [CVE-2014-4583](https://cve.now/CVE-2014-4583.md): Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earli (no CVSS)
- [CVE-2014-4584](https://cve.now/CVE-2014-4584.md): Cross-site scripting (XSS) vulnerability in admin/editFacility.php in the wp-easybooking plugin 1.0.3 and earlier for WordPress allows remot (no CVSS)
- [CVE-2014-4585](https://cve.now/CVE-2014-4585.md): Cross-site scripting (XSS) vulnerability in the WP-FaceThumb plugin possibly 1.0 and earlier for WordPress allows remote attackers to inject (no CVSS)
- [CVE-2014-4602](https://cve.now/CVE-2014-4602.md): Multiple cross-site scripting (XSS) vulnerabilities in xencarousel-admin.js.php in the XEN Carousel plugin 0.12.2 and earlier for WordPress (no CVSS)
- [CVE-2014-1317](https://cve.now/CVE-2014-1317.md): iBooks Commerce in Apple OS X before 10.9.4 places Apple ID credentials in the iBooks log, which allows local users to obtain sensitive info (no CVSS)
- [CVE-2014-1325](https://cve.now/CVE-2014-1325.md): WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attacker (no CVSS)
- [CVE-2014-1340](https://cve.now/CVE-2014-1340.md): WebKit, as used in Apple Safari before 6.1.5 and 7.x before 7.0.5, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS)
- [CVE-2014-1345](https://cve.now/CVE-2014-1345.md): WebKit in Apple iOS before 7.1.2 and Apple Safari before 6.1.5 and 7.x before 7.0.5 does not properly encode domain names in URLs, which all (no CVSS)
- [CVE-2014-1348](https://cve.now/CVE-2014-1348.md): Mail in Apple iOS before 7.1.2 advertises the availability of data protection for attachments but stores cleartext attachments under mobile/ (no CVSS)
- [CVE-2014-1349](https://cve.now/CVE-2014-1349.md): Use-after-free vulnerability in Safari in Apple iOS before 7.1.2 allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2014-1350](https://cve.now/CVE-2014-1350.md): Settings in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended iCloud password requirement, and turn off the (no CVSS)
- [CVE-2014-1351](https://cve.now/CVE-2014-1351.md): Siri in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended lock-screen passcode requirement, and read a cont (no CVSS)
- [CVE-2014-1352](https://cve.now/CVE-2014-1352.md): Lock Screen in Apple iOS before 7.1.2 does not properly enforce the limit on failed passcode attempts, which makes it easier for physically (no CVSS)
- [CVE-2014-1353](https://cve.now/CVE-2014-1353.md): Lock Screen in Apple iOS before 7.1.2 does not properly manage the telephony state in Airplane Mode, which allows physically proximate attac (no CVSS)
- [CVE-2014-1354](https://cve.now/CVE-2014-1354.md): CoreGraphics in Apple iOS before 7.1.2 does not properly restrict allocation of stack memory for processing of XBM images, which allows remo (no CVSS)
- [CVE-2014-1355](https://cve.now/CVE-2014-1355.md): The IOKit implementation in the kernel in Apple iOS before 7.1.2 and Apple TV before 6.1.2, and in IOReporting in Apple OS X before 10.9.4, (no CVSS)
- [CVE-2014-1356](https://cve.now/CVE-2014-1356.md): Heap-based buffer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to exe (no CVSS)
- [CVE-2014-1357](https://cve.now/CVE-2014-1357.md): Heap-based buffer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to exe (no CVSS)
- [CVE-2014-1358](https://cve.now/CVE-2014-1358.md): Integer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbit (no CVSS)
- [CVE-2014-1359](https://cve.now/CVE-2014-1359.md): Integer underflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbi (no CVSS)
- [CVE-2014-1360](https://cve.now/CVE-2014-1360.md): Lockdown in Apple iOS before 7.1.2 does not properly verify data from activation servers, which makes it easier for physically proximate att (no CVSS)
- [CVE-2014-1361](https://cve.now/CVE-2014-1361.md): Secure Transport in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 does not ensure that a DTLS message is accep (no CVSS)
- [CVE-2014-1362](https://cve.now/CVE-2014-1362.md): WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attacker (no CVSS)
- [CVE-2014-1363](https://cve.now/CVE-2014-1363.md): WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attacker (no CVSS)
- [CVE-2014-1364](https://cve.now/CVE-2014-1364.md): WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attacker (no CVSS)
- [CVE-2014-1365](https://cve.now/CVE-2014-1365.md): WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attacker (no CVSS)
- [CVE-2014-1366](https://cve.now/CVE-2014-1366.md): WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attacker (no CVSS)
- [CVE-2014-1367](https://cve.now/CVE-2014-1367.md): WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attacker (no CVSS)
- [CVE-2014-1368](https://cve.now/CVE-2014-1368.md): WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attacker (no CVSS)
- [CVE-2014-1369](https://cve.now/CVE-2014-1369.md): WebKit in Apple Safari before 6.1.5 and 7.x before 7.0.5 allows user-assisted remote attackers to access file: URLs by leveraging a URL drag (no CVSS)
- [CVE-2014-1370](https://cve.now/CVE-2014-1370.md): The byte-swapping implementation in copyfile in Apple OS X before 10.9.4 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2014-1371](https://cve.now/CVE-2014-1371.md): Array index error in Dock in Apple OS X before 10.9.4 allows attackers to execute arbitrary code or cause a denial of service (incorrect fun (no CVSS)
- [CVE-2014-1372](https://cve.now/CVE-2014-1372.md): Graphics Driver in Apple OS X before 10.9.4 does not properly restrict read operations during processing of an unspecified system call, whic (no CVSS)
- [CVE-2014-1373](https://cve.now/CVE-2014-1373.md): Intel Graphics Driver in Apple OS X before 10.9.4 does not properly restrict an unspecified OpenGL API call, which allows attackers to execu (no CVSS)
- [CVE-2014-1375](https://cve.now/CVE-2014-1375.md): Intel Graphics Driver in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechanism by leveraging read access to a (no CVSS)
- [CVE-2014-1376](https://cve.now/CVE-2014-1376.md): Intel Compute in Apple OS X before 10.9.4 does not properly restrict an unspecified OpenCL API call, which allows attackers to execute arbit (no CVSS)
- [CVE-2014-1377](https://cve.now/CVE-2014-1377.md): Array index error in IOAcceleratorFamily in Apple OS X before 10.9.4 allows attackers to execute arbitrary code via a crafted application. (no CVSS)
- [CVE-2014-1378](https://cve.now/CVE-2014-1378.md): IOGraphicsFamily in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechanism by leveraging read access to a kerne (no CVSS)
- [CVE-2014-1379](https://cve.now/CVE-2014-1379.md): Graphics Drivers in Apple OS X before 10.9.4 allows attackers to gain privileges or cause a denial of service (NULL pointer dereference and (no CVSS)
- [CVE-2014-1380](https://cve.now/CVE-2014-1380.md): The Security - Keychain component in Apple OS X before 10.9.4 does not properly implement keystroke observers, which allows physically proxi (no CVSS)
- [CVE-2014-1381](https://cve.now/CVE-2014-1381.md): Thunderbolt in Apple OS X before 10.9.4 does not properly restrict IOThunderBoltController API calls, which allows attackers to execute arbi (no CVSS)
- [CVE-2014-1382](https://cve.now/CVE-2014-1382.md): WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attacker (no CVSS)
- [CVE-2014-1383](https://cve.now/CVE-2014-1383.md): Apple TV before 6.1.2 allows remote authenticated users to bypass an intended password requirement for iTunes Store purchase transactions vi (no CVSS)
- [CVE-2014-2509](https://cve.now/CVE-2014-2509.md): Session fixation vulnerability in the Report Advisor (RA) component in EMC Network Configuration Manager (NCM) before 9.3 allows remote atta (no CVSS)
- [CVE-2014-2512](https://cve.now/CVE-2014-2512.md): Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4 before P19, and 7.4.4 SP1 allow remote authenticate (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-07-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.