# CVEs published 2014-07-02

76 CVEs were published on July 2, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3737](https://cve.now/CVE-2014-3737.md): Cross-site scripting (XSS) vulnerability in templates/defaultheader.php in Lamp Design Storesprite before 7 - 19-06-14, when using the curre (no CVSS)
- [CVE-2014-4534](https://cve.now/CVE-2014-4534.md): Multiple cross-site scripting (XSS) vulnerabilities in videoplayer/autoplay.php in the HTML5 Video Player with Playlist plugin 2.4.0 and ear (no CVSS)
- [CVE-2014-4546](https://cve.now/CVE-2014-4546.md): Cross-site scripting (XSS) vulnerability in book\_ajax.php in the Rezgo plugin 1.4.2 and earlier for WordPress allows remote attackers to inj (no CVSS)
- [CVE-2014-4549](https://cve.now/CVE-2014-4549.md): Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before (no CVSS)
- [CVE-2014-4554](https://cve.now/CVE-2014-4554.md): Cross-site scripting (XSS) vulnerability in templates/download.php in the SS Downloads plugin before 1.5 for WordPress allows remote attacke (no CVSS)
- [CVE-2014-4555](https://cve.now/CVE-2014-4555.md): Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers (no CVSS)
- [CVE-2014-4563](https://cve.now/CVE-2014-4563.md): Cross-site scripting (XSS) vulnerability in go.php in the URL Cloak & Encrypt (url-cloak-encrypt) plugin 2.0 and earlier for WordPress allow (no CVSS)
- [CVE-2014-4565](https://cve.now/CVE-2014-4565.md): Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPre (no CVSS)
- [CVE-2014-4571](https://cve.now/CVE-2014-4571.md): Multiple cross-site scripting (XSS) vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote att (no CVSS)
- [CVE-2014-4581](https://cve.now/CVE-2014-4581.md): Cross-site scripting (XSS) vulnerability in facture.php in the WPCB plugin 2.4.8 and earlier for WordPress allows remote attackers to inject (no CVSS)
- [CVE-2014-4591](https://cve.now/CVE-2014-4591.md): Cross-site scripting (XSS) vulnerability in picasa\_upload.php in the WP-Picasa-Image plugin 1.0 and earlier for WordPress allows remote atta (no CVSS)
- [CVE-2014-4597](https://cve.now/CVE-2014-4597.md): Cross-site scripting (XSS) vulnerability in test.php in the WP Social Invitations plugin before 1.4.4.3 for WordPress allows remote attacker (no CVSS)
- [CVE-2014-4606](https://cve.now/CVE-2014-4606.md): Cross-site scripting (XSS) vulnerability in redirect\_to\_zeenshare.php in the ZeenShare plugin 1.0.1 and earlier for WordPress allows remote (no CVSS)
- [CVE-2014-4614](https://cve.now/CVE-2014-4614.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of adm (no CVSS)
- [CVE-2014-4522](https://cve.now/CVE-2014-4522.md): Cross-site scripting (XSS) vulnerability in client-assist.php in the dsSearchAgent: WordPress Edition plugin 1.0-beta10 and earlier for Word (no CVSS)
- [CVE-2014-4524](https://cve.now/CVE-2014-4524.md): Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allow (no CVSS)
- [CVE-2014-4526](https://cve.now/CVE-2014-4526.md): Multiple cross-site scripting (XSS) vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress allow remote attack (no CVSS)
- [CVE-2014-4527](https://cve.now/CVE-2014-4527.md): Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters ( (no CVSS)
- [CVE-2014-4529](https://cve.now/CVE-2014-4529.md): Cross-site scripting (XSS) vulnerability in fpg\_preview.php in the Flash Photo Gallery plugin 0.7 and earlier for WordPress allows remote at (no CVSS)
- [CVE-2014-4531](https://cve.now/CVE-2014-4531.md): Cross-site scripting (XSS) vulnerability in main\_page.php in the Game tabs plugin 0.4.0 and earlier for WordPress allows remote attackers to (no CVSS)
- [CVE-2014-4532](https://cve.now/CVE-2014-4532.md): Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList\_Footer.tpl.php in the GarageSale plugin before 1.2.3 for WordPress (no CVSS)
- [CVE-2014-4537](https://cve.now/CVE-2014-4537.md): Cross-site scripting (XSS) vulnerability in inpage.tpl.php in the Keyword Strategy Internal Links plugin 2.0 and earlier for WordPress allow (no CVSS)
- [CVE-2014-4540](https://cve.now/CVE-2014-4540.md): Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter\_login\_form.php in the Oleggo LiveStream plugin 0.2.6 and earlier for Word (no CVSS)
- [CVE-2014-4541](https://cve.now/CVE-2014-4541.md): Cross-site scripting (XSS) vulnerability in shortcode-generator/preview-shortcode-external.php in the OMFG Mobile Pro plugin 1.1.26 and earl (no CVSS)
- [CVE-2014-4542](https://cve.now/CVE-2014-4542.md): Cross-site scripting (XSS) vulnerability in redirect.php in the Ooorl plugin for WordPress allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2014-4543](https://cve.now/CVE-2014-4543.md): Multiple cross-site scripting (XSS) vulnerabilities in payper/payper.php in the Pay Per Media Player plugin 1.24 and earlier for WordPress a (no CVSS)
- [CVE-2014-4547](https://cve.now/CVE-2014-4547.md): Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index\_ajax.php in the Rezgo Online Booking plugin before 1.8.2 for (no CVSS)
- [CVE-2014-4551](https://cve.now/CVE-2014-4551.md): Cross-site scripting (XSS) vulnerability in diagnostics/test.php in the Social Connect plugin 1.0.4 and earlier for WordPress allows remote (no CVSS)
- [CVE-2014-4552](https://cve.now/CVE-2014-4552.md): Cross-site scripting (XSS) vulnerability in library/includes/payment/paypalexpress/DoDirectPayment.php in the Spotlight (spotlightyour) plug (no CVSS)
- [CVE-2014-4557](https://cve.now/CVE-2014-4557.md): Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop) plugin 3.1.0 (no CVSS)
- [CVE-2014-4560](https://cve.now/CVE-2014-4560.md): Cross-site scripting (XSS) vulnerability in includes/getTipo.php in the ToolPage plugin 1.6.1 and earlier for WordPress allows remote attack (no CVSS)
- [CVE-2014-4566](https://cve.now/CVE-2014-4566.md): Cross-site scripting (XSS) vulnerability in res/fake\_twitter/frame.php in the "verwei.se - WordPress - Twitter" (verweise-wordpress-twitter) (no CVSS)
- [CVE-2014-4568](https://cve.now/CVE-2014-4568.md): Cross-site scripting (XSS) vulnerability in posts/videowhisper/r\_logout.php in the Video Posts Webcam Recorder plugin 1.55.4 and earlier for (no CVSS)
- [CVE-2014-4570](https://cve.now/CVE-2014-4570.md): Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Video Presentation plugin before 3.31 for WordPress allow remote att (no CVSS)
- [CVE-2014-4572](https://cve.now/CVE-2014-4572.md): Cross-site scripting (XSS) vulnerability in bvc.php in the Votecount for Balatarin plugin 0.1.1 and earlier for WordPress allows remote atta (no CVSS)
- [CVE-2014-4573](https://cve.now/CVE-2014-4573.md): Multiple cross-site scripting (XSS) vulnerabilities in frame-maker.php in the Walk Score plugin 0.5.5 and earlier for WordPress allow remote (no CVSS)
- [CVE-2014-4574](https://cve.now/CVE-2014-4574.md): Cross-site scripting (XSS) vulnerability in resize.php in the WebEngage plugin before 2.0.1 for WordPress allows remote attackers to inject (no CVSS)
- [CVE-2014-4576](https://cve.now/CVE-2014-4576.md): Cross-site scripting (XSS) vulnerability in services/diagnostics.php in the WordPress Social Login plugin 2.0.3 and earlier for WordPress al (no CVSS)
- [CVE-2014-4578](https://cve.now/CVE-2014-4578.md): Cross-site scripting (XSS) vulnerability in asset-studio/icons-launcher.php in the WP App Maker plugin 1.0.16.4 and earlier for WordPress al (no CVSS)
- [CVE-2014-4579](https://cve.now/CVE-2014-4579.md): Cross-site scripting (XSS) vulnerability in js/test.php in the Appointments Scheduler plugin 1.5 and earlier for WordPress allows remote att (no CVSS)
- [CVE-2014-4580](https://cve.now/CVE-2014-4580.md): Cross-site scripting (XSS) vulnerability in blipbot.ajax.php in the WP BlipBot plugin 3.0.9 and earlier for WordPress allows remote attacker (no CVSS)
- [CVE-2014-4582](https://cve.now/CVE-2014-4582.md): Cross-site scripting (XSS) vulnerability in admin/admin\_show\_dialogs.php in the WP Consultant plugin 1.0 and earlier for WordPress allows re (no CVSS)
- [CVE-2014-4587](https://cve.now/CVE-2014-4587.md): Multiple cross-site scripting (XSS) vulnerabilities in the WP GuestMap plugin 1.8 and earlier for WordPress allow remote attackers to inject (no CVSS)
- [CVE-2014-4588](https://cve.now/CVE-2014-4588.md): Cross-site scripting (XSS) vulnerability in tpls/editmedia.php in the Hot Files: File Sharing and Download Manager (wphotfiles) plugin 1.0.0 (no CVSS)
- [CVE-2014-4589](https://cve.now/CVE-2014-4589.md): Cross-site scripting (XSS) vulnerability in uploader.php in the WP Silverlight Media Player (wp-media-player) plugin 0.8 and earlier for Wor (no CVSS)
- [CVE-2014-4590](https://cve.now/CVE-2014-4590.md): Cross-site scripting (XSS) vulnerability in get.php in the WP Microblogs plugin 0.4.0 and earlier for WordPress allows remote attackers to i (no CVSS)
- [CVE-2014-4593](https://cve.now/CVE-2014-4593.md): Cross-site scripting (XSS) vulnerability in wp-plugins-net/index.php in the WP Plugin Manager (wppm) plugin 1.6.4.b and earlier for WordPres (no CVSS)
- [CVE-2014-4594](https://cve.now/CVE-2014-4594.md): Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote atta (no CVSS)
- [CVE-2014-4595](https://cve.now/CVE-2014-4595.md): Multiple cross-site scripting (XSS) vulnerabilities in the WP RESTful plugin 0.1 and earlier for WordPress allow remote attackers to inject (no CVSS)
- [CVE-2014-4596](https://cve.now/CVE-2014-4596.md): Multiple cross-site scripting (XSS) vulnerabilities in js/button-snapapp.php in the SnapApp plugin 1.5 and earlier for WordPress allow remot (no CVSS)
- [CVE-2014-4598](https://cve.now/CVE-2014-4598.md): Cross-site scripting (XSS) vulnerability in wp-tmkm-amazon-search.php in the wp-tmkm-amazon plugin 1.5b and earlier for WordPress allows rem (no CVSS)
- [CVE-2014-4599](https://cve.now/CVE-2014-4599.md): Multiple cross-site scripting (XSS) vulnerabilities in forms/search.php in the WP-Business Directory (wp-ttisbdir) plugin 1.0.2 and earlier (no CVSS)
- [CVE-2014-4600](https://cve.now/CVE-2014-4600.md): Multiple cross-site scripting (XSS) vulnerabilities in contact/edit.php in the WP Ultimate Email Marketer plugin 1.1.0 and earlier for WordP (no CVSS)
- [CVE-2014-4601](https://cve.now/CVE-2014-4601.md): Cross-site scripting (XSS) vulnerability in wu-ratepost.php in the Wu-Rating plugin 1.0 12319 and earlier for WordPress allows remote attack (no CVSS)
- [CVE-2014-4603](https://cve.now/CVE-2014-4603.md): Multiple cross-site scripting (XSS) vulnerabilities in yupdates\_application.php in the Yahoo! Updates for WordPress plugin 1.0 and earlier f (no CVSS)
- [CVE-2014-4604](https://cve.now/CVE-2014-4604.md): Cross-site scripting (XSS) vulnerability in settings/pwsettings.php in the Your Text Manager plugin 0.3.0 and earlier for WordPress allows r (no CVSS)
- [CVE-2014-4605](https://cve.now/CVE-2014-4605.md): Cross-site scripting (XSS) vulnerability in cal/test.php in the ZdStatistics (zdstats) plugin 2.0.1 and earlier for WordPress allows remote (no CVSS)
- [CVE-2014-3889](https://cve.now/CVE-2014-3889.md): silex SX-2000WG devices with firmware before 1.5.4 allow remote attackers to cause a denial of service (connectivity outage) via crafted dat (no CVSS)
- [CVE-2014-3890](https://cve.now/CVE-2014-3890.md): silex SX-2000WG devices with firmware before 1.5.4 allow remote attackers to cause a denial of service (connectivity outage) via a crafted I (no CVSS)
- [CVE-2014-3066](https://cve.now/CVE-2014-3066.md): IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity (no CVSS)
- [CVE-2014-3074](https://cve.now/CVE-2014-3074.md): The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain priv (no CVSS)
- [CVE-2014-3297](https://cve.now/CVE-2014-3297.md): Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows (no CVSS)
- [CVE-2014-3298](https://cve.now/CVE-2014-3298.md): Form Data Viewer in Cisco Intelligent Automation for Cloud in Cisco Cloud Portal places passwords in form data, which allows remote authenti (no CVSS)
- [CVE-2014-3307](https://cve.now/CVE-2014-3307.md): The DHCP client implementation in Universal Small Cell firmware on Cisco Small Cell products allows remote attackers to execute arbitrary co (no CVSS)
- [CVE-2014-4687](https://cve.now/CVE-2014-4687.md): Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2014-4688](https://cve.now/CVE-2014-4688.md): pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag\_dns.php in a Create (no CVSS)
- [CVE-2014-4689](https://cve.now/CVE-2014-4689.md): Absolute path traversal vulnerability in pkg\_edit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full (no CVSS)
- [CVE-2014-4690](https://cve.now/CVE-2014-4690.md): Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow (1) remote attackers to read arbitrary .info files via a crafted (no CVSS)
- [CVE-2014-4691](https://cve.now/CVE-2014-4691.md): Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie. (no CVSS)
- [CVE-2014-4692](https://cve.now/CVE-2014-4692.md): pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it ea (no CVSS)
- [CVE-2014-4693](https://cve.now/CVE-2014-4693.md): Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to i (no CVSS)
- [CVE-2014-4694](https://cve.now/CVE-2014-4694.md): Multiple cross-site scripting (XSS) vulnerabilities in suricata\_select\_alias.php in the Suricata package before 1.0.6 for pfSense through 2. (no CVSS)
- [CVE-2014-4695](https://cve.now/CVE-2014-4695.md): Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users (no CVSS)
- [CVE-2014-4696](https://cve.now/CVE-2014-4696.md): Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect use (no CVSS)
- [CVE-2014-3100](https://cve.now/CVE-2014-3100.md): Stack-based buffer overflow in the encode\_key function in /system/bin/keystore in the KeyStore service in Android 4.3 allows attackers to ex (no CVSS)
- [CVE-2014-4668](https://cve.now/CVE-2014-4668.md): The cherokee\_validator\_ldap\_check function in validator\_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly conside (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-07-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.