# CVEs published 2014-07-03

26 CVEs were published on July 3, 2014: 0 critical, 1 high. Days are UTC.

- [CVE-2014-0247](https://cve.now/CVE-2014-0247.md): LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to doc/do (no CVSS)
- [CVE-2014-0477](https://cve.now/CVE-2014-0477.md): The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to c (no CVSS)
- [CVE-2014-3497](https://cve.now/CVE-2014-3497.md): Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or (no CVSS, swift)
- [CVE-2014-4168](https://cve.now/CVE-2014-4168.md): (1) iodined.c and (2) user.c in iodine before 0.7.0 allows remote attackers to bypass authentication by continuing execution after an error (no CVSS)
- [CVE-2014-4672](https://cve.now/CVE-2014-4672.md): The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value (no CVSS, yiisoft/yii)
- [CVE-2014-0325](https://cve.now/CVE-2014-0325.md): Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2014-2965](https://cve.now/CVE-2014-2965.md): Cross-site scripting (XSS) vulnerability in auth-settings-x.php in SpamTitan before 6.04 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2014-3149](https://cve.now/CVE-2014-3149.md): Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded be (no CVSS)
- [CVE-2014-3538](https://cve.now/CVE-2014-3538.md): file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial o (no CVSS)
- [CVE-2014-3857](https://cve.now/CVE-2014-3857.md): Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control (formerly WinRoute Firewall) before 8.3.2 allow remote a (no CVSS)
- [CVE-2014-3920](https://cve.now/CVE-2014-3920.md): Cross-site request forgery (CSRF) vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrat (no CVSS)
- [CVE-2014-4002](https://cve.now/CVE-2014-4002.md): Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1 (no CVSS)
- [CVE-2014-4195](https://cve.now/CVE-2014-4195.md): Cross-site scripting (XSS) vulnerability in zero\_view\_article.php in ZeroCMS 1.0 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2014-4716](https://cve.now/CVE-2014-4716.md): Cross-site request forgery (CSRF) vulnerability in Thomson TWG87OUIR allows remote attackers to hijack the authentication of unspecified vic (no CVSS)
- [CVE-2014-4717](https://cve.now/CVE-2014-4717.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordPress allow remote at (no CVSS)
- [CVE-2014-4718](https://cve.now/CVE-2014-4718.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of (no CVSS)
- [CVE-2014-4719](https://cve.now/CVE-2014-4719.md): Cross-site scripting (XSS) vulnerability in the login panel (svn/login/) in User-Friendly SVN (aka USVN) before 1.0.7 allows remote attacker (no CVSS)
- [CVE-2014-4608](https://cve.now/CVE-2014-4608.md): Multiple integer overflows in the lzo1x\_decompress\_safe function in lib/lzo/lzo1x\_decompress\_safe.c in the LZO decompressor in the Linux ker (CVSS 7.3)
- [CVE-2014-4611](https://cve.now/CVE-2014-4611.md): Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4\_uncompress function in lib/lz4/l (no CVSS)
- [CVE-2014-4652](https://cve.now/CVE-2014-4652.md): Race condition in the tlv handler functionality in the snd\_ctl\_elem\_user\_tlv function in sound/core/control.c in the ALSA control implementa (no CVSS)
- [CVE-2014-4653](https://cve.now/CVE-2014-4653.md): sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, w (no CVSS)
- [CVE-2014-4654](https://cve.now/CVE-2014-4654.md): The snd\_ctl\_elem\_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check au (no CVSS)
- [CVE-2014-4655](https://cve.now/CVE-2014-4655.md): The snd\_ctl\_elem\_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly (no CVSS)
- [CVE-2014-4656](https://cve.now/CVE-2014-4656.md): Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to (no CVSS)
- [CVE-2014-4667](https://cve.now/CVE-2014-4667.md): The sctp\_association\_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog valu (no CVSS)
- [CVE-2014-4715](https://cve.now/CVE-2014-4715.md): Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-07-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.