# CVEs published 2014-07-07

41 CVEs were published on July 7, 2014: 0 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2013-7389](https://cve.now/CVE-2013-7389.md): Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. (no CVSS)
- [CVE-2014-0034](https://cve.now/CVE-2014-0034.md): The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is ena (no CVSS, org.apache.cxf:cxf-rt-ws-security)
- [CVE-2014-0035](https://cve.now/CVE-2014-0035.md): The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy (no CVSS, org.apache.cxf:cxf-core)
- [CVE-2014-0176](https://cve.now/CVE-2014-0176.md): Cross-site scripting (XSS) vulnerability in application/panel\_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remot (no CVSS)
- [CVE-2014-0180](https://cve.now/CVE-2014-0180.md): The wait\_for\_task function in app/controllers/application\_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 al (no CVSS)
- [CVE-2014-0184](https://cve.now/CVE-2014-0184.md): Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtai (no CVSS)
- [CVE-2014-0248](https://cve.now/CVE-2014-0248.md): org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and J (no CVSS)
- [CVE-2014-3481](https://cve.now/CVE-2014-3481.md): org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity (no CVSS)
- [CVE-2014-3486](https://cve.now/CVE-2014-3486.md): The (1) shell\_exec function in lib/util/MiqSshUtilV1.rb and (2) temp\_cmd\_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 (no CVSS)
- [CVE-2014-3489](https://cve.now/CVE-2014-3489.md): lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for (no CVSS)
- [CVE-2014-4646](https://cve.now/CVE-2014-4646.md): Buffer overflow in the FPDFBookmark\_GetTitle method in Foxit PDF SDK DLL before 3.1.1.5005 allows context-dependent attackers to execute arb (no CVSS)
- [CVE-2014-4722](https://cve.now/CVE-2014-4722.md): Multiple cross-site scripting (XSS) vulnerabilities in the OCS Reports Web Interface in OCS Inventory NG allow remote attackers to inject ar (no CVSS)
- [CVE-2014-4723](https://cve.now/CVE-2014-4723.md): Cross-site scripting (XSS) vulnerability in the Easy Banners plugin 1.4 for WordPress allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2014-4724](https://cve.now/CVE-2014-4724.md): Cross-site scripting (XSS) vulnerability in the Custom Banners plugin 1.2.2.2 for WordPress allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2013-3993](https://cve.now/CVE-2013-3993.md): IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access un (CVSS 6.5, KEV)
- [CVE-2013-5423](https://cve.now/CVE-2013-5423.md): IBM Flex System Manager (FSM) 1.1 through 1.3 before 1.3.2.0 allows remote attackers to enumerate user accounts via unspecified vectors. (no CVSS)
- [CVE-2014-0602](https://cve.now/CVE-2014-0602.md): Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows (no CVSS)
- [CVE-2014-0860](https://cve.now/CVE-2014-0860.md): The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (no CVSS)
- [CVE-2014-0864](https://cve.now/CVE-2014-0864.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Executer in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 bef (no CVSS)
- [CVE-2014-0865](https://cve.now/CVE-2014-0865.md): RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validatio (no CVSS)
- [CVE-2014-0866](https://cve.now/CVE-2014-0866.md): RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics sends cleartext credentials over HTTP (no CVSS)
- [CVE-2014-0867](https://cve.now/CVE-2014-0867.md): rcore6/main/addcookie.jsp in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows r (no CVSS)
- [CVE-2014-0868](https://cve.now/CVE-2014-0868.md): RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validatio (no CVSS)
- [CVE-2014-0869](https://cve.now/CVE-2014-0869.md): The decrypt function in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics does not requ (no CVSS)
- [CVE-2014-0870](https://cve.now/CVE-2014-0870.md): Multiple cross-site scripting (XSS) vulnerabilities in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in (no CVSS)
- [CVE-2014-0871](https://cve.now/CVE-2014-0871.md): RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to obtain pot (no CVSS)
- [CVE-2014-0875](https://cve.now/CVE-2014-0875.md): Active Cloud Engine (ACE) in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions (no CVSS)
- [CVE-2014-0894](https://cve.now/CVE-2014-0894.md): RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows context-dependent attackers to (no CVSS)
- [CVE-2014-2197](https://cve.now/CVE-2014-2197.md): The Administration GUI in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before (no CVSS)
- [CVE-2014-2198](https://cve.now/CVE-2014-2198.md): Cisco Unified Communications Domain Manager (CDM) in Unified CDM Platform Software before 4.4.2 has a hardcoded SSH private key, which makes (no CVSS)
- [CVE-2014-2614](https://cve.now/CVE-2014-2614.md): Unspecified vulnerability in HP SiteScope 11.1x through 11.13 and 11.2x through 11.24 allows remote attackers to bypass authentication via u (no CVSS)
- [CVE-2014-2615](https://cve.now/CVE-2014-2615.md): Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive informa (no CVSS)
- [CVE-2014-2616](https://cve.now/CVE-2014-2616.md): Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive informa (no CVSS)
- [CVE-2014-2617](https://cve.now/CVE-2014-2617.md): Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive informa (no CVSS)
- [CVE-2014-2967](https://cve.now/CVE-2014-2967.md): Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute arbitrary code via Python os library calls in Python API c (no CVSS)
- [CVE-2014-2969](https://cve.now/CVE-2014-2969.md): NETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5 have a hardcoded password of debugpassword for the ntgruser account, which allow (no CVSS)
- [CVE-2014-3113](https://cve.now/CVE-2014-3113.md): Multiple buffer overflows in RealNetworks RealPlayer before 17.0.10.8 allow remote attackers to execute arbitrary code via a malformed (1) e (no CVSS)
- [CVE-2014-3300](https://cve.now/CVE-2014-3300.md): The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 10 d (no CVSS)
- [CVE-2014-3308](https://cve.now/CVE-2014-3308.md): Cisco IOS XR on Trident line cards in ASR 9000 devices lacks a static punt policer, which allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2014-3482](https://cve.now/CVE-2014-3482.md): SQL injection vulnerability in activerecord/lib/active\_record/connection\_adapters/postgresql\_adapter.rb in the PostgreSQL adapter for Active (no CVSS, activerecord)
- [CVE-2014-3483](https://cve.now/CVE-2014-3483.md): SQL injection vulnerability in activerecord/lib/active\_record/connection\_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active (no CVSS, activerecord)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-07-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.