# CVEs published 2014-07-11 24 CVEs were published on July 11, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2014-3815](https://cve.now/CVE-2014-3815.md): Juniper Junos 12.1X46 before 12.1X46-D20 and 12.1X47 before 12.1X47-D10 on SRX Series devices allows remote attackers to cause a denial of s (no CVSS) - [CVE-2014-3816](https://cve.now/CVE-2014-3816.md): Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R11, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D20, (no CVSS) - [CVE-2014-3817](https://cve.now/CVE-2014-3817.md): Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D32, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12 (no CVSS) - [CVE-2014-3819](https://cve.now/CVE-2014-3819.md): Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R10, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, (no CVSS) - [CVE-2014-3821](https://cve.now/CVE-2014-3821.md): Cross-site scripting (XSS) vulnerability in SRX Web Authentication (webauth) in Juniper Junos 11.4 before 11.4R11, 12.1X44 before 12.1X44-D3 (no CVSS) - [CVE-2014-3822](https://cve.now/CVE-2014-3822.md): Juniper Junos 11.4 before 11.4R8, 12.1 before 12.1R5, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D15, 12.1X46 before 12.1X46-D10, an (no CVSS) - [CVE-2014-4738](https://cve.now/CVE-2014-4738.md): Multiple cross-site scripting (XSS) vulnerabilities in FortiGuard FortiWeb 5.0.x, 5.1.x, and 5.2.x before 5.2.1 allow remote attackers to in (no CVSS) - [CVE-2014-4937](https://cve.now/CVE-2014-4937.md): Directory traversal vulnerability in includes/bookx\_export.php BookX plugin 1.7 for WordPress allows remote attackers to read arbitrary file (no CVSS) - [CVE-2014-4938](https://cve.now/CVE-2014-4938.md): SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL (no CVSS) - [CVE-2014-4939](https://cve.now/CVE-2014-4939.md): SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to (no CVSS) - [CVE-2014-4940](https://cve.now/CVE-2014-4940.md): Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary (no CVSS) - [CVE-2014-4941](https://cve.now/CVE-2014-4941.md): Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files v (no CVSS) - [CVE-2014-4942](https://cve.now/CVE-2014-4942.md): The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct reques (no CVSS) - [CVE-2013-6117](https://cve.now/CVE-2013-6117.md): Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user cre (no CVSS) - [CVE-2014-0174](https://cve.now/CVE-2014-0174.md): Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the (no CVSS) - [CVE-2014-3485](https://cve.now/CVE-2014-3485.md): The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to re (no CVSS) - [CVE-2014-3499](https://cve.now/CVE-2014-3499.md): Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via un (no CVSS, github.com/docker/docker) - [CVE-2014-3503](https://cve.now/CVE-2014-3503.md): Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the pas (no CVSS, org.apache.syncope:syncope) - [CVE-2014-3991](https://cve.now/CVE-2014-3991.md): Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2014-3992](https://cve.now/CVE-2014-3992.md): Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the (no CVSS) - [CVE-2014-4167](https://cve.now/CVE-2014-4167.md): The L3-agent in OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause (no CVSS) - [CVE-2014-4700](https://cve.now/CVE-2014-4700.md): Citrix XenDesktop 7.x, 5.x, and 4.x, when pooled random desktop groups is enabled and ShutdownDesktopsAfterUse is disabled, allows local gue (no CVSS) - [CVE-2014-4907](https://cve.now/CVE-2014-4907.md): Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana\_error\_page.php in PNP4Nagios before 0.6.22 allows remote atta (no CVSS) - [CVE-2014-4908](https://cve.now/CVE-2014-4908.md): Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HT (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-07-11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.