# CVEs published 2014-07-15

11 CVEs were published on July 15, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-1474](https://cve.now/CVE-2014-1474.md): Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to caus (no CVSS)
- [CVE-2014-3418](https://cve.now/CVE-2014-3418.md): config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacharacters in (no CVSS)
- [CVE-2014-3419](https://cve.now/CVE-2014-3419.md): Infoblox NetMRI before 6.8.5 has a default password of admin for the "root" MySQL database account, which makes it easier for local users to (no CVSS)
- [CVE-2014-3952](https://cve.now/CVE-2014-3952.md): FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize the buffer between the header and da (no CVSS)
- [CVE-2014-3953](https://cve.now/CVE-2014-3953.md): FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize certain data structures, which allow (no CVSS)
- [CVE-2014-4031](https://cve.now/CVE-2014-4031.md): The Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allo (no CVSS)
- [CVE-2014-4663](https://cve.now/CVE-2014-4663.md): TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell (no CVSS)
- [CVE-2014-4962](https://cve.now/CVE-2014-4962.md): Shopizer 1.1.5 and earlier allows remote attackers to reduce the total cost of their shopping cart via a negative number in the productQuant (no CVSS)
- [CVE-2014-4963](https://cve.now/CVE-2014-4963.md): Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.customerId parameter t (no CVSS)
- [CVE-2014-4964](https://cve.now/CVE-2014-4964.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hijack the authentication (no CVSS)
- [CVE-2014-4965](https://cve.now/CVE-2014-4965.md): Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbitrary web script or H (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-07-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.