# CVEs published 2014-07-22

14 CVEs were published on July 22, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-3518](https://cve.now/CVE-2014-3518.md): jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat (no CVSS)
- [CVE-2014-3530](https://cve.now/CVE-2014-3530.md): The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application (no CVSS, org.picketlink:picketlink-common)
- [CVE-2014-4947](https://cve.now/CVE-2014-4947.md): Buffer overflow in the HVM graphics console support in Citrix XenServer 6.2 Service Pack 1 and earlier has unspecified impact and attack vec (no CVSS)
- [CVE-2014-4948](https://cve.now/CVE-2014-4948.md): Unspecified vulnerability in Citrix XenServer 6.2 Service Pack 1 and earlier allows attackers to cause a denial of service and obtain sensit (no CVSS)
- [CVE-2013-7392](https://cve.now/CVE-2013-7392.md): Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/. (no CVSS)
- [CVE-2014-2385](https://cve.now/CVE-2014-2385.md): Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject ar (no CVSS)
- [CVE-2014-4326](https://cve.now/CVE-2014-4326.md): Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) za (no CVSS, logstash)
- [CVE-2014-4511](https://cve.now/CVE-2014-4511.md): Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request (no CVSS)
- [CVE-2014-4911](https://cve.now/CVE-2014-4911.md): The ssl\_decrypt\_buf function in library/ssl\_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial (no CVSS)
- [CVE-2014-5019](https://cve.now/CVE-2014-5019.md): The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP (no CVSS)
- [CVE-2014-5020](https://cve.now/CVE-2014-5020.md): The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with ce (no CVSS)
- [CVE-2014-5021](https://cve.now/CVE-2014-5021.md): Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated (no CVSS)
- [CVE-2014-5022](https://cve.now/CVE-2014-5022.md): Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2014-5023](https://cve.now/CVE-2014-5023.md): Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary commands via shell metacha (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-07-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.