Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: July 2014

61 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2013-3662
    47Plan

    Timbre SketchUp (formerly Google SketchUp) before 8 Maintenance 2 allows remote attackers to execute arbitrary code via a crafted color pale

    CriticalCVSS 9.3No exploitEPSS 31%

    google · sketchupJul 1, 2014

  • CVE-2013-3664
    46Plan

    Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color pa

    CriticalCVSS 9.3Proof of conceptEPSS 29%

    google · sketchupJul 1, 2014

  • CVE-2013-7388
    41Plan

    Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689), allows remote attack

    CriticalCVSS 9.3No exploitEPSS 13%

    google · sketchupJul 1, 2014

  • CVE-2014-0325
    42Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 3, 2014

  • CVE-2014-3538
    24Monitor

    file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial o

    MediumCVSS 5.0No exploitEPSS 11%

    christos zoulas · fileJul 3, 2014

  • CVE-2013-3993
    57Plan

    IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access un

    MediumCVSS 6.5KEVWeaponizedEPSS 4%

    ibm · infosphere biginsightsJul 7, 2014

  • CVE-2014-2617
    44Plan

    Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive informa

    CriticalCVSS 10.0No exploitEPSS 12%

    hp · universal configuration management databaseJul 7, 2014

  • CVE-2014-3300
    40Plan

    The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 10 d

    HighCVSS 7.5WeaponizedEPSS 21%

    cisco · unified cdm application softwareJul 7, 2014

  • CVE-2013-7389
    40Plan

    Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev.

    MediumCVSS 4.3WeaponizedEPSS 27%

    dlink · dir-645 firmwareJul 7, 2014

  • CVE-2014-1767
    32Monitor

    Double free vulnerability in the Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2,

    HighCVSS 7.2Proof of conceptEPSS 12%

    microsoft · windows 7Jul 8, 2014

  • CVE-2014-1824
    43Plan

    Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20

    CriticalCVSS 9.3No exploitEPSS 18%

    microsoft · windows 7Jul 8, 2014

  • CVE-2014-2785
    42Plan

    Microsoft Internet Explorer 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2786
    42Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 15%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2787
    42Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2788
    42Plan

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2789
    42Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2790
    42Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2791
    42Plan

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2792
    42Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2794
    42Plan

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2795
    42Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2797
    42Plan

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2798
    42Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2800
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2801
    44Plan

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2802
    42Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2803
    42Plan

    Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2804
    44Plan

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2806
    42Plan

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2807
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2809
    42Plan

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2813
    42Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    CriticalCVSS 9.3No exploitEPSS 16%

    microsoft · internet explorerJul 8, 2014

  • CVE-2014-2814
    21Monitor

    Microsoft Service Bus 1.1 on Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a d

    MediumCVSS 4.0No exploitEPSS 18%

    microsoft · service busJul 8, 2014

  • CVE-2014-4671
    40Plan

    Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.

    MediumCVSS 4.3WeaponizedEPSS 22%

    adobe · flash playerJul 9, 2014

  • CVE-2014-0207
    31Monitor

    The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5

    MediumCVSS 6.5No exploitEPSS 16%

    php · phpJul 9, 2014

  • CVE-2014-3478
    31Monitor

    Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.

    MediumCVSS 6.5No exploitEPSS 15%

    php · phpJul 9, 2014

  • CVE-2014-3479
    21Monitor

    The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5

    MediumCVSS 4.3No exploitEPSS 14%

    php · phpJul 9, 2014

  • CVE-2014-3480
    29Monitor

    The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, d

    MediumCVSS 6.5No exploitEPSS 11%

    php · phpJul 9, 2014

  • CVE-2014-3487
    21Monitor

    The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, doe

    MediumCVSS 4.3No exploitEPSS 14%

    php · phpJul 9, 2014

  • CVE-2014-3515
    39Monitor

    The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data

    HighCVSS 7.5No exploitEPSS 30%

    php · phpJul 9, 2014

  • CVE-2014-3888
    52Plan

    Stack-based buffer overflow in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000, CENTUM CS 3000 R3.09.50 and earlier, CENTUM VP R5.03.20 and earli

    HighCVSS 8.3WeaponizedEPSS 62%

    yokogawa · exaopcJul 10, 2014

  • CVE-2013-6117
    51Plan

    Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user cre

    HighCVSS 7.5WeaponizedEPSS 69%

    dahuasecurity · dvr firmwareJul 11, 2014

  • CVE-2014-4940
    26Monitor

    Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary

    MediumCVSS 5.0Proof of conceptEPSS 19%

    tera charts plugin project · tera-chartsJul 11, 2014

  • CVE-2014-4977
    48Plan

    Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL comman

    MediumCVSS 6.5WeaponizedEPSS 74%

    sonicwall · scrutinizerJul 16, 2014

  • CVE-2014-2477
    40Plan

    Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, a

    LowCVSS 3.6WeaponizedEPSS 7%

    oracle · vm virtualboxJul 17, 2014

  • CVE-2014-4210
    31Monitor

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers

    MediumCVSS 5.0Proof of conceptEPSS 38%

    oracle · fusion middlewareJul 17, 2014

  • CVE-2014-2623
    67This week

    Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown vectors.

    CriticalCVSS 10.0WeaponizedEPSS 90%

    hp · storage data protectorJul 17, 2014

  • CVE-2014-2364
    48Plan

    Advantech WebAccess Stack-Based Buffer Overflow

    HighCVSS 7.5WeaponizedEPSS 61%

    advantech · advantech webaccessJul 19, 2014

  • CVE-2013-4352
    20Monitor

    The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forwa

    MediumCVSS 4.3No exploitEPSS 11%

    apache · http serverJul 20, 2014

  • CVE-2014-0117
    28Monitor

    The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a deni

    MediumCVSS 4.3No exploitEPSS 35%

    apache · http serverJul 20, 2014

  • CVE-2014-0118
    28Monitor

    The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompr

    MediumCVSS 4.3No exploitEPSS 37%

    apache · http serverJul 20, 2014

  • CVE-2014-0226
    53Plan

    Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-b

    MediumCVSS 6.8Proof of conceptEPSS 85%

    apache · http serverJul 20, 2014

  • CVE-2014-0231
    33Monitor

    The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a deni

    MediumCVSS 5.0No exploitEPSS 43%

    apache · http serverJul 20, 2014

  • CVE-2014-3523
    25Monitor

    Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windo

    MediumCVSS 5.0No exploitEPSS 16%

    apache · http serverJul 20, 2014

  • CVE-2014-4511
    55Plan

    Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request

    HighCVSS 7.5WeaponizedEPSS 82%

    gitlist · gitlistJul 22, 2014

  • CVE-2014-4927
    34Monitor

    Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote atta

    HighCVSS 7.8Proof of conceptEPSS 11%

    acme · micro httpdJul 24, 2014

  • CVE-2014-2626
    43Plan

    Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows

    CriticalCVSS 9.4No exploitEPSS 19%

    hp · network virtualizationJul 26, 2014

  • CVE-2014-4971
    40Plan

    Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary me

    HighCVSS 7.2WeaponizedEPSS 23%

    microsoft · windows xpJul 26, 2014

  • CVE-2014-4725
    48Plan

    The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute

    HighCVSS 7.5WeaponizedEPSS 60%

    mailpoet · mailpoet newslettersJul 27, 2014

  • CVE-2014-5111
    26Monitor

    Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a ..

    MediumCVSS 5.0Proof of conceptEPSS 21%

    netfortris · trixboxJul 28, 2014

  • CVE-2014-3120
    89Now

    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL exp

    HighCVSS 8.1KEVWeaponizedEPSS 88%

    elastic · elasticsearchJul 28, 2014