# CVEs published 2014-06-17 19 CVEs were published on June 17, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2013-6078](https://cve.now/CVE-2013-6078.md): The default configuration of EMC RSA BSAFE Toolkits and RSA Data Protection Manager (DPM) 20130918 uses the Dual Elliptic Curve Deterministi (no CVSS) - [CVE-2014-4038](https://cve.now/CVE-2014-4038.md): ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to (1) rtas\_errd/diag\_support.c and /tmp/get\_d (no CVSS) - [CVE-2014-4039](https://cve.now/CVE-2014-4039.md): ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, whic (no CVSS) - [CVE-2014-4040](https://cve.now/CVE-2014-4040.md): snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a wa (no CVSS) - [CVE-2014-4191](https://cve.now/CVE-2014-4191.md): The TLS implementation in EMC RSA BSAFE-C Toolkits (aka Share for C and C++) sends a long series of random bytes during use of the Dual\_EC\_D (no CVSS) - [CVE-2014-4192](https://cve.now/CVE-2014-4192.md): The Dual\_EC\_DRBG implementation in EMC RSA BSAFE-C Toolkits (aka Share for C and C++) processes certain requests for output bytes by conside (no CVSS) - [CVE-2014-4193](https://cve.now/CVE-2014-4193.md): The TLS implementation in EMC RSA BSAFE-Java Toolkits (aka Share for Java) supports the Extended Random extension during use of the Dual\_EC\_ (no CVSS) - [CVE-2014-0478](https://cve.now/CVE-2014-0478.md): APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse p (no CVSS) - [CVE-2014-3249](https://cve.now/CVE-2014-3249.md): Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes (no CVSS) - [CVE-2014-3476](https://cve.now/CVE-2014-3476.md): OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, w (no CVSS, keystone) - [CVE-2014-4044](https://cve.now/CVE-2014-4044.md): OpenAFS 1.6.8 does not properly clear the fields in the host structure, which allows remote attackers to cause a denial of service (uninitia (no CVSS) - [CVE-2014-4045](https://cve.now/CVE-2014-4045.md): The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when sub\_min\_expiry is set to zero, (no CVSS) - [CVE-2014-4046](https://cve.now/CVE-2014-4046.md): Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Ma (no CVSS) - [CVE-2014-4047](https://cve.now/CVE-2014-4047.md): Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 an (no CVSS) - [CVE-2014-4048](https://cve.now/CVE-2014-4048.md): The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminatin (no CVSS) - [CVE-2014-4187](https://cve.now/CVE-2014-4187.md): Cross-site scripting (XSS) vulnerability in signup.php in ClipBucket allows remote attackers to inject arbitrary web script or HTML via the (no CVSS) - [CVE-2014-4188](https://cve.now/CVE-2014-4188.md): Cross-site request forgery (CSRF) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and JP1/Performance Manage (no CVSS) - [CVE-2014-4189](https://cve.now/CVE-2014-4189.md): Cross-site scripting (XSS) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and JP1/Performance Management - (no CVSS) - [CVE-2014-4190](https://cve.now/CVE-2014-4190.md): Multiple heap-based buffer overflows in Huawei Campus Series Switches S3700HI, S5700, S6700, S3300HI, S5300, S6300, S9300, S7700, and LSW S9 (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-06-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.