CVEs published June 30, 2017
35 CVEs were published on June 30, 2017: 3 critical, 0 high.
- Published
- 35
- Critical
- 3
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Rockwell Automation Allen-Bradley MicroLogix 1100 and
- 5
- Belden Hirschmann GECKO
- 3
- Sierra Wireless AirLink Raven XE and XT
- 3
- Marel Food Processing Systems
- 2
- Schneider Electric Modicon Modbus Protocol
- 2
- Schneider Electric Modicon PLCs
- 2
- B. Braun Medical SpaceCom
- 1
- BD Kiestra PerformA and KLA Journal Service
- 1
- Elastic Kibana X-Pack Security
- 1
- GE Multilin SR, UR, and URplus Protective Relays
- 1
Critical 3
- CVE-2017-6034Schneider Electric Modicon Modbus Protocol Authentication Bypass by Capture-replaySchneider Electric Modicon Modbus Protocol
- CVE-2017-7898An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 progrRockwell Automation Allen-Bradley MicroLogix 1100 and
- CVE-2017-7903A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-LRockwell Automation Allen-Bradley MicroLogix 1100 and
Medium, low and unrated 32
- CVE-2017-2292Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code emcollective, Puppet, Puppet Enterprise
- CVE-2017-2298The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written.Puppet mcollective
- CVE-2017-8443In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperlElastic Kibana X-Pack Security
- CVE-2017-10709The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature b
- CVE-2015-9102Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote autheSynology Photo Station
- CVE-2015-9103Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inSynology Note Station
- CVE-2015-9104Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticatedSynology Audio Station
- CVE-2015-9105Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0Synology Video Station
- CVE-2017-10674Antiy Antivirus Engine 5.0.0.06281654 allows local users to cause a denial of service (BSOD) via a long third argument in a DeviceIoControl
- CVE-2017-10699avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy(
- CVE-2017-10668A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET).
- CVE-2017-10669Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET).
- CVE-2017-10670An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.
- CVE-2016-9358A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A32Marel Food Processing Systems
- CVE-2017-6017A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR020Schneider Electric Modicon M340 PLC
- CVE-2017-6018An open redirect issue was discovered in B.B. Braun Medical SpaceCom
- CVE-2017-6022A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA JourBD Kiestra PerformA and KLA Journal Service
- CVE-2017-6026A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to VersiSchneider Electric Modicon PLCs
- CVE-2017-6028An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and ModSchneider Electric Modicon PLCs
- CVE-2017-6030Schneider Electric Modicon PLCs Predictable Value Range from Previous ValuesSchneider Electric Modicon M221 · Schneider Electric Mod… +1
- CVE-2017-6032A Violation of Secure Design Principles issue was discovered in Schneider Electric Modicon Modbus Protocol.Schneider Electric Modicon Modbus Protocol
- CVE-2017-6036A Server-Side Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions.Belden Hirschmann GECKO
- CVE-2017-6038A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions.Belden Hirschmann GECKO
- CVE-2017-6040An Information Exposure issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions.Belden Hirschmann GECKO
- CVE-2017-6041An Unrestricted Upload issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A32Marel Food Processing Systems
- CVE-2017-6042A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, aSierra Wireless AirLink Raven XE and XT
- CVE-2017-6044An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all Sierra Wireless AirLink Raven XE and XT
- CVE-2017-6046An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Sierra Wireless AirLink Raven XE and XT
- CVE-2017-7899An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWARockwell Automation Allen-Bradley MicroLogix 1100 and
- CVE-2017-7901A Predictable Value Range from Previous Values issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic Rockwell Automation Allen-Bradley MicroLogix 1100 and
- CVE-2017-7902A "Reusing a Nonce, Key Pair in Encryption" issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic conRockwell Automation Allen-Bradley MicroLogix 1100 and
- CVE-2017-7905A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions pGE Multilin SR, UR, and URplus Protective Relays