# CVEs published 2017-06-30

35 CVEs were published on June 30, 2017: 3 critical, 0 high. Days are UTC.

- [CVE-2017-2292](https://cve.now/CVE-2017-2292.md): Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe\_load, allowing the potential for arbitrary code e (no CVSS, mcollective, Puppet, Puppet Enterprise)
- [CVE-2017-2298](https://cve.now/CVE-2017-2298.md): The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. (no CVSS, Puppet mcollective)
- [CVE-2017-8443](https://cve.now/CVE-2017-8443.md): In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperl (no CVSS, Elastic Kibana X-Pack Security)
- [CVE-2017-10709](https://cve.now/CVE-2017-10709.md): The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature b (no CVSS)
- [CVE-2015-9102](https://cve.now/CVE-2015-9102.md): Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authe (no CVSS, Synology Photo Station)
- [CVE-2015-9103](https://cve.now/CVE-2015-9103.md): Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to in (no CVSS, Synology Note Station)
- [CVE-2015-9104](https://cve.now/CVE-2015-9104.md): Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated (no CVSS, Synology Audio Station)
- [CVE-2015-9105](https://cve.now/CVE-2015-9105.md): Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0 (no CVSS, Synology Video Station)
- [CVE-2017-10674](https://cve.now/CVE-2017-10674.md): Antiy Antivirus Engine 5.0.0.06281654 allows local users to cause a denial of service (BSOD) via a long third argument in a DeviceIoControl (no CVSS)
- [CVE-2017-10699](https://cve.now/CVE-2017-10699.md): avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy( (no CVSS)
- [CVE-2017-10668](https://cve.now/CVE-2017-10668.md): A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). (no CVSS)
- [CVE-2017-10669](https://cve.now/CVE-2017-10669.md): Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). (no CVSS)
- [CVE-2017-10670](https://cve.now/CVE-2017-10670.md): An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1. (no CVSS)
- [CVE-2016-9358](https://cve.now/CVE-2016-9358.md): A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A32 (no CVSS, Marel Food Processing Systems)
- [CVE-2017-6017](https://cve.now/CVE-2017-6017.md): A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR020 (no CVSS, Schneider Electric Modicon M340 PLC)
- [CVE-2017-6018](https://cve.now/CVE-2017-6018.md): An open redirect issue was discovered in B. (no CVSS, B. Braun Medical SpaceCom)
- [CVE-2017-6022](https://cve.now/CVE-2017-6022.md): A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Jour (no CVSS, BD Kiestra PerformA and KLA Journal Service)
- [CVE-2017-6026](https://cve.now/CVE-2017-6026.md): A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Versi (no CVSS, Schneider Electric Modicon PLCs)
- [CVE-2017-6028](https://cve.now/CVE-2017-6028.md): An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Mod (no CVSS, Schneider Electric Modicon PLCs)
- [CVE-2017-6030](https://cve.now/CVE-2017-6030.md): Schneider Electric Modicon PLCs Predictable Value Range from Previous Values (CVSS 6.5, Schneider Electric Modicon M221 · Schneider Electric Mod… +1)
- [CVE-2017-6032](https://cve.now/CVE-2017-6032.md): A Violation of Secure Design Principles issue was discovered in Schneider Electric Modicon Modbus Protocol. (no CVSS, Schneider Electric Modicon Modbus Protocol)
- [CVE-2017-6034](https://cve.now/CVE-2017-6034.md): Schneider Electric Modicon Modbus Protocol Authentication Bypass by Capture-replay (CVSS 9.8, Schneider Electric Modicon Modbus Protocol)
- [CVE-2017-6036](https://cve.now/CVE-2017-6036.md): A Server-Side Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. (no CVSS, Belden Hirschmann GECKO)
- [CVE-2017-6038](https://cve.now/CVE-2017-6038.md): A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. (no CVSS, Belden Hirschmann GECKO)
- [CVE-2017-6040](https://cve.now/CVE-2017-6040.md): An Information Exposure issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. (no CVSS, Belden Hirschmann GECKO)
- [CVE-2017-6041](https://cve.now/CVE-2017-6041.md): An Unrestricted Upload issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A32 (no CVSS, Marel Food Processing Systems)
- [CVE-2017-6042](https://cve.now/CVE-2017-6042.md): A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, a (no CVSS, Sierra Wireless AirLink Raven XE and XT)
- [CVE-2017-6044](https://cve.now/CVE-2017-6044.md): An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all (no CVSS, Sierra Wireless AirLink Raven XE and XT)
- [CVE-2017-6046](https://cve.now/CVE-2017-6046.md): An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink (no CVSS, Sierra Wireless AirLink Raven XE and XT)
- [CVE-2017-7898](https://cve.now/CVE-2017-7898.md): An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 progr (CVSS 9.8, Rockwell Automation Allen-Bradley MicroLogix 1100 and)
- [CVE-2017-7899](https://cve.now/CVE-2017-7899.md): An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA (no CVSS, Rockwell Automation Allen-Bradley MicroLogix 1100 and)
- [CVE-2017-7901](https://cve.now/CVE-2017-7901.md): A Predictable Value Range from Previous Values issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic (no CVSS, Rockwell Automation Allen-Bradley MicroLogix 1100 and)
- [CVE-2017-7902](https://cve.now/CVE-2017-7902.md): A "Reusing a Nonce, Key Pair in Encryption" issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic con (no CVSS, Rockwell Automation Allen-Bradley MicroLogix 1100 and)
- [CVE-2017-7903](https://cve.now/CVE-2017-7903.md): A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L (CVSS 9.8, Rockwell Automation Allen-Bradley MicroLogix 1100 and)
- [CVE-2017-7905](https://cve.now/CVE-2017-7905.md): A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions p (no CVSS, GE Multilin SR, UR, and URplus Protective Relays)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-06-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.