# CVEs published 2018-04-30

29 CVEs were published on April 30, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-1000172](https://cve.now/CVE-2018-1000172.md): Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. (no CVSS)
- [CVE-2018-10575](https://cve.now/CVE-2018-10575.md): An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. (no CVSS)
- [CVE-2018-10576](https://cve.now/CVE-2018-10576.md): An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. (no CVSS)
- [CVE-2018-10364](https://cve.now/CVE-2018-10364.md): BigTree before 4.2.22 has XSS in the Users management page via the name or company field. (no CVSS)
- [CVE-2018-10574](https://cve.now/CVE-2018-10574.md): site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the… (no CVSS)
- [CVE-2018-1183](https://cve.now/CVE-2018-1183.md): In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to… (no CVSS, Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC Sol…)
- [CVE-2018-1277](https://cve.now/CVE-2018-1277.md): Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. (no CVSS, Cloud Foundry Garden-runC)
- [CVE-2018-1102](https://cve.now/CVE-2018-1102.md): A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. (no CVSS, Red Hat atomic-openshift)
- [CVE-2018-5234](https://cve.now/CVE-2018-5234.md): The Norton Core router prior to v237 may be susceptible to a command injection exploit. (no CVSS, Symantec Norton Core)
- [CVE-2018-10571](https://cve.now/CVE-2018-10571.md): Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2018-10572](https://cve.now/CVE-2018-10572.md): interface/patient\_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the… (no CVSS)
- [CVE-2018-10573](https://cve.now/CVE-2018-10573.md): interface/fax/fax\_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the… (no CVSS)
- [CVE-2018-9310](https://cve.now/CVE-2018-9310.md): An issue was discovered in MagniComp SysInfo before 10-H82 if setuid root (the default). (no CVSS)
- [CVE-2018-10570](https://cve.now/CVE-2018-10570.md): Frog CMS 0.9.5 has XSS in /install/index.php via the \['config'\]\['admin\_username'\] field. (no CVSS)
- [CVE-2017-9657](https://cve.now/CVE-2017-9657.md): Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the… (no CVSS, Philips IntelliVue MX40 Patient Worn Monitor)
- [CVE-2017-9658](https://cve.now/CVE-2017-9658.md): Certain 802.11 network management messages have been determined to invoke wireless access point blacklisting security defenses when not… (no CVSS, Philips IntelliVue MX40 Patient Worn Monitor)
- [CVE-2018-7891](https://cve.now/CVE-2018-7891.md): The Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) 2016 R1 (10.0.a) to 2018 R1… (no CVSS)
- [CVE-2018-8839](https://cve.now/CVE-2018-8839.md): Delta PMSoft versions 2.10 and prior have multiple stack-based buffer overflow vulnerabilities where a .ppm file can introduce a value… (no CVSS, Delta Electronics PMSoft)
- [CVE-2017-17314](https://cve.now/CVE-2017-17314.md): Huawei DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00… (no CVSS, Huawei Technologies Co. DP300, RP200, TE30, TE40, TE50, TE60)
- [CVE-2017-17318](https://cve.now/CVE-2017-17318.md): Huawei MBB (Mobile Broadband) products E5771h-937 with the versions before E5771h-937TCPU-V200R001B328D62SP00C1133 and the versions before… (no CVSS, Huawei Technologies Co. E5771h-937)
- [CVE-2018-1389](https://cve.now/CVE-2018-1389.md): IBM API Connect 5.0.0.0 through 5.0.8.2 is impacted by generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship… (no CVSS, IBM API Connect)
- [CVE-2018-1430](https://cve.now/CVE-2018-1430.md): IBM API Connect 5.0.0.0 through 5.0.8.2 is vulnerable to cross-site scripting. (no CVSS, IBM API Connect)
- [CVE-2018-7901](https://cve.now/CVE-2018-7901.md): RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions… (no CVSS, Huawei Technologies Co. ALP-AL00B, BLA-AL00B)
- [CVE-2017-18262](https://cve.now/CVE-2017-18262.md): Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for… (no CVSS)
- [CVE-2018-0711](https://cve.now/CVE-2018-0711.md): Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could… (no CVSS, QNAP QTS)
- [CVE-2017-2591](https://cve.now/CVE-2017-2591.md): 389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness\_entry\_to\_config() function in the… (CVSS 3.7, 389-ds-base)
- [CVE-2018-10550](https://cve.now/CVE-2018-10550.md): In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access… (no CVSS)
- [CVE-2018-10553](https://cve.now/CVE-2018-10553.md): An issue was discovered in Nagios XI 5.4.13. (no CVSS)
- [CVE-2018-10554](https://cve.now/CVE-2018-10554.md): An issue was discovered in Nagios XI 5.4.13. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-04-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.