CVEs published April 30, 2018
29 CVEs were published on April 30, 2018: 0 critical, 0 high.
- Published
- 29
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 1
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- IBM API Connect
- 2
- Philips IntelliVue MX40 Patient Worn Monitor
- 2
- 389-ds-base
- 1
- Cloud Foundry Garden-runC
- 1
- Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC Sol…
- 1
- Delta Electronics PMSoft
- 1
- Huawei Technologies Co. ALP-AL00B, BLA-AL00B
- 1
- Huawei Technologies Co. DP300, RP200, TE30, TE40, TE50, TE60
- 1
- Huawei Technologies Co. E5771h-937
- 1
- QNAP QTS
- 1
Medium, low and unrated 29
- CVE-2018-1000172Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text.
- CVE-2018-10575An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15.
- CVE-2018-10576An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15.
- CVE-2018-10364BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
- CVE-2018-10574site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the B
- CVE-2018-1183In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC Sol…
- CVE-2018-1277Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers.Cloud Foundry Garden-runC
- CVE-2018-1102A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x.Red Hat atomic-openshift
- CVE-2018-5234The Norton Core router prior to v237 may be susceptible to a command injection exploit.Symantec Norton Core
- CVE-2018-10571Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script
- CVE-2018-10572interface/patient_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the n
- CVE-2018-10573interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan
- CVE-2018-9310An issue was discovered in MagniComp SysInfo before 10-H82 if setuid root (the default).
- CVE-2018-10570Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.
- CVE-2017-9657Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the centraPhilips IntelliVue MX40 Patient Worn Monitor
- CVE-2017-9658Certain 802.11 network management messages have been determined to invoke wireless access point blacklisting security defenses when not requPhilips IntelliVue MX40 Patient Worn Monitor
- CVE-2018-7891The Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) 2016 R1 (10.0.a) to 2018 R1 (12.1a
- CVE-2018-8839Delta PMSoft versions 2.10 and prior have multiple stack-based buffer overflow vulnerabilities where a .ppm file can introduce a value largeDelta Electronics PMSoft
- CVE-2017-17314Huawei DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V6Huawei Technologies Co. DP300, RP200, TE30, TE40, TE50, TE60
- CVE-2017-17318Huawei MBB (Mobile Broadband) products E5771h-937 with the versions before E5771h-937TCPU-V200R001B328D62SP00C1133 and the versions before EHuawei Technologies Co. E5771h-937
- CVE-2018-1389IBM API Connect 5.0.0.0 through 5.0.8.2 is impacted by generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship allowingIBM API Connect
- CVE-2018-1430IBM API Connect 5.0.0.0 through 5.0.8.2 is vulnerable to cross-site scripting.IBM API Connect
- CVE-2018-7901RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions earHuawei Technologies Co. ALP-AL00B, BLA-AL00B
- CVE-2017-18262Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for han
- CVE-2018-0711Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow QNAP QTS
- CVE-2017-2591389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "a389-ds-base
- CVE-2018-10550In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to
- CVE-2018-10553An issue was discovered in Nagios XI 5.4.13.
- CVE-2018-10554An issue was discovered in Nagios XI 5.4.13.