# CVEs published 2018-04-30

29 CVEs were published on April 30, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-1000172](https://cve.now/CVE-2018-1000172.md): Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. (no CVSS)
- [CVE-2018-10575](https://cve.now/CVE-2018-10575.md): An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. (no CVSS)
- [CVE-2018-10576](https://cve.now/CVE-2018-10576.md): An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. (no CVSS)
- [CVE-2018-10364](https://cve.now/CVE-2018-10364.md): BigTree before 4.2.22 has XSS in the Users management page via the name or company field. (no CVSS)
- [CVE-2018-10574](https://cve.now/CVE-2018-10574.md): site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the B (no CVSS)
- [CVE-2018-1183](https://cve.now/CVE-2018-1183.md): In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8 (no CVSS, Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC Sol…)
- [CVE-2018-1277](https://cve.now/CVE-2018-1277.md): Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. (no CVSS, Cloud Foundry Garden-runC)
- [CVE-2018-1102](https://cve.now/CVE-2018-1102.md): A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. (no CVSS, Red Hat atomic-openshift)
- [CVE-2018-5234](https://cve.now/CVE-2018-5234.md): The Norton Core router prior to v237 may be susceptible to a command injection exploit. (no CVSS, Symantec Norton Core)
- [CVE-2018-10571](https://cve.now/CVE-2018-10571.md): Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2018-10572](https://cve.now/CVE-2018-10572.md): interface/patient\_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the n (no CVSS)
- [CVE-2018-10573](https://cve.now/CVE-2018-10573.md): interface/fax/fax\_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan (no CVSS)
- [CVE-2018-9310](https://cve.now/CVE-2018-9310.md): An issue was discovered in MagniComp SysInfo before 10-H82 if setuid root (the default). (no CVSS)
- [CVE-2018-10570](https://cve.now/CVE-2018-10570.md): Frog CMS 0.9.5 has XSS in /install/index.php via the \['config'\]\['admin\_username'\] field. (no CVSS)
- [CVE-2017-9657](https://cve.now/CVE-2017-9657.md): Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the centra (no CVSS, Philips IntelliVue MX40 Patient Worn Monitor)
- [CVE-2017-9658](https://cve.now/CVE-2017-9658.md): Certain 802.11 network management messages have been determined to invoke wireless access point blacklisting security defenses when not requ (no CVSS, Philips IntelliVue MX40 Patient Worn Monitor)
- [CVE-2018-7891](https://cve.now/CVE-2018-7891.md): The Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) 2016 R1 (10.0.a) to 2018 R1 (12.1a (no CVSS)
- [CVE-2018-8839](https://cve.now/CVE-2018-8839.md): Delta PMSoft versions 2.10 and prior have multiple stack-based buffer overflow vulnerabilities where a .ppm file can introduce a value large (no CVSS, Delta Electronics PMSoft)
- [CVE-2017-17314](https://cve.now/CVE-2017-17314.md): Huawei DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V6 (no CVSS, Huawei Technologies Co. DP300, RP200, TE30, TE40, TE50, TE60)
- [CVE-2017-17318](https://cve.now/CVE-2017-17318.md): Huawei MBB (Mobile Broadband) products E5771h-937 with the versions before E5771h-937TCPU-V200R001B328D62SP00C1133 and the versions before E (no CVSS, Huawei Technologies Co. E5771h-937)
- [CVE-2018-1389](https://cve.now/CVE-2018-1389.md): IBM API Connect 5.0.0.0 through 5.0.8.2 is impacted by generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship allowing (no CVSS, IBM API Connect)
- [CVE-2018-1430](https://cve.now/CVE-2018-1430.md): IBM API Connect 5.0.0.0 through 5.0.8.2 is vulnerable to cross-site scripting. (no CVSS, IBM API Connect)
- [CVE-2018-7901](https://cve.now/CVE-2018-7901.md): RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions ear (no CVSS, Huawei Technologies Co. ALP-AL00B, BLA-AL00B)
- [CVE-2017-18262](https://cve.now/CVE-2017-18262.md): Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for han (no CVSS)
- [CVE-2018-0711](https://cve.now/CVE-2018-0711.md): Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow (no CVSS, QNAP QTS)
- [CVE-2017-2591](https://cve.now/CVE-2017-2591.md): 389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness\_entry\_to\_config() function in the "a (CVSS 3.7, 389-ds-base)
- [CVE-2018-10550](https://cve.now/CVE-2018-10550.md): In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to (no CVSS)
- [CVE-2018-10553](https://cve.now/CVE-2018-10553.md): An issue was discovered in Nagios XI 5.4.13. (no CVSS)
- [CVE-2018-10554](https://cve.now/CVE-2018-10554.md): An issue was discovered in Nagios XI 5.4.13. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.