# CVEs published 2018-07-30

14 CVEs were published on July 30, 2018: 0 critical, 4 high. Days are UTC.

- [CVE-2018-3772](https://cve.now/CVE-2018-3772.md): Concatenating unsanitized user input in the \`whereis\` npm module \< 0.4.1 allowed an attacker to execute arbitrary commands. (no CVSS, https://github.com/vvo whereis · whereis)
- [CVE-2018-3773](https://cve.now/CVE-2018-3773.md): There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the \`metascrape\` npm module \<= 3.9.2. (no CVSS, https://github.com/microlinkhq metascraper · metascraper)
- [CVE-2018-10847](https://cve.now/CVE-2018-10847.md): prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. (CVSS 4.2, \[UNKNOWN\] prosody)
- [CVE-2018-10898](https://cve.now/CVE-2018-10898.md): A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. (CVSS 8.8, \[UNKNOWN\] openstack-tripleo-heat-templates · tripleo-heat-t…)
- [CVE-2018-10883](https://cve.now/CVE-2018-10883.md): A flaw was found in the Linux kernel's ext4 filesystem. (CVSS 4.8, \[UNKNOWN\] kernel)
- [CVE-2018-10903](https://cve.now/CVE-2018-10903.md): A flaw was found in python-cryptography versions between \>=1.9.0 and \<2.3. (CVSS 7.5, \[UNKNOWN\] python-cryptography · cryptography)
- [CVE-2018-9064](https://cve.now/CVE-2018-9064.md): In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the cred (no CVSS, Lenovo Group Lenovo xClarity Administrator)
- [CVE-2018-9065](https://cve.now/CVE-2018-9065.md): In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be a (no CVSS, Lenovo Group Lenovo xClarity Administrator)
- [CVE-2018-9066](https://cve.now/CVE-2018-9066.md): In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additiona (no CVSS, Lenovo Group Lenovo xClarity Administrator)
- [CVE-2016-9597](https://cve.now/CVE-2016-9597.md): It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found (no CVSS, Red Hat libxml2)
- [CVE-2017-7482](https://cve.now/CVE-2017-7482.md): In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. (CVSS 7.1, \[UNKNOWN\] kernel:)
- [CVE-2017-7514](https://cve.now/CVE-2017-7514.md): A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. (CVSS 4.3, Red Hat Satellite)
- [CVE-2017-7518](https://cve.now/CVE-2017-7518.md): A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulatio (CVSS 5.5, \[UNKNOWN\] Kernel:)
- [CVE-2018-13280](https://cve.now/CVE-2018-13280.md): Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 all (CVSS 7.4, Synology DiskStation Manager)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-07-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.