CVEs published April 14, 2024
14 CVEs were published on April 14, 2024: 3 critical, 7 high.
- Published
- 14
- Critical
- 3
- High
- 7
- Medium
- 0
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- CS Technologies Australia Evolution Controller
- 9
- Emlog Pro
- 2
- slowlyo OwlAdmin
- 1
- Tuya SDK
- 1
- Xiongmai AHB7804R-MH-V2 · Xiongmai AHB8004T-GL +5
- 1
Critical 3
- CVE-2024-29844Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functionsCS Technologies Australia Evolution Controller
- CVE-2024-29836Broken Authentication on USER_CHANGE in Evolution Controller allows unauthenticated account creation and takeoverCS Technologies Australia Evolution Controller
- CVE-2024-3765Xiongmai AHB7804R-MH-V2 Sofia Service access controlXiongmai AHB7804R-MH-V2 · Xiongmai AHB8004T-GL +5
High 7
- CVE-2024-29843Broken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumerationCS Technologies Australia Evolution Controller
- CVE-2024-29842Broken Access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve ABACARD values CS Technologies Australia Evolution Controller
- CVE-2024-29841Broken Access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve keys values CS Technologies Australia Evolution Controller
- CVE-2024-29840Broken Access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve PIN field valuesCS Technologies Australia Evolution Controller
- CVE-2024-29839Broken Access control on DESKTOP_EDIT_USER_GET_CARD in Evolution Controller allows unauthenticated attackers to retrieve card data values.CS Technologies Australia Evolution Controller
- CVE-2024-29838Unsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crashCS Technologies Australia Evolution Controller
- CVE-2024-29837Poor session management in Evolution Controller allows administrator functionality for unauthenticated connectionsCS Technologies Australia Evolution Controller
Medium, low and unrated 4
- CVE-2024-3766slowlyo OwlAdmin Image File Upload upload_image cross site scriptingslowlyo OwlAdmin
- CVE-2024-3764Tuya SDK MQTT Packet denial of serviceTuya SDK
- CVE-2024-3763Emlog Pro Post Tag tag.php cross site scriptingEmlog Pro
- CVE-2024-3762Emlog Pro Whisper Page twitter.php cross site scriptingEmlog Pro