# CVEs published 2024-04-14

14 CVEs were published on April 14, 2024: 3 critical, 7 high. Days are UTC.

- [CVE-2024-29844](https://cve.now/CVE-2024-29844.md): Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions (CVSS 9.8, CS Technologies Australia Evolution Controller)
- [CVE-2024-29843](https://cve.now/CVE-2024-29843.md): Broken Access control on MOBILE\_GET\_USERS\_LIST in Evolution Controller allows unauthenticated user enumeration (CVSS 7.5, CS Technologies Australia Evolution Controller)
- [CVE-2024-29842](https://cve.now/CVE-2024-29842.md): Broken Access control on DESKTOP\_EDIT\_USER\_GET\_ABACARD\_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve ABACARD values (CVSS 7.5, CS Technologies Australia Evolution Controller)
- [CVE-2024-29841](https://cve.now/CVE-2024-29841.md): Broken Access control on DESKTOP\_EDIT\_USER\_GET\_KEYS\_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve keys values (CVSS 7.5, CS Technologies Australia Evolution Controller)
- [CVE-2024-29840](https://cve.now/CVE-2024-29840.md): Broken Access control on DESKTOP\_EDIT\_USER\_GET\_PIN\_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve PIN field values (CVSS 7.5, CS Technologies Australia Evolution Controller)
- [CVE-2024-29839](https://cve.now/CVE-2024-29839.md): Broken Access control on DESKTOP\_EDIT\_USER\_GET\_CARD in Evolution Controller allows unauthenticated attackers to retrieve card data values. (CVSS 7.5, CS Technologies Australia Evolution Controller)
- [CVE-2024-29838](https://cve.now/CVE-2024-29838.md): Unsanitised variable on DAL\_ADD in Evolution Controller causes application level denial of service and crash (CVSS 7.5, CS Technologies Australia Evolution Controller)
- [CVE-2024-29837](https://cve.now/CVE-2024-29837.md): Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections (CVSS 8.8, CS Technologies Australia Evolution Controller)
- [CVE-2024-29836](https://cve.now/CVE-2024-29836.md): Broken Authentication on USER\_CHANGE in Evolution Controller allows unauthenticated account creation and takeover (CVSS 9.8, CS Technologies Australia Evolution Controller)
- [CVE-2024-3766](https://cve.now/CVE-2024-3766.md): slowlyo OwlAdmin Image File Upload upload\_image cross site scripting (CVSS 2.4, slowlyo OwlAdmin)
- [CVE-2024-3765](https://cve.now/CVE-2024-3765.md): Xiongmai AHB7804R-MH-V2 Sofia Service access control (CVSS 9.8, Xiongmai AHB7804R-MH-V2 · Xiongmai AHB8004T-GL +5)
- [CVE-2024-3764](https://cve.now/CVE-2024-3764.md): Tuya SDK MQTT Packet denial of service (CVSS 2.7, Tuya SDK)
- [CVE-2024-3763](https://cve.now/CVE-2024-3763.md): Emlog Pro Post Tag tag.php cross site scripting (CVSS 2.4, Emlog Pro)
- [CVE-2024-3762](https://cve.now/CVE-2024-3762.md): Emlog Pro Whisper Page twitter.php cross site scripting (CVSS 2.4, Emlog Pro)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.