Skip to content
OpenAdvisories

Archive

14 April 2024

Vulnerabilities first published on this day (UTC), newest first.

← March 2024 2024 / April /14 May 2024 →
  1. 1103
  2. 2173
  3. 3232
  4. 4139
  5. 5102
  6. 640
  7. 762
  8. 8119
  9. 9387
  10. 10218
  11. 1181
  12. 12128
  13. 1316
  14. 1414
  15. 15221
  16. 16243
  17. 17298
  18. 18124
  19. 19115
  20. 206
  21. 215
  22. 2281
  23. 2364
  24. 24131
  25. 2595
  26. 26138
  27. 2727
  28. 2844
  29. 29150
  30. 3074
All Critical High Medium Low Exploited only Public exploit

14 results · Feed

  • Critical 9.8
    CVE-2024-29844

    Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions

    Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There…

    CS Technologies Australia Evolution Controller
  • High 7.5
    CVE-2024-29843

    Broken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumeration

    The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels

    CS Technologies Australia Evolution Controller
  • High 7.5
    CVE-2024-29842

    Broken Access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve ABACARD values

    The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS, allowing for an unauthenticated attacker to return the abacard field of any user

    CS Technologies Australia Evolution Controller
  • High 7.5
    CVE-2024-29841

    Broken Access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve keys values

    The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS, allowing for an unauthenticated attacker to return the keys value of any user

    CS Technologies Australia Evolution Controller
  • High 7.5
    CVE-2024-29840

    Broken Access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve PIN field values

    The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user

    CS Technologies Australia Evolution Controller
  • High 7.5
    CVE-2024-29839

    Broken Access control on DESKTOP_EDIT_USER_GET_CARD in Evolution Controller allows unauthenticated attackers to retrieve card data values.

    The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allowing for an unauthenticated attacker to return the card value data of any user

    CS Technologies Australia Evolution Controller
  • High 7.5
    CVE-2024-29838

    Unsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crash

    The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below does not proper sanitize user input, allowing for an unauthenticated attacker to crash the controller software

    CS Technologies Australia Evolution Controller
  • High 8.8
    CVE-2024-29837

    Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections

    The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.

    CS Technologies Australia Evolution Controller
  • Critical 9.8
    CVE-2024-29836

    Broken Authentication on USER_CHANGE in Evolution Controller allows unauthenticated account creation and takeover

    The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated attacker to update and add user profiles within the application, and gain full access of the site.

    CS Technologies Australia Evolution Controller
  • Low 2.4
    CVE-2024-3766

    slowlyo OwlAdmin Image File Upload upload_image cross site scripting

    A vulnerability, which was classified as problematic, has been found in slowlyo OwlAdmin up to 3.5.7. Affected by this issue is some unknown functionality of the file /admin-api/upload_image of the component Image File Upload. The manipulation of the argument…

    slowlyo OwlAdmin
  • Critical 9.8
    CVE-2024-3765

    Xiongmai AHB7804R-MH-V2 Sofia Service access control

    A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R80X30-PQ_8M. Affected by this vulnerability is an unknown functionality of the component Sofia Servic…

    Xiongmai AHB7004T-MHV2 XM530_R80X30-PQ_8M AHB8004T-GL
  • Low 2.7
    CVE-2024-3764

    Tuya SDK MQTT Packet denial of service

    ** DISPUTED ** A vulnerability classified as problematic has been found in Tuya SDK up to 5.0.x. Affected is an unknown function of the component MQTT Packet Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. T…

    Tuya SDK
  • Low 2.4
    CVE-2024-3763

    Emlog Pro Post Tag tag.php cross site scripting

    A vulnerability was found in Emlog Pro 2.2.10. It has been rated as problematic. This issue affects some unknown processing of the file /admin/tag.php of the component Post Tag Handler. The manipulation leads to cross site scripting. The attack may be initiat…

  • Low 2.4
    CVE-2024-3762

    Emlog Pro Whisper Page twitter.php cross site scripting

    A vulnerability was found in Emlog Pro 2.2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/twitter.php of the component Whisper Page. The manipulation leads to cross site scripting. The attack can be initiat…