CVE-2024-23784

The CVE-2024-23784 issue affects SHARP Energy Management Controller with Cloud Services (JH-RVB1/JH-RV11) up to Ver.B0.1.9.1, where improper access control could allow a network-adjacent, unauthenticated attacker to view a username and its hashed password on the product’s management page. The SHA...

CVE-2024-23784

Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a network-adjacent unauthenticated attacker to obtain a username and its hashed password displayed on the management page of the affected...

CVE-2024-23784

Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a network-adjacent unauthenticated attacker to obtain a username and its hashed password displayed on the management page of the affected...

CVE-2024-23783

Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to access the affected product without authentication...

CVE-2024-23783

CVE-2024-23783 affects Sharp Energy Management Controller with Cloud Services (JH-RVB1/JH-RV11) up to Ver.B0.1.9.1. The vulnerability is described as improper authentication allowing a network-adjacent unauthenticated attacker to access the product without authentication. Public sources in the co...

CVE-2024-23783

Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to access the affected product without authentication...

PT-2024-20088

Name of the Vulnerable Software and Affected Versions Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier Description The issue allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command on the affected product. Recommendation...

CVE-2024-23789: Improper Neutralization of Special Elements used in an OS Command

Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command on the affected product...

CVE-2024-23784: Undefined Security Weakness

Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a network-adjacent unauthenticated attacker to obtain a username and its hashed password displayed on the management page of the affected...

CVE-2024-23785: Cross-Site Request Forgery (CSRF)

Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthenticated attacker to change the product settings...

CVE-2024-23783: Missing Authentication for Critical Function

Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to access the affected product without authentication...

CVE-2024-23787: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to obtain an arbitrary file in the affected product...

CVE-2024-23788: Server-Side Request Forgery (SSRF)

Server-side request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to send an arbitrary HTTP request GET from the affected product...

CVE-2024-23786: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the management page of the affected...

PT-2024-3009 · Uamqp +2 · Uamqp +2

Name of the Vulnerable Software and Affected Versions: uAMQP affected versions not specified Description: The uAMQP library, used for AMQP 1.0 communication to Azure Cloud Services, contains an error related to the incorrect processing of an AMQP VALUE failed state, which may cause a double free...

PT-2024-20087

Name of the Vulnerable Software and Affected Versions Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier Description A server-side request forgery issue allows a network-adjacent unauthenticated attacker to send an arbitrary HTTP request GET from the...

PT-2024-20083

Name of the Vulnerable Software and Affected Versions Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier Description An improper access control issue exists, potentially allowing a network-adjacent unauthenticated attacker to obtain a username and its...

PT-2024-20084 · Unknown · Energy Management Controller With Cloud Services

Name of the Vulnerable Software and Affected Versions: Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier Description: A cross-site request forgery issue allows a remote unauthenticated attacker to change the product settings. Recommendations: For...

PT-2024-20082

Name of the Vulnerable Software and Affected Versions Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier Description The issue allows a network-adjacent unauthenticated attacker to access the affected product without authentication. This is due to an...

PT-2024-20085

Name of the Vulnerable Software and Affected Versions SHARP Energy Management Controller with Cloud Services versions B0.1.9.1 and earlier Description A cross-site scripting issue allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user...