Read the docs

Johnson Controls

Records126All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical25CVSS 9.0–10.0
CVSS high65CVSS 7.0–8.9

Exploited now

Johnson Controls records in CISA KEV

No Johnson Controls vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Metasys Extended Application And Data Server 11 records MEDIUM Metasys Application And Data Server 10 records MEDIUM Metasys Open Application Server 10 records MEDIUM Exacqvision Web Service 8 records MEDIUM Frick Controls Quantum Hd Firmware 6 records MEDIUM Exacqvision Server 4 records MEDIUM Metasys System Configuration Tool 4 records MEDIUM C-cure 9000 Firmware 3 records MEDIUM

Records

8 records in Exacqvision Web Service · all components

TI-2020-07263 CVE-2020-9047 · GHSA-jhjw-25g5-p452

exacqVision Software - Improper Verification of Cryptographic Signature

Priority MEDIUM 42

A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0777 Published 2020-06-26 No fix listed CWE-347
TI-2024-21735 CVE-2024-32863 · GHSA-frwc-xr7f-wxx2

exacqVison - CSRF issues with Web Service

Priority LOW 39

Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF)

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00204 Published 2024-08-01 No fix listed CWE-352
TI-2024-21734 CVE-2024-32862 · GHSA-cvv3-vch8-mp39

exacqVision CORS

Priority LOW 38

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00431 Published 2024-08-01 No fix listed CWE-942
TI-2021-09104 CVE-2021-27656 · GHSA-4v7v-2c44-w644

exacqVision Web Services - Information Exposure

Priority LOW 36

A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01336 Published 2021-03-18 No fix listed CWE-862
TI-2024-21736 CVE-2024-32864 · GHSA-x65v-v924-92w9

exacqVison - HTTPS Session Establishment

Priority LOW 35

Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS)

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00222 Published 2024-08-01 No fix listed CWE-319
TI-2021-09107 CVE-2021-27659 · GHSA-6h9h-w393-9gcp

exacqVision Web Service CSS

Priority LOW 30

exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01222 Published 2021-06-24 No fix listed CWE-79
TI-2024-21801 CVE-2024-32931 · GHSA-hqf8-3w52-4344

exacqVison - Token Disclosed in URL

Priority LOW 26

Under certain circumstances the exacqVision Web Service can expose authentication token details within communications.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00376 Published 2024-08-01 No fix listed CWE-598
Open these records in search →