Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Johnson Controls Component: C-cure 9000 Firmware Clear all filters
TI-2021-14617 CVE-2021-36201 · GHSA-r78m-94wm-v7cv

CCURE Observable Response Discrepancy

Priority LOW 25

Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00648 Published 2022-10-11 No fix listed CWE-204
TI-2021-09108 CVE-2021-27660 · GHSA-2cfq-h45g-8h84

Improper input validation in Johnson Controls C-CURE 9000

Priority MEDIUM 42

An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02096 Published 2021-07-01 Fixed in 2.80 CWE-20
TI-2020-07261 CVE-2020-9045 · GHSA-389j-cw3h-6fc8

Cleartext storage of sensitive information in Johnson Controls Software House C•CURE 9000…

Priority MEDIUM 44

During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0099 Published 2020-05-21 No fix listed CWE-312