Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Johnson Controls System Configuration Tool (SCT) 14.2.3, 15.0.3 Clear all filters
TI-2022-06304 CVE-2022-21940 · GHSA-hp26-q6wq-vrfp

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)

Priority LOW 35

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00372 Published 2023-02-09 Fixed in 14.2.3, 15.0.3 CWE-614
TI-2022-06303 CVE-2022-21939 · GHSA-mw9r-vp4h-34mp

Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)

Priority LOW 36

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00546 Published 2023-02-09 Fixed in 14.2.3, 15.0.3 CWE-1004