Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Johnson Controls Metasys ADS/ADX/OAS server 10.1.5, 11.0.2 Clear all filters
TI-2022-06302 CVE-2022-21938 · GHSA-3279-q5c5-7rr6

Metasys MUI Graphics XSS

Priority LOW 36

Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the MUI Graphics web in…

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00551 Published 2022-06-15 Fixed in 10.1.5, 11.0.2 CWE-79
TI-2022-06299 CVE-2022-21935 · GHSA-77fh-mgrj-x7vc

Metasys password guessing

Priority LOW 35

A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change.

CVSS 3.1HIGH 7.5 Adjacent network No auth No interaction EPSS 0.00994 Published 2022-06-15 Fixed in 10.1.5, 11.0.2 CWE-620
TI-2022-06301 CVE-2022-21937 · GHSA-6p3q-m7x8-x9pq

Cross-site scripting in Johnson Controls Metasys ADS/ADX/OAS server

Priority LOW 38

Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the web interface.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00592 Published 2022-06-15 Fixed in 10.1.5, 11.0.2 CWE-79