Skip to contentJohnson Controls Metasys vulnerabilities
- johnson controls metasys 14, metasys 15 +1 moreImproper neutralization of input during web page generation ('cross-site scripting')...CVE-2026-344916.1 Medium
- johnson controls metasysMetasys product command injection vulnerability could allow remote SQL executionCVE-2025-263859.5 Critical
- johnson controls facility explorer f4-snc, metasys nae55/sne/snc, johnsoncontrols f4-snc firmware +9 more +11 moreUncontrolled Resource Consumption in Metasys and Facility ExplorerCVE-2023-44867.5 High
- johnson controls metasys ads/adx/oas, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreInsufficiently Protected Credentials in MetasysCVE-2021-362047.8 High
- johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreMetasys ADS/ADX/OAS with MUICVE-2021-362005.3 Medium
- johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreMetasys MUI Graphics XSSCVE-2022-219388.1 High
- johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreMetasys password guessingCVE-2022-219357.5 High
- johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreMetasys CSSCVE-2022-219378.7 High
- johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreMetasys Unverified Password ChangeCVE-2022-219348.0 High
- johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreMetasys privilege managementCVE-2021-362078.8 High
- johnson controls metasys, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreMetasys session tokenCVE-2021-362058.1 High
- johnson controls metasys, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 moreMetasys UICVE-2021-362028.4 High
- johnson controls metasysMetasys Improper Privilege ManagementCVE-2021-276578.8 High
- johnsoncontrols metasys reporting engine, johnson controls metasys reporting engine (mre) web services versions 2.0 and 2.1 +1 moreMetasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2020-90507.5 High
- johnnson controls metasys system configuration tool (sct), johnson controls metasys application and data server (ads, ads-lite), metasys extended application and data server (adx) +20 more +22 moreMetasys Improper Restriction of XML External Entity ReferenceCVE-2020-90447.5 High
- johnson controls metasys versions prior to 9.0, johnsoncontrols metasys system +1 moreMetasys use of hardcoded RC2 keyCVE-2019-75946.8 Medium
- johnson controls metasys versions prior to 9.0, johnsoncontrols metasys system +1 moreMetasys use of shared RSA key pairsCVE-2019-75936.8 Medium
- johnson controls bcpro (bcm), metasys system, johnsoncontrols bcpro +2 moreJohnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive InformationCVE-2018-106244.3 Medium