Johnsoncontrols Metasys vulnerabilities

• johnson controls system configuration tool (sct), johnsoncontrols metasys system configuration tool +1 more Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT) CVE-2022-21940 7.5 HighFebruary 9, 2023
• johnson controls system configuration tool (sct), johnsoncontrols metasys system configuration tool +1 more Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT) CVE-2022-21939 7.5 HighFebruary 9, 2023
• johnson controls metasys ads/adx/oas, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 more Insufficiently Protected Credentials in Metasys CVE-2021-36204 7.8 HighJanuary 13, 2023
• johnsoncontrols metasys extended application and data server Metasys MVE CVE-2022-21936 8.1 HighOctober 7, 2022
• johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 more Metasys ADS/ADX/OAS with MUI CVE-2021-36200 5.3 MediumJuly 22, 2022
• johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 more Metasys MUI Graphics XSS CVE-2022-21938 8.1 HighJune 15, 2022
• johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 more Metasys password guessing CVE-2022-21935 7.5 HighJune 15, 2022
• johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 more Metasys CSS CVE-2022-21937 8.7 HighJune 15, 2022
• johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 more Metasys Unverified Password Change CVE-2022-21934 8.0 HighMay 6, 2022
• johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 more Metasys privilege management CVE-2021-36207 8.8 HighApril 29, 2022
• johnnson controls metasys system configuration tool (sct), metasys system configuration tool pro (sct pro), johnsoncontrols metasys system configuration tool +2 more Johnson Controls Metasys SCT Pro CVE-2021-36203 5.3 MediumApril 22, 2022
• johnson controls metasys, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 more Metasys session token CVE-2021-36205 8.1 HighApril 15, 2022
• johnson controls metasys, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 more Metasys UI CVE-2021-36202 8.4 HighApril 7, 2022
• johnson controls metasys Metasys Improper Privilege Management CVE-2021-27657 8.8 HighJune 4, 2021
• johnsoncontrols metasys reporting engine, johnson controls metasys reporting engine (mre) web services versions 2.0 and 2.1 +1 more Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2020-9050 7.5 HighFebruary 19, 2021
• johnnson controls metasys system configuration tool (sct), johnson controls metasys application and data server (ads, ads-lite), metasys extended application and data server (adx) +20 more +22 more Metasys Improper Restriction of XML External Entity Reference CVE-2020-9044 7.5 HighMarch 10, 2020
• johnson controls metasys versions prior to 9.0, johnsoncontrols metasys system +1 more Metasys use of hardcoded RC2 key CVE-2019-7594 6.8 MediumAugust 20, 2019
• johnson controls metasys versions prior to 9.0, johnsoncontrols metasys system +1 more Metasys use of shared RSA key pairs CVE-2019-7593 6.8 MediumAugust 20, 2019
• johnson controls bcpro (bcm), metasys system, johnsoncontrols bcpro +2 more Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information CVE-2018-10624 4.3 MediumAugust 1, 2018