Vulnerabilities > Johnsoncontrols
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-07-01 | CVE-2021-27660 | Improper Input Validation vulnerability in Johnsoncontrols C-Cure 9000 Firmware 2.70 An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs. | 8.8 |
| 2021-07-01 | CVE-2021-27661 | Incorrect Authorization vulnerability in Johnsoncontrols F4-Snc Firmware 11 Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC. | 8.8 |
| 2021-06-24 | CVE-2021-27658 | Cross-site Scripting vulnerability in Johnsoncontrols Exacqvision Enterprise Manager 20.06.4.0/20.12 exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users. | 5.4 |
| 2021-06-24 | CVE-2021-27659 | Cross-site Scripting vulnerability in Johnsoncontrols Exacqvision web Service 20.06.11.0/20.06.3.0/21.03 exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users. | 6.1 |
| 2021-06-04 | CVE-2021-27657 | Improper Privilege Management vulnerability in Johnsoncontrols Metasys 11.0 Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. | 8.8 |
| 2021-03-18 | CVE-2021-27656 | Missing Authorization vulnerability in Johnsoncontrols Exacqvision web Service 20.06.11.0/20.06.3.0 A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system. | 7.5 |
| 2021-02-19 | CVE-2020-9050 | Path Traversal vulnerability in Johnsoncontrols Metasys Reporting Engine 2.0/2.1 Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system. | 7.5 |
| 2020-11-19 | CVE-2020-9049 | Improper Authentication vulnerability in Johnsoncontrols C-Cure web and Victor web A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. | 5.3 |
| 2020-10-08 | CVE-2020-9048 | Incorrect Permission Assignment for Critical Resource vulnerability in multiple products A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack. | 8.1 |
| 2020-06-26 | CVE-2020-9047 | Improper Verification of Cryptographic Signature vulnerability in Johnsoncontrols products A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. | 7.2 |