Vulnerabilities > Johnsoncontrols > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-04-29 | CVE-2021-36207 | Improper Privilege Management vulnerability in Johnsoncontrols products Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator. | 8.8 |
| 2022-04-07 | CVE-2021-36202 | Server-Side Request Forgery (SSRF) vulnerability in Johnsoncontrols products Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. | 8.8 |
| 2021-12-06 | CVE-2021-36198 | Exposure of Resource to Wrong Sphere vulnerability in Johnsoncontrols Kantech Entrapass Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data. | 7.5 |
| 2021-10-11 | CVE-2021-27665 | Integer Overflow or Wraparound vulnerability in Johnsoncontrols Exacqvision Server 21.06.11.0 An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition. | 7.5 |
| 2021-09-15 | CVE-2021-27662 | Authentication Bypass by Capture-replay vulnerability in Johnsoncontrols Kantech Kt-1 Door Controller Firmware The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. | 8.1 |
| 2021-07-01 | CVE-2021-27660 | Improper Input Validation vulnerability in Johnsoncontrols C-Cure 9000 Firmware 2.70 An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs. | 8.8 |
| 2021-07-01 | CVE-2021-27661 | Incorrect Authorization vulnerability in Johnsoncontrols F4-Snc Firmware 11 Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC. | 8.8 |
| 2021-06-04 | CVE-2021-27657 | Improper Privilege Management vulnerability in Johnsoncontrols Metasys 11.0 Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. | 8.8 |
| 2021-03-18 | CVE-2021-27656 | Missing Authorization vulnerability in Johnsoncontrols Exacqvision web Service 20.06.11.0/20.06.3.0 A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system. | 7.5 |
| 2021-02-19 | CVE-2020-9050 | Path Traversal vulnerability in Johnsoncontrols Metasys Reporting Engine 2.0/2.1 Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system. | 7.5 |