Johnsoncontrols Metasys_system_configuration_tool
4 CVEs affecting Johnsoncontrols Metasys_system_configuration_tool. Latest disclosed: 2023-02-09. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21940 | High | 7.5 | 2023-02-09 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and v… |
CVE-2022-21939 | High | 7.5 | 2023-02-09 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 1… |
CVE-2020-9044 | High | 7.5 | 2020-03-10 | XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. T… |
CVE-2021-36203 | Medium | 5.3 | 2022-04-22 | The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request. |