CVEs (4)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Johnsoncontrols 1Metasys System Configuration Tool Jun 17, 2026 Feb 9, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie. |
1Johnsoncontrols 1Metasys System Configuration Tool Jun 17, 2026 Feb 9, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie. |
1Johnsoncontrols 1Metasys System Configuration Tool Jun 17, 2026 Apr 22, 2022 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request. |
1Johnsoncontrols 13Metasys Application And Data Server Metasys Extended Application And Data ServerMetasys Lonworks Control Server+10 moreJun 17, 2026 Mar 10, 2020 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Se...Show more |