Vendor
Johnson Controls
113 known vulnerabilities.
Products
38 results · Clear filters · Feed
-
Medium 5.3
Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retriev…
-
Medium 5.1
L4L
Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394.
-
Medium 5.6
- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affec…
-
Medium 6.3
- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resou…
-
Medium 5.6
: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abu…
-
Medium 5.6
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This i…
-
Medium 5.6
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects Eas…
-
Medium 5.0
: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-…
-
Medium 5.6
EasyIO FG
- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.0b52.
-
Medium 5.2
T2000 open debug port
Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6.
-
Medium 6.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls …
-
Medium 6.9
Simplex Incident Manager Clear Test
Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire…
-
Medium 4.8
FMS Employee Vulnerable to HTML Injection
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1.
-
Medium 4.8
FMS Employee vulnerable to XSS
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1.
-
Medium 4.8
FMS Employee Allows Upload of Unrestricted Files
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.
-
Medium 4.8
XAAP Android Data Stored in Unencrypted Database
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.
-
Medium 6.9
Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware
A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or …
-
Medium 6.5
OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)
Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information.
-
Medium 6.3
The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized …
-
Medium 6.8
exacqVision CORS
Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains.
-
Medium 5.7
exacqVison - Token Disclosed in URL
Under certain circumstances the exacqVision Web Service can expose authentication token details within communications.
-
Medium 6.4
exacqVison - TLS certificate validation
Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices.
-
Medium 6.4
exacqVison - HTTPS Session Establishment
Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS)
-
Medium 6.8
exacqVison - CSRF issues with Web Service
Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF)
-
Medium 6.8
American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interface
Under certain circumstances the web interface users credentials may be recovered by an authenticated user.
-
Medium 6.8
American Dynamics Illustra Essentials Gen 4 - Linux Credential Leak
Under certain circumstances unnecessary user details are provided within system logs
-
Medium 6.8
American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - Linux
Under certain circumstances the Linux users credentials may be recovered by an authenticated user.
-
Medium 5.0
Exposure of Sensitive Information in OpenBlue Enterprise Manager Data Collector
OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.
-
Medium 4.3
CCURE Observable Response Discrepancy
Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions.
-
Medium 5.3
Metasys ADS/ADX/OAS with MUI
Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.
-
Medium 5.3
VideoEdge
Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop.
-
Medium 5.3
exacqVision Web Service CSS
exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.
-
Medium 4.3
exacqVision Enterprise Manager CSS
exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.
-
Medium 5.3
exacqVision Web Services - Information Exposure
A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system.
-
Medium 6.8CVE-2020-9047 Public exploit
exacqVision Software - Improper Verification of Cryptographic Signature
A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with a…
-
Medium 6.8
Metasys use of hardcoded RC2 key
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).
-
Medium 6.8
Metasys use of shared RSA key pairs
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).
-
Medium 4.3
Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information
In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical info…