exacqVision Web Service CSRF

The vulnerability of the exacqVision Web Service interface of the video surveillance system involves the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

exacqVision Web Service TLS Certificate Validation Man-in-the-Middle

The vulnerability of the exacqVision Web Service web interface of the video surveillance system involves errors in the authentication process for TLS certificates. Exploiting this vulnerability could allow a malicious actor to carry out a “Man-in-the-Middle” attack...

exacqVision Web Service CORS Cross-origin Attack

The vulnerability of the CORS Cross-Origin Resource Sharing mechanism in the exacqVision Web Service web interface of the video surveillance system exists due to incorrect processing of the HTTP header “Origin”. Exploiting this vulnerability allows a malicious actor to bypass security restriction...

exacqVision Web Service HTTPS Unauthorized Access

The vulnerability of the HTTPS implementation of the exacqVision Web Service in the video surveillance system exacqVision relates to the transmission of credentials in an unencrypted form. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected...

exacqVision Web Service Information Disclosure

The vulnerability of the exacqVision Web Service web interface of the video surveillance system involves the disclosure of information through query strings during the processing of authentication tokens. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorize...

Johnson Controls exacqVision Web Server Installed (Windows)

Binary data exacqvisionwebserverwininstalled.nbin...

Johnson Controls ExacqVision Web Server < 24.04 Improper Certificate Validation (JCI-PSA-2024-18)

The version of the Johnson Controls exacqVision Web Server running on the remote host is prior to 24.04. It is, therefore, affected by a certificate validation vulnerability. Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected...

Johnson Controls exacqVision Web Service < 24.06 Multiple Vulnerabilities

The version of the Johnson Controls exacqVision Web Service running on the remote host is prior to 24.03. It is, therefore, affected by multiple vulnerabilities. - Under certain circumstances the exacqVision Web Services does not provide sufficient protection from untrusted domains. CVE-2024-3286...

Johnson Controls ExacqVision Web Server Inadequate Encryption Strength (JCI-PSA-2024-14)

The version of the Johnson Controls exacqVision Web Server running on the remote host is affected by an inadequate encryption strength vulnerability. Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange. Note...

CVE-2024-32931

Under certain circumstances the exacqVision Web Service can expose authentication token details within communications...

CVE-2024-32931

Under certain circumstances the exacqVision Web Service can expose authentication token details within communications...

CVE-2024-32758

Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange...

CVE-2024-32862

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32865

Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices...

CVE-2024-32758

Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange...

CVE-2024-32865

Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices...

CVE-2024-32862

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32862 exacqVision CORS

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32862 exacqVision CORS

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32862

ExacqVision Web Service (Johnson Controls) is affected by CVE-2024-32862 due to a permissive Cross-domain Policy with Untrusted Domains in its CORS handling. The vulnerability impacts exacqVision Web Service versions prior to 24.06 (notably 22.12.1.0 per ICS alert) and could allow an attacker to ...