252 matches found
CVE-2020-9044
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server ADS, ADS-Lite versions 10.1 and prior; Metasys Extended Application and...
Xxe
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server ADS, ADS-Lite versions 10.1 and prior; Metasys Extended Application and...
CVE-2020-9044
CVE-2020-9044 - XML External Entity (XXE) in Metasys Web Services : The vulnerability is an XXE in Johnson Controls Metasys Web Services, enabling potential DoS and harvesting of server ASCII files. Affected products include ADS/ADS-Lite, ADX, ODS, OAS, NAE55/NIE55/ NIE59 families, NAE85/NIE85, L...
CVE-2020-9044 Metasys Improper Restriction of XML External Entity Reference
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server ADS, ADS-Lite versions 10.1 and prior; Metasys Extended Application and...
CVE-2020-9044: Improper Restriction of XML External Entity Reference
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server ADS, ADS-Lite versions 10.1 and prior; Metasys Extended Application and...
PT-2020-20457
Name of the Vulnerable Software and Affected Versions Metasys Application and Data Server ADS, ADS-Lite versions prior to 10.1 Metasys Extended Application and Data Server ADX versions prior to 10.1 Metasys Open Data Server ODS versions prior to 10.1 Metasys Open Application Server OAS version 10...
Johnson Controls Metasys
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Johnson Controls Equipment: Metasys Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability can allow a...
CVE-2019-7594
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal SMP...
CVE-2019-7593
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal SMP...
CVE-2019-7594
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal SMP...
CVE-2019-7593
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal SMP...
Hardcoded credentials
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal SMP...
Code injection
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal SMP...
CVE-2019-7594 Metasys use of hardcoded RC2 key
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal SMP...
CVE-2019-7594
Metasys ADS/ADX servers and NAE/NIE/NCE engines before version 9.0 use a hardcoded RC2 key for Site Management Portal (SMP) encryption. This flaw can allow an attacker with access to the key to decrypt captured network traffic between the Metasys components and the SMP client. Affected products a...
CVE-2019-7593 Metasys use of shared RSA key pairs
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal SMP...
CVE-2019-7593
Metasys ADS/ADX servers and NAE/NIE/NCE engines prior to version 9.0 use a shared RSA key pair for certain Site Management Portal (SMP) encryption, allowing an attacker with access to the key to decrypt captured traffic between the Metasys components and the SMP client. CVE-2019-7593 is authentic...
PT-2019-18662
Name of the Vulnerable Software and Affected Versions Metasys versions prior to 9.0 Description The issue concerns the use of a hardcoded RC2 key for encryption operations involving the Site Management Portal. Recommendations For versions prior to 9.0, update to version 9.0 or later to resolve th...
CVE-2019-7594: Use of Hard-coded Cryptographic Key
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal SMP...
PT-2019-5780
Name of the Vulnerable Software and Affected Versions Metasys versions prior to 9.0 Description The issue is related to the reuse of a cryptographic pair in encryption, which may allow a remote attacker to impact the confidentiality and integrity of protected information. The Metasys system uses ...