Johnson Controls exacqVision client and exacqVision server

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.0 ATTENTION : Exploitable remotely Vendor : Johnson Controls Inc. Equipment : exacqVision Client, exacqVision Server key Vulnerability : Inadequate Encryption Strength 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker...

PT-2024-5522 · Unknown · Exacqvision Web Service

Name of the Vulnerable Software and Affected Versions: exacqVision Web Service affected versions not specified Description: The issue is related to the exposure of authentication token details within communications under certain circumstances. This can occur when the exacqVision Web Service handl...

PT-2024-5519 · Tyco Security Products · Exacqvision Web Service

Name of the Vulnerable Software and Affected Versions: exacqVision Web Services affected versions not specified Description: The issue is related to Cross-Site Request Forgery CSRF, which can be exploited under certain circumstances. This could allow a remote attacker to perform a CSRF attack...

PT-2024-5766 · Unknown · Exacqvision Server +1

Name of the Vulnerable Software and Affected Versions: exacqVision Client and exacqVision Server affected versions not specified Description: The issue is related to insufficient key length and exchange in the communication between exacqVision Client and exacqVision Server, which may allow a remo...

CVE-2024-32931: Use of GET Request Method With Sensitive Query Strings

Under certain circumstances the exacqVision Web Service can expose authentication token details within communications...

PT-2024-5521

Name of the Vulnerable Software and Affected Versions exacqVision Web Services affected versions not specified Description The issue is related to the implementation of the HTTPS protocol in the exacqVision Web Service system, which may lead to the transmission of credentials in an unencrypted...

PT-2024-5520

Name of the Vulnerable Software and Affected Versions exacqVision Server affected versions not specified Description The issue is related to the improper validation of TLS certificates by the exacqVision Server under certain circumstances. This could allow a remote attacker to perform a...

CVE-2024-32862: Permissive Cross-domain Policy with Untrusted Domains

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32758: Inadequate Encryption Strength

Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange...

CVE-2024-32863: Cross-Site Request Forgery (CSRF)

Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery CSRF...

PT-2024-5518 · Unknown · Exacqvision Web Service

Name of the Vulnerable Software and Affected Versions: ExacqVision Web Services affected versions not specified Description: The issue is related to the ExacqVision Web Services, which under certain circumstances does not provide sufficient protection from untrusted domains. This is due to...

CVE-2024-32865: Improper Certificate Validation

Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices...

CVE-2024-32864: Cleartext Transmission of Sensitive Information

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

Johnson Controls exacqVision Server Information Disclosure Vulnerability

Johnson Controls exacqVision Server is a surveillance video management software from Johnson Controls, a U.S. company. Johnson Controls is vulnerable to an information disclosure vulnerability that stems from excessive data output from the application. An attacker could use this vulnerability to...

Johnson Controls exacqVision Server 信息泄露漏洞

Johnson Controls exacqVision Server is a surveillance video management software from Johnson Controls, a U.S. company. Johnson Controls is vulnerable to an information disclosure vulnerability that stems from excessive data output from the application. An attacker could use this vulnerability to...

Johnson Controls exacqVision Web Service Information Disclosure (JCI-PSA-2021-16)

Binary data exacqVisionwebservicecve-2021-27664.nbin...

CVE-2021-27664

Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server...

CVE-2021-27665

An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition...

CVE-2021-27664

Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server...

CVE-2021-27665

An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition...