CVE-2022-21940

Summary : CVE-2022-21940 affects Johnson Controls System Configuration Tool (SCT) versions 14 before 14.2.3 and 15 before 15.0.3. The issue is a sensitive cookie in HTTPS session without the Secure attribute , which could allow cookie exposure. Root cause : cookies accepted in HTTPS sessions with...

CVE-2022-21939

CVE-2022-21939 affects Johnson Controls System Configuration Tool (SCT) versions 14 prior to 14.2.3 and 15 prior to 15.0.3. The vulnerability is a SENSITIVE COOKIE WITHOUT 'HttpOnly' FLAG, described as a cross-site scripting issue that could allow an attacker to access cookies and take control of...

CVE-2022-21939: Sensitive Cookie Without 'HttpOnly' Flag

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool SCT version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie...

CVE-2022-21940: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool SCT version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie...