633 matches found
EUVD-2026-65005
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...
CVE-2026-34491: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...
PT-2026-80980
Name of the Vulnerable Software and Affected Versions Metasys versions prior to 14.1.5 Metasys versions prior to 15.0.1 Description Improper neutralization of input during web page generation allows Cross Site Scripting XSS, a condition where malicious scripts are injected into trusted websites...
CVE-2026-27875
Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...
CVE-2026-27875 Simplex Incident Manager Clear Test
Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...
CVE-2026-27875
Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (before 2.01.05 ) stores user credentials—passwords and authentication tokens—in unencrypted form within system memory while running. A local attacker with low privileges can extract these embedded sensitive data using memory...
CVE-2026-27875: Cleartext Storage of Sensitive Information in Memory
Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...
CVE-2026-64887
Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1...
CVE-2026-34492
External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...
EUVD-2026-58772
External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...
CVE-2026-34492 Airwall - Arbitrary file read
External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...
CVE-2026-34492
Johnson Controls Airwall (before 4.1) is affected by CVE-2026-34492: external control of a file name or path can lead to arbitrary file read (and related file manipulation). The provided documents do not specify the exact root cause details, vulnerable components, or affected versions beyond Air...
CVE-2026-34492 Airwall - Arbitrary file read
External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...
CVE-2026-64887 Airwall - Hardcoded Secrets
Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1...
CVE-2026-64887
Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1...
CVE-2026-64887
CVE-2026-64887 affects Johnson Controls Airwall prior to version 4.1 and describes a hard-coded cryptographic key vulnerability that enables a cryptanalytic attack. The available documents do not provide details on the affected component surface, exact root cause beyond the hard-coded key, or any...
CVE-2026-64887: Use of Hard-coded Cryptographic Key
Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1...
CVE-2026-34492: External Control of File Name or Path
External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...
CVE-2026-27871: Use of a Broken or Risky Cryptographic Algorithm
Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63...