Metasys Extended Application And Data Server Security Vulnerabilities - CVSS Score 9 - 10

CVE-2020-9044

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and ...

CVE-2021-36205

Under certain circumstances the session token is not cleared on logout.