CVE-2021-27660

CVE-2021-27660 affects Johnson Controls C-CURE 9000. The vulnerability arises from an insecure client auto-update feature (improper input validation CWE-20) that can enable remote execution of lower-privileged Windows programs. Impact is high (C/H/I/H/A/H) with network vector and low attack compl...

CVE-2021-36201

CVE-2021-36201 affects Johnson Controls/Sensormatic C-CURE 9000. The vulnerability, labeled Observable Response Discrepancy, occurs in CCURE 9000 versions prior to 2.90 and could allow an unauthorized CCURE Portal user to enumerate existing user accounts due to problematic responses. CVSS base me...

CVE-2020-9045

CVE-2020-9045 affects Software House C•CURE 9000 v2.70 and American Dynamics victor VMS v5.2. During installation or upgrade, the credentials of the user performing the process are logged to an install log file, which persists after installation. Publicly documented mitigations include upgrading ...