CVE-2020-9047

Exacqvision Web Service <= 20.06.3.0 and ExacqVision Enterprise Manager

CVE-2021-27664

CVE-2021-27664 affects Exacq Technologies exacqVision Web Service. Root cause: improper privilege management that could allow an unauthenticated remote user to access credentials stored on the exacqVision Server. Affected product/versions: exacqVision Web Service 21.06.11.0 or older. Impact: cred...

CVE-2021-27656

CVE-2021-27656 affects exacqVision Web Service (all versions ≤ 20.12.02.0). It enables an unauthenticated attacker to view system-level information about the Web Service and the operating system due to insufficient authentication (information disclosure). The vulnerability is documented by Johnso...

CVE-2024-32864

Summary: CVE-2024-32864 affects Johnson Controls exacqVision Web Service prior to version 24.06, where HTTPS is not enforced under certain conditions, enabling potential exposure of sensitive information via cleartext transmission (CWE-319). The vulnerability affects exacqVision Web Service versi...

CVE-2024-32931

Summary of CVE-2024-32931 : Johnson Controls exacqVision Web Service (versions up to 24.03) may expose authentication token details in communications, via use of GET requests with sensitive query strings. The issue has a CVSS v3.1 base score of 5.7 (Network, Low complexity, Privileges Low, User I...

CVE-2024-32862

ExacqVision Web Service (Johnson Controls) is affected by CVE-2024-32862 due to a permissive Cross-domain Policy with Untrusted Domains in its CORS handling. The vulnerability impacts exacqVision Web Service versions prior to 24.06 (notably 22.12.1.0 per ICS alert) and could allow an attacker to ...

CVE-2024-32863

Johnson Controls exacqVision Web Service is affected up to version 24.03 by a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2024-32863). The issue allows performing state-changing operations with administrative privileges and has CVSSv3.1 base score 6.8 (vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H...

CVE-2021-27659

CVE-2021-27659 affects Exacq Technologies exacqVision Web Service (version 21.03 and earlier). The issue is cross-site scripting (CWE-79) caused by improper neutralization of user-controlled input before it is placed in output rendered as a web page, potentially allowing an attacker to lure victi...