Advisories · Technology

Johnson Controls Metasys ADS/ADX/OAS server.

Every CVE that names Johnson Controls Metasys ADS/ADX/OAS server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2021-36200 CVE record

CVSS 5.3 Medium

Metasys ADS/ADX/OAS with MUI
- Johnson Controls Metasys ADS/ADX/OAS server
- Authentication bypass
Not analysed yet 22 Jul 2022
CVE-2022-21938 CVE record

CVSS 8.1 High

Metasys MUI Graphics XSS
- Johnson Controls Metasys ADS/ADX/OAS server
- Cross-site scripting (XSS)
Not analysed yet 15 Jun 2022
CVE-2022-21935 CVE record

CVSS 7.5 High

Metasys password guessing
- Johnson Controls Metasys ADS/ADX/OAS server
- CWE-620
Not analysed yet 15 Jun 2022
CVE-2022-21937 CVE record

CVSS 8.7 High

Metasys CSS
- Johnson Controls Metasys ADS/ADX/OAS server
- Cross-site scripting (XSS)
Not analysed yet 15 Jun 2022
CVE-2022-21934 CVE record

CVSS 8.0 High

Metasys Unverified Password Change
- Johnson Controls Metasys ADS/ADX/OAS server
- CWE-620
Not analysed yet 6 May 2022
CVE-2021-36207 CVE record

CVSS 8.8 High

Metasys privilege management
- Johnson Controls Metasys ADS/ADX/OAS server
- Privilege escalation
Not analysed yet 29 Apr 2022