Advisories · Technology

Johnson Controls Metasys Open Application Server (OAS).

Every CVE that names Johnson Controls Metasys Open Application Server (OAS) among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2020-9044 CVE record

CVSS 7.5 High

Metasys Improper Restriction of XML External Entity Reference
- Johnson Controls Metasys Application and Data Server (ADS, ADS-Lite)
- Johnson Controls Metasys Extended Application and Data Server (ADX)
- XML external entities (XXE)
Not analysed yet 10 Mar 2020