{"vulnerability": "CVE-2021-3620", "sightings": [{"uuid": "d1ff9986-2337-4912-8ad2-2d15ecc7b179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-36204", "type": "seen", "source": "https://t.me/cibsecurity/56496", "content": "\u203c CVE-2021-36204 \u203c\n\nUnder some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3 allows API calls to expose credentials in plain text.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-14T00:36:28.000000Z"}, {"uuid": "04aa0c75-7228-4b0e-addd-b62ce71581b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-36206", "type": "seen", "source": "https://t.me/cibsecurity/52197", "content": "\u203c CVE-2021-36206 \u203c\n\nAll versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-28T07:29:06.000000Z"}, {"uuid": "1b6bbdee-1660-4571-8bdb-5b3d44a46374", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-36207", "type": "seen", "source": "https://t.me/cibsecurity/41680", "content": "\u203c CVE-2021-36207 \u203c\n\nUnder certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-29T20:25:13.000000Z"}, {"uuid": "2a96bcf3-1077-4a76-8d4f-217aed2dd6fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-36205", "type": "seen", "source": "https://t.me/cibsecurity/40887", "content": "\u203c CVE-2021-36205 \u203c\n\nUnder certain circumstances the session token is not cleared on logout.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-15T20:20:25.000000Z"}, {"uuid": "30ae6d70-ee05-4341-8152-d801bfb6803a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-36209", "type": "seen", "source": "https://t.me/cibsecurity/26952", "content": "\u203c CVE-2021-36209 \u203c\n\nIn JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-06T18:32:50.000000Z"}, {"uuid": "abf086b6-6dc3-4b1c-89e0-897b0b285707", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-36204", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/10796", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-36204\n\ud83d\udd25 CVSS Score: 7.8 (cvssV3_1, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3 allows API calls to expose credentials in plain text.\n\ud83d\udccf Published: 2023-01-13T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-07T19:45:35.972Z\n\ud83d\udd17 References:\n1. https://www.johnsoncontrols.com/cyber-solutions/security-advisories\n2. https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-06", "creation_timestamp": "2025-04-07T20:46:30.000000Z"}, {"uuid": "2c7eada8-7b19-4534-b646-9e70c8404d50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-36200", "type": "seen", "source": "https://t.me/cibsecurity/46801", "content": "\u203c CVE-2021-36200 \u203c\n\nUnder certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-22T18:19:28.000000Z"}, {"uuid": "2fac8a72-cd9f-4b49-a5ca-c503bc6764b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-36203", "type": "seen", "source": "https://t.me/cibsecurity/41325", "content": "\u203c CVE-2021-36203 \u203c\n\nA vulnerability in all versions of SCT/SCT Pro prior to version 14.2.2 allows a remote unauthenticated attacker to identify and forge requests to internal systems via a specially crafted request allowing the attacker to determine if specific files or paths exist. This issue affects all versions of SCT/SCT Pro prior to version 14.2.2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-22T18:27:59.000000Z"}, {"uuid": "ac72fc5c-2601-4978-98b4-c8fb49e76581", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-3620", "type": "seen", "source": "https://t.me/cibsecurity/38375", "content": "\u203c CVE-2021-3620 \u203c\n\nA flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-03T22:26:15.000000Z"}, {"uuid": "749e720e-f66c-474e-99af-4edf1a151c6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-36202", "type": "seen", "source": "https://t.me/cibsecurity/40326", "content": "\u203c CVE-2021-36202 \u203c\n\nServer-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-08T00:36:30.000000Z"}]}