Metasys 14
Monthly
Reflected or stored cross-site scripting in Johnson Controls Metasys 14 (before 14.1.5) and Metasys 15 (before 15.0.1) allows a low-privileged attacker to inject malicious scripts into web pages that execute in a victim user's browser. Metasys is a building automation and management system, meaning successful exploitation could enable session hijacking or unauthorized interaction with building infrastructure controls accessible through the web interface. No public exploit has been identified and no active exploitation is confirmed; a vendor-released patch is available.
Reflected or stored cross-site scripting in Johnson Controls Metasys 14 (before 14.1.5) and Metasys 15 (before 15.0.1) allows a low-privileged attacker to inject malicious scripts into web pages that execute in a victim user's browser. Metasys is a building automation and management system, meaning successful exploitation could enable session hijacking or unauthorized interaction with building infrastructure controls accessible through the web interface. No public exploit has been identified and no active exploitation is confirmed; a vendor-released patch is available.