42 results · Clear filters · Feed
-
Medium 6.5
Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which coul…
-
Medium 6.7
The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalatio…
-
Medium 4.3
The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only …
-
Medium 6.7
A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized …
-
Medium 5.1
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to pri…
-
Medium 5.7
An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerabi…
-
Medium 5.7
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to pri…
-
Medium 5.9
The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited afte…
-
Medium 5.4
A configuration file on the local file system had improper input validation which could allow code execution and potent…
-
Medium 6.7
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to pot…
-
Medium 6.0
An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead…
-
Medium 6.7
ACAP applications can gain elevated privileges due to improper input validation during the installation process, potent…
-
Medium 6.4
The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain …
-
Medium 4.3
The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usabili…
-
Medium 6.7
An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privile…
-
Medium 6.7
An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privil…
-
Medium 6.0
A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it.
-
Medium 6.6
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applica…
-
Medium 6.7
ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escal…
-
Medium 6.8
The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only b…
-
Medium 6.4
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to pot…
-
Medium 6.7
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vul…
-
Medium 6.7
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vul…
-
Medium 6.7
ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerabi…
-
Medium 4.3
A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacke…
-
Medium 4.3
During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX De…
-
Medium 4.3
51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have s…
-
Medium 5.3
Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to …
-
Medium 6.5
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient…
-
Medium 4.3
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable…
-
Medium 6.1
During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device …
-
Medium 6.8
Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-pr…
-
Medium 6.5
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of a…
-
Medium 6.5
Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for fil…
-
Medium 4.3
Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path t…
-
Medium 5.3
Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic b…
-
Medium 6.5
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi wa…
-
Medium 6.5
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs local_list.cgi, create_overlay.cg…
-
Medium 5.4
Insufficient input validation in VAPIX API create_overlay.cgi
Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator-…
-
Medium 6.3
Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not hav…