61 results · Feed
-
Medium 6.1
During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device …
-
Medium 6.8
Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-pr…
-
Medium 6.5
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of a…
-
Medium 6.5
Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for fil…
-
Medium 4.3
Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path t…
-
Medium 5.3
Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic b…
-
Medium 6.5
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi wa…
-
Medium 6.5
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs local_list.cgi, create_overlay.cg…
-
Medium 5.4
Insufficient input validation in VAPIX API create_overlay.cgi
Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator-…
-
Medium 6.3
Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not hav…
-
High 7.6
During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device …
-
High 7.1
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to pa…
-
High 7.1
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnera…
-
High 7.1
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable …
-
Medium 6.5
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to p…
-
High 7.1
NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection f…
-
Critical 9.1
Remote code execution vulnerability during the installation of ACAP applications on the Axis device
GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. The application handling service in AXIS OS was vulnerable to command injection allowing an attacker t…
-
Medium 4.1
AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static …
-
Unscored —
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the…
-
Unscored —
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass …
-
Unscored —
User controlled parameters related to SMTP notifications are not correctly validated. This can lead to a buffer overflo…