Vendor
Axis Communications AB
100 known vulnerabilities.
Products
100 results · Feed
-
High 7.1
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to pa…
-
High 7.1
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnera…
-
High 7.1
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable …
-
Medium 6.5
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to p…
-
High 7.1
NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection f…
-
Critical 9.1
Remote code execution vulnerability during the installation of ACAP applications on the Axis device
GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. The application handling service in AXIS OS was vulnerable to command injection allowing an attacker t…
-
High 7.2
Non-sanitized user input could lead to SQL injections in AXIS License Plate Verifier
User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections.
-
High 7.2
Non-sanitized user input could lead to arbitrary code execution during Access Control configuration in AXIS License Plate Verifier
User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution.
-
High 7.2
Non-sanitized user input could lead to arbitrary code execution in AXIS License Plate Verifier
User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution.
-
High 8.4
Insufficient file permissions leak administrator-privileged credentials in AXIS License Verifier ACAP
Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuration of the application.
-
High 8.4
Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP
Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems.
-
High 8.8
Privilege escalation in AXIS License Plate Verifier ACAP
A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.
-
High 7.1
Heap-based buffer overflow in Axis A1001 Network Door Controller's OSDP communication
Ariel Harush and Roy Hodir from OTORIO have found a flaw in the AXIS A1001 when communicating over OSDP. A heap-based buffer overflow was found in the pacsiod process which is handling the OSDP communication allowing to write outside of the allocated buffer. …
-
Medium 6.5
Denial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communication
Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes the pacsiod process, causing a temporary unavailability of the door-controll…
-
Medium 4.1
AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static …
-
Unscored —
AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijac…
-
Unscored —
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the…
-
Unscored —
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass …
-
Unscored —
User controlled parameters related to SMTP notifications are not correctly validated. This can lead to a buffer overflo…
-
Unscored —
A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions e…