CVE-2018-8032

Axis Apache eXtensible Interaction System ------------------------------------------- ¡Bienvenido a Axis! Encontrarás documentación en el directorio docs/. Por favor, lee las notas de la versión release-notes.html en este directorio para obtener detalles sobre la versión actual. Gracias de parte...

cve-2019-0227

cve-2019-0227 apache axis1.4远程代码执行漏洞 需要在本机msf设置监听，另外需要修改代码24-30行处 ＃您需要更改这些变量以匹配您的配置 myip = “ 192.168.0.117 ” ＃您机器的IP target = “ 192.168.0.102 ” ＃目标IP 网关= “ 192.168.0.1 ” ＃默认网关 targetport = “ 8080 ” ＃目标运行轴的端口（可能是8080） pathtoaxis = “ http://192.168.0.102:8080/axis ” ＃这可以是自定义的视轴安装，但是这是默认...

CVE-2025-0324-axis-vapix-privesc

CVE-2025-0324 — 根因分析 一个由客户端控制的Host 头，成为 AXIS OS VAPIX 设备配置框架中的 root 组后门。 %20%2F%208.8%20High%20\NVD-b3261e 摘要 Axis Communications 于 2025-06-02 披露了 CVE-2025-0324，将其定性为 AXIS OS 平台中 VAPIX® 设备配置框架的一个严重（CVSS 9.4）权限提升漏洞，并致谢漏洞赏金研究员 Malacupa 的发现——但明确拒绝公布任何技术细节： "Axis 不会提供有关该漏洞的更详细信息。"...

Axis1.4-CVE-2019-0227

Axis1.4 CVE-2019-0227 リモートコマンド実行脆弱性利用ツール 📖 脆弱性の説明 Apache Axis1.4 には、リモートコマンド実行脆弱性 CVE-2019-0227 が存在します。enableRemoteAdmin プロパティが true に設定されている場合、攻撃者は AdminService インターフェースを介して悪意のあるサービスをデプロイし、ターゲットサーバー上で任意のシステムコマンドを実行できます。 影響を受けるバージョン : Apache Axis ≤ 1.4 トリガー条件 : enableRemoteAdmin が true に設定されていること...

cve-2025-11142-axis-mediaclip-rce

CVE-2025-11142 — AXIS mediaclip.cgi 操作系统命令注入 n-day 研究文章与 PoC — 针对 AXIS VAPIX Media Clip API 中 CVSS 7.1 操作系统命令注入漏洞的补丁后技术分析，通过黑盒测试针对 Axis 设备独立重新发现并验证。 Axis 官方公告未公布技术利用细节或公开 PoC（截至公告发布时，“Axis 不会提供有关该漏洞的更详细信息”，“目前没有公开已知的漏洞利用”）。本仓库记录了一项独立复现、基于证据的确认，仅在供应商修复（AXIS OS 12.7.36）普遍可用后发布。参见披露时间线。 摘要 | ---|---...

PT-2026-98972

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

Astra Linux – Vulnerability in Axis

UNSUPPORTED WHEN ASSIGNED When integrating Apache Axis 1.x in an application, it might not have been obvious that using “ServiceFactory.getService” could lead to potentially dangerous operations, such as LDAP queries. Passing untrusted input to this API method could expose the application to DoS,...

Exploit for OS Command Injection in Axis Axis_Os

CVE-2025-11142 — AXIS mediaclip.cgi OS Command Injection...

Exploit for Incomplete Filtering of Special Elements in Axis Axis_Os

CVE-2025-0324 — Root Cause Analysis A client-controlled Ho...

Malicious code in axis-datagrid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b8e97884917400dda89c79754629edd51961e893d64fa580de04bb82bd0cab3 package.json declares a dependency whose key equals the package's own name axis-datagrid and whose source is the bare HTTPS URL...

MAL-2026-15528 Malicious code in axis-datagrid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b8e97884917400dda89c79754629edd51961e893d64fa580de04bb82bd0cab3 package.json declares a dependency whose key equals the package's own name axis-datagrid and whose source is the bare HTTPS URL...

CVE-2026-5304

A flaw was found in Axis devices. An attacker could exploit a lack of input validation in an ACAP AXIS Camera Application Platform configuration file to achieve privilege escalation. This vulnerability requires the Axis device to be configured to allow unsigned ACAP applications, and an attacker...

CVE-2026-4757

A flaw was found in Axis. An attacker with an administrator-privileged service account could exploit improper input validation in a VAPIX API parameter. This could allow for arbitrary code execution and potentially lead to privilege escalation, granting the attacker higher system privileges...

CVE-2026-5304

An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a maliciou...

CVE-2026-6505

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

CVE-2026-5303

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

CVE-2026-6505

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

CVE-2026-6505

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

EUVD-2026-55966

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

CVE-2026-6505

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...