AXIS OS 安全漏洞

AXIS OS is an edge device operating system from Axis Sweden AXIS. A security vulnerability exists in AXIS OS versions 8.40 through 11.10. An attacker exploiting the vulnerability could enumerate folder or file names on the local file system...

AXIS OS 安全漏洞

AXIS OS is an edge device operating system from Axis Sweden. A security vulnerability exists in AXIS OS version 11.11 that stems from an access control error. An attacker can escalate privileges by exploiting the vulnerability...

AXIS OS 安全漏洞

AXIS OS is an edge device operating system from Axis Sweden AXIS. A security vulnerability exists in AXIS OS versions 6.50 through 11.11. An attacker exploited the vulnerability to cause the device to run out of resources...

AXIS OS 安全漏洞

AXIS OS is an edge device operating system from Axis Sweden. AXIS OS has a security vulnerability. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or the vendor announcement...

AXIS OS 安全漏洞

AXIS OS is an edge device operating system from Axis Sweden. A security vulnerability exists in AXIS OS versions 6.50 through 11.10, which stems from the Guard Tour VAPIX API parameter that allows the use of arbitrary values...

CVE-2024-6509: Improper Neutralization of Wildcards or Matching Symbols

Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource exhaustion of the Axis device. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security...

CVE-2024-0067: Path Traversal: '.../...//'

Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folder/file names on the local file system of the Axis device. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer...

CVE-2024-7784: Stack-based Buffer Overflow

During internal Axis Security Development Model ASDM threat-modelling, a flaw was found in the protection for device tampering commonly known as Secure Boot in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the...

CVE-2024-6173: Improper Validation of Syntactic Correctness of Input

51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowing for an attacker to block access to the guard tour configuration page in the web interface of the Axis device. Axis has released patched AXIS OS versions...

CVE-2024-6979: Incorrect Authorization

Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as it requires complex steps to execute, including knowing of...

PT-2024-38578 · Axis Communications · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS affected versions not specified Description: A flaw was found in the protection for device tampering, commonly known as Secure Boot, in AXIS OS, making it vulnerable to a sophisticated attack to bypass this protection. To the vendor's...

PT-2024-38017 · Axis Communications · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS affected versions not specified Description: A broken access control issue has been discovered, allowing less-privileged operator- and/or viewer accounts to have more privileges than designed. The risk of exploitation is very low, as ...

PT-2024-37433 · Axis · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS affected versions not specified Description: A Guard Tour VAPIX API parameter in Axis devices allows the use of arbitrary values, enabling an attacker to block access to the guard tour configuration page in the web interface. Axis has...

PT-2024-37679 · Axis · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS affected versions not specified Description: The VAPIX API alwaysmulti.cgi is vulnerable to file globbing, which could lead to resource exhaustion of the Axis device. The issue was discovered by Marinus Pfund, a member of the AXIS OS...

PT-2024-15331 · Axis · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS affected versions not specified Description: The VAPIX API ledlimit.cgi is vulnerable to path traversal attacks, allowing attackers to list folder and file names on the local file system of the Axis device. This issue was discovered b...

HP SiteScope SOAP Call GetFileInternal Remote File Access

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HP SiteScope SOAP Call getFileInternal Remote File Access', 'Description' = %q This module exploits an authentication bypass vulnerability in HP...

Axis Communications Autodesk Plugin Exposure of Sensitive Information Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected services of Axis Communications Autodesk Plugin. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AzureBlobRestAPI.dll module. The issue results from exposed credential...

Security Bulletin: Multiple Vulnerabilities in Apache Axis affect Cloud Pak System

Summary Vulnerabilities in Apache Axis affect Cloud Pak System CVE-2012-5784, CVE-2014-3596 Vulnerability Details CVEID:CVE-2012-5784 DESCRIPTION: Apache Axis 1.4, as used in multiple products, could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the...

jenkins-2-plugins: matrix-project plugin path traversal vulnerability

A flaw was found in The Matrix Project Plugin for Jenkins, which does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This issue may allow attackers with Item/Configure permission to create or replace any config.xml file on...

CVE-2024-0066

Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client Axis device and O3C server. If O3C is not being used this flaw does not apply. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer...