CVE-2018-9157

AXIS M1033-W IP camera, firmware 5.40.5.1 , is affected by CVE-2018-9157. The issue allows uploading a crafted .shtml webshell via the fileUpload.shtml endpoint, which is interpreted by Apache HTTP Server’s mod_include and can execute system commands. After successful upload, an attacker can perf...

CVE-2018-9158

CVE-2018-9158 affects Axis M1033-W IP camera firmware version 5.40.5.1. The issue is that the device does not employ a suitable mechanism to prevent a DoS attack, resulting in a response time delay. An attacker can use the hping3 tool to perform an IPv4 flood attack, and services are interrupted ...

PT-2018-18894 · Axis +1 · Axis M1033-W +1

Name of the Vulnerable Software and Affected Versions: AXIS M1033-W IP camera Firmware version 5.40.5.1 Description: An issue was discovered where the upload web page does not verify the file type, allowing an attacker to upload a webshell by making a fileUpload.shtml request for a custom .shtml...

PT-2018-18893 · Apache +1 · Apache Http Server +1

Name of the Vulnerable Software and Affected Versions: AXIS P1354 IP camera Firmware version 5.90.1.1 Description: An issue was discovered where the upload web page does not verify the file type, allowing an attacker to upload a webshell by making a fileUpload.shtml request for a custom .shtml...

PT-2018-18895

Name of the Vulnerable Software and Affected Versions AXIS M1033-W IP camera Firmware version 5.40.5.1 Description The issue concerns a lack of a suitable mechanism to prevent a Denial of Service DoS attack, resulting in a response time delay. An attacker can exploit this by using the hping3 tool...

CVE-2018-9158: Improper Input Validation

An issue was discovered on AXIS M1033-W IP camera Firmware version 5.40.5.1 devices. They don't employ a suitable mechanism to prevent a DoS attack, which leads to a response time delay. An attacker can use the hping3 tool to perform an IPv4 flood attack, and the services are interrupted from...

CVE-2018-9157: Unrestricted Upload of File with Dangerous Type

An issue was discovered on AXIS M1033-W IP camera Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server modinclude...

CVE-2018-9156: Unrestricted Upload of File with Dangerous Type

An issue was discovered on AXIS P1354 IP camera Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server modinclude modul...

Axis SSI - Remote Command Execution / Read Files Vulnerabilities

Exploit for multiple platform in category remote exploits STX Subject: SSI Remote Execute and Read Files Researcher: bashis August 2016 Release date: October, 2017 Old stuff that I've forgotten, fixed Q3/2016 by Axis Attack Vector: Remote Authentication: Anonymous no credentials needed Conditions...

AXIS HTTP GET Heap Overflow

The remote AXIS device is affected by a heap overflow vulnerability in its web administration interface due to a flaw in handling of special characters. An unauthenticated remote attacker can exploit this vulnerability for denial of service and possibly remote code execution. C Tenable Network...

Axis Communications MPQT/PACS Heap Overflow / Information Leakage Vulnerabilities

Axis Communications MPQT/PACS suffers from heap overflow and information leakage vulnerabilities. STX Subject: Axis Communications MPQT/PACS Heap Overflow and Information Leakage. Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis August 2017 PoC:...

Axis Communications MPQT/PACS Heap Overflow / Information Leakage

STX Subject: Axis Communications MPQT/PACS Heap Overflow and Information Leakage. Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis August 2017 PoC: https://github.com/mcw0/PoC Release date: December 1, 2017 Full Disclosure: 90 days due to the large volume o...

Axis Communications MPQTPACS - Heap Overflow Information Leakage

Axis Communications MPQTPACS - Heap Overflow Information Leakage STX Subject: Axis Communications MPQT/PACS Heap Overflow and Information Leakage. Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis August 2017 PoC: https://github.com/mcw0/PoC Release date:...

Axis Communications MPQT/PACS - Heap Overflow / Information Leakage

STX Subject: Axis Communications MPQT/PACS Heap Overflow and Information Leakage. Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis August 2017 PoC: https://github.com/mcw0/PoC Release date: December 1, 2017 Full Disclosure: 90 days due to the large volume o...

Axis 2100 Network Camera Cross-Site Scripting Vulnerability

Axis 2100 Network Camera is a wireless camera product from Axis, Sweden. web administration portal is one of the web administration pages. A cross-site scripting vulnerability exists in the web administration portal in Axis 2100 Network Camera version 2.03. A remote attacker can exploit this...

CVE-2017-15885

Reflected XSS in the web administration portal on the Axis 2100 Network Camera 2.03 allows an attacker to execute arbitrary JavaScript via the confLayoutOwnTitle parameter to view/view.shtml. NOTE: this might overlap CVE-2007-5214...

Cross site scripting

Reflected XSS in the web administration portal on the Axis 2100 Network Camera 2.03 allows an attacker to execute arbitrary JavaScript via the confLayoutOwnTitle parameter to view/view.shtml. NOTE: this might overlap CVE-2007-5214...

CVE-2017-15885

Reflected XSS in the web administration portal on the Axis 2100 Network Camera 2.03 allows an attacker to execute arbitrary JavaScript via the confLayoutOwnTitle parameter to view/view.shtml. NOTE: this might overlap CVE-2007-5214...

CVE-2017-15885

Reflected XSS in the web administration portal on the Axis 2100 Network Camera 2.03 allows an attacker to execute arbitrary JavaScript via the confLayoutOwnTitle parameter to view/view.shtml. NOTE: this might overlap CVE-2007-5214...

CVE-2017-15885

Axis 2100 Network Camera 2.03 is associated with CVE-2017-15885: a reflected XSS in the web administration portal that allows arbitrary JavaScript execution via the conf_Layout_OwnTitle parameter to view/view.shtml. This entry may overlap with CVE-2007-5214. The connected documents confirm the vu...