CVE-2024-0055

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis...

CVE-2024-0054

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs locallist.cgi, createoverlay.cgi and irissetup.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Axis has released patched AXIS OS versions for the highlighted flaw. Please...

CVE-2024-0055

The CVE-2024-0055 entry concerns AXIS OS where the VAPIX endpoints mediaclip.cgi and playclip.cgi are vulnerable to file globbing, enabling a resource-exhaustion (DoS) condition. Affected software is AXIS OS; the issue is fixed in patched AXIS OS versions as per Axis advisory. Connected sources c...

CVE-2024-0055

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis...

CVE-2024-0055

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis...

CVE-2024-0054

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs locallist.cgi, createoverlay.cgi and irissetup.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Axis has released patched AXIS OS versions for the highlighted flaw. Please...

CVE-2024-0054

CVE-2024-0054 affects Axis OS: the VAPIX endpoints local_list.cgi, create_overlay.cgi and irissetup.cgi are vulnerable to file globbing, enabling a resource-exhaustion DoS. The issue is rooted in how these APIs handle globbing, with exploitation described in Axis advisories and vendor-confirmed p...

AXIS OS Security Vulnerability

AXIS Os is an edge device operating system from Axis Sweden. A security vulnerability exists in AXIS OS versions 6.50 through 11.8, which stems from the VAPIX APIs locallist.cgi, createoverlay.cgi, and irissetup.cgi being susceptible to a file globbing attack that can lead to resource exhaustion...

AXIS OS Security Vulnerability

AXIS Os is an edge device operating system from AXIS of Sweden. A security vulnerability exists in AXIS OS versions 10.12 through 11.8, which stems from the vulnerability of the VAPIX APIs mediaclip.cgi and playclip.cgi to a file globbing attack that can lead to resource exhaustion...

PT-2024-15327 · Axis Communications · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS affected versions not specified Description: The VAPIX APIs are vulnerable to file globbing, which could lead to a resource exhaustion attack. The affected API endpoints include "local list.cgi", "create overlay.cgi", and...

PT-2024-15328 · Axis Communications · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS versions prior to the patched version Description: The VAPIX APIs, specifically the "mediaclip.cgi" and "playclip.cgi" endpoints, were found to be vulnerable to file globbing, which could lead to a resource exhaustion attack. This iss...

SUSE SLES12 Security Update : axis (SUSE-SU-2024:0851-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0851-1 advisory. - CVE-2023-51441: Fixed SSRF when untrusted input is passed to the service admin HTTP API bsc1218605. Tenable has extracted the preceding...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : axis (SUSE-SU-2024:0852-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0852-1 advisory. - CVE-2023-51441: Fixed SSRF when untrusted input is passed to the service admin HTTP API bsc1218605...

SUSE-SU-2024:0852-1 Security update for axis

This update for axis fixes the following issues: - CVE-2023-51441: Fixed SSRF when untrusted input is passed to the service admin HTTP API bsc1218605...

SUSE-SU-2024:0851-1 Security update for axis

This update for axis fixes the following issues: - CVE-2023-51441: Fixed SSRF when untrusted input is passed to the service admin HTTP API bsc1218605...

[SECURITY] Fedora 40 Update: vecmath1.2-1.14-36.fc40

This is an unofficial implementation java source code of the javax.vecmath package specified in the JavaTM 3D API 1.2 . The package includes classes for 3-space vector/point, 4-space vector, 4x4, 3x3 matrix, quaternion, axis-angle combination and etc. which are often utilized for computer graphic...

BIT-TENSORFLOW-2021-37685 Heap OOB in TensorFlow Lite

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TFLite's expanddims.cc contains a vulnerability which allows reading one element outside of bounds of heap allocated data. If axis is a large negative value e.g., -100000, then after the first if it would...

BIT-TENSORFLOW-2022-21726 Out of bounds read in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses. The axis argument can be -1 the default value for the optional argument or any other positive value at most the number of...

BIT-TENSORFLOW-2022-21727 Integer overflow in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness. The axis argument can be -1 the default value for the optional argument or any other positive value at most the number of dimensions of the...

Security Bulletin: Vulnerabilities in Apache Axis, Apache Shiro and SnakeYAML affect IBM WebSphere Service Registry and Repository

Summary An execute arbitrary code vulnerability in Apache Axis CVE-2023-40743, an authentication bypass vulnerability in Apache Shiro CVE-2023-34478 and several vulnerabilities in SnakeYAML incl. remote code execution vulnerability CVE-2022-1471 affect IBM WebSphere Service Registry and Repositor...