Axis Communications AB

GoSecure on behalf of Genetec Inc.

The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.

The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution.

Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution.

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to…

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary SMTP headers in the ge…

A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation.

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework.

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion.

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service…

During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack t…

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients.

An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation.

An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation.

An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation.

ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation.

NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications.

The ACAP Application framework could allow privilege escalation through a symlink attack.

Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to trans…

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for file deletion.

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder deletion.

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing for an attacker to block access to the overlay configuration p…

User controlled parameters related to SMTP notifications are not correctly validated.

An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution.

An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation.