Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Axis Subscribe
Total 46 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2008-5260 1 Axis 1 Axis Camera Control 2018-10-11 9.3 HIGH N/A
Heap-based buffer overflow in the CamImage.CamImage.1 ActiveX control in AxisCamControl.ocx in AXIS Camera Control 2.40.0.0 allows remote attackers to execute arbitrary code via a long image_pan_tilt property value.
CVE-2018-10658 1 Axis 780 A1001, A1001 Firmware, A8004-v and 777 more 2018-08-20 5.0 MEDIUM 7.5 HIGH
There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash). The crash arises from code inside libdbus-send.so shared object or similar.
CVE-2018-10663 1 Axis 780 A1001, A1001 Firmware, A8004-v and 777 more 2018-08-20 5.0 MEDIUM 7.5 HIGH
An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation.
CVE-2018-10664 1 Axis 780 A1001, A1001 Firmware, A8004-v and 777 more 2018-08-20 5.0 MEDIUM 7.5 HIGH
An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption.
CVE-2018-10659 1 Axis 780 A1001, A1001 Firmware, A8004-v and 777 more 2018-08-20 5.0 MEDIUM 7.5 HIGH
There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of service (crash) by sending a crafted command which will result in a code path that calls the UND undefined ARM instruction.
CVE-2018-9158 1 Axis 2 M1033-w, M1033-w Firmware 2018-05-15 5.0 MEDIUM 7.5 HIGH
An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. They don't employ a suitable mechanism to prevent a DoS attack, which leads to a response time delay. An attacker can use the hping3 tool to perform an IPv4 flood attack, and the services are interrupted from attack start to end.
CVE-2018-9157 1 Axis 2 M1033-w, M1033-w Firmware 2018-05-15 7.6 HIGH 7.5 HIGH
** DISPUTED ** An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality.
CVE-2018-9156 1 Axis 2 P1354, P1354 Firmware 2018-05-15 7.6 HIGH 7.5 HIGH
** DISPUTED ** An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality.
CVE-2017-15885 1 Axis 2 2100 Network Camera, 2100 Network Camera Firmware 2017-11-14 4.3 MEDIUM 6.1 MEDIUM
Reflected XSS in the web administration portal on the Axis 2100 Network Camera 2.03 allows an attacker to execute arbitrary JavaScript via the conf_Layout_OwnTitle parameter to view/view.shtml. NOTE: this might overlap CVE-2007-5214.
CVE-2011-5261 1 Axis 2 M1054 Network Camera, M10 Series Network Cameras Firmware 2017-08-28 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in serverreport.cgi in Axis M10 Series Network Cameras M1054 firmware 5.21 and earlier allows remote attackers to inject arbitrary web script or HTML via the pageTitle parameter to admin/showReport.shtml.
CVE-2017-12413 1 Axis 2 2100 Network Camera, 2100 Network Camera Firmware 2017-08-15 4.3 MEDIUM 6.1 MEDIUM
AXIS 2100 devices 2.43 have XSS via the URI, possibly related to admin/admin.shtml.
CVE-2007-2239 1 Axis 10 2100 Network Camera, 2110 Network Camera, 2120 Network Camera and 7 more 2017-07-28 9.3 HIGH N/A
Stack-based buffer overflow in the SaveBMP method in the AXIS Camera Control (aka CamImage) ActiveX control before 2.40.0.0 in AxisCamControl.ocx in AXIS 2100, 2110, 2120, 2130 PTZ, 2420, 2420-IR, 2400, 2400+, 2401, 2401+, 2411, and Panorama PTZ allows remote attackers to cause a denial of service (Internet Explorer crash) or execute arbitrary code via a long argument.
CVE-2003-1386 1 Axis 2 2400 Video Server, 2401 Video Server 2017-07-28 6.4 MEDIUM N/A
AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, which displays the server's /var/log/messages file.
CVE-2004-2426 1 Axis 14 2100 Network Camera, 2110 Network Camera, 2120 Network Camera and 11 more 2017-07-10 5.0 MEDIUM N/A
Directory traversal vulnerability in Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to bypass authentication via a .. (dot dot) in an HTTP POST request to ServerManager.srv, then use these privileges to conduct other activities, such as modifying files using editcgi.cgi.
CVE-2004-2425 1 Axis 14 2100 Network Camera, 2110 Network Camera, 2120 Network Camera and 11 more 2017-07-10 7.5 HIGH N/A
Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent (`) and possibly other shell metacharacters in the query string to virtualinput.cgi.
CVE-2004-0789 9 Axis, Delegate, Dnrd and 6 more 15 2100 Network Camera, 2110 Network Camera, 2120 Network Camera and 12 more 2017-07-10 5.0 MEDIUM N/A
Multiple implementations of the DNS protocol, including (1) Poslib 1.0.2-1 and earlier as used by Posadis, (2) Axis Network products before firmware 3.13, and (3) Men & Mice Suite 2.2x before 2.2.3 and 3.5.x before 3.5.2, allow remote attackers to cause a denial of service (CPU and network bandwidth consumption) by triggering a communications loop via (a) DNS query packets with localhost as a spoofed source address, or (b) a response packet that triggers a response packet.
CVE-2003-0240 1 Axis 9 2100 Network Camera, 2110 Network Camera, 2120 Network Camera and 6 more 2017-07-10 10.0 HIGH N/A
The web-based administration capability for various Axis Network Camera products allows remote attackers to bypass access restrictions and modify configuration via an HTTP request to the admin/admin.shtml containing a leading // (double slash).
CVE-2015-8257 1 Axis 11 Cannon Network Camera, Explosion-protected Camera, Fixed Box Camera and 8 more 2017-05-16 9.0 HIGH 8.8 HIGH
The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to (1) app_license.shtml, (2) app_license_custom.shtml, (3) app_index.shtml, or (4) app_params.shtml.
CVE-2015-8256 1 Axis 11 Cannon Network Camera, Explosion-protected Camera, Fixed Box Camera and 8 more 2017-04-24 4.3 MEDIUM 6.1 MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras.
CVE-2015-8258 1 Axis 1 Axis Communications Firmware 2017-04-13 7.8 HIGH 7.5 HIGH
AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability."