WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor axis✕Has a public PoC✕
Overview 16 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 5 EPSS ≥ 0.5
16matches 0in Waratek scope0.0% 0protected0.0% 1exploited6.2% 0CISA KEV0.0% 5EPSS ≥ 0.531.2%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 6.2% Not applicable 15 93.8% Withdrawn CVE 0 0.0%
Critical 3 18.8% High 9 56.2% Medium 4 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 16 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 6.2% Working exploit published 15 93.8% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 4 / year
Not applicable: 15Outside Waratek scope: 1 Medium: 4High: 9Critical: 3 not blocked: 16 Working exploit published: 15Exploited: 1
20001 Not applicable1 High1 not blocked1 Working exploit published1 20010 20020 20032 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20041 Not applicable1 High1 not blocked1 Working exploit published1 20050 20060 20072 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20080 20090 20100 20110 20120 20132 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20140 20150 20160 20174 Not applicable4 High3 Medium1 not blocked4 Working exploit published4 20183 Not applicable3 Critical3 not blocked3 Exploited1 Working exploit published2 20191 Outside Waratek scope1 High1 not blocked1 Working exploit published1
2001200320052007200920112013201520172019
16 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-0227 High 2019-05-01 Outside Waratek scope Working exploit published A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
CVE-2018-10662 Critical 2018-06-26 Not applicable Working exploit published An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.
CVE-2018-10661 Critical 2018-06-26 Not applicable Exploited An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.
CVE-2018-10660 Critical 2018-06-26 Not applicable Working exploit published An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
CVE-2015-8257 High 2017-05-02 Not applicable Working exploit published The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to (1) app_license.shtml, (2) app_license_custom.shtml, (3) app_index.shtml, or (4) app_params.shtml.
CVE-2015-8256 Medium 2017-04-17 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras.
CVE-2015-8258 High 2017-04-10 Not applicable Working exploit published AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability."
CVE-2015-8255 High 2017-04-10 Not applicable Working exploit published AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi.
CVE-2013-3543 High 2013-10-04 Not applicable Working exploit published The AXIS Media Control (AMC) ActiveX control (AxisMediaControlEmb.dll) 6.2.10.11 for AXIS network cameras allows remote attackers to create or overwrite arbitrary files via a file path to the (1) StartRecord, (2) SaveCurrentImage, or (3) StartRecordMedia methods.
CVE-2011-5261 Medium 2013-02-12 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in serverreport.cgi in Axis M10 Series Network Cameras M1054 firmware 5.21 and earlier allows remote attackers to inject arbitrary web script or HTML via the pageTitle parameter to admin/showReport.shtml.
CVE-2007-4930 Medium 2007-09-18 Not applicable Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 207W camera allow remote attackers to perform certain actions as administrators via (1) axis-cgi/admin/restart.cgi, (2) the user and sgrp parameters to axis-cgi/admin/pwdgrp.cgi in an add action, or (3) the server parameter to admin/restartMessage.shtml.
CVE-2007-2239 High 2007-05-07 Not applicable Working exploit published Stack-based buffer overflow in the SaveBMP method in the AXIS Camera Control (aka CamImage) ActiveX control before 2.40.0.0 in AxisCamControl.ocx in AXIS 2100, 2110, 2120, 2130 PTZ, 2420, 2420-IR, 2400, 2400+, 2401, 2401+, 2411, and Panorama PTZ allows remote attackers to cause a denial of service (Internet Explorer crash) or execute arbitrary code via a long argument.
CVE-2004-2425 High 2004-12-31 Not applicable Working exploit published Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent (`) and possibly other shell metacharacters in the query string to virtualinput.cgi.
CVE-2003-1386 Medium 2003-12-31 Not applicable Working exploit published AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, which displays the server's /var/log/messages file.
CVE-2003-0240 High 2003-06-09 Not applicable Working exploit published The web-based administration capability for various Axis Network Camera products allows remote attackers to bypass access restrictions and modify configuration via an HTTP request to the admin/admin.shtml containing a leading // (double slash).
CVE-2000-0191 High 2000-02-29 Not applicable Working exploit published Axis StorPoint CD allows remote attackers to access administrator URLs without authentication via a .. (dot dot) attack.