Cookiejack15

**Name of the Vulnerable Software and Affected Versions** Axis ACAP framework (affected versions not specified) **Description** The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which is a software bug where a system checks the state of a resource before using it, but the state changes between the check and the use. This issue could potentially lead to privilege escalation. Exploitation requires the Axis device to be configured to allow the installation of unsigned ACAP applications and for an attacker to convince the victim to install a malicious ACAP application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Axis Communications ACAP (affected versions not specified) **Description** An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This issue is exploitable only if the device is configured to allow the installation of unsigned ACAP applications and a user is convinced to install a malicious ACAP application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Axis ACAP framework (affected versions not specified) **Description** The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which is a software bug where a system checks the state of a resource before using it, but the state changes between the check and the use. This issue could potentially lead to privilege escalation. Exploitation requires the Axis device to be configured to allow the installation of unsigned ACAP applications and for an attacker to convince the victim to install a malicious ACAP application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the installation of unsigned ACAP applications to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Axis (affected versions not specified) **Description** Improper input validation in a configuration file on the local file system could allow code execution and potentially lead to privilege escalation. This issue can only be exploited if an attacker has SSH access to the Axis device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dovecot versions prior to 2.4.3 **Description** If the `auth username chars` setting is empty, an attacker can inject arbitrary LDAP filters into Dovecot's LDAP authentication process. This can bypass restrictions and allow probing of the LDAP structure. No publicly available exploits are known. **Recommendations** Do not clear out the `auth username chars` setting. Install version 2.4.3 or later.