Xerox vulnerabilities, page 3
99 vulnerabilities
Known vulnerabilities in Xerox products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 221 products.
CVE-2022-23320xeroxxmpie_ustore
EPSS score1.64%
XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database.CVE-2022-23968xeroxversalink_firmwareEPSS score1.91%
Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot, but image parsing is restarted as soon as the boot process finishes. However, this boot loop can be resolved by a field technician. The TIFF file must have an incomplete Image Directory. Affected firmware versions include xx.42.01 and xx.50.61. NOTE: the 2022-01-24 NeoSmart article included "believed to affect all previous and later versions as of the date of this posting" but a 2022-01-26 vendor statement reports "the latest versions of firmware are not vulnerable to this issue."CVE-2012-0569sunsunos+1EPSS score0.35%
Unspecified vulnerability Oracle Sun Solaris 10 allows local users to affect confidentiality and integrity via unknown vectors related to Install/smpatch.CVE-2012-0773adobeadobe_air+3EPSS score5.44%
The NetStream class in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228 on Windows, Mac OS X, and Linux; Flash Player before 10.3.183.18 and 11.x before 11.2.202.223 on Solaris; Flash Player before 11.1.111.8 on Android 2.x and 3.x; and AIR before 3.2.0.2070 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.CVE-2010-0549xeroxworkcentre_6400_net_controller+1EPSS score1.22%
Unspecified vulnerability in the Network Controller in Xerox WorkCentre 6400 System Software 060.070.109.11407 through 060.070.109.29510, and Net Controller 060.079.11410 through 060.079.29310, allows remote attackers to access "directory structure" via a crafted PostScript file, aka "Unauthorized Directory Structure Access Vulnerability."CVE-2024-55927xeroxworkplace_suite+1EPSS score0.27%
A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to unauthorized access to sensitive functions.CVE-2024-55925xeroxworkplace_suite+1EPSS score0.36%
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.CVE-2024-55930xeroxworkplace_suite+1EPSS score0.29%
Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete filesCVE-2024-55929xeroxworkplace_suite+1EPSS score0.18%
A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sources.CVE-2024-55931xeroxworkplace_suite+1EPSS score0.36%
Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised.
The patch for this vulnerability will be included in a future release of Workplace Suite, and customers will be notified through an update to the security bulletin.CVE-2024-55928xeroxworkplace_suite+1EPSS score0.15%
Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets without encryptionCVE-2024-55926xeroxworkplace_suite+1EPSS score0.42%
A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to dataCVE-2024-47559xeroxfreeflow_coreEPSS score0.50%
Authenticated RCE via Path TraversalCVE-2024-47555xeroxfreeflow_coreEPSS score0.23%
Missing Authentication - User & System ConfigurationCVE-2024-47558xeroxfreeflow_coreEPSS score0.50%
Authenticated RCE via Path TraversalCVE-2024-47557xeroxfreeflow_coreEPSS score0.52%
Pre-Auth RCE via Path TraversalCVE-2024-47556xeroxfreeflow_coreEPSS score0.52%
Pre-Auth RCE via Path TraversalCVE-2024-6333xeroxaltalink® b8045 / b8055 / b8065 / b8075 / b8090 | c8030 / c8035 / c8045 / c8055 / c807+16EPSS score1.17%
Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.CVE-2024-12511xeroxphaser_6510_firmware+16EPSS score0.62%
With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access.CVE-2024-12510xeroxphaser_6510_firmware+16EPSS score0.97%
If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup.