Xerox

Latest CVEs · RSS

• CVE-2026-2252 2026-02-27 · CVSS 7.5
  An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious extern
• CVE-2026-2251 2026-02-27 · CVSS 9.8
  Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to
• CVE-2026-1769 2026-02-06 · CVSS 5.3
  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xerox CentreWare on Windows allows Stored XSS.This
• CVE-2025-8356 2025-08-08 · CVSS 9.8
  In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote
• CVE-2025-8355 2025-08-08 · CVSS 7.5
  In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing refer
• CVE-2025-1984 2025-03-12 · CVSS 5.2
  Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level ac
• CVE-2024-12511 2025-02-03 · CVSS 7.6
  With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and pri
• CVE-2024-12510 2025-02-03 · CVSS 6.7
  If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active
• CVE-2024-55931 2025-01-27 · CVSS 6.5
  Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised.  The patch for this vulne
• CVE-2024-55930 2025-01-23 · CVSS 6.7
  Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files
• CVE-2024-55929 2025-01-23 · CVSS 5.3
  A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted source
• CVE-2024-55928 2025-01-23 · CVSS 6.5
  Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets wit
• CVE-2024-55927 2025-01-23 · CVSS 7.6
  A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forg
• CVE-2024-55926 2025-01-23 · CVSS 7.6
  A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting
• CVE-2024-55925 2025-01-23 · CVSS 7.5
  In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the
• CVE-2024-6333 2024-10-17 · CVSS 7.2
  Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.
• CVE-2024-47559 2024-10-07 · CVSS 7.6
  Authenticated RCE via Path Traversal
• CVE-2024-47558 2024-10-07 · CVSS 7.6
  Authenticated RCE via Path Traversal
• CVE-2024-47557 2024-10-07 · CVSS 8.3
  Pre-Auth RCE via Path Traversal
• CVE-2024-47556 2024-10-07 · CVSS 8.3
  Pre-Auth RCE via Path Traversal
• CVE-2024-47555 2024-10-07 · CVSS 8.3
  Missing Authentication - User & System Configuration