Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.
Product
FreeFlow-Druckserver ist eine Druckserveranwendung für Xerox-Produktionsdrucker, die Flexibilität, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.
Vulnerabilities 108
-
Critical 9.6CVE-2022-26486 Exploited
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…
KEV Mar 7, 2022 -
High 8.8
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…
KEV Mar 7, 2022 -
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Apr 13, 2022 -
High 7.0
Windows User Profile Service Elevation of Privilege Vulnerability
Windows User Profile Service Elevation of Privilege Vulnerability
KEV Apr 25, 2022 -
Critical 9.8
Windows Network File System Remote Code Execution Vulnerability
Windows Network File System Remote Code Execution Vulnerability
-
Critical 9.8
Windows Network File System Remote Code Execution Vulnerability
Windows Network File System Remote Code Execution Vulnerability
-
Critical 9.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
Critical 9.6
If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to th…
-
Critical 9.6
If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scr…
-
High 8.8
Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen,…
-
High 8.8
Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 9…
-
High 8.8
By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute …
-
High 8.8
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have bee…
-
High 8.8
When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone n…
-
High 8.8
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors …
-
High 8.8
Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firef…
-
High 8.8
Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 8.8
Windows SMB Remote Code Execution Vulnerability
Windows SMB Remote Code Execution Vulnerability
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 8.8
Windows Server Service Remote Code Execution Vulnerability
Windows Server Service Remote Code Execution Vulnerability
-
High 8.8
An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially explo…
-
High 8.8CVE-2022-28281 Public exploit
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent p…
-
High 8.8
SVG's <code><use></code> element could have been used to load unexpected content that could have executed script …
-
High 8.8
Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory …
-
High 8.8
Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team …
-
High 8.1
Windows Kerberos Remote Code Execution Vulnerability
Windows Kerberos Remote Code Execution Vulnerability
-
High 8.1
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
-
High 8.0
Remote Desktop Protocol Remote Code Execution Vulnerability
Remote Desktop Protocol Remote Code Execution Vulnerability
-
High 7.8
Windows Hyper-V Remote Code Execution Vulnerability
Windows Hyper-V Remote Code Execution Vulnerability
-
High 7.8
Windows Win32k Elevation of Privilege Vulnerability
Windows Win32k Elevation of Privilege Vulnerability
-
High 7.8
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
-
High 7.8
Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
-
High 7.8CVE-2022-24494 Public exploit
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
-
High 7.8
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
-
High 7.8
Microsoft Endpoint Configuration Manager Elevation of Privilege Vulnerability
Microsoft Endpoint Configuration Manager Elevation of Privilege Vulnerability
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
-
High 7.8
Windows Hyper-V Remote Code Execution Vulnerability
Windows Hyper-V Remote Code Execution Vulnerability
-
High 7.8
Windows Win32k Elevation of Privilege Vulnerability
Windows Win32k Elevation of Privilege Vulnerability
-
High 7.8
Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
-
High 7.8
Windows Digital Media Receiver Elevation of Privilege Vulnerability
Windows Digital Media Receiver Elevation of Privilege Vulnerability
-
High 7.8
Windows AppX Package Manager Elevation of Privilege Vulnerability
Windows AppX Package Manager Elevation of Privilege Vulnerability
-
High 7.8
Windows Telephony Server Elevation of Privilege Vulnerability
Windows Telephony Server Elevation of Privilege Vulnerability
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 7.8
PowerShell Elevation of Privilege Vulnerability
PowerShell Elevation of Privilege Vulnerability
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
High 7.8CVE-2022-26810 Public exploit
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
-
High 7.8
Windows Graphics Component Remote Code Execution Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability
-
High 7.8
Windows Fax Compose Form Remote Code Execution Vulnerability
Windows Fax Compose Form Remote Code Execution Vulnerability
-
High 7.8
Windows Fax Compose Form Remote Code Execution Vulnerability
Windows Fax Compose Form Remote Code Execution Vulnerability
-
High 7.8
Windows Fax Compose Form Remote Code Execution Vulnerability
Windows Fax Compose Form Remote Code Execution Vulnerability
-
High 7.5
Win32 Stream Enumeration Remote Code Execution Vulnerability
Win32 Stream Enumeration Remote Code Execution Vulnerability
-
High 7.5
Win32 File Enumeration Remote Code Execution Vulnerability
Win32 File Enumeration Remote Code Execution Vulnerability
-
High 7.5
Win32 Stream Enumeration Remote Code Execution Vulnerability
Win32 Stream Enumeration Remote Code Execution Vulnerability
-
High 7.5
Regular expression denial of service in Rust's regex crate
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations…
-
High 7.5
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming …
-
High 7.5
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
-
High 7.5
Windows Secure Channel Denial of Service Vulnerability
Windows Secure Channel Denial of Service Vulnerability
-
High 7.2
Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
-
High 7.1
A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write …
-
High 7.0
Windows ALPC Elevation of Privilege Vulnerability
Windows ALPC Elevation of Privilege Vulnerability
-
High 7.0
Windows Direct Show Remote Code Execution Vulnerability
Windows Direct Show Remote Code Execution Vulnerability
-
High 7.0
Windows ALPC Elevation of Privilege Vulnerability
Windows ALPC Elevation of Privilege Vulnerability
-
High 7.0
Windows Work Folder Service Elevation of Privilege Vulnerability
Windows Work Folder Service Elevation of Privilege Vulnerability
-
High 7.0
Windows File Explorer Elevation of Privilege Vulnerability
Windows File Explorer Elevation of Privilege Vulnerability
-
High 7.0
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
-
Medium 6.5
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on diffe…
-
Medium 6.5
If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so,…
-
Medium 6.5
Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to conne…
-
Medium 6.5
When importing resources using Web Workers, error messages would distinguish the difference between <code>application/j…
-
Medium 6.5
Windows iSCSI Target Service Information Disclosure Vulnerability
Windows iSCSI Target Service Information Disclosure Vulnerability
-
Medium 6.5
In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to…
-
Medium 6.5
By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object…
-
Medium 6.5
The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to includ…
-
Medium 6.5
When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conju…
-
Medium 6.5
In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. …
-
Medium 5.5CVE-2022-24483 Public exploit
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
Medium 5.5
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
-
Medium 5.4
Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user con…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Sup…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Sup…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Sup…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.3CVE-2022-21340 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serializat…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Suppo…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). …
-
Medium 4.3
Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed u…
-
Medium 4.3
While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page f…
-
Medium 4.3
When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serializat…
Revision history
-
#2
Neue Updates von XEROX aufgenommen
-
#1
Initiale Fassung
References
-
XEROX Security Advisory XRX23-005 vom 2023-04-04
https://security.business.xerox.com/wp-content/uploads/2023/04/Xerox-Security-Bulletin-XRX23-005-Xerox%25C2%25AE-FreeFlow%25C2%25AE-Print-Server-v9.pdf
-
Xerox Security Bulletin vom 2022-05-11
https://security.business.xerox.com/wp-content/uploads/2022/05/Xerox-Security-Bulletin-XRX22-010-FreeFlowPrint-Server-v2-Windows10.pdf