Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Dateien zu manipulieren.
Product
FreeFlow-Druckserver ist eine Druckserveranwendung für Xerox-Produktionsdrucker, die Flexibilität, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.
Vulnerabilities 119
-
High 7.0CVE-2022-21919 Exploited
Windows User Profile Service Elevation of Privilege Vulnerability
Windows User Profile Service Elevation of Privilege Vulnerability
KEV Apr 25, 2022 -
Critical 9.8
Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, …
-
Critical 9.8
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability af…
-
Critical 9.8
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
-
Critical 9.0
Windows Hyper-V Elevation of Privilege Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability
-
High 8.8
Remote Desktop Client Remote Code Execution Vulnerability
Remote Desktop Client Remote Code Execution Vulnerability
-
High 8.8
Remote Desktop Client Remote Code Execution Vulnerability
Remote Desktop Client Remote Code Execution Vulnerability
-
High 8.8
Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
-
High 8.8
Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 8.8
Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow c…
-
High 8.8
Certain network request objects were freed too early when releasing a network request handle. This could have lead to a…
-
High 8.8
The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This …
-
High 8.8
Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon…
-
High 8.8
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these …
-
High 8.0
Remote Desktop Protocol Remote Code Execution Vulnerability
Remote Desktop Protocol Remote Code Execution Vulnerability
-
High 7.8
Virtual Machine IDE Drive Elevation of Privilege Vulnerability
Virtual Machine IDE Drive Elevation of Privilege Vulnerability
-
High 7.8
Microsoft Cryptographic Services Elevation of Privilege Vulnerability
Microsoft Cryptographic Services Elevation of Privilege Vulnerability
-
High 7.8
Windows Certificate Spoofing Vulnerability
Windows Certificate Spoofing Vulnerability
-
High 7.8
Windows Security Center API Remote Code Execution Vulnerability
Windows Security Center API Remote Code Execution Vulnerability
-
High 7.8
Windows Geolocation Service Remote Code Execution Vulnerability
Windows Geolocation Service Remote Code Execution Vulnerability
-
High 7.8
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
-
High 7.8
Windows User Profile Service Elevation of Privilege Vulnerability
Windows User Profile Service Elevation of Privilege Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
-
High 7.8
Windows DWM Core Library Elevation of Privilege Vulnerability
Windows DWM Core Library Elevation of Privilege Vulnerability
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
-
High 7.8
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
-
High 7.5
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
-
High 7.5
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
-
High 7.5
Windows GDI+ Information Disclosure Vulnerability
Windows GDI+ Information Disclosure Vulnerability
-
High 7.5
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
-
High 7.5
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
-
High 7.5
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
-
High 7.5
Windows GDI Information Disclosure Vulnerability
Windows GDI Information Disclosure Vulnerability
-
High 7.5
Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could h…
-
High 7.5
When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. …
-
High 7.0
Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability
Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability
-
High 7.0
Windows AppContracts API Server Elevation of Privilege Vulnerability
Windows AppContracts API Server Elevation of Privilege Vulnerability
-
High 7.0
Windows Application Model Core API Elevation of Privilege Vulnerability
Windows Application Model Core API Elevation of Privilege Vulnerability
-
High 7.0
Windows StateRepository API Server file Elevation of Privilege Vulnerability
Windows StateRepository API Server file Elevation of Privilege Vulnerability
-
High 7.0
Windows UI Immersive Server API Elevation of Privilege Vulnerability
Windows UI Immersive Server API Elevation of Privilege Vulnerability
-
High 7.0
Windows System Launcher Elevation of Privilege Vulnerability
Windows System Launcher Elevation of Privilege Vulnerability
-
High 7.0
Windows Push Notifications Apps Elevation of Privilege Vulnerability
Windows Push Notifications Apps Elevation of Privilege Vulnerability
-
High 7.0
Windows Devices Human Interface Elevation of Privilege Vulnerability
Windows Devices Human Interface Elevation of Privilege Vulnerability
-
High 7.0
Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability
Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability
-
High 7.0
Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability
Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability
-
High 7.0
Tile Data Repository Elevation of Privilege Vulnerability
Tile Data Repository Elevation of Privilege Vulnerability
-
High 7.0
Windows Storage Elevation of Privilege Vulnerability
Windows Storage Elevation of Privilege Vulnerability
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 7.0
Windows GDI Elevation of Privilege Vulnerability
Windows GDI Elevation of Privilege Vulnerability
-
High 7.0
If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched …
-
Medium 6.8
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
-
Medium 6.8
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
-
Medium 6.8
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
-
Medium 6.8
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
-
Medium 6.8
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
-
Medium 6.8
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
-
Medium 6.5
When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory co…
-
Medium 6.5
Windows GDI+ Information Disclosure Vulnerability
Windows GDI+ Information Disclosure Vulnerability
-
Medium 6.5
Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This…
-
Medium 6.5
When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potent…
-
Medium 6.5
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerab…
-
Medium 6.5
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have l…
-
Medium 6.5
Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handli…
-
Medium 6.5
By generally accepting and passing resource handles across processes, a compromised content process might have confused…
-
Medium 6.3
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
-
Medium 5.9
A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window …
-
Medium 5.5
Windows Cleanup Manager Elevation of Privilege Vulnerability
Windows Cleanup Manager Elevation of Privilege Vulnerability
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Win32k Information Disclosure Vulnerability
-
Medium 5.5
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
Medium 5.5
Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability
Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Sup…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Sup…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Sup…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.3CVE-2022-21340 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serializat…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Suppo…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). …
-
Medium 5.3
Local Security Authority (Domain Policy) Remote Protocol Security Feature Bypass
Local Security Authority (Domain Policy) Remote Protocol Security Feature Bypass
-
Medium 5.3
Workstation Service Remote Protocol Security Feature Bypass Vulnerability
Workstation Service Remote Protocol Security Feature Bypass Vulnerability
-
Medium 4.6
Windows Hyper-V Security Feature Bypass Vulnerability
Windows Hyper-V Security Feature Bypass Vulnerability
-
Medium 4.6
Windows Hyper-V Security Feature Bypass Vulnerability
Windows Hyper-V Security Feature Bypass Vulnerability
-
Medium 4.4CVE-2022-21894 Public exploit
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
Medium 4.3
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made th…
-
Medium 4.3
When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serializat…
-
Unscored —
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such…
-
Unscored —
When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have …
-
Unscored —
Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to…
-
Unscored —
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user…
-
Unscored —
The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while …
-
Unscored —
By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geol…
-
Unscored —
Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled…
-
Unscored —
The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run …
-
Unscored —CVE-2021-43530 Public exploit
A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a…
-
Unscored —
When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element c…
-
Unscored —
The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that tr…
-
Unscored —
When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some o…
-
Unscored —
Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. T…
-
Unscored —
An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a p…
-
Unscored —
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that h…
-
Unscored —
Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within …
-
Unscored —
WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that…
-
Unscored —
When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly esc…
-
Unscored —
Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading ex…
-
Unscored —
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additi…
-
Unscored —
When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the addr…
-
Unscored —
Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thu…
-
Unscored —
It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerabil…
Revision history
-
#4
Neue Updates von XEROX aufgenommen
-
#3
Neue Updates von XEROX aufgenommen
-
#2
Neue Updates von XEROX aufgenommen
-
#1
Initiale Fassung
References
-
Xerox Security Bulletin: XR22-001 vom 2022-02-03
https://securitydocs.business.xerox.com/wp-content/uploads/2022/02/Xerox-Security-Bulletin-XRX22-001-XeroxFreeFlowPrintServer-v2Window10.pdf
-
Xerox Security Bulletin
https://security.business.xerox.com/wp-content/uploads/2022/02/Xerox-Security-Bulletin-XRX22-004-FreeFlowPrint-Server-v9.pdf
-
Xerox Security Bulletin
https://security.business.xerox.com/wp-content/uploads/2022/02/Xerox-Security-Bulletin-XRX22-007-FreeFlowPrint-Server-v9.pdf
-
XEROX Security Advisory XRX22-005 vom 2022-02-14
https://securitydocs.business.xerox.com/wp-content/uploads/2022/02/Xerox-Security-Bulletin-XRX22-005-FreeFlow-Print-Server-v7.pdf
-
Xerox Security Bulletin
https://security.business.xerox.com/wp-content/uploads/2022/02/Xerox-Security-Bulletin-XRX22-006-FreeFlowPrint-Server-v7.pdf
-
XEROX Security Advisory XRX22-004 vom 2022-02-14
https://securitydocs.business.xerox.com/wp-content/uploads/2022/02/Xerox-Security-Bulletin-XRX22-004-FreeFlowPrint-Server-v9.pdf
-
XEROX Security Advisory XRX23-005 vom 2023-04-04
https://security.business.xerox.com/wp-content/uploads/2023/04/Xerox-Security-Bulletin-XRX23-005-Xerox%25C2%25AE-FreeFlow%25C2%25AE-Print-Server-v9.pdf
-
XEROX Security Advisory XRX25-017 vom 2025-10-07
https://security.business.xerox.com/wp-content/uploads/2025/10/Xerox-Security-Bulletin-XRX25-017-for-Xerox-FreeFlow-Print-Server-v9.pdf