Vendor
Xerox
23 known vulnerabilities.
Products
12 results · Clear filters · Feed
-
High 7.5
XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)
An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. P…
-
High 7.5CVE-2025-8355 EPSS 11%
XXE leading to SSRF
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).
-
High 7.6
SMB/FTP Address Book Scan Pass-back attack
With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access.
-
High 7.6
Flawed token generation implementation & Hard-coded key implementation
A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to unauthorized access to sensitive functions.
-
High 7.6
Arbitrary file upload, deletion and read through header manipulation
A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data
-
High 7.5
API Security bypass through header manipulation
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unautho…
-
High 7.2CVE-2024-6333 Public exploit
Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products
Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.
-
High 7.6
Authenticated RCE via Path Traversal
Authenticated RCE via Path Traversal
-
High 7.6
Authenticated RCE via Path Traversal
Authenticated RCE via Path Traversal
-
High 8.3
-
High 8.3
-
High 8.3
Missing Authentication - User & System Configuration
Missing Authentication - User & System Configuration