Xerox: Security Vulnerabilities
Pre-Auth RCE via Path Traversal
CVSS Score
8.3
EPSS Score
0.002
Published
2024-10-07
Pre-Auth RCE via Path Traversal
CVSS Score
8.3
EPSS Score
0.002
Published
2024-10-07
Authenticated RCE via Path Traversal
CVSS Score
7.6
EPSS Score
0.002
Published
2024-10-07
Authenticated RCE via Path Traversal
CVSS Score
7.6
EPSS Score
0.002
Published
2024-10-07
Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encryption key, the information such as the server credentials may be obtained from the exported Address Book data. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS Score
5.9
EPSS Score
0.002
Published
2023-11-02
On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored cleartext credentials associated with those settings.
CVSS Score
6.5
EPSS Score
0.001
Published
2023-01-31
Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitive information.
CVSS Score
7.5
EPSS Score
0.003
Published
2022-04-04
Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub_3226AC via the TIMEZONE variable. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
CVSS Score
9.8
EPSS Score
0.004
Published
2022-02-15
A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0.
CVSS Score
4.8
EPSS Score
0.006
Published
2022-02-10
XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database.
CVSS Score
7.5
EPSS Score
0.003
Published
2022-02-07
Page 1