DeutschShown in its original language — a full translation is planned for a future version.
Xerox FreeFlow Print Server: Mehrere Schwachstellen
view advisory published 2023-11-14
Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
01
describes (135)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-3666US | — | — | ||
The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cros… | ||||
| CVE-2023-30587US | — | — | ||
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector).
By exploiti… | ||||
| CVE-2023-30584US | — | — | ||
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass wh… | ||||
| CVE-2023-30583US | — | — | ||
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20. This flaw arises from a miss… | ||||
| CVE-2023-30582US | — | — | ||
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This fl… | ||||
| CVE-2023-40477US | — | Exploit | ||
RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affect… | ||||
| CVE-2023-30590US | high7.5OT elevated | — | ||
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set… | ||||
| CVE-2023-30588US | medium5.3OT elevated | — | ||
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when th… | ||||
| CVE-2023-30585US | high7.5OT elevated | — | ||
A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vuln… | ||||
| CVE-2023-30581US | high7.5OT elevated | — | ||
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects… | ||||
| CVE-2023-45802US | medium5.9 | Exploit | ||
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was defer… | ||||
| CVE-2023-43622US | high7.5 | Exploit | ||
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to e… | ||||
| CVE-2023-31122US | high7.5 | — | ||
Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. | ||||
| CVE-2023-22129US | — | — | ||
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows low privi… | ||||
| CVE-2023-22128US | low3.1 | — | ||
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allo… | ||||
| CVE-2023-22081US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected ar… | ||||
| CVE-2023-22067US | —OT elevated | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381… | ||||
| CVE-2023-22025US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE (component: Hotspot). Supported versions that are affecte… | ||||
| CVE-2023-4504US | high7.0 | Exploit | ||
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code e… | ||||
| CVE-2023-32665US | medium5.5 | — | ||
A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of servic… | ||||
showing 20 of 135
02
references
External citations — patches, advisories, analysis.
- openSUSE Security Update OPENSUSE-SU-2024:14572-1 vom 2024-12-13external
- SUSE Security Update SUSE-SU-2024:3949-1 vom 2024-11-08external
- XEROX Security Advisory XRX23-022 vom 2023-12-01external
- XEROX Security Advisory XRX23-019 vom 2023-11-16external
- XEROX Security Advisory XRX24-001 vom 2024-03-11external
- XEROX Security Advisory XRX24-005 vom 2024-03-04external
- Xerox Security Bulletin XRX23-016 vom 2023-11-14external
- Xerox Security Bulletin XRX23-017 vom 2023-11-14external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan