unnamed
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS 10b61619-3869-496c-8a1e-f291b0e71e3f
03
assessed vulnerabilities (21)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-2252US | — | — | ||
An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references… | ||||
| CVE-2026-2251US | — | — | ||
Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE.
This issue aff… | ||||
| CVE-2026-1769US | medium5.4 | Exploit | ||
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xerox CentreWare on Windows allows Stored XSS.This issue affects Centre… | ||||
| CVE-2025-8356US | — | — | ||
In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE… | ||||
| CVE-2025-8355US | high7.5 | — | ||
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal UR… | ||||
| CVE-2025-1984US | — | — | ||
Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access. | ||||
| CVE-2024-12511US | —OT elevated | — | ||
With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access. | ||||
| CVE-2024-12510US | — | — | ||
If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup. | ||||
| CVE-2024-55931US | medium6.5 | — | ||
Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised.
The patch for this vulnerability will be inc… | ||||
| CVE-2024-55930US | critical9.8OT elevated | — | ||
Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files | ||||
| CVE-2024-55929US | medium5.3OT elevated | — | ||
A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sources. | ||||
| CVE-2024-55928US | high7.5OT elevated | — | ||
Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets without encryption | ||||
| CVE-2024-55927US | high7.5OT elevated | — | ||
A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to… | ||||
| CVE-2024-55926US | critical9.8 | — | ||
A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation… | ||||
| CVE-2024-55925US | — | — | ||
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without… | ||||
| CVE-2024-6333US | — | Exploit | ||
Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products. | ||||
| CVE-2024-47559US | high8.8 | — | ||
Authenticated RCE via Path Traversal | ||||
| CVE-2024-47558US | high8.8 | — | ||
Authenticated RCE via Path Traversal | ||||
| CVE-2024-47557US | critical9.8 | — | ||
Pre-Auth RCE via Path Traversal | ||||
| CVE-2024-47556US | critical9.8 | — | ||
Pre-Auth RCE via Path Traversal | ||||