CVE-2021-3438

包含哪些内容？ CVE-2021-3438detection v2sccm.ps1 是一个通过 SCCM 运行以获取受管理设备漏洞小型报告的脚本。 CVE-2021-3438detection.ps1 是一个在受管理设备上手动或远程运行的脚本。 CVE-2021-3438remediation.ps1 是一个用于检查并在检测到易受攻击的驱动程序时运行安装程序的脚本。 HP-Samsung.exe 是 HP/Samsung 修复安装程序 Xerox 是 Xerox 修复安装程序。 如何执行这些脚本？ 即时运行： root@kitploit: PS...

CVE-2024-6333

CVE-2024-6333 - 제록스 인증된 원격 코드 실행 제록스 WorkCentre 프린터의 네트워크 문제 해결 로그 기능을 통한 인증된 원격 코드 실행 취약점입니다. 설명 네트워크 문제 해결 로그 기능/properties/security/networktroubleshootinglog.php은 대상 서버 매개변수security.nwtroubleshoot.destination.server를 적절히 검증하지 않아, 인증된 관리자가 임의의 OS 명령을 주입할 수 있습니다. 네트워크 로그 캡처가 시작되면 주입된 페이로드가 셸 명령으...

Xerox Printers Clone File Command Injection (CVE-2021-28673)

Xerox Phaser 6510 before 64.61.23 and 64.59.11 Bridge, WorkCentre 6515 before 65.61.23 and 65.59.11 Bridge, VersaLink B400 before 37.61.23 and 37.59.01 Bridge, B405 before 38.61.23 and 38.59.01 Bridge, B600/B610 before 32.61.23 and 32.59.01 Bridge, B605/B615 before 33.61.23 and 33.59.01 Bridge,...

Xerox Printers Improper Authentication (CVE-2023-46327)

Multiple MFPs multifunction printers provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encrypti...

Xerox Printers Improper Neutralization of Special Elements used in an OS Command (CVE-2024-6333)

Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505562;...

Xerox AltaLink Abuse Scan Feature to Delete Files (CVE-2021-28670)

Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.32000 allow unauthorized users, by leveraging the Scan To Mailbox feature, to delete arbitrary files from the disk. This plugin only works...

Xerox Printers Improper Authentication (CVE-2024-12510)

If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Xerox WorkCentre 3550 Cleartext Storage of Sensitive Information (CVE-2022-45897)

On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored cleartext credentials associated with those settings. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Xerox Printers Remote Command Execution (CVE-2021-28671)

Xerox Phaser 6510 before 64.65.51 and 64.59.11 Bridge, WorkCentre 6515 before 65.65.51 and 65.59.11 Bridge, VersaLink B400 before 37.65.51 and 37.59.01 Bridge, B405 before 38.65.51 and 38.59.01 Bridge, B600/B610 before 32.65.51 and 32.59.01 Bridge, B605/B615 before 33.65.51 and 33.59.01 Bridge,...

Xerox Printers Buffer Copy without Checking Size of Input (CVE-2021-28672)

Xerox Phaser 6510 before 64.65.51 and 64.59.11 Bridge, WorkCentre 6515 before 65.65.51 and 65.59.11 Bridge, VersaLink B400 before 37.65.51 and 37.59.01 Bridge, B405 before 38.65.51 and 38.59.01 Bridge, B600/B610 before 32.65.51 and 32.59.01 Bridge, B605/B615 before 33.65.51 and 33.59.01 Bridge,...

Xerox AltaLink Missing Authorization (CVE-2021-28669)

Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 provide the ability to set configuration attributes without administrative rights. This plugin only works with Tenable.ot. Please visit...

Xerox Phaser 4622 Out-of-bounds Write (CVE-2021-37354)

Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub3226AC via the TIMEZONE variable. This vulnerability allows attackers to cause a Denial of Service DoS via crafted overflow data. This plugin only works with Tenable.ot. Please visit...

Xerox Printers Loop with Unreachable Exit Condition (CVE-2022-23968)

Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot, but image parsing is restarted as so...

Xerox AltaLink Improper Neutralization of Special Elements used in an SQL Command (CVE-2021-28668)

Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 has several SQL injection vulnerabilities. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot...

Xerox Printers Missing Authentication for Critical Function (CVE-2024-12511)

With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

CVE-2026-2252

An XML External Entity XXE vulnerability allows malicious user to perform Server-Side Request Forgery SSRF via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core...

EUVD-2026-9014

Improper limitation of a pathname to a restricted directory Path Traversal vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 vi...

CVE-2026-2252

An XML External Entity XXE vulnerability allows malicious user to perform Server-Side Request Forgery SSRF via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core...

CVE-2026-2252

An XML External Entity XXE vulnerability allows malicious user to perform Server-Side Request Forgery SSRF via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core...

CVE-2026-2251

Improper limitation of a pathname to a restricted directory Path Traversal vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 vi...