Xerox

86 CVEs across 355 Xerox products. Browse Xerox vulnerabilities, severities, and proof-of-concept exploits.

Xerox products with known CVEs

ProductCVEs
Workcentre20
Workcentre 23212
Workcentre 23812
Workcentre 24512
Workcentre 25512
Workcentre 26512
Workcentre 27512
Altalink C80359
Altalink C8035 Firmware9
Freeflow Core9
Altalink B80458
Altalink B8045 Firmware8
Altalink B80558
Altalink B8055 Firmware8
Altalink B80658
Altalink B8065 Firmware8
Altalink B80758
Altalink B8075 Firmware8
Altalink B80908
Altalink B8090 Firmware8
Altalink C80308
Altalink C8030 Firmware8
Altalink C80458
Altalink C8045 Firmware8
Altalink C80558
Altalink C8055 Firmware8
Altalink C80708
Altalink C8070 Firmware8
Freeflow Core8
Phaser 33208
Phaser 3320 Firmware8
Workcentre 36558
Workcentre 3655 Firmware8
Workcentre 3655i8
Workcentre 3655i Firmware8
Workcentre 66558
Workcentre 6655 Firmware8
Workcentre 6655i8
Workcentre 6655i Firmware8
Workcentre 72208
Workcentre 7220 Firmware8
Workcentre 72258
Workcentre 7225 Firmware8
Workcentre 78308
Workcentre 7830 Firmware8
Workcentre 78358
Workcentre 7835 Firmware8
Workcentre 78458
Workcentre 7845 Firmware8
Workcentre 78558
Xerox CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-2252High7.52026-02-27An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious exter…
CVE-2026-2251Critical9.82026-02-27Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to…
CVE-2026-1769Medium5.32026-02-06Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xerox CentreWare on Windows allows Stored XSS.This…
CVE-2025-8356Critical9.82025-08-08In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remot…
CVE-2025-8355High7.52025-08-08In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing refe…
CVE-2025-1984Medium5.22025-03-12Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level a…
CVE-2024-12511High7.62025-02-03With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and pr…
CVE-2024-12510Medium6.72025-02-03If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active…
CVE-2024-55931Medium6.52025-01-27Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised.  The patch for this vuln…
CVE-2024-55930Medium6.72025-01-23Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files
CVE-2024-55929Medium5.32025-01-23A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sourc…
CVE-2024-55928Medium6.52025-01-23Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets wi…
CVE-2024-55927High7.62025-01-23A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or for…
CVE-2024-55926High7.62025-01-23A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploitin…
CVE-2024-55925High7.52025-01-23In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the…
CVE-2024-6333High7.22024-10-17Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.
CVE-2024-47559High7.62024-10-07Authenticated RCE via Path Traversal
CVE-2024-47558High7.62024-10-07Authenticated RCE via Path Traversal
CVE-2024-47557High8.32024-10-07Pre-Auth RCE via Path Traversal
CVE-2024-47556High8.32024-10-07Pre-Auth RCE via Path Traversal
CVE-2024-47555High8.32024-10-07Missing Authentication - User & System Configuration
CVE-2023-46327Medium5.92023-11-02Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their…
CVE-2022-45897Medium6.52023-01-31On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored cleartext credentials asso…
CVE-2022-26572High7.52022-04-04Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitive information.
CVE-2021-37354Critical9.82022-02-15Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub_3226AC via the TIMEZONE variable. This vulnerability allows at…
CVE-2022-23321Medium4.82022-02-10A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore applica…
CVE-2022-23320High7.52022-02-07XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative creden…
CVE-2022-23968High7.52022-01-26Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthentic…
CVE-2019-10881Critical9.82021-04-13Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with…
CVE-2021-28672Critical9.82021-03-29Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (Br…
CVE-2021-28671Critical9.82021-03-29Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (Br…
CVE-2021-28673Critical9.82021-03-29Xerox Phaser 6510 before 64.61.23 and 64.59.11 (Bridge), WorkCentre 6515 before 65.61.23 and 65.59.11 (Bridge), VersaLink B400 before 37.61.23 and 37.59.01 (Br…
CVE-2021-28669High7.52021-03-29Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 pr…
CVE-2021-28668Critical9.82021-03-29Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 ha…
CVE-2021-28670Critical9.12021-03-29Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.32…
CVE-2019-18630High7.52021-03-04On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, porti…
CVE-2019-18629High8.12021-03-04Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an…
CVE-2019-18628Medium4.92021-03-04Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow a u…
CVE-2020-36201High7.52021-01-26An issue was discovered in certain Xerox WorkCentre products. They do not properly encrypt passwords. This affects 3655, 3655i, 58XX, 58XXi 59XX, 59XXi, 6655…
CVE-2020-26162Medium6.12020-10-09Xerox WorkCentre EC7836 before 073.050.059.25300 and EC7856 before 073.020.059.25300 devices allow XSS via Description pages.
CVE-2016-11061Critical9.82020-04-29Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly…
CVE-2019-13172Critical9.82020-03-13Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Authentication Cookie of the web applicati…
CVE-2019-13171Critical9.82020-03-13Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by one or more stack-based buffer overflow vulnerabilities in the Google Cloud Print…
CVE-2019-13170Medium6.52020-03-13Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerabili…
CVE-2019-13169Critical9.82020-03-13Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Content-Type HTTP Header of the web applic…
CVE-2019-13168Critical9.82020-03-13Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the attributes parser of the IPP service. This…
CVE-2019-13167Medium6.12020-03-13Multiple Stored XSS vulnerabilities were found in the Xerox Web Application, used by the Phaser 3320 V53.006.16.000 and other printers. Successful exploitation…
CVE-2019-13166High7.52020-03-13Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout. Local account credentials may be extracted from the device via…
CVE-2019-13165Critical9.82020-03-13Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the request parser of the IPP service. This wo…
CVE-2020-9330High8.82020-02-21Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connecto…
CVE-2013-6362Critical9.82020-02-13Xerox ColorCube and WorkCenter devices in 2013 had hardcoded FTP and shell user accounts.
CVE-2019-19832High8.82019-12-18Xerox AltaLink C8035 printers allow CSRF. A request to add users is made in the Device User Database form field to the xerox.set URI. (The frmUserName value mu…
CVE-2019-17184Critical9.82019-10-04Xerox AtlaLink B8045/B8055/B8065/B8075/B8090 C8030/C8035/C8045/C8055/C8070 printers with software before 101.00x.089.22600 allow an attacker to gain privileges.
CVE-2018-15530Medium6.12019-05-13Cross-site scripting (XSS) in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript code.
CVE-2019-10880Critical9.82019-04-12Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS C…
CVE-2018-20771Critical9.82019-02-10An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devic…
CVE-2018-20770Critical9.82019-02-10An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devic…
CVE-2018-20769High7.52019-02-10An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devic…
CVE-2018-20768Critical9.82019-02-10An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devic…
CVE-2018-20767High8.82019-02-10An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devic…
CVE-2018-17172Critical9.82019-01-03The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.05200, and C8070 bef…
CVE-2014-31382014-05-02SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote…
CVE-2013-04152013-01-17Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the…
CVE-2013-04072013-01-17Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Kernel/DTrace Framework.
CVE-2012-05692013-01-17Unspecified vulnerability Oracle Sun Solaris 10 allows local users to affect confidentiality and integrity via unknown vectors related to Install/smpatch.
CVE-2012-07732012-03-28The NetStream class in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228 on Windows, Mac OS X, and Linux; Flash Player before 10.3.183.18 and…
CVE-2010-05492010-02-04Unspecified vulnerability in the Network Controller in Xerox WorkCentre 6400 System Software 060.070.109.11407 through 060.070.109.29510, and Net Controller 06…
CVE-2010-05482010-02-04Multiple unspecified vulnerabilities in the Network Controller and Web Server in Xerox WorkCentre 5632, 5638, 5645, 5655, 5665, 5675, and 5687 allow remote att…
CVE-2009-39132009-11-09SQL injection vulnerability in summary.php in Xerox Fiery Webtools allows remote attackers to execute arbitrary SQL commands via the select parameter.
CVE-2009-16562009-05-16Xerox WorkCentre and WorkCentre Pro 232, 238, 245, 255, 265, 275; and WorkCentre 5632, 5638, 5645, 5655, 5665, 5675, 5687, 7655, 7656, and 7675 allows remote a…
CVE-2008-64362009-03-06Cross-site scripting (XSS) vulnerability in the Web Server in Xerox WorkCentre 7132, 7228, 7235, and 7245 allows remote attackers to inject arbitrary web scrip…
CVE-2008-52252008-11-25Multiple cross-site scripting (XSS) vulnerabilities in Xerox DocuShare 6 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH…
CVE-2008-35712008-08-10The Xerox Phaser 8400 allows remote attackers to cause a denial of service (reboot) via an empty UDP packet to port 1900.
CVE-2008-31222008-07-10Multiple SQL injection vulnerabilities in Xerox CentreWare Web (CWW) before 4.6.46 allow remote authenticated users to execute arbitrary SQL commands via the u…
CVE-2008-31212008-07-10Multiple cross-site scripting (XSS) vulnerabilities in Xerox CentreWare Web (CWW) before 4.6.46 allow remote authenticated users to inject arbitrary web script…
CVE-2008-28252008-06-23Cross-site scripting (XSS) vulnerability in the embedded Web Server in Xerox WorkCentre M123, M128, and 133 and WorkCentre Pro 123, 128, and 133 allows remote…
CVE-2008-28242008-06-23Unspecified vulnerability in the Extensible Interface Platform in Web Services in Xerox WorkCentre 7655, 7665, and 7675 allows remote attackers to make configu…
CVE-2008-27432008-06-17Cross-site scripting (XSS) vulnerability in the embedded web server in Xerox 4110, 4590, and 4595 Copier/Printers allows remote attackers to inject arbitrary w…
CVE-2006-64732006-12-11Multiple unspecified vulnerabilities in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 have…
CVE-2006-64722006-12-11The httpd.conf file in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 configures port 443 t…
CVE-2006-64712006-12-11Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 use weak permissions for certain files, whic…
CVE-2006-64702006-12-11The SNMP Agent in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 returns no error for a non…
CVE-2006-64692006-12-11Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not block the postgres port (5432/tcp), w…
CVE-2006-64682006-12-11Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not check the Fully Qualified Domain Name…
CVE-2006-64672006-12-11Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not properly restrict access to SMB file…
CVE-2006-64412006-12-10Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows local users to bypass security contro…
CVE-2006-64402006-12-10Multiple unspecified vulnerabilities in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allo…
CVE-2006-64392006-12-10Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to download the audi…
CVE-2006-64382006-12-10Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 leaves sensitive user data in http.log after…
CVE-2006-64372006-12-10ops3-dmn in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows attackers to cause a deni…
CVE-2006-64362006-12-10Cross-site scripting (XSS) vulnerability in the Network controller in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and…
CVE-2006-64352006-12-10The SNMP implementation in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 does not generate…
CVE-2006-64342006-12-10Unspecified vulnerability in the Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14…
CVE-2006-64332006-12-10Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 does not record accurate timestamps, which m…
CVE-2006-64322006-12-10Unspecified vulnerability in the Scan-to-mailbox feature in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x befor…
CVE-2006-64312006-12-10Unspecified vulnerability in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows attacker…
CVE-2006-64302006-12-10Web services in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 do not require HTTPS, which…
CVE-2006-64292006-12-10Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows attackers to modify certain configura…
CVE-2006-64282006-12-10Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allow remote attackers to gain access via un…
CVE-2006-64272006-12-10The Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows remote atta…