Kofax Front Office Server 4.1.1.11.0.5212
Approved changes feed: RSS · Atom
cpe:2.3:a:kofax:front_office_server:4.1.1.11.0.5212:*:*:*:*:*:*:*
part: a version: 4.1.1.11.0.5212 update: *
| Vendor | Kofax (cc413fe9-b37f-525b-a8ba-fd5e43880a6e) |
|---|---|
| Product | Front Office Server (d68b07e2-d7b1-5567-b54e-3133ab74fdab) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2018-17289 |
vulnerable | 2026-06-08 05:11:06.230899 |
Details available
An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration (.ZIP file) within the Kofax/KFS/Admin/PackageService/package/upload file parameter.
Published: 2019-04-18T17:47:25.000Z
Updated: 2024-08-05T10:47:04.126Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-17288 |
vulnerable | 2026-06-08 05:11:06.230485 |
Details available
Kofax Front Office Server version 4.1.1.11.0.5212 (both Thin Client and Administration Console) suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Filename" field in /Kofax/KFS/ThinClient/document/upload/ - (Thin Client) or (2) "DeviceName" field in /Kofax/KFS/Admin/DeviceService/device/ - (Administration Console).
Published: 2019-04-18T17:42:22.000Z
Updated: 2024-08-05T10:47:04.051Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-17287 |
vulnerable | 2026-06-08 05:11:06.230065 |
Details available
In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation.
Published: 2019-04-18T17:29:40.000Z
Updated: 2024-08-05T10:47:04.102Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.