Secunia

Multiple vulnerabilities have been reported in Xerox WorkCentre and WorkCentre Pro, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting attacks, or cause a DoS (Denial of Service).

1) Some unspecified errors in the Xerox MicroServer web server can be exploited to bypass the user authentication.

2) Some unspecified errors within the handling of HTTP requests in the Xerox MicroServer web server can be exploited to cause a DoS or access certain files.

3) Certain unspecified input passed to the Xerox MicroServer web server is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

The vulnerabilities affect the following products:
* WorkCentre M35/M45/M55 (versions 2.028.11.000 through 2.97.20.050 or versions 4.84.16.000 through 4.97.20.050)
* WorkCentre Pro 35/45/55 (versions 3.028.11.000 through 3.97.20.050)
WorkCentre Pro 65/75/90 (versions 1.001.00.060 through 1.001.02.706)
WorkCentre Pro 32/40 Color (versions 0.001.00.060 through 0.001.02.707)
WorkCentre M165/M175 (versions 6.47.30.000 through 6.57.32.008 or versions 8.47.30.000 through 8.57.32.008)
WorkCentre Pro 165/175 (versions 7.47.30.000 though 7.57.32.008)

Solution
Apply patch:
Further details available in Customer Area

Provided and/or discovered by
Reported by vendor.

Original Advisory
Xerox:
http://www.xerox.com/downloads/usa/en/c/cert_XRX05_007.pdf

Deep Links
Links available in Customer Area