NetScaler Web Management Successful Authentication

Nessus successfully logged into the remote Citrix NetScaler web management interface using the supplied credentials and stored the authentication cookie for later use. netscalerweblogin.nasl GPLv2 History: 1.00, 11/21/07 - Initial release Changes by Tenable: - Revised plugin title 9/23/09 - Added...

CVE-2007-6192

The web management interface in Citrix NetScaler 8.0 build 47.8 uses weak encryption XOR of unpadded data to store credentials within a cookie, which makes it easier for remote attackers to obtain cleartext credentials when a cookie is captured via a known-plaintext attack...

Design/Logic Flaw

The web management interface in Citrix NetScaler 8.0 build 47.8 uses weak encryption XOR of unpadded data to store credentials within a cookie, which makes it easier for remote attackers to obtain cleartext credentials when a cookie is captured via a known-plaintext attack...

CVE-2007-6193

The web management interface in Citrix NetScaler 8.0 build 47.8 stores the device's primary IP address in a cookie, which might allow remote attackers to obtain sensitive network configuration information if this address is not the same as the address being used by the web interface...

Code injection

The web management interface in Citrix NetScaler 8.0 build 47.8 stores the device's primary IP address in a cookie, which might allow remote attackers to obtain sensitive network configuration information if this address is not the same as the address being used by the web interface...

CVE-2007-6192

The web management interface in Citrix NetScaler 8.0 build 47.8 uses weak encryption XOR of unpadded data to store credentials within a cookie, which makes it easier for remote attackers to obtain cleartext credentials when a cookie is captured via a known-plaintext attack...

CVE-2007-6193

The web management interface in Citrix NetScaler 8.0 build 47.8 stores the device's primary IP address in a cookie, which might allow remote attackers to obtain sensitive network configuration information if this address is not the same as the address being used by the web interface...

CVE-2007-6192

The CVE-2007-6192 entry describes an information disclosure vulnerability in the Citrix NetScaler Web Management Interface (NetScaler 8.0 build 47.8). The issue arises from using weak encryption to protect cookie contents by XORing sensitive values (including credentials) with a fixed key stream,...

citrix-xss.txt

Citrix NetScaler Web Management XSS Product: Citrix NetScaler http://www.citrix.com/lang/English/ps2/index.asp Citrix NetScaler contains a cross-site scripting vulnerability in the web management interface. None of the parameter values of /ws/genericapicall.pl are sanitized before they get embedd...

Citrix NetScaler Web Management Cookie Weakness

Citrix NetScaler Web Management Cookie Weakness Product: Citrix NetScaler http://www.citrix.com/lang/English/ps2/index.asp Background: For most web application logins a user fills out an HTTP form, which sets up the user with a session cookie. The cookie content is merely a session ID, which allo...

Citrix NetScaler weak cryptography

Username/password are stored as a part of cookie with encryption XORing with reused key, making it's possible to discover parts of the password...

Citrix NetScaler generic_api_call.pl跨站脚本执行漏洞

BUGTRAQ ID: 26491 Citrix NetScaler是很多企业和银行都在使用的应用交付系统。 Citrix NetScaler的Web管理界面实现上存在输入验证漏洞，远程攻击者可能利用此漏洞导致跨站脚本执行。 Citrix NetScaler的Web管理界面没有过滤/ws/genericapicall.pl的参数值便嵌入到了HTML输出中，如果用户提交了恶意请求的话就可以执行跨站脚本攻击，导致在浏览器会话中执行任意代码。 Citrix NetScaler 8.0 build 47.8 时解决方法： 在浏览其他站点时不要登录在NetScaler的Web管理界面上。 厂商补丁...

CVE-2007-6037

Cross-site scripting XSS vulnerability in ws/genericapicall.pl in Citrix NetScaler 8.0 build 47.8 allows remote attackers to inject arbitrary web script or HTML via the standalone parameter and other unspecified parameters...

CVE-2007-6037

CVE-2007-6037 corresponds to a cross-site scripting (XSS) vulnerability in Citrix NetScaler 8.0 build 47.8, specifically affecting the web management interface via ws/generic_api_call.pl and the standalone parameter (and other unspecified params). OpenVAS entries describe the NetScaler Web Manage...

Citrix NetScaler crossite scripting

Crossite scripting in /ws/genericapicall.pl...

Citrix NetScaler Web Management XSS

Citrix NetScaler Web Management XSS Product: Citrix NetScaler http://www.citrix.com/lang/English/ps2/index.asp Citrix NetScaler contains a cross-site scripting vulnerability in the web management interface. None of the parameter values of /ws/genericapicall.pl are sanitized before they get embedd...

Citrix Netscaler 8.0 build 47.8 - Generic_API_Call.pl Cross-Site Scripting

source: https://www.securityfocus.com/bid/26491/info Citrix NetScaler is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting use...