Citrix XenServer Workload Balancer Detection

Citrix XenServer Workload Balancer, a daemon for migrating virtual machines between Xen hosts based on load, is running on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid58749; scriptversion"1.4"; scriptcvsdate"Date: 2019/11/25";...

PT-2011-36: Insufficient authorization in Citrix XenServer Virtual Switch Controller

Positive Research Center has discovered an insufficient authorization in Citrix XenServer Virtual Switch Controller. Low privileged Read-Only users can change certain configuration parameters e.g. hostname and domain. Configuration snapshots that contain the entire system configuration including...

PT-2011-37: HTTP Response Splitting in Citrix XenServer Virtual Switch Controller

Positive Research Center has discovered a HTTP Response Splitting in Citrix XenServer Virtual Switch Controller. GET parameter lastpage of the login page allows one to insert an arbitrary HTTP header into the server response. How to fix Update your software up to the latest version Advisory statu...

PT-2011-34: HTTP Response Splitting in Citrix XenServer Web Self Service

The specialists of the Positive Research center have detected "HTTP Response Splitting" vulnerability in Citrix XenServer Web Self Service. GET parameter page of the login page allows one to insert an arbitrary HTTP header into the server response. How to fix Update your software up to the latest...

PT-2011-35: Multiple CSRF vulnerabilities in Citrix XenServer Virtual Switch Controller

Positive Research Center has discovered a multiple CSRF vulnerabilities in Citrix XenServer Virtual Switch Controller. All web interface forms are vulnerable to CSRF attacks. One can exploit these vulnerabilities to change the system configuration. How to fix Update your software up to the latest...

PT-2011-38: URL redirector abuse in Citrix XenServer Virtual Switch Controller

Positive Research Center has discovered an URL redirector abuse in Citrix XenServer Virtual Switch Controller. URL redirector GET parameter lastpage of the login page allows forwarding to an arbitrary location. It allows an attacker to conduct a phishing attack. How to fix Update your software up...

PT-2011-32: Cross-site scripting in Citrix XenServer Web Self Service

The specialists of the Positive Research center have detected "Cross-site scripting" vulnerability in Citrix XenServer Web Self Service. Since special characters in usernames are not properly escaped a stored XSS attack is possible. How to fix Update your software up to the latest version Advisor...

PT-2011-31: Multiple Cross-Site Request Forgery vulnerabilities in Citrix XenServer Web Self Service

The specialists of the Positive Research center have detected "Cross-Site Request Forgery" vulnerabilities in Citrix XenServer Web Self Service. All web interface forms are vulnerable to CSRF attacks. One can exploit these vulnerabilities to change the system configuration. How to fix Update your...

PT-2011-33: URL redirector abuse in Citrix XenServer Web Self Service

The specialists of the Positive Research center have detected "URL redirector abuse" vulnerability in Citrix XenServer Web Self Service. URL redirector GET parameter page of the login page allows forwarding to an arbitrary location. It allows an attacker to conduct a phishing attack. How to fix...

PT-2011-39: Denial of Service in Citrix XenServer Workload Balancer

Positive Research Center has discovered a Denial of Service vulnerability in Citrix XenServer Workload Balancer. Remote attackers can cause an unhandled exception in the DwmWebSvc component by sending a specially crafted HTTP request. How to fix Update your software up to the latest version...

Citrix XenServer凭证本地信息泄露漏洞

BUGTRAQ ID: 47804 Citrix XenServer产品线是一种企业级平台，通过灵活的聚合计算和存储资源对数据中心的服务器虚拟化进行管理。 Citrix XenServer在实现上存在凭证本地信息泄露漏洞，客户端虚拟机中的恶意本地用户可利用此漏洞造成拒绝服务；恶意本地用户可利用此漏洞泄露敏感信息。 1）不明细节错误可被利用中断管理程序的常规操作。成功利用此漏洞需要客户端操作系统上的管理权限； 2）由于存储媒体凭证的不安全记录导致的安全问题可被本地用户利用泄露凭证信息； Citrix XenServer 5.6 厂商补丁： Citrix ------...

Citrix XenServer多个不明细节拒绝服务漏洞

BUGTRAQ ID: 47802 Citrix XenServer产品线是一种企业级平台，通过灵活的聚合计算和存储资源对数据中心的服务器虚拟化进行管理。 Citrix XenServer在实现上存在多个不明细节的拒绝服务漏洞，客户端虚拟机中的恶意本地用户可利用此漏洞造成拒绝服务。 Citrix XenServer 5.6 Citrix XenServer 5.5 厂商补丁： Citrix ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.citrix.com...

CVE-2010-2619

Citrix XenServer 5.0 Update 2 and earlier, and 5.5 Update 1 and earlier, when using a pvops kernel, allows guest users to cause a denial of service in the host via unspecified vectors that trigger "incorrectly set flags."...

Design/Logic Flaw

Citrix XenServer 5.0 Update 2 and earlier, and 5.5 Update 1 and earlier, when using a pvops kernel, allows guest users to cause a denial of service in the host via unspecified vectors that trigger "incorrectly set flags."...

CVE-2010-0633

Unspecified vulnerability in Citrix XenServer 5.0 Update 3 and earlier, and 5.5, allows local users to bypass authentication and execute unspecified Xen API XAPI calls via unknown vectors...

Authentication flaw

Unspecified vulnerability in Citrix XenServer 5.0 Update 3 and earlier, and 5.5, allows local users to bypass authentication and execute unspecified Xen API XAPI calls via unknown vectors...

CVE-2010-0633

Unspecified vulnerability in Citrix XenServer 5.0 Update 3 and earlier, and 5.5, allows local users to bypass authentication and execute unspecified Xen API XAPI calls via unknown vectors...

Citrix XenCenterWeb Multiple Vulnerabilities

Secure Network - Security Research Advisory Vuln name: Citrix XenCenterWeb Multiple Vulnerabilities Systems affected: Citrix XenCenterWeb Systems not affected: n/a Severity: High Local/Remote: Remote Vendor URL: http://www.citrix.com Authors: Alberto Trivero [email protected] - Claudio...

Cross site scripting

Cross-site scripting XSS vulnerability in the XenAPI HTTP interfaces in Citrix XenServer Express, Standard, and Enterprise Edition 4.1.0; Citrix XenServer Dell Edition Express and Enterprise 4.1.0; and HP integrated Citrix XenServer Select and Enterprise 4.1.0 allows remote attackers to inject...

CVE-2008-3253

Cross-site scripting XSS vulnerability in the XenAPI HTTP interfaces in Citrix XenServer Express, Standard, and Enterprise Edition 4.1.0; Citrix XenServer Dell Edition Express and Enterprise 4.1.0; and HP integrated Citrix XenServer Select and Enterprise 4.1.0 allows remote attackers to inject...