CVE-2015-2841

Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types...

CVE-2015-2840

Cross-site scripting XSS vulnerability in help/rt/largesearch.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter...

CVE-2015-2839

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting XSS attacks via the filename JSON member in params/xenhotfix/0 to nitro/v1/config/xenhotfix...

CVE-2015-2838

Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...

Design/Logic Flaw

Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...

Cross site scripting

Cross-site scripting XSS vulnerability in help/rt/largesearch.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter...

Cross site scripting

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting XSS attacks via the filename JSON member in params/xenhotfix/0 to nitro/v1/config/xenhotfix...

CVE-2015-2838

Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...

CVE-2015-2839

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting XSS attacks via the filename JSON member in params/xenhotfix/0 to nitro/v1/config/xenhotfix...

CVE-2015-2841

CVE-2015-2841 affects Citrix NetScaler AppFirewall (NetScaler 10.5) by allowing remote attackers to bypass firewall restrictions through a crafted Content-Type header (e.g., application/octet-stream and text/xml). The root cause is parameter/header handling in AppFirewall that permits content-typ...

CVE-2015-2838

CVE-2015-2838 affects Citrix NetScaler Nitro API prior to 10.5 build 52.3nc. The vulnerability arises from CSRF that lets an attacker craft requests via the file_name JSON field in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix, enabling shell metacharacters to execute commands as nsroot. This...

CVE-2015-2840

Cross-site scripting XSS vulnerability in help/rt/largesearch.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter...

CVE-2015-2841

Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types...

CVE-2015-2840

CVE-2015-2840 covers a cross-site scripting vulnerability in Citrix NetScaler. The issue affects NetScaler prior to version 10.5 build 52.3nc , where an attacker can inject arbitrary script via the searchQuery parameter in the page help/rt/large_search.html . The underlying cause is insufficient ...

CVE-2015-2839

The CVE-2015-2839 issue affects Citrix NetScaler prior to 10.5 build 52.3nc where the Nitro API returns error messages with an incorrect Content-Type, enabling remote XSS via the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix. Multiple sources corroborate the vulnerabi...

KLA10536 Multiple vulnerabilities in Citrix NetScaler

Multiple serious vulnerabilities have been found in Citrix NetScaler. Malicious users can exploit these vulnerabilities to execute or inject arbitrary code and conduct XSS attack. Below is a complete list of vulnerabilities 1. XSS vulnerability can be exploited remotely via a specially designed...

Citrix Command Center Arbitrary Code Execution Vulnerability

Citrix Command Center provides centralized management of Branch Repeater products deployed across the network. Citrix Command Center fails to properly restrict access to Advent Java Management Extensions JMX, which allows remote attackers to exploit a vulnerability to execute arbitrary code via...

Citrix Command Center Information Disclosure Vulnerability

Citrix Command Center provides centralized management of Branch Repeater products deployed across the network. A security vulnerability exists in Citrix Command Center that allows a remote attacker to submit a conf/securitydbData.xml request to obtain sensitive information...

CVE-2015-2683

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions JMX Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmxdynamic...