CVE-2008-3485

Untrusted search path vulnerability in Citrix MetaFrame Presentation Server allows local users to gain privileges via a malicious icabar.exe placed in the search path...

Citrix MetaFrame Privilege Escalation

INTRUDERS TIGER TEAM SECURITY - SECURITY ADVISORY http://www.intruders.com.br/ http://www.security.org.br/ ADVISORY/1907 - Citrix MetaFrame Privilege Escalation PRIORITY: Low I - INTRUDERS: ---------------- Intruders Tiger Team Security http://www.intruders.com.br/ is a SecurityLabs...

Citrix Metaframe Privilege escalation

Autorun item path is not fully specified...

Citrix Presentation Server 'icabar.exe'本地特权提升漏洞

BUGTRAQ ID: 30446 CNCAN ID：CNCAN-2008073109 Citrix Presentation Server允许用户通过网络远程访问应用程序。 Citrix Presentation Server icabar.exe文件存在错误，本地攻击者可以利用漏洞提升特权。 icabar.exe文件设计用于启动Citrix MetaFrame管理工具条，允许攻击者在windows 2000或者以下版本的系统中，在默认配置情况下提升特权。在部分环境下的windows 2003也可能利用。...

CVE-2008-3253

Cross-site scripting XSS vulnerability in the XenAPI HTTP interfaces in Citrix XenServer Express, Standard, and Enterprise Edition 4.1.0; Citrix XenServer Dell Edition Express and Enterprise 4.1.0; and HP integrated Citrix XenServer Select and Enterprise 4.1.0 allows remote attackers to inject...

Cross site scripting

Cross-site scripting XSS vulnerability in the XenAPI HTTP interfaces in Citrix XenServer Express, Standard, and Enterprise Edition 4.1.0; Citrix XenServer Dell Edition Express and Enterprise 4.1.0; and HP integrated Citrix XenServer Select and Enterprise 4.1.0 allows remote attackers to inject...

CVE-2008-3253

CVE-2008-3253 describes a cross-site scripting (XSS) vulnerability in the XenAPI HTTP interfaces of Citrix XenServer family products (Express, Standard, Enterprise 4.1.0; Dell Edition 4.1.0; HP integrated XenServer 4.1.0). The vulnerability allows remote attackers to inject arbitrary web script o...

CVE-2008-3253

Cross-site scripting XSS vulnerability in the XenAPI HTTP interfaces in Citrix XenServer Express, Standard, and Enterprise Edition 4.1.0; Citrix XenServer Dell Edition Express and Enterprise 4.1.0; and HP integrated Citrix XenServer Select and Enterprise 4.1.0 allows remote attackers to inject...

Citrix XenServer XenAPI HTTP接口跨站脚本漏洞

BUGTRAQ ID: 30265 Citrix XenServer产品线是一种企业级平台，通过灵活的聚合计算和存储资源对数据中心的服务器虚拟化进行管理。 XenServer的XenAPI HTTP接口存在跨站脚本漏洞，如果向XenServer发送了特制的URL的话，响应中会包含有未经正确转义的请求URL，导致在用户浏览器中执行客户端脚本。 Citrix XenServer 4.1 Citrix ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.citrix.com...

Deterministic Network Extender 'dne2000.sys'本地特权提升漏洞

BUGTRAQ ID: 29772 CNCAN ID：CNCAN-2008061907 Deterministic Network Extender不正确过滤用户提供的数据，可导致本地特权提升。 攻击者可以利用漏洞以SYSTEM级别权限执行任意代码。 Deterministic Network Extender 'dne2000.sys' 2.21.7.233 - 3.21.7.17464版本受此漏洞影响，'dne2000.sys'驱动与如下产品绑定使用： - SafeNet HighAssurance Remote and SoftRemote - Cisco VPN Client -...

Deterministic Network Extender dne2000.sys驱动本地权限提升漏洞

BUGTRAQ ID: 29772 Deterministic Network Enhancer（DNE）是用于扩展Windows联网栈的软件包。 DNE的驱动程序实现上存在漏洞，本地攻击者可以通过对DNE驱动（dne2000.sys）发送特制的IOCTL请求导致以内核级权限执行任意指令。 Citrix Deterministic Network Extender 2.21.7.233 - 3.21.7.17464 Citrix ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2008-2528

Unspecified vulnerability in Citrix Access Gateway Standard Edition 4.5.7 and earlier and Advanced Edition 4.5 HF2 and earlier allows attackers to bypass authentication and gain "access to network resources" via unspecified vectors...

Authentication flaw

Unspecified vulnerability in Citrix Access Gateway Standard Edition 4.5.7 and earlier and Advanced Edition 4.5 HF2 and earlier allows attackers to bypass authentication and gain "access to network resources" via unspecified vectors...

CVE-2008-2528

Unspecified vulnerability in Citrix Access Gateway Standard Edition 4.5.7 and earlier and Advanced Edition 4.5 HF2 and earlier allows attackers to bypass authentication and gain "access to network resources" via unspecified vectors...

CVE-2008-2528

CVE-2008-2528 affects Citrix Access Gateway Standard Edition 4.5.7 and earlier and Advanced Edition 4.5 HF2 and earlier. The issue is an authentication bypass that could grant access to network resources; exact vectors are not disclosed. Impact is described as bypassing authentication with potent...

CVE-2008-2299

Unspecified vulnerability in SecureICA and ICA Basic encryption of Citrix Presentation Server 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 can cause clients to use weaker encryption settings than configured by the administrator, which might allow attackers to bypass...

CVE-2008-2300

Unspecified vulnerability in Citrix Presentation Server 4.5 and earlier, Citrix Access Essentials 2.0 and earlier, and Citrix Desktop Server 1.0 allows remote authenticated users to access unauthorized desktops via unknown attack vectors...

Design/Logic Flaw

Unspecified vulnerability in SecureICA and ICA Basic encryption of Citrix Presentation Server 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 can cause clients to use weaker encryption settings than configured by the administrator, which might allow attackers to bypass...

Code injection

Unspecified vulnerability in Citrix Presentation Server 4.5 and earlier, Citrix Access Essentials 2.0 and earlier, and Citrix Desktop Server 1.0 allows remote authenticated users to access unauthorized desktops via unknown attack vectors...

CVE-2008-2299

The CVE-2008-2299 entry involves Citrix Presentation Server 4.5 and earlier (also affecting Access Essentials 2.0 and Desktop Server 1.0) where SecureICA and ICA Basic encryption can be configured but allow clients to end up using weaker encryption settings than intended, potentially bypassing ad...