Citrix NetScaler generic_api_call.pl跨站脚本执行漏洞

BUGTRAQ ID: 26491 Citrix NetScaler是很多企业和银行都在使用的应用交付系统。 Citrix NetScaler的Web管理界面实现上存在输入验证漏洞，远程攻击者可能利用此漏洞导致跨站脚本执行。 Citrix NetScaler的Web管理界面没有过滤/ws/genericapicall.pl的参数值便嵌入到了HTML输出中，如果用户提交了恶意请求的话就可以执行跨站脚本攻击，导致在浏览器会话中执行任意代码。 Citrix NetScaler 8.0 build 47.8 时解决方法： 在浏览其他站点时不要登录在NetScaler的Web管理界面上。 厂商补丁...

CVE-2007-6037

Cross-site scripting XSS vulnerability in ws/genericapicall.pl in Citrix NetScaler 8.0 build 47.8 allows remote attackers to inject arbitrary web script or HTML via the standalone parameter and other unspecified parameters...

Cross site scripting

Cross-site scripting XSS vulnerability in ws/genericapicall.pl in Citrix NetScaler 8.0 build 47.8 allows remote attackers to inject arbitrary web script or HTML via the standalone parameter and other unspecified parameters...

CVE-2007-6037

CVE-2007-6037 corresponds to a cross-site scripting (XSS) vulnerability in Citrix NetScaler 8.0 build 47.8, specifically affecting the web management interface via ws/generic_api_call.pl and the standalone parameter (and other unspecified params). OpenVAS entries describe the NetScaler Web Manage...

CVE-2007-6037

Cross-site scripting XSS vulnerability in ws/genericapicall.pl in Citrix NetScaler 8.0 build 47.8 allows remote attackers to inject arbitrary web script or HTML via the standalone parameter and other unspecified parameters...

Citrix NetScaler crossite scripting

Crossite scripting in /ws/genericapicall.pl...

Citrix NetScaler Web Management XSS

Citrix NetScaler Web Management XSS Product: Citrix NetScaler http://www.citrix.com/lang/English/ps2/index.asp Citrix NetScaler contains a cross-site scripting vulnerability in the web management interface. None of the parameter values of /ws/genericapicall.pl are sanitized before they get embedd...

CVE-2002-2426

Cross-site request forgery CSRF vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the...

Citrix NetScaler Generic_API_Call.PL跨站脚本漏洞

Citrix NetScaler是一款安全易用的Web应用交付解决方案。 Citrix NetScaler GenericAPICall.PL不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行跨站脚本攻击，获得目标用户敏感信息。 问题是由于'GenericAPICall.PL'脚本对用户提交的'standalone'参数缺少过滤，提交恶意脚本代码作为参数数据，并诱使用户处理，可导致获得目标用户敏感信息，或未授权访问应用程序。 Citrix NetScaler 8.0 build 47.8 目前没有详细解决方案提供：...

CVE-2002-2426

The CVE-2002-2426 entry describes a CSRF vulnerability in Citrix Presentation Server 4.0/4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0–2.0. The issue arises from the InitialProgram key in an ICA connection, allowing remote attackers to run published applications (and possibly ...

Citrix Netscaler 8.0 build 47.8 - Generic_API_Call.pl Cross-Site Scripting

Citrix Netscaler 8.0 build 47.8 - GenericAPICall.pl Cross-Site Scripting source: https://www.securityfocus.com/bid/26491/info Citrix NetScaler is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this iss...

Citrix Netscaler 8.0 build 47.8 - Generic_API_Call.pl Cross-Site Scripting

source: https://www.securityfocus.com/bid/26491/info Citrix NetScaler is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting use...

Citrix Presentation Server远程未授权代码执行漏洞

Citrix Presentation Server是一款集中部署应用和提供按需接入的解决方案。 Citrix Presentation Server存在一个设计问题，远程攻击者可以利用漏洞以授权用户上下文执行任意未授权代码。 如果授权用户被诱使调用ICA连接到Citrix Presentation Server，它可能被攻击者利用并以授权用户上下文执行未授权代码。 ICA连接可通过起用.ica文件或使用ICA客户端插件来调用，因此攻击者构建恶意的.ICA文件，诱使用户打开，可导致任意代码未授权执行。 测试方法 Citrix Presentation Server 4.0 Citrix...

CVE-2007-0011

The web portal interface in Citrix Access Gateway aka Citrix Advanced Access Control before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows context-dependent attackers to hijack sessions by reading "residual information", including the a referer log, browser history, or...

Input validation

The web portal interface in Citrix Access Gateway aka Citrix Advanced Access Control before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows context-dependent attackers to hijack sessions by reading "residual information", including the a referer log, browser history, or...

CVE-2007-0011

The CVE-2007-0011 issue affects Citrix Access Gateway (also Citrix Advanced Access Control) prior to Advanced Edition 4.5 HF1. The vulnerability is that a session ID is placed in the URL during the web portal authentication flow, enabling context-dependent attackers to hijack a user session by re...

CVE-2007-0011

The web portal interface in Citrix Access Gateway aka Citrix Advanced Access Control before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows context-dependent attackers to hijack sessions by reading "residual information", including the a referer log, browser history, or...

Citrix Access Gateway information leak

HTTP session cookie is passed through HTTP GET request parameters, making it possible to leak it value thorugh Referer: field or in the browsing history...

Corsaire Security Advisory - Citrix Access Gateway session ID disclosure issue

Note: This is a belated release to the mailing lists though most of the tracking services picked this up via the Citrix advisory... -- Corsaire Security Advisory -- Title: Citrix Access Gateway session ID disclosure issue Date: 05.09.06 Application: Citrix Advanced Access Control 4.0 Citrix...

SYMSA-2007-013: Lotus Notes Memory Mapped Files Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Symantec Vulnerability Research http://www.symantec.com/research Security Advisory Advisory ID: SYMSA-2007-013 Advisory Title: Lotus Notes Memory Mapped Files Vulnerability Author: Ollie Whitehouse / [email protected] Release Date: 23-10-20...