Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Path Traversal Vulnerability

A vulnerability in the video endpoint API xAPI of Cisco TelePresence Collaboration Endpoint CE Software, Cisco TelePresence Codec TC Software, and Cisco RoomOS Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is...

XAPI HTTP directory traversal

ISSUE DESCRIPTION XAPI has an unauthenticated HTTP endpoint update/ which exports the contents of /var/update for other hosts to use. However, the resolution of . and .. in paths is performed before url unquoting is performed. This allows an attacker to traverse out of the web root. IMPACT An...

XAPI Keeps Maintenance Mode For A Long Time After Restarting XenServer

XAPI keeps maintenance mode long time after restarting XenServer every time. This issue is happening from XenServer env was configured first. XAPI can't create network connection to other pool member and xenbr0 raise a network error. Sep 10 19:36:08 XXXX fe: 5481 /sbin/ip addr add...

Citrix XenServer Linux Foundation xapi Security Bypass Vulnerability

Citrix XenServer is a virtualization solution. A security vulnerability in Citrix XenServer Linux Foundation xapi allows remote attackers to exploit the vulnerability to submit a special request and corrupt the host database...

Citrix XenServer Linux Foundation xapi Security Bypass Vulnerability (CNVD-2017-01230)

Citrix XenServer is a virtualization solution. A security vulnerability exists in Citrix XenServer Linux Foundation xapi, which allows remote attackers to exploit the vulnerability to submit a special request to cancel an administrator job...

Design/Logic Flaw

An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can cancel tasks of other administrators...

CVE-2017-5572

An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can corrupt the host database...

CVE-2017-5573

An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can cancel tasks of other administrators...

Design/Logic Flaw

An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can corrupt the host database...

CVE-2017-5572

An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can corrupt the host database...

CVE-2017-5573

An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can cancel tasks of other administrators...

CVE-2017-5573

CVE-2017-5573 affects Citrix XenServer (Linux Foundation xapi). An authenticated read-only administrator can cancel tasks of other administrators. The connected documents describe the vulnerability and impact but do not provide root-cause details, affected versions beyond XenServer up to 7.0, exp...

CVE-2017-5572

CVE-2017-5572 affects Citrix XenServer (Linux Foundation xapi) up to version 7.0. An authenticated read-only administrator can corrupt the host database, as described in multiple sources. CVSS data from NVD indicates network-based access with low complexity and partial integrity/availability impa...

CVE-2017-5572

An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can corrupt the host database...

XAPI Service unable to start , error : xapi dies but pid file exists.

XAPI Service unable to start. It shows that the it already has a pid and is dead. Looking at the logs xensource.log, you will find INTERNALERROR as below: xapi top-level caught exception: INTERNALERROR: Xmlm.MakeStringBuffer.Error, -372779099 Caught exception at toplevel:...

How to take a XenServer toolstack (XAPI) database dump and view it

XenServer stores the vital information related to objects such asVM, VIF, VDI, PBD in an XMLformat file under /var/xapi/state.db.Thisfile is synced between pool membersat regular intervals to maintain aconsistent view of the XenServer pool. We recommend that you back up this XAPIdatabase file. Th...

misplaced free in ocaml xc_vcpu_getaffinity stub

ISSUE DESCRIPTION The ocaml binding for the xcvcpugetaffinity function incorrectly frees a pointer before using it and subsequently freeing it again afterwards. The code therefore contains a use-after-free and double-free flaws. IMPACT An attacker may be able to cause a multithreaded toolstack...

Authentication flaw

Unspecified vulnerability in Citrix XenServer 5.0 Update 3 and earlier, and 5.5, allows local users to bypass authentication and execute unspecified Xen API XAPI calls via unknown vectors...

CVE-2010-0633

Technical details about CVE-2010-0633 are not publicly disclosed in the provided connected documents. No concrete impact, affected products, or remediation are listed here. Monitor for updates from official advisories.