Citrix Access Gateway - Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Citrix Access Gateway Command Injection Vulnerability Release Date: 2010-12-21 Application: Citrix Access...

Citrix Access Gateway Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Citrix Access Gateway Command Injection Vulnerability Release Date: 2010-12-21 Application: Citrix Access...

Microsoft security update stamps out 11 product vulnerabilities

Microsoft security update stamps out 11 product vulnerabilities American software heavyweight Microsoft Corp. has this week rolled out three security bulletins for Windows, addressing a total of 11 vulnerabilities targeting potential exploits in platforms ranging from Microsoft Office to Forefron...

Open redirect

Open redirect vulnerability in the web interface in Microsoft Forefront Unified Access Gateway UAG 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka "UAG Redirection Spoofing...

CVE-2010-2733

This CVE-2010-2733 entry concerns a non-persistent cross-site scripting (XSS) vulnerability in Forefront UAG Web Monitor across 2010 Gold, Update 1, and Update 2. The issue is documented under Microsoft MS10-089, which addresses multiple UAG vulnerabilities (CVE-2010-2732, CVE-2010-2733, CVE-2010...

CVE-2010-2732

CVE-2010-2732 is an open redirect spoofing vulnerability in Forefront UAG 2010 (Gold), Update 1, and Update 2. The issue arises when the UAG web interface fails to validate redirects, allowing an attacker to redirect users to a malicious site via a specially crafted URL, potentially capturing cre...

CVE-2010-2734

CVE-2010-2734 is a non-persistent cross-site scripting (XSS) vulnerability in the Forefront Unified Access Gateway (UAG) mobile portal. According to the MS10-089 bulletin, it affects UAG 2010, Update 1, and Update 2, and could allow an attacker to inject script via specially crafted input that ru...

CVE-2010-2734

Cross-site scripting XSS vulnerability in the mobile portal in Microsoft Forefront Unified Access Gateway UAG 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS Issue on UAG Mobile Portal Website in Forefron...

Microsoft Forefront Unified Access Gateway multiple security vulnerabilities

Crossite scripting, form redirection...

Microsoft Releases November Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Office and Forefront United Access Gateway as part of the Microsoft Security Bulletin Summary for November 2010. These vulnerabilities may allow an attacker to execute arbitrary code or operate with elevated privileges. US-CER...

Microsoft Forefront Unified Access Gateway 'Signurl.asp' Cross-Site Scripting Vulnerability

Description Microsoft Forefront Unified Access Gateway is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

Microsoft Forefront Unified Access Gateway Spoofing Vulnerability

Description Microsoft Forefront Unified Access Gateway UAG is prone to a spoofing vulnerability. An attacker can exploit this issue to spoof a UAG server or redirect legitimate network traffic intended for a UAG server. This may allow the attacker to masquerade as a legitimate server, aiding in...

Microsoft Forefront Unified Access Gateway Mobile Portal Cross-Site Scripting Vulnerability

Description Microsoft Forefront Unified Access Gateway is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

MS10-089: Vulnerabilities in Forefront Unified Access Gateway (UAG) Could Allow Elevation of Privilege (2316074)

The version of Forefront Unified Access Gateway UAG running on the remote host has multiple vulnerabilities : - An unspecified redirection spoofing vulnerability, which could result in users being redirected from the UAG server to a similar looking, malicious server. CVE-2010-2732 - An unspecifie...

Microsoft Forefront Unified Access Gateway Installed

Microsoft Forefront Unified Access Gateway formerly known as Microsoft Intelligent Application Gateway, or IAG is installed on the remote host. This software provides secure remote access to corporate networks for remote employees and business partners. C Tenable Network Security, Inc...

Microsoft To Patch Critical Office Flaw

Microsoft will use its monthly patch to fix a critical security hole in versions of its Microsoft Office suit that could allow attackers to run malicious code on vulnerable systems. The company announced details of its upcoming monthly patch for November on Thursday. This months patch also includ...

Microsoft Releases Advance Notification for November Security Bulletin

Microsoft has issued an Security Bulletin Advance Notification indicating that its November release will contain three bulletins. One of these bulletins will have the severity rating of critical and will be for Microsoft Office. The remaining two bulletins will have the severity rating of importa...

CVE-2009-2631

CVE-2009-2631 describes a design-level flaw in multiple clientless SSL VPN products (e.g., Stonesoft StoneGate, Cisco ASA, SonicWALL E-Class SSL VPN, Citrix Access Gateway, Juniper Secure Access, Nortel CallPilot, SafeNet SecureWire) where, if configured to access resources from a different domai...

Citrix NetScaler和Access Gateway多个远程拒绝服务漏洞

BUGTRAQ ID: 36948 Citrix NetScaler是一款网络流量管理产品，Citrix Access Gateway是一款通用的SSL VPN设备。 远程攻击者可以利用Citrix NetScaler和Access Gateway等产品中所使用的URL Transform、Application Firewall和AGEE Clientless VPN功能中的安全漏洞导致拒绝服务。 Citrix Access Gateway 企业版9.1 Citrix Access Gateway 企业版9.0 Citrix NetScaler 9.1 Citrix NetScaler...

Design/Logic Flaw

Citrix XenApp formerly Presentation Server 4.5 Hotfix Rollup Pack 3 does not apply an access policy when it is defined with the Access Gateway Advanced Edition filters, which allows attackers to bypass intended access restrictions via unknown vectors...