5444 matches found
CVE-2009-3758
SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...
CVE-2009-3760
Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to inject arbitrary PHP code into include/config.ini.php via the pool1 parameter. NOTE: some of these details are obtained from third party...
Code injection
Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to inject arbitrary PHP code into include/config.ini.php via the pool1 parameter. NOTE: some of these details are obtained from third party...
CVE-2009-3759
Multiple cross-site request forgery CSRF vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to hijack the authentication of administrators for 1 requests that change the password via the username parameter to config/changepw.php or 2 stop a...
CVE-2009-3758
CVE-2009-3758 is a SQL injection in login.php of the XenServer Resource Kit / XenCenterWeb. The vulnerability allows remote attackers to execute arbitrary SQL commands via the username parameter, as described in NVD/NIST and mirrored in multiple sources. Public exploit coverage is indicated by a ...
CVE-2009-3759
Multiple cross-site request forgery CSRF vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to hijack the authentication of administrators for 1 requests that change the password via the username parameter to config/changepw.php or 2 stop a...
CVE-2009-3758
SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...
CVE-2009-3760
Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to inject arbitrary PHP code into include/config.ini.php via the pool1 parameter. NOTE: some of these details are obtained from third party...
CVE-2009-3757
Multiple cross-site scripting XSS vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter to config/edituser.php; 2 location, 3 sessionid, and 4 vmname parameters to console.php;...
CVE-2009-3760
CVE-2009-3760 affects the Citrix XenCenterWeb XenServer Resource Kit sample code: a vulnerability in config/writeconfig.php where the pool1 parameter enables static code injection into include/config.ini.php, allowing remote attackers to inject arbitrary PHP code. Root cause is improper handling ...
CVE-2009-3759
CVE-2009-3759 concerns multiple CSRF vulnerabilities in the XenServer Resource Kit sample code used by Citrix XenCenterWeb. The issues allow remote attackers to hijack administrator authentication to trigger (1) password changes via config/changepw.php and (2) VM stopping via hardstopvm.php (stop...
CVE-2009-3757
CVE-2009-3757 affects the XenServer Resource Kit sample code in Citrix XenCenterWeb. The vulnerability is multiple cross-site scripting (XSS) flaws in the web UI, exploitable through user-controlled input in PHP scripts: config/edituser.php (username), console.php (location, sessionid, vmname), f...
PT-2009-6003 · Citrix · Citrix Xencenterweb
Name of the Vulnerable Software and Affected Versions: Citrix XenCenterWeb affected versions not specified Description: The issue concerns multiple cross-site request forgery CSRF vulnerabilities in sample code within the XenServer Resource Kit in Citrix XenCenterWeb. These vulnerabilities allow...
Citrix Licensing Service Detection
The remote host is running Citrix Licensing Service. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid40876; scriptversion"1.7"; scriptnameenglish:"Citrix Licensing Service Detection"; scriptsummaryenglish:"Checks for Citrix Licensing Service"; scriptsetattribute...
Citrix License Server Licensing Management Console Unspecified Issue
Citrix License Server is installed on the remote host. The version of Citrix License Server on the remote host is reportedly affected by a security vulnerability involving the Licensing Management Console. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid40614;...
Citrix Password Manager Agent Secondary Credentials Information Disclosure
Citrix Password Manager Agent is installed on the remote host. The version of Citrix Password Manager Agent on the remote host is reportedly affected by an information disclosure vulnerability involving secondary credentials. C Tenable Network Security, Inc. include"compat.inc"; if description...
Citrix Password Manager Service Stored Secondary Credentials Disclosure
Citrix Password Manager Service is installed on the remote host. The version of Citrix Password Manager Service on the remote host is reportedly affected by an information disclosure vulnerability involving secondary credentials. C Tenable Network Security, Inc. include"compat.inc"; if descriptio...
Update Protection against Citrix XenCenterWeb Cross Site Scripting Vulnerabilities
Citrix XenCenterWeb is a web interface for Citrix XenServer environment management. Lack of sanitization in the username parameter may allow an attacker to access the Citrix XENCenter management console with javascript embedded in the username parameter...