Citrix XenServer Multiple Vulnerabilities (CTX200892)

The version of Citrix XenServer installed on the remote host is affected by multiple vulnerabilities : - A flaw exists in the VGA emulator in QEMU that allows a local guest user to read host memory by setting the display to a high resolution. CVE-2014-3615 - A flaw exists in the setpixelformat...

Citrix XenServer Multiple Security Updates (CTX200892)

A number of security vulnerabilities have been identified in Citrix XenServer. These vulnerabilities could, if exploited, allow a malicious administrator of an HVM guest to compromise the host. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced...

MS15-0 3 4/CVE-2 0 1 5-1 6 3 5 HTTP remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

! /Article/UploadPic/2015-4/2 0 1 5 4 1 6 1 0 4 9 1 9 2 1 8. png Foreword In 4 month's patch day, Microsoft by marking“high-risk”MS15-0 3 4 patch fix HTTP. SYS a remote code Vulnerability, CVE-2 0 1 5-1 6 3 5 It. According to Microsoft Bulletinthe call, when the vulnerability exists in the HTTP...

IIS the latest high-risk Vulnerability, CVE-2 0 1 5-1 6 3 5, AND MS15-0 3 4 analysis-vulnerability warning-the black bar safety net

Foreword In 4 month's patch day, Microsoft by marking“high-risk”MS15-0 3 4 patch fix HTTP. SYS a remote code Vulnerability, CVE-2 0 1 5-1 6 3 5 It. According to Microsoft Bulletin https://technet.microsoft.com/en-us/library/security/MS15-034 the call, when the vulnerability exists in the HTTP...

Citrix NetScaler Nitro help/rt/large_search.html Cross-Site Scripting Vulnerability

Citrix NetScaler is a network traffic management product. A cross-site scripting vulnerability in Citrix NetScaler help/rt/largesearch.html allows an attacker to inject malicious script code via the searchQuery parameter...

Citrix NetScaler Nitro API Cross-Site Request Forgery Vulnerability

Citrix NetScaler is a network traffic management product. A cross-site request forgery vulnerability exists in the Citrix NetScaler Nitro API, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions such a...

Citrix NetScaler Citrix NetScaler AppFirewall Access Restriction Bypass Vulnerability

Citrix NetScaler is a network traffic management product. A security vulnerability in the Citrix NetScaler AppFirewall used by Citrix NetScaler allows an attacker to bypass firewall restrictions via a specially crafted Content-Type header...

CVE-2015-2841

Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types...

CVE-2015-2840

Cross-site scripting XSS vulnerability in help/rt/largesearch.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter...

CVE-2015-2839

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting XSS attacks via the filename JSON member in params/xenhotfix/0 to nitro/v1/config/xenhotfix...

CVE-2015-2838

Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...

Cross site scripting

Cross-site scripting XSS vulnerability in help/rt/largesearch.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter...

Cross site scripting

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting XSS attacks via the filename JSON member in params/xenhotfix/0 to nitro/v1/config/xenhotfix...

Design/Logic Flaw

Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types...

CVE-2015-2838

Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...

CVE-2015-2840

Cross-site scripting XSS vulnerability in help/rt/largesearch.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter...

CVE-2015-2839

The CVE-2015-2839 issue affects Citrix NetScaler prior to 10.5 build 52.3nc where the Nitro API returns error messages with an incorrect Content-Type, enabling remote XSS via the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix. Multiple sources corroborate the vulnerabi...

CVE-2015-2840

CVE-2015-2840 covers a cross-site scripting vulnerability in Citrix NetScaler. The issue affects NetScaler prior to version 10.5 build 52.3nc , where an attacker can inject arbitrary script via the searchQuery parameter in the page help/rt/large_search.html . The underlying cause is insufficient ...

CVE-2015-2839

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting XSS attacks via the filename JSON member in params/xenhotfix/0 to nitro/v1/config/xenhotfix...