Cross site scripting

Cross-site scripting XSS vulnerability in vpn/js/gatewayloginformview.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows remote attackers to inject arbitrary web script or HTML via the NSCTMAC cookie...

CVE-2016-4945

Cross-site scripting XSS vulnerability in vpn/js/gatewayloginformview.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows remote attackers to inject arbitrary web script or HTML via the NSCTMAC cookie...

CVE-2016-4945

The CVE-2016-4945 entry describes a Cross-Site Scripting (XSS) vulnerability in Citrix NetScaler Gateway 11.0 prior to Build 66.11, exploitable via the NSC_TMAC cookie in vpn/js/gateway_login_form_view.js. Affected component: the gateway’s login form view script; root cause is improper handling o...

XenMobile POC Cheat Sheet

The purpose of this cheat sheet is to provide a detailed POC checklist to assist with the implementation of On-Premise POC implementations. This checklist includes a detailed diagram of your XenMobile POC implementation populated from the information included in the filled out checklist. Addition...

Citrix NetScaler Gateway Clickjacking Vulnerability

Citrix NetScaler Gateway formerly Citrix Access Gateway Enterprise Edition is a secure remote access solution from Citrix Systems. The solution provides administrators with application-level and data-level controls to enable users to remotely access applications and data from any location. Citrix...

Citrix NetScaler Gateway Login Form Hijacking Vulnerability (CTX213313)

Citrix NetScaler is prone to a login form hijacking vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Citrix Netscaler 11.0 Build 64.35 Cross Site Scripting

PERSICON Security Advisory ======================================================================= Title: Login Form Hijacking vulnerability Product: Citrix Netscaler Vulnerable Version: 11.0 Build 64.35 Fixed Version: 11.0 Build 66.11 CVE-ID: CVE-2016-4945 Impact: medium found: 2015-04-07 by: Dr...

NetScaler Cheat Sheets for XenMobile Integration

The purpose of these NetScaler cheat sheets is to provide a reference article with key information about each Session Policy or Session Profile configured via NetScaler / XenMobile wizard. These cheat sheets are applicable for XenMobile 9 and 10.x solutions. STWBRWIPAddress Clientless Access...

Error: "Page Can't be displayed" When Connecting to StoreFront Through NetScaler Gateway

The following error is displayed when connecting to StoreFront through NetScaler Gateway: Page Can't be displayed...

Citrix Systems NetScaler ADC and Gateway Information Disclosure Vulnerability (CNVD-2016-02416)

Citrix Systems NetScaler ADC is a suite of service and application delivery solutions and Citrix Access Gateway Enterprise Edition is a secure remote access solution. An information disclosure vulnerability exists in Citrix Systems NetScaler ADC and Gateway, which can be exploited by remote...

NetScaler LOM Version and Support Matrix

This article provides information on Lights out Management LOM and support matrix for NetScaler model and LOM firmware version. Lights out Management LOM Various NetScaler MPX appliances have an Intelligent Platform Management Interface IPMI also known as the Lights out Management LOM port on the...

Addressing False Positives from CBC and MAC Vulnerability Scans of NetScaler SSHD

BUG0217580 addressed an SSH vulnerability CVE-2008-5161 involving CBC algorithms used in SSH connections CBC Mode Plaintext Recovery Vulnerability. The bug was reported when NetScaler 10.0 was still the newest version as NetScaler shipped with an affected version of OpenSSH. The NetScaler bug fix...

Secure Flag not set for Cookies generated by Netscaler if Vserver is part of Persistence Group

We need to have the NSC cookies using the Secure and HttpOnly flag set, however Secure flag is not set by NetScaler...

Error: 403 forbidden | Post authentication when accessing through NetScaler Gateway

We see 403 forbidden error post authentication when accessing the apps through Netscaler Gateway...

Troubleshooting pointers for TCP monitor showing DOWN

How to troubleshoot an issue related to TCP monitor down reported for services configured on NetScaler...

Error: "Incorrect credentials. Try again." when logging into NetScaler Gateway

Users fail to log on to NetScaler Gateway with the following error: "Incorrect credentials. Try again." Log on through StoreFront is successful. From /tmp/aaad.debug, the following is the logon failure message: /usr/home/build/rs1011296/usr.src/usr.bin/nsaaad/../../netscaler/aaad/ldapcommon.c341:...

Application Enumeration Fails When Connecting Through Windows App Receiver and NetScaler Gateway

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Application enumeration fails when connecting through Windows App Receiver and NetScaler Gateway...

Error: "Intermediate CA or Root CA Certificate Signature Verification Failed" on NetScaler Gateway

Enrollment and authentication works with LDAP policy however unable to enroll devices using CBA client certification authentication. Authentication is denied at NetScaler Gateway.While disabling authentication on NetScaler Gateway, client certificate can be pushed to the device using a device...

How to Use sAMAccountName and userPrincipalName at Same Time for User Logon with Active Directory

This article describes how use sAMAccountName and userPrincipalName at same time for user logon with Active Directory. Background While authenticating with LDAP for NetScaler Gateway or any other resource behind the NetScaler, we can only access resources using either 'domain\username' or...

CVE-2015-8277 - Citrix Licensing Security Updates

Description of Problem A vulnerability has been identified in Citrix Licensing that could allow a remote, unauthenticated attacker to crash the License Server and potentially execute arbitrary code on the server. This vulnerability affects the following products: Citrix License Server for Windows...