CVE-2015-2839: Improper Neutralization of Input During Web Page Generation

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting XSS attacks via the filename JSON member in params/xenhotfix/0 to nitro/v1/config/xenhotfix...

Citrix NetScaler VPX crossite scripting

Crossite scripting in help pages...

Citrix NITRO SDK xen_hotfix page is vulnerable to Cross-Site Scripting

------------------------------------------------------------------------ Citrix NITRO SDK xenhotfix page is vulnerable to Cross-Site Scripting ------------------------------------------------------------------------ Han Sahin, August 2014...

Citrix NetScaler VPX help pages are vulnerable to Cross-Site Scripting

------------------------------------------------------------------------ Citrix NetScaler VPX help pages are vulnerable to Cross-Site Scripting ------------------------------------------------------------------------ Han Sahin, August 2014...

Citrix NITRO SDK xen_hotfix Cross Site Scripting

------------------------------------------------------------------------ Citrix NITRO SDK xenhotfix page is vulnerable to Cross-Site Scripting ------------------------------------------------------------------------ Han Sahin, August 2014...

Citrix Netscaler NS10.5 - WAF Bypass Via HTTP Header Pollution Vulnerability

Exploit for linux platform in category web applications Exploit Title: Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution Date: Mar 13, 2015 Exploit Author: BGA Security Vendor Homepage: http://www.citrix.com/ Version: NS10.5 Tested on: NetScaler NS10.5: Build 50.9.nc, Document Title:...

Citrix NetScaler VPX Cross Site Scripting

------------------------------------------------------------------------ Citrix NetScaler VPX help pages are vulnerable to Cross-Site Scripting ------------------------------------------------------------------------ Han Sahin, August 2014...

Citrix NITRO SDK - Command Injection Vulnerability

A command injection vulnerability in Citrix NITRO SDK's xenhotfix page was discovered. The attacker-supplied command is executed with elevated privileges nsroot. This issue can be used to compromise of the entire Citrix SDX appliance along with all underlying applications and data. Abstract...

Citrix NITRO SDK Command Injection

------------------------------------------------------------------------ Command injection vulnerability in Citrix NITRO SDK xenhotfix page ------------------------------------------------------------------------ Han Sahin, August 2014...

Citrix Netscaler NS10.5 HTTP Header Contamination WAF Bypass Vulnerability

Citrix NetScaler is a network traffic management product A security vulnerability exists in Citrix NetScaler that allows attackers to exploit a vulnerability to bypass WAF protection via HTTP header pollution for unauthorized access...

Citrix Nitro SDK - Command Injection

Abstract Securify discovered a command injection vulnerability in xenhotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges nsroot. This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data. Tested...

Citrix Nitro SDK - Command Injection

Citrix Nitro SDK - Command Injection Abstract Securify discovered a command injection vulnerability in xenhotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges nsroot. This issue can be used to compromise of the entire Citrix SDX appliance and all...

Citrix Netscaler NS10.5 WAF Bypass

Document Title: ============ Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution Release Date: =========== 12 Mar 2015 Product & Service Introduction: ======================== Citrix NetScaler AppFirewall is a comprehensive application security solution that blocks known and unknown...

Citrix Netscaler NS10.5 - WAF Bypass (Via HTTP Header Pollution)

Exploit Title: Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution Date: Mar 13, 2015 Exploit Author: BGA Security Vendor Homepage: http://www.citrix.com/ Version: NS10.5 Tested on: NetScaler NS10.5: Build 50.9.nc, Document Title: ============ Citrix Netscaler NS10.5 WAF Bypass via HTTP...

Citrix Netscaler NS10.5 - WAF Bypass (Via HTTP Header Pollution)

Citrix Netscaler NS10.5 - WAF Bypass Via HTTP Header Pollution Exploit Title: Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution Date: Mar 13, 2015 Exploit Author: BGA Security Vendor Homepage: http://www.citrix.com/ Version: NS10.5 Tested on: NetScaler NS10.5: Build 50.9.nc, Document...

Citrix NetScaler Unspecified Remote Unauthorized Access (CTX200254)

The remote Citrix NetScaler device is affected by an unspecified remote unauthorized access vulnerability in the management interface. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid81316; scriptversion"1.5";...

CVE-2015-0235 - Citrix Security Advisory for glibc GHOST Vulnerability

Overview A vulnerability has been recently disclosed in the glibc gethostbyname function. This issue could potentially allow an attacker to inject code into a process that calls the vulnerable function. The issue is known as the GHOST vulnerability and has been assigned the following CVE...

Citrix NetScaler SOAP Handler Remote Code Execution

No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpClient include...

CVE-2014-8580

Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5.50.10 before 10.5-52.11, 10.1.122.17 before 10.1-129.11, and 10.1-120.1316.e before 10.1-129.1105.e, when using unspecified configurations, allows remote authenticated users to access "network resources" of other users vi...

Code injection

Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5.50.10 before 10.5-52.11, 10.1.122.17 before 10.1-129.11, and 10.1-120.1316.e before 10.1-129.1105.e, when using unspecified configurations, allows remote authenticated users to access "network resources" of other users vi...