Cross site scripting

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting XSS attacks via the filename JSON member in params/xenhotfix/0 to nitro/v1/config/xenhotfix...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...

Cross site scripting

Cross-site scripting XSS vulnerability in help/rt/largesearch.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter...

Design/Logic Flaw

Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types...

CVE-2015-2838

Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...

CVE-2015-2839

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting XSS attacks via the filename JSON member in params/xenhotfix/0 to nitro/v1/config/xenhotfix...

CVE-2015-2840

Cross-site scripting XSS vulnerability in help/rt/largesearch.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter...

CVE-2015-2841

Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types...

CVE-2015-2841

CVE-2015-2841 affects Citrix NetScaler AppFirewall (NetScaler 10.5) by allowing remote attackers to bypass firewall restrictions through a crafted Content-Type header (e.g., application/octet-stream and text/xml). The root cause is parameter/header handling in AppFirewall that permits content-typ...

CVE-2015-2838

CVE-2015-2838 affects Citrix NetScaler Nitro API prior to 10.5 build 52.3nc. The vulnerability arises from CSRF that lets an attacker craft requests via the file_name JSON field in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix, enabling shell metacharacters to execute commands as nsroot. This...

CVE-2015-2840

CVE-2015-2840 covers a cross-site scripting vulnerability in Citrix NetScaler. The issue affects NetScaler prior to version 10.5 build 52.3nc , where an attacker can inject arbitrary script via the searchQuery parameter in the page help/rt/large_search.html . The underlying cause is insufficient ...

CVE-2015-2839

The CVE-2015-2839 issue affects Citrix NetScaler prior to 10.5 build 52.3nc where the Nitro API returns error messages with an incorrect Content-Type, enabling remote XSS via the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix. Multiple sources corroborate the vulnerabi...

PT-2015-5925

Name of the Vulnerable Software and Affected Versions Citrix NetScaler versions prior to 10.5 build 52.3nc Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the searchQuery parameter in the "help/rt/large search.html" page...

CVE-2015-2838: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...

PT-2015-5923

Name of the Vulnerable Software and Affected Versions Citrix NetScaler versions prior to 10.5 build 52.3nc Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack administrator authentication for requests that execute arbitrary commands as nsroot. This is...

PT-2015-5924

Name of the Vulnerable Software and Affected Versions Citrix NetScaler versions prior to 10.5 build 52.3nc Description The issue allows remote attackers to conduct cross-site scripting XSS attacks. This is achieved by exploiting the Nitro API, which returns an error message with an incorrect...

PT-2015-5926

Name of the Vulnerable Software and Affected Versions Citrix NetScaler versions 10.5 Description The issue allows remote attackers to bypass intended firewall restrictions by using a crafted Content-Type header. This can be achieved with specific Content-Types, such as application/octet-stream an...

KLA10536 Multiple vulnerabilities in Citrix NetScaler

Multiple serious vulnerabilities have been found in Citrix NetScaler. Malicious users can exploit these vulnerabilities to execute or inject arbitrary code and conduct XSS attack. Below is a complete list of vulnerabilities 1. XSS vulnerability can be exploited remotely via a specially designed...

CVE-2015-2841: Improper Access Control

Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types...

CVE-2015-2840: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in help/rt/largesearch.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter...