CVE-2015-2838: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the filename JSON member in...

CVE-2015-2839: Improper Neutralization of Input During Web Page Generation

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting XSS attacks via the filename JSON member in params/xenhotfix/0 to nitro/v1/config/xenhotfix...