CVE-2009-3759

CVE-2009-3759 concerns multiple CSRF vulnerabilities in the XenServer Resource Kit sample code used by Citrix XenCenterWeb. The issues allow remote attackers to hijack administrator authentication to trigger (1) password changes via config/changepw.php and (2) VM stopping via hardstopvm.php (stop...

CVE-2009-3760

CVE-2009-3760 affects the Citrix XenCenterWeb XenServer Resource Kit sample code: a vulnerability in config/writeconfig.php where the pool1 parameter enables static code injection into include/config.ini.php, allowing remote attackers to inject arbitrary PHP code. Root cause is improper handling ...

CVE-2009-3758

CVE-2009-3758 is a SQL injection in login.php of the XenServer Resource Kit / XenCenterWeb. The vulnerability allows remote attackers to execute arbitrary SQL commands via the username parameter, as described in NVD/NIST and mirrored in multiple sources. Public exploit coverage is indicated by a ...

CVE-2009-3757

CVE-2009-3757 affects the XenServer Resource Kit sample code in Citrix XenCenterWeb. The vulnerability is multiple cross-site scripting (XSS) flaws in the web UI, exploitable through user-controlled input in PHP scripts: config/edituser.php (username), console.php (location, sessionid, vmname), f...