Overview 324 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
324matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
2
0.6%
Not applicable
322
99.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
324
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
324
100.0%
split by
peak 33 / year
20013
Not applicable3
High2
Medium1
not blocked3
No public exploit3
20023
Not applicable3
Medium3
not blocked3
No public exploit3
20030
20043
Not applicable3
High1
Medium1
Low1
not blocked3
No public exploit3
20055
Not applicable5
High2
Medium1
Low2
not blocked5
No public exploit5
20066
Not applicable6
High1
Medium5
not blocked6
No public exploit6
200713
Not applicable13
High4
Medium8
Low1
not blocked13
No public exploit13
20088
Not applicable8
High3
Medium4
Low1
not blocked8
No public exploit8
20099
Not applicable9
High3
Medium5
Low1
not blocked9
No public exploit9
20106
Not applicable6
High2
Medium2
Low2
not blocked6
No public exploit6
20118
Not applicable8
High2
Medium5
Low1
not blocked8
No public exploit8
201210
Not applicable10
High3
Medium5
Low2
not blocked10
No public exploit10
201314
Not applicable14
High10
Medium3
Low1
not blocked14
No public exploit14
201426
Not applicable26
High7
Medium18
Low1
not blocked26
No public exploit26
201511
Not applicable11
High4
Medium7
not blocked11
No public exploit11
201618
Not applicable18
Critical3
High8
Medium7
not blocked18
No public exploit18
201731
Outside Waratek scope2
Not applicable29
Critical4
High16
Medium11
not blocked31
No public exploit31
201831
Not applicable31
Critical10
High12
Medium8
Low1
not blocked31
No public exploit31
201912
Not applicable12
Critical4
High4
Medium4
not blocked12
No public exploit12
202033
Not applicable33
Critical4
High21
Medium8
not blocked33
No public exploit33
202114
Not applicable14
Critical1
High8
Medium5
not blocked14
No public exploit14
202215
Not applicable15
Critical2
High6
Medium6
Low1
not blocked15
No public exploit15
202310
Not applicable10
Critical1
High5
Medium4
not blocked10
No public exploit10
202417
Not applicable17
High9
Medium8
not blocked17
No public exploit17
20259
Not applicable9
High6
Medium3
not blocked9
No public exploit9
20269
Not applicable9
High8
Medium1
not blocked9
No public exploit9
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-88778 | High | 2026-09-27 | Not applicable | No public exploit | Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23. |
| CVE-2026-88777 | High | 2026-09-27 | Not applicable | No public exploit | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service |
| CVE-2026-88776 | High | 2026-09-27 | Not applicable | No public exploit | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service |
| CVE-2026-88775 | High | 2026-09-27 | Not applicable | No public exploit | Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service |
| CVE-2026-88774 | High | 2026-09-27 | Not applicable | No public exploit | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage. |
| CVE-2026-8655 | High | 2026-06-30 | Not applicable | No public exploit | Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured as a DNS recursive resolver deployment |
| CVE-2026-13474 | High | 2026-06-30 | Not applicable | No public exploit | Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler |
| CVE-2026-10817 | Medium | 2026-06-30 | Not applicable | No public exploit | Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeStamp is enabled in TCP Profile and is associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler |
| CVE-2026-10816 | High | 2026-06-30 | Not applicable | No public exploit | Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is enabled |
| CVE-2025-7776 | High | 2025-08-26 | Not applicable | No public exploit | Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) with PCoIP Profile bounded to it |
| CVE-2025-6759 | High | 2025-07-08 | Not applicable | No public exploit | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS |
| CVE-2025-5349 | High | 2025-06-17 | Not applicable | No public exploit | Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway |
| CVE-2025-4879 | High | 2025-06-17 | Not applicable | No public exploit | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
| CVE-2025-4365 | Medium | 2025-06-17 | Not applicable | No public exploit | Arbitrary file read in NetScaler Console and NetScaler SDX (SVM) |
| CVE-2025-0320 | High | 2025-06-17 | Not applicable | No public exploit | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows |
| CVE-2025-1223 | Medium | 2025-02-20 | Not applicable | No public exploit | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
| CVE-2025-1222 | Medium | 2025-02-20 | Not applicable | No public exploit | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
| CVE-2024-12284 | High | 2025-02-20 | Not applicable | No public exploit | Authenticated privilege escalation in NetScaler Console and NetScaler Agent allows. |
| CVE-2024-8535 | Medium | 2024-11-12 | Not applicable | No public exploit | Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as an Auth Server (AAA Vserver) with KCDAccount configuration for Kerberos SSO to access backend resources |
| CVE-2024-8534 | High | 2024-11-12 | Not applicable | No public exploit | Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configured as a Gateway (VPN Vserver) with RDP Feature enabled OR the appliance must be configured as a Gateway (VPN Vserver) and RDP Proxy Server Profile is created and set to Gateway (VPN Vserver) OR the appliance must be configured as a Auth Server (AAA Vserver) with RDP Feature enabled |
| CVE-2024-7890 | Medium | 2024-09-11 | Not applicable | No public exploit | Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
| CVE-2024-7889 | High | 2024-09-11 | Not applicable | No public exploit | Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
| CVE-2024-42423 | High | 2024-09-10 | Not applicable | No public exploit | Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. A local unauthenticated user with low privileges may potentially exploit this vulnerability to bypass existing controls and perform unauthorized actions leading to information disclosure and tampering. |
| CVE-2024-6677 | High | 2024-07-12 | Not applicable | No public exploit | Privilege escalation in uberAgent |
| CVE-2024-6286 | High | 2024-07-10 | Not applicable | No public exploit | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
| CVE-2024-6236 | High | 2024-07-10 | Not applicable | No public exploit | Denial of Service in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX |
| CVE-2024-6151 | High | 2024-07-10 | Not applicable | No public exploit | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS |
| CVE-2024-6150 | Medium | 2024-07-10 | Not applicable | No public exploit | A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning |
| CVE-2024-6149 | Medium | 2024-07-10 | Not applicable | No public exploit | Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5 |
| CVE-2024-6148 | Medium | 2024-07-10 | Not applicable | No public exploit | Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5 |
| CVE-2024-5492 | Medium | 2024-07-10 | Not applicable | No public exploit | Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites in NetScaler ADC and NetScaler Gateway |
| CVE-2024-5491 | High | 2024-07-10 | Not applicable | No public exploit | Denial of Service in NetScaler ADC and NetScaler Gateway in NetScaler |
| CVE-2024-5661 | Medium | 2024-06-13 | Not applicable | No public exploit | An issue has been identified in both XenServer 8 and Citrix Hypervisor 8.2 CU1 LTSR which may allow a malicious administrator of a guest VM to cause the host to become slow and/or unresponsive. |
| CVE-2024-3661 | High | 2024-05-06 | Not applicable | No public exploit | DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. |
| CVE-2024-2049 | Medium | 2024-03-12 | Not applicable | No public exploit | Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited information from the appliance via Access to management IP. |
| CVE-2023-24492 | Critical | 2023-07-11 | Not applicable | No public exploit | A vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if exploited, could allow an attacker to remotely execute code if a victim user opens an attacker-crafted link and accepts further prompts. |
| CVE-2023-24491 | High | 2023-07-11 | Not applicable | No public exploit | A vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an attacker with access to an endpoint with Standard User Account that has the vulnerable client installed to escalate their local privileges to that of NT AUTHORITY\SYSTEM. |
| CVE-2023-24490 | Medium | 2023-07-10 | Not applicable | No public exploit | Users with only access to launch VDA applications can launch an unauthorized desktop |
| CVE-2023-24487 | High | 2023-07-10 | Not applicable | No public exploit | Arbitrary file read in Citrix ADC and Citrix Gateway |
| CVE-2023-24486 | Medium | 2023-07-10 | Not applicable | No public exploit | A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able to gain access to the Citrix Virtual Apps and Desktops session of another user who is using the same computer from which the ICA session is launched. |
| CVE-2023-24485 | High | 2023-02-16 | Not applicable | No public exploit | Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace app. |
| CVE-2023-24484 | Medium | 2023-02-16 | Not applicable | No public exploit | A malicious user can cause log files to be written to a directory that they do not have permission to write to. |
| CVE-2023-24483 | High | 2023-02-16 | Not applicable | No public exploit | A vulnerability has been identified that, if exploited, could result in a local user elevating their privilege level to NT AUTHORITY\SYSTEM on a Citrix Virtual Apps and Desktops Windows VDA. |
| CVE-2022-27508 | High | 2023-01-26 | Not applicable | No public exploit | Unauthenticated denial of service |
| CVE-2022-27507 | Medium | 2023-01-26 | Not applicable | No public exploit | Authenticated denial of service |
| CVE-2019-18177 | Medium | 2022-12-26 | Not applicable | No public exploit | In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint. This affects Citrix ADC and Citrix Gateway 13.0-58.30 and later releases before the CTX276688 update. |
| CVE-2022-27516 | Critical | 2022-11-08 | Not applicable | No public exploit | User login brute force protection functionality bypass |
| CVE-2022-27513 | Critical | 2022-11-08 | Not applicable | No public exploit | Remote desktop takeover via phishing |
| CVE-2022-27509 | Medium | 2022-07-28 | Not applicable | No public exploit | Unauthenticated redirection to a malicious website |
| CVE-2022-27512 | Medium | 2022-06-16 | Not applicable | No public exploit | Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM. |
| CVE-2022-27511 | High | 2022-06-16 | Not applicable | No public exploit | Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, allowing an attacker with ssh access to connect with the default administrator credentials after the device has rebooted. |
| CVE-2022-21827 | High | 2022-05-26 | Not applicable | No public exploit | An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 what could allow an attacker who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt or delete files as SYSTEM. |
| CVE-2021-44519 | High | 2022-04-19 | Not applicable | No public exploit | In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to remote code execution. |
| CVE-2022-27506 | Low | 2022-04-13 | Not applicable | No public exploit | Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI |
| CVE-2022-27505 | Medium | 2022-04-13 | Not applicable | No public exploit | Reflected cross site scripting (XSS) |
| CVE-2022-27503 | Medium | 2022-04-13 | Not applicable | No public exploit | Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9 |
| CVE-2022-26151 | High | 2022-04-13 | Not applicable | No public exploit | Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection. |
| CVE-2021-44520 | High | 2022-04-13 | Not applicable | No public exploit | In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges. |
| CVE-2022-26355 | Medium | 2022-03-10 | Not applicable | No public exploit | Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) to incorrectly store that key in the Microsoft Software Key Storage Provider (MSKSP). This issue only occurs if PowerShell was used when configuring FAS to store the registration authority certificate’s private key in the TPM. It does not occur if the TPM was not selected for use or if the FAS administration console was used for configuration. |
| CVE-2022-21825 | High | 2022-02-09 | Not applicable | No public exploit | An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow an attacker to perform local privilege escalation. |
| CVE-2021-22956 | High | 2021-12-07 | Not applicable | No public exploit | An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with management interface access to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication. |
| CVE-2021-22955 | High | 2021-12-07 | Not applicable | No public exploit | A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtual server could allow an attacker to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication. |
| CVE-2021-22932 | High | 2021-08-16 | Not applicable | No public exploit | An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file encryption option to become disabled if it had previously been enabled. Customers are only affected by this issue if they previously selected “Enable Encryption” in the ShareFile configuration page and did not re-select this setting after running the CTX269106 mitigation tool. ShareFile customers who have not run the CTX269106 mitigation tool or who re-selected “Enable Encryption” immediately after running the tool are unaffected by this issue. |
| CVE-2021-22928 | High | 2021-08-05 | Not applicable | No public exploit | A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed to escalate their privilege level on that Windows VDA to SYSTEM. |
| CVE-2021-22927 | High | 2021-08-05 | Not applicable | No public exploit | A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session. |
| CVE-2021-22920 | Medium | 2021-08-05 | Not applicable | No public exploit | A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to a phishing attack through a SAML authentication hijack to steal a valid user session. |
| CVE-2021-22919 | High | 2021-08-05 | Not applicable | No public exploit | A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to the limited available disk space on the appliances being fully consumed. |
| CVE-2021-22914 | High | 2021-06-16 | Not applicable | No public exploit | Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud Connector installation log files. Such information could be used by an malicious actor to access a Citrix Cloud environment. This issue affects all versions of Citrix Cloud Connector that were installed by passing secure client parameters for installation via the command line. The issue does not affect Citrix Cloud Connector if it was installed using the interactive installer or where a parameter file was used with the command-line installer. |
| CVE-2020-8300 | Medium | 2021-06-16 | Not applicable | No public exploit | Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible. |
| CVE-2020-8299 | Medium | 2021-06-16 | Not applicable | No public exploit | Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0, 11.3.2, 11.3.1a, 11.2.3a, 11.1.2c, 10.2.9a suffers from uncontrolled resource consumption by way of a network-based denial-of-service from within the same Layer 2 network segment. Note that the attacker must be in the same Layer 2 network segment as the vulnerable appliance. |
| CVE-2021-22907 | High | 2021-05-27 | Not applicable | No public exploit | An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions prior to 2105 and 1912 LTSR prior to CU4. |
| CVE-2021-22891 | Critical | 2021-05-27 | Not applicable | No public exploit | A missing authorization vulnerability exists in Citrix ShareFile Storage Zones Controller before 5.7.3, 5.8.3, 5.9.3, 5.10.1 and 5.11.18 may allow unauthenticated remote compromise of the Storage Zones Controller. |
| CVE-2020-8275 | Medium | 2021-01-06 | Not applicable | No public exploit | Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device. |
| CVE-2020-8274 | Medium | 2021-01-06 | Not applicable | No public exploit | Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device. |
| CVE-2020-8258 | High | 2020-12-14 | Not applicable | No public exploit | Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, allows an attacker to modify arbitrary files. |
| CVE-2020-8257 | Critical | 2020-12-14 | Not applicable | No public exploit | Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, lead to privilege escalation attacks |
| CVE-2020-8273 | High | 2020-11-16 | Not applicable | No public exploit | Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.8. |
| CVE-2020-8272 | High | 2020-11-16 | Not applicable | No public exploit | Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 |
| CVE-2020-8271 | Critical | 2020-11-16 | Not applicable | No public exploit | Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 |
| CVE-2020-8253 | High | 2020-09-18 | Not applicable | No public exploit | Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 leads to the ability to access sensitive files. |
| CVE-2020-8247 | High | 2020-09-18 | Not applicable | No public exploit | Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2 before 10.2.7b are vulnerable to escalation of privileges on the management interface. |
| CVE-2020-8246 | High | 2020-09-18 | Not applicable | No public exploit | Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2 before 10.2.7b are vulnerable to a denial of service attack originating from the management network. |
| CVE-2020-8245 | Medium | 2020-09-18 | Not applicable | No public exploit | Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2 before 10.2.7b leads to an HTML Injection attack against the SSL VPN web portal. |
| CVE-2020-8200 | Medium | 2020-09-18 | Not applicable | No public exploit | Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server. |
| CVE-2020-8212 | Critical | 2020-08-17 | Not applicable | No public exploit | Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows access to privileged functionality. |
| CVE-2020-8211 | Critical | 2020-08-17 | Not applicable | No public exploit | Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows SQL Injection. |
| CVE-2020-8210 | High | 2020-08-17 | Not applicable | No public exploit | Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 discloses credentials of a service account. |
| CVE-2020-8208 | Medium | 2020-08-17 | Not applicable | No public exploit | Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.11 before RP6 and Citrix XenMobile Server before 10.9 RP5 allows Cross-Site Scripting (XSS). |
| CVE-2020-8207 | High | 2020-07-24 | Not applicable | No public exploit | Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the automatic updater service is running. |
| CVE-2020-8199 | High | 2020-07-10 | Not applicable | No public exploit | Improper access control in Citrix ADC Gateway Linux client versions before 1.0.0.137 results in local privilege escalation to root. |
| CVE-2020-8198 | Medium | 2020-07-10 | Not applicable | No public exploit | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in Stored Cross-Site Scripting (XSS). |
| CVE-2020-8197 | High | 2020-07-10 | Not applicable | No public exploit | Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands. |
| CVE-2020-8190 | High | 2020-07-10 | Not applicable | No public exploit | Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege escalation. |
| CVE-2020-8187 | High | 2020-07-10 | Not applicable | No public exploit | Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthenticated users to perform a denial of service attack. |
| CVE-2020-13998 | High | 2020-06-11 | Not applicable | No public exploit | Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA error page only occurs after a valid username is entered. NOTE: This vulnerability only affects products that are no longer supported by the maintainer |
| CVE-2020-13885 | High | 2020-06-08 | Not applicable | No public exploit | Citrix Workspace App before 1912 on Windows has Insecure Permissions which allows local users to gain privileges during the uninstallation of the application. |
| CVE-2020-13884 | High | 2020-06-08 | Not applicable | No public exploit | Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows local users to gain privileges during the uninstallation of the application. |
| CVE-2020-8983 | High | 2020-05-07 | Not applicable | No public exploit | An arbitrary file write issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020, which allows remote code execution. RCE and file access is granted to everything hosted by ShareFile, be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8982. |
| CVE-2020-6175 | Medium | 2020-03-16 | Not applicable | No public exploit | Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation. |
| CVE-2019-11345 | Medium | 2020-03-10 | Not applicable | No public exploit | Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow XSS. |