WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor citrix✕
Overview 15 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
15matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 15 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 15 100.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 15 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 15 100.0%
split by peak 2 / year
Not applicable: 15 Low: 15 not blocked: 15 No public exploit: 15
20041 Not applicable1 Low1 not blocked1 No public exploit1 20052 Not applicable2 Low2 not blocked2 No public exploit2 20060 20071 Not applicable1 Low1 not blocked1 No public exploit1 20081 Not applicable1 Low1 not blocked1 No public exploit1 20091 Not applicable1 Low1 not blocked1 No public exploit1 20102 Not applicable2 Low2 not blocked2 No public exploit2 20111 Not applicable1 Low1 not blocked1 No public exploit1 20122 Not applicable2 Low2 not blocked2 No public exploit2 20131 Not applicable1 Low1 not blocked1 No public exploit1 20141 Not applicable1 Low1 not blocked1 No public exploit1 20150 20160 20170 20181 Not applicable1 Low1 not blocked1 No public exploit1 20190 20200 20210 20221 Not applicable1 Low1 not blocked1 No public exploit1
2004200620082010201220142016201820202022
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-27506 Low 2022-04-13 Not applicable No public exploit Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI
CVE-2018-16968 Low 2018-09-26 Not applicable No public exploit Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal.
CVE-2014-2690 Low 2014-04-15 Not applicable No public exploit Citrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.3 allows local users to obtain administrator credentials by reading the log.
CVE-2012-5616 Low 2013-01-22 Not applicable No public exploit Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.
CVE-2012-5512 Low 2012-12-13 Not applicable No public exploit Array index error in the HVMOP_set_mem_access handler in Xen 4.1 allows local HVM guest OS administrators to cause a denial of service (crash) or obtain sensitive information via unspecified vectors.
CVE-2012-3494 Low 2012-11-23 Not applicable No public exploit The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service (host crash) by writing to the reserved bits of the DR7 debug control register.
CVE-2011-3262 Low 2011-08-19 Not applicable No public exploit tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allows local users to cause a denial of service (management software infinite loop and management domain resource consumption) via unspecified vectors related to "Lack of error checking in the decompression loop."
CVE-2010-3699 Low 2010-12-08 Not applicable No public exploit The backend driver in Xen 3.x allows guest OS users to cause a denial of service via a kernel thread leak, which prevents the device and guest OS from being shut down or create a zombie domain, causes a hang in zenwatch, or prevents unspecified xm commands from working properly, related to (1) netback, (2) blkback, or (3) blktap.
CVE-2010-2619 Low 2010-07-02 Not applicable No public exploit Citrix XenServer 5.0 Update 2 and earlier, and 5.5 Update 1 and earlier, when using a pvops kernel, allows guest users to cause a denial of service in the host via unspecified vectors that trigger "incorrectly set flags."
CVE-2008-6561 Low 2009-03-31 Not applicable No public exploit Citrix Presentation Server Client for Windows before 10.200 does not clear "credential information" from process memory in unspecified circumstances, which might allow local users to gain privileges.
CVE-2008-5107 Low 2008-11-17 Not applicable No public exploit The installation process for Citrix Presentation Server 4.5 and Desktop Server 1.0, when MSI logging is enabled, stores database credentials in MSI log files, which allows local users to obtain these credentials by reading the log files.
CVE-2007-6267 Low 2007-12-07 Not applicable No public exploit Citrix EdgeSight 4.2 and 4.5 for Presentation Server, EdgeSight 4.2 and 4.5 for Endpoints, and EdgeSight for NetScaler 1.0 and 1.1 do not properly store database credentials in configuration files, which allows local users to obtain sensitive information.
CVE-2005-4412 Low 2005-12-20 Not applicable No public exploit Citrix Program Neighborhood client before 9.150 caches the user password in plaintext in the GUI while asterisks are used to visually obfuscate the password, which allows attackers with access to the session to obtain the password by using a tool to directly access the field.
CVE-2005-0822 Low 2005-05-02 Not applicable No public exploit Citrix Metaframe Password Manager 2.5 and earlier stores a password in cleartext although it is obfuscated when presented to a user, which allows users to view their secondary passwords even if it is not allowed by policy.
CVE-2004-1902 Low 2004-12-31 Not applicable No public exploit The Citrix MetaFrame Password Manager 2.0, when a central credential store is not configured, does not encrypt passwords entered immediately after executing the First Time User Wizards, which allows local users to gain sensitive information.