Overview 153 matches · 0 in Waratek scope · 0 protected · 9 exploited · 5 CISA KEV · 15 public PoC · 2 EPSS ≥ 0.5
153matches
0in Waratek scope0.0%
0protected0.0%
9exploited5.9%
5CISA KEV3.3%
15public PoC9.8%
2EPSS ≥ 0.51.3%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
153
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
153
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
9
5.9%
Working exploit published
11
7.2%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
133
86.9%
split by
peak 19 / year
20012
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20024
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
20031
Not applicable1
Medium1
not blocked1
Working exploit published1
20041
Not applicable1
Medium1
not blocked1
No public exploit1
20051
Not applicable1
Medium1
not blocked1
No public exploit1
20066
Not applicable6
Medium6
not blocked6
Working exploit published1
No public exploit5
20079
Not applicable9
Medium9
not blocked9
Working exploit published1
No public exploit8
20084
Not applicable4
Medium4
not blocked4
No public exploit4
20096
Not applicable6
Medium6
not blocked6
Working exploit published1
No public exploit5
20102
Not applicable2
Medium2
not blocked2
No public exploit2
20115
Not applicable5
Medium5
not blocked5
No public exploit5
20125
Not applicable5
Medium5
not blocked5
No public exploit5
20133
Not applicable3
Medium3
not blocked3
No public exploit3
201419
Not applicable19
Medium19
not blocked19
Working exploit published1
No public exploit18
201510
Not applicable10
Medium10
not blocked10
Working exploit published3
No public exploit7
20169
Not applicable9
Medium9
not blocked9
Exploited1
Working exploit published1
No public exploit7
201711
Not applicable11
Medium11
not blocked11
No public exploit11
20188
Not applicable8
Medium8
not blocked8
No public exploit8
20194
Not applicable4
Medium4
not blocked4
No public exploit4
202013
Not applicable13
Medium13
not blocked13
Exploited5
No public exploit8
20215
Not applicable5
Medium5
not blocked5
No public exploit5
20226
Not applicable6
Medium6
not blocked6
No public exploit6
20235
Not applicable5
Medium5
not blocked5
Exploited1
No public exploit4
202410
Not applicable10
Medium10
not blocked10
Exploited2
No public exploit8
20253
Not applicable3
Medium3
not blocked3
No public exploit3
20261
Not applicable1
Medium1
not blocked1
No public exploit1
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-10817 | Medium | 2026-06-30 | Not applicable | No public exploit | Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeStamp is enabled in TCP Profile and is associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler |
| CVE-2025-4365 | Medium | 2025-06-17 | Not applicable | No public exploit | Arbitrary file read in NetScaler Console and NetScaler SDX (SVM) |
| CVE-2025-1223 | Medium | 2025-02-20 | Not applicable | No public exploit | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
| CVE-2025-1222 | Medium | 2025-02-20 | Not applicable | No public exploit | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
| CVE-2024-8535 | Medium | 2024-11-12 | Not applicable | No public exploit | Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as an Auth Server (AAA Vserver) with KCDAccount configuration for Kerberos SSO to access backend resources |
| CVE-2024-8069 | Medium | 2024-11-12 | Not applicable | Exploited | Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server |
| CVE-2024-8068 | Medium | 2024-11-12 | Not applicable | Exploited | Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain |
| CVE-2024-7890 | Medium | 2024-09-11 | Not applicable | No public exploit | Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
| CVE-2024-6150 | Medium | 2024-07-10 | Not applicable | No public exploit | A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning |
| CVE-2024-6149 | Medium | 2024-07-10 | Not applicable | No public exploit | Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5 |
| CVE-2024-6148 | Medium | 2024-07-10 | Not applicable | No public exploit | Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5 |
| CVE-2024-5492 | Medium | 2024-07-10 | Not applicable | No public exploit | Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites in NetScaler ADC and NetScaler Gateway |
| CVE-2024-5661 | Medium | 2024-06-13 | Not applicable | No public exploit | An issue has been identified in both XenServer 8 and Citrix Hypervisor 8.2 CU1 LTSR which may allow a malicious administrator of a guest VM to cause the host to become slow and/or unresponsive. |
| CVE-2024-2049 | Medium | 2024-03-12 | Not applicable | No public exploit | Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited information from the appliance via Access to management IP. |
| CVE-2023-24490 | Medium | 2023-07-10 | Not applicable | No public exploit | Users with only access to launch VDA applications can launch an unauthorized desktop |
| CVE-2023-24488 | Medium | 2023-07-10 | Not applicable | Exploited | Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting |
| CVE-2023-24486 | Medium | 2023-07-10 | Not applicable | No public exploit | A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able to gain access to the Citrix Virtual Apps and Desktops session of another user who is using the same computer from which the ICA session is launched. |
| CVE-2023-24484 | Medium | 2023-02-16 | Not applicable | No public exploit | A malicious user can cause log files to be written to a directory that they do not have permission to write to. |
| CVE-2022-27507 | Medium | 2023-01-26 | Not applicable | No public exploit | Authenticated denial of service |
| CVE-2019-18177 | Medium | 2022-12-26 | Not applicable | No public exploit | In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint. This affects Citrix ADC and Citrix Gateway 13.0-58.30 and later releases before the CTX276688 update. |
| CVE-2022-27509 | Medium | 2022-07-28 | Not applicable | No public exploit | Unauthenticated redirection to a malicious website |
| CVE-2022-27512 | Medium | 2022-06-16 | Not applicable | No public exploit | Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM. |
| CVE-2022-27505 | Medium | 2022-04-13 | Not applicable | No public exploit | Reflected cross site scripting (XSS) |
| CVE-2022-27503 | Medium | 2022-04-13 | Not applicable | No public exploit | Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9 |
| CVE-2022-26355 | Medium | 2022-03-10 | Not applicable | No public exploit | Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) to incorrectly store that key in the Microsoft Software Key Storage Provider (MSKSP). This issue only occurs if PowerShell was used when configuring FAS to store the registration authority certificate’s private key in the TPM. It does not occur if the TPM was not selected for use or if the FAS administration console was used for configuration. |
| CVE-2021-22920 | Medium | 2021-08-05 | Not applicable | No public exploit | A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to a phishing attack through a SAML authentication hijack to steal a valid user session. |
| CVE-2020-8300 | Medium | 2021-06-16 | Not applicable | No public exploit | Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible. |
| CVE-2020-8299 | Medium | 2021-06-16 | Not applicable | No public exploit | Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0, 11.3.2, 11.3.1a, 11.2.3a, 11.1.2c, 10.2.9a suffers from uncontrolled resource consumption by way of a network-based denial-of-service from within the same Layer 2 network segment. Note that the attacker must be in the same Layer 2 network segment as the vulnerable appliance. |
| CVE-2020-8275 | Medium | 2021-01-06 | Not applicable | No public exploit | Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device. |
| CVE-2020-8274 | Medium | 2021-01-06 | Not applicable | No public exploit | Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device. |
| CVE-2020-8245 | Medium | 2020-09-18 | Not applicable | No public exploit | Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2 before 10.2.7b leads to an HTML Injection attack against the SSL VPN web portal. |
| CVE-2020-8200 | Medium | 2020-09-18 | Not applicable | No public exploit | Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server. |
| CVE-2020-8208 | Medium | 2020-08-17 | Not applicable | No public exploit | Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.11 before RP6 and Citrix XenMobile Server before 10.9 RP5 allows Cross-Site Scripting (XSS). |
| CVE-2020-8198 | Medium | 2020-07-10 | Not applicable | No public exploit | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in Stored Cross-Site Scripting (XSS). |
| CVE-2020-8196 | Medium | 2020-07-10 | Not applicable | Exploited | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users. |
| CVE-2020-8195 | Medium | 2020-07-10 | Not applicable | Exploited | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users. |
| CVE-2020-8194 | Medium | 2020-07-10 | Not applicable | Exploited | Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modification of a file download. |
| CVE-2020-8193 | Medium | 2020-07-10 | Not applicable | Exploited | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints. |
| CVE-2020-8191 | Medium | 2020-07-10 | Not applicable | Exploited | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting (XSS). |
| CVE-2020-6175 | Medium | 2020-03-16 | Not applicable | No public exploit | Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation. |
| CVE-2019-11345 | Medium | 2020-03-10 | Not applicable | No public exploit | Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow XSS. |
| CVE-2020-10112 | Medium | 2020-03-06 | Not applicable | No public exploit | Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. NOTE: Citrix disputes this as not a vulnerability. By default, Citrix ADC only caches static content served under certain URL paths for Citrix Gateway usage. No dynamic content is served under these paths, which implies that those cached pages would not change based on parameter values. All other data traffic going through Citrix Gateway are NOT cached by default |
| CVE-2020-10110 | Medium | 2020-03-06 | Not applicable | No public exploit | Citrix Gateway 11.1, 12.0, and 12.1 allows Information Exposure Through Caching. NOTE: Citrix disputes this as not a vulnerability. There is no sensitive information disclosure through the cache headers on Citrix ADC. The "Via" header lists cache protocols and recipients between the start and end points for a request or a response. The "Age" header provides the age of the cached response in seconds. Both headers are commonly used for proxy cache and the information is not sensitive |
| CVE-2014-3798 | Medium | 2019-07-11 | Not applicable | No public exploit | The Windows Guest Tools in Citrix XenServer 6.2 SP1 and earlier allows remote attackers to cause a denial of service (guest OS crash) via a crafted Ethernet frame. |
| CVE-2019-7218 | Medium | 2019-05-13 | Not applicable | No public exploit | Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app (like google authenticator) is able to bypass the first authentication phase (username/password mechanism) and log-in using username/otp combination only (phase 2 of 2FA). |
| CVE-2019-11550 | Medium | 2019-05-08 | Not applicable | No public exploit | Citrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper Certificate Validation. |
| CVE-2019-6485 | Medium | 2019-02-22 | Not applicable | No public exploit | Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Application Delivery Controller (ADC) 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 allow remote attackers to obtain sensitive plaintext information because of a TLS Padding Oracle Vulnerability when CBC-based cipher suites are enabled. |
| CVE-2018-19965 | Medium | 2018-12-08 | Not applicable | No public exploit | An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation. |
| CVE-2018-18517 | Medium | 2018-10-24 | Not applicable | No public exploit | Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS. |
| CVE-2018-18014 | Medium | 2018-10-24 | Not applicable | No public exploit | * Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private services listening on ports 8000, 30000 and 30001. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost. |
| CVE-2018-16969 | Medium | 2018-09-26 | Not applicable | No public exploit | Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message. |
| CVE-2018-3665 | Medium | 2018-06-21 | Not applicable | No public exploit | System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel. |
| CVE-2018-10651 | Medium | 2018-05-23 | Not applicable | No public exploit | There are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
| CVE-2018-10649 | Medium | 2018-05-23 | Not applicable | No public exploit | There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3. |
| CVE-2018-6811 | Medium | 2018-03-06 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Citrix NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to inject arbitrary web script or HTML via the Citrix NetScaler interface. |
| CVE-2017-17549 | Medium | 2017-12-13 | Not applicable | No public exploit | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 allow remote attackers to obtain sensitive information from the backend client TLS handshake by leveraging use of TLS with Client Certificates and a Diffie-Hellman Ephemeral (DHE) key exchange. |
| CVE-2017-17382 | Medium | 2017-12-13 | Not applicable | No public exploit | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack. |
| CVE-2015-3642 | Medium | 2017-08-02 | Not applicable | No public exploit | The TLS and DTLS processing functionality in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway devices with firmware 9.x before 9.3 Build 68.5, 10.0 through Build 78.6, 10.1 before Build 130.13, 10.1.e before Build 130.1302.e, 10.5 before Build 55.8, and 10.5.e before Build 55.8007.e makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). |
| CVE-2016-6877 | Medium | 2017-05-05 | Not applicable | No public exploit | Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page. NOTE: the vendor reports "our internal analysis of this issue concluded that this was not a valid vulnerability" because an exploitation scenario would involve a man-in-the-middle attack against a TLS session |
| CVE-2017-5933 | Medium | 2017-02-08 | Not applicable | No public exploit | Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly generates GCM nonces, which makes it marginally easier for remote attackers to obtain the GCM authentication key and spoof data by leveraging a reused nonce in a session and a "forbidden attack," a similar issue to CVE-2016-0270. |
| CVE-2017-5573 | Medium | 2017-01-30 | Not applicable | No public exploit | An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can cancel tasks of other administrators. |
| CVE-2017-5572 | Medium | 2017-01-30 | Not applicable | No public exploit | An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can corrupt the host database. |
| CVE-2016-10025 | Medium | 2017-01-26 | Not applicable | No public exploit | VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check. |
| CVE-2016-10024 | Medium | 2017-01-26 | Not applicable | No public exploit | Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations. |
| CVE-2016-9385 | Medium | 2017-01-23 | Not applicable | No public exploit | The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks. |
| CVE-2016-9677 | Medium | 2017-01-18 | Not applicable | No public exploit | Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive kernel address information via unspecified vectors. |
| CVE-2016-9111 | Medium | 2016-11-07 | Not applicable | Working exploit published | Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication requirement by leveraging physical access to a VDI for temporary disconnection of a LAN cable. NOTE: as of 20161208, the vendor could not reproduce the issue, stating "the researcher was unable to provide us with information that would allow us to confirm the behaviour and, despite extensive investigation on test deployments of supported products, we were unable to reproduce the behaviour as he described. The researcher has also, despite additional requests for information, ceased to respond to us." |
| CVE-2016-6259 | Medium | 2016-08-02 | Not applicable | No public exploit | Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check. |
| CVE-2016-5109 | Medium | 2016-07-13 | Not applicable | No public exploit | Citrix Worx Home for iOS before 10.3.6 and XenMobile MDX Toolkit for iOS before 10.3.6 might allow physically proximate attackers to bypass in-application Apple Touch ID authentication via unspecified vectors, related to an application requiring re-authentication. |
| CVE-2016-5433 | Medium | 2016-06-17 | Not applicable | No public exploit | Citrix iOS Receiver before 7.0 allows attackers to cause TLS certificates to be incorrectly validated via unspecified vectors. |
| CVE-2016-4945 | Medium | 2016-06-01 | Not applicable | Exploited | Cross-site scripting (XSS) vulnerability in vpn/js/gateway_login_form_view.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows remote attackers to inject arbitrary web script or HTML via the NSC_TMAC cookie. |
| CVE-2016-3712 | Medium | 2016-05-11 | Not applicable | No public exploit | Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode. |
| CVE-2016-2789 | Medium | 2016-04-07 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Web User Interface in Citrix XenMobile Server 10.0, 10.1 before Rolling Patch 4, and 10.3 before Rolling Patch 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2016-2072 | Medium | 2016-02-17 | Not applicable | No public exploit | The Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, 10.5.e before Build 59.1305.e, and 10.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors. |
| CVE-2016-1571 | Medium | 2016-01-22 | Not applicable | No public exploit | The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check. |
| CVE-2015-7998 | Medium | 2015-11-17 | Not applicable | No public exploit | The administration UI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allows attackers to obtain sensitive information via unspecified vectors. |
| CVE-2015-7997 | Medium | 2015-11-17 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2015-7996 | Medium | 2015-11-17 | Not applicable | No public exploit | The Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM (SVM) devices allow attackers to obtain credentials via the browser cache. |
| CVE-2015-6672 | Medium | 2015-09-17 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 132.8, 10.5 before Build 57.7, and 10.5e before Build 56.1505.e allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2015-4106 | Medium | 2015-06-03 | Not applicable | No public exploit | QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors. |
| CVE-2015-2841 | Medium | 2015-04-03 | Not applicable | Working exploit published | Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types. |
| CVE-2015-2840 | Medium | 2015-04-03 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in help/rt/large_search.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter. |
| CVE-2015-2839 | Medium | 2015-04-03 | Not applicable | No public exploit | The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix. |
| CVE-2015-2838 | Medium | 2015-04-03 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in Nitro API in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands as nsroot via shell metacharacters in the file_name JSON member in params/xen_hotfix/0 to nitro/v1/config/xen_hotfix. |
| CVE-2015-2682 | Medium | 2015-03-26 | Not applicable | Working exploit published | Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml. |
| CVE-2014-8580 | Medium | 2014-11-07 | Not applicable | No public exploit | Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5.50.10 before 10.5-52.11, 10.1.122.17 before 10.1-129.11, and 10.1-120.1316.e before 10.1-129.1105.e, when using unspecified configurations, allows remote authenticated users to access "network resources" of other users via unknown vectors. |
| CVE-2014-8495 | Medium | 2014-10-31 | Not applicable | No public exploit | Citrix XenMobile MDX Toolkit before 9.0.4, when used to wrap iOS 8 applications, does not properly encrypt cached application data, which allows context-dependent attackers to obtain sensitive information by reading the cache. |
| CVE-2011-2593 | Medium | 2014-08-12 | Not applicable | No public exploit | Integer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a crafted Content-Length HTTP header, which triggers a heap-based buffer overflow. |
| CVE-2014-4948 | Medium | 2014-07-22 | Not applicable | No public exploit | Unspecified vulnerability in Citrix XenServer 6.2 Service Pack 1 and earlier allows attackers to cause a denial of service and obtain sensitive information by modifying the guest virtual hard disk (VHD). |
| CVE-2014-4347 | Medium | 2014-07-16 | Not applicable | No public exploit | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) before 9.3-62.4 and 10.x before 10.1-126.12 allows attackers to obtain sensitive information via vectors related to a cookie. |
| CVE-2014-4346 | Medium | 2014-07-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2014-4700 | Medium | 2014-07-11 | Not applicable | No public exploit | Citrix XenDesktop 7.x, 5.x, and 4.x, when pooled random desktop groups is enabled and ShutdownDesktopsAfterUse is disabled, allows local guest users to gain access to another user's desktop via unspecified vectors. |
| CVE-2013-2758 | Medium | 2014-05-23 | Not applicable | No public exploit | Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C uses a hash of a predictable sequence, which makes it easier for remote attackers to guess the console access URL via a brute force attack. |
| CVE-2013-2756 | Medium | 2014-05-23 | Not applicable | No public exploit | Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C allows remote attackers to bypass the console proxy authentication by leveraging knowledge of the source code. |
| CVE-2014-1899 | Medium | 2014-05-02 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2013-6944 | Medium | 2014-03-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the user interface in the AAA TM vServer in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2013-6943 | Medium | 2014-03-11 | Not applicable | No public exploit | Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to conduct an LDAP injection attack via vectors related to SSH and Web management usernames. |
| CVE-2013-6942 | Medium | 2014-03-11 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. |
| CVE-2013-6940 | Medium | 2014-03-11 | Not applicable | No public exploit | Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 logs user credentials, which allows attackers to obtain sensitive information via unspecified vectors. |
| CVE-2013-6939 | Medium | 2014-03-11 | Not applicable | No public exploit | Unspecified vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows attackers to cause a denial of service via unknown vectors, related to "RADIUS authentication." |