Citrix
Page 2 of 3 — Citrix CVEs from a corpus of 264, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34675 | Medium | 5.5 | 2022-12-30 | NVIDIA Display Driver for Linux contains a vulnerability in the Virtual GPU Manager, where it does not check the return value from a null-pointer dereference… |
CVE-2022-34674 | Medium | 6.8 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where a helper function maps more physical pages than were reque… |
CVE-2022-34670 | High | 7.8 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause truncation errors w… |
CVE-2019-18177 | Medium | 6.5 | 2022-12-26 | In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint. This affects Citri… |
CVE-2022-27518 | Critical | 9.8 | 2022-12-13 | Unauthenticated remote arbitrary code execution |
CVE-2022-34666 | Medium | 6.5 | 2022-11-10 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-… |
CVE-2022-27516 | Medium | 5.3 | 2022-11-08 | User login brute force protection functionality bypass |
CVE-2022-27513 | High | 8.3 | 2022-11-08 | Remote desktop takeover via phishing |
CVE-2022-27510 | Critical | 9.8 | 2022-11-08 | Unauthorized access to Gateway user capabilities |
CVE-2022-27509 | Medium | 6.1 | 2022-07-28 | Unauthenticated redirection to a malicious website |
CVE-2022-27512 | Medium | 5.3 | 2022-06-16 | Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM. |
CVE-2022-27511 | High | 8.1 | 2022-06-16 | Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, a… |
CVE-2022-21827 | High | 7.1 | 2022-05-26 | An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 what could allow an… |
CVE-2021-44519 | High | 8.8 | 2022-04-19 | In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to remote code execution. |
CVE-2022-20717 | Medium | 5.5 | 2022-04-15 | A vulnerability in the NETCONF process of Cisco SD-WAN vEdge Routers could allow an authenticated, local attacker to cause an affected device to run out of mem… |
CVE-2022-27506 | Low | 2.7 | 2022-04-13 | Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI |
CVE-2022-27505 | Medium | 6.1 | 2022-04-13 | Reflected cross site scripting (XSS) |
CVE-2022-27503 | Medium | 6.1 | 2022-04-13 | Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9 |
CVE-2022-26151 | High | 7.2 | 2022-04-13 | Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection. |
CVE-2021-44520 | High | 8.8 | 2022-04-13 | In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges. |
CVE-2022-26355 | Medium | 4.4 | 2022-03-10 | Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private… |
CVE-2022-21825 | High | 7.8 | 2022-02-09 | An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow an attacker to perfo… |
CVE-2021-22956 | High | 7.5 | 2021-12-07 | An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSI… |
CVE-2021-22955 | High | 7.5 | 2021-12-07 | A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtua… |
CVE-2021-22941 | Critical | 9.8 | 2021-09-23 | Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zo… |
CVE-2021-22932 | High | 7.5 | 2021-08-16 | An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file encryption option t… |
CVE-2021-22928 | High | 7.8 | 2021-08-05 | A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile… |
CVE-2021-22927 | High | 8.1 | 2021-08-05 | A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijac… |
CVE-2021-22920 | Medium | 6.5 | 2021-08-05 | A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN… |
CVE-2021-22919 | High | 7.5 | 2021-08-05 | A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN… |
CVE-2021-22914 | High | 7.5 | 2021-06-16 | Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud… |
CVE-2020-8300 | Medium | 6.5 | 2021-06-16 | Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access contr… |
CVE-2020-8299 | Medium | 6.5 | 2021-06-16 | Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Editio… |
CVE-2021-22907 | High | 7.8 | 2021-05-27 | An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions prior to 2105 and 19… |
CVE-2021-22891 | Critical | 9.8 | 2021-05-27 | A missing authorization vulnerability exists in Citrix ShareFile Storage Zones Controller before 5.7.3, 5.8.3, 5.9.3, 5.10.1 and 5.11.18 may allow unauthentica… |
CVE-2021-1087 | Medium | 5.5 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), which could allow an attacker to retrieve information that could lead to… |
CVE-2021-1086 | High | 7.1 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it allows guests to control unauthorized resources, which may lead t… |
CVE-2021-1085 | High | 7.3 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to write to a shared memory location and man… |
CVE-2021-1084 | High | 7.8 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input length is not validated, w… |
CVE-2021-1083 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input length is not validated… |
CVE-2021-1082 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which an input length is not validated, which may lead to informatio… |
CVE-2021-1081 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU manager (vGPU plugin), in which an input length is not validated… |
CVE-2021-1080 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which certain input data is not validated, which may lead to informa… |
CVE-2021-1066 | Medium | 5.5 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to unexpected consumption of resources, w… |
CVE-2021-1065 | High | 7.1 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to tampering of data or denial of service… |
CVE-2021-1064 | High | 7.1 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which it obtains a value from an untrusted source, converts this value to a pointer, and de… |
CVE-2021-1063 | High | 7.8 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input offset is not validated, which may lead to a buffer overread, which in turn… |
CVE-2021-1062 | High | 7.1 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input data length is not validated, which may lead to tampering of data or denial… |
CVE-2021-1061 | Medium | 6.3 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which a race condition may cause the vGPU plugin to continue using a previously validated r… |
CVE-2021-1060 | High | 7.1 | 2021-01-08 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input index is not validated, which may lead to tamp… |
CVE-2021-1059 | High | 7.8 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input index is not validated, which may lead to integer overflow, which in turn ma… |
CVE-2021-1058 | High | 7.1 | 2021-01-08 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input data size is not validated, which may lead to… |
CVE-2021-1057 | High | 7.8 | 2021-01-08 | NVIDIA Virtual GPU Manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin in which it allows guests to allocate some resources for which the g… |
CVE-2020-8275 | Medium | 4.3 | 2021-01-06 | Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored… |
CVE-2020-8274 | Medium | 6.5 | 2021-01-06 | Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read… |
CVE-2020-8283 | High | 8.8 | 2020-12-14 | An authorised user on a Windows host running Citrix Universal Print Server can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912… |
CVE-2020-8258 | High | 7.5 | 2020-12-14 | Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, allows an attacke… |
CVE-2020-8257 | Critical | 9.8 | 2020-12-14 | Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, lead to privilege… |
CVE-2020-8273 | High | 8.8 | 2020-11-16 | Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.8. |
CVE-2020-8272 | High | 7.5 | 2020-11-16 | Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 |
CVE-2020-8271 | Critical | 9.8 | 2020-11-16 | Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 |
CVE-2020-8270 | High | 8.8 | 2020-11-16 | An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes C… |
CVE-2020-8269 | High | 8.8 | 2020-11-16 | An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CT… |
CVE-2020-8253 | High | 7.5 | 2020-09-18 | Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Cit… |
CVE-2020-8247 | High | 8.8 | 2020-09-18 | Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix… |
CVE-2020-8246 | High | 7.5 | 2020-09-18 | Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix… |
CVE-2020-8245 | Medium | 6.1 | 2020-09-18 | Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIP… |
CVE-2020-8200 | Medium | 6.5 | 2020-09-18 | Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Ci… |
CVE-2020-8212 | Critical | 9.8 | 2020-08-17 | Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix Xen… |
CVE-2020-8211 | Critical | 9.8 | 2020-08-17 | Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix X… |
CVE-2020-8210 | High | 7.5 | 2020-08-17 | Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and… |
CVE-2020-8209 | High | 7.5 | 2020-08-17 | Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Cit… |
CVE-2020-8208 | Medium | 6.1 | 2020-08-17 | Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.11 before RP6 and C… |
CVE-2020-8207 | High | 8.8 | 2020-07-24 | Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the automatic updater servi… |
CVE-2020-8199 | High | 7.8 | 2020-07-10 | Improper access control in Citrix ADC Gateway Linux client versions before 1.0.0.137 results in local privilege escalation to root. |
CVE-2020-8198 | Medium | 6.1 | 2020-07-10 | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-O… |
CVE-2020-8197 | High | 8.8 | 2020-07-10 | Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low… |
CVE-2020-8196 | Medium | 4.3 | 2020-07-10 | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP… |
CVE-2020-8195 | Medium | 6.5 | 2020-07-10 | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-O… |
CVE-2020-8194 | Medium | 6.5 | 2020-07-10 | Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP… |
CVE-2020-8193 | Medium | 6.5 | 2020-07-10 | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP… |
CVE-2020-8191 | Medium | 6.1 | 2020-07-10 | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-O… |
CVE-2020-8190 | High | 7.5 | 2020-07-10 | Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege esca… |
CVE-2020-8187 | High | 7.5 | 2020-07-10 | Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthenticated users to perform a denial of service… |
CVE-2020-13998 | Medium | 5.3 | 2020-06-11 | Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA error page o… |
CVE-2020-13885 | High | 7.8 | 2020-06-08 | Citrix Workspace App before 1912 on Windows has Insecure Permissions which allows local users to gain privileges during the uninstallation of the application. |
CVE-2020-13884 | High | 7.8 | 2020-06-08 | Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows local users to gain privileges during the… |
CVE-2020-8983 | High | 7.5 | 2020-05-07 | An arbitrary file write issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases… |
CVE-2020-8982 | High | 7.5 | 2020-05-07 | An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent… |
CVE-2020-7473 | High | 7.5 | 2020-05-07 | In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020… |
CVE-2020-6175 | Medium | 5.9 | 2020-03-16 | Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation. |
CVE-2019-11345 | Medium | 6.1 | 2020-03-10 | Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow XSS. |
CVE-2020-10112 | Medium | 5.4 | 2020-03-06 | Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. NOTE: Citrix disputes this as not a vulnerability. By default, Citrix ADC only caches static conten… |
CVE-2020-10111 | High | 7.5 | 2020-03-06 | Citrix Gateway 11.1, 12.0, and 12.1 has an Inconsistent Interpretation of HTTP Requests. NOTE: Citrix disputes the reported behavior as not a security issue. C… |
CVE-2020-10110 | Medium | 5.3 | 2020-03-06 | Citrix Gateway 11.1, 12.0, and 12.1 allows Information Exposure Through Caching. NOTE: Citrix disputes this as not a vulnerability. There is no sensitive infor… |
CVE-2012-4606 | High | 7.8 | 2020-01-23 | Citrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5.0 Update 3 contains a Local Privilege Escalation Vulnerabilit… |
CVE-2012-4603 | High | 7.8 | 2020-01-10 | Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow remote attackers to execute arbitrary co… |
CVE-2013-3620 | High | 7.5 | 2020-01-02 | Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315… |
CVE-2013-3619 | High | 8.1 | 2020-01-02 | Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 gener… |
CVE-2019-19781 | Critical | 9.8 | 2019-12-27 | An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal. |