Citrix
Page 3 of 5 — Citrix CVEs from a corpus of 459, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-18225 | Critical | 9.8 | 2019-10-21 | An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway before 10.5 build 70.8, 11.x before 11.1 build 63.9, 12.0 before build 62.1… |
CVE-2019-17366 | High | 8.8 | 2019-10-09 | Citrix Application Delivery Management (ADM) 12.1 before build 54.13 has Incorrect Access Control. |
CVE-2019-13608 | High | 7.5 | 2019-08-29 | Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. |
CVE-2019-12992 | High | 8.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 6 of 6). |
CVE-2019-12991 | High | 8.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6). |
CVE-2019-12990 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal. |
CVE-2019-12989 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection. |
CVE-2019-12988 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6). |
CVE-2019-12987 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6). |
CVE-2019-12986 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6). |
CVE-2019-12985 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6). |
CVE-2014-3798 | Medium | 6.5 | 2019-07-11 | The Windows Guest Tools in Citrix XenServer 6.2 SP1 and earlier allows remote attackers to cause a denial of service (guest OS crash) via a crafted Ethernet fr… |
CVE-2019-12292 | Critical | 9.8 | 2019-06-24 | Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control. |
CVE-2019-9548 | Critical | 10.0 | 2019-06-05 | Citrix Application Delivery Management (ADM) 12.1.x before 12.1.50.33 has Incorrect Access Control. |
CVE-2018-18571 | Critical | 9.1 | 2019-06-05 | An Incorrect Access Control vulnerability has been identified in Citrix XenMobile Server 10.8.0 before Rolling Patch 6 and 10.9.0 before Rolling Patch 3. An at… |
CVE-2019-10883 | Critical | 9.8 | 2019-06-03 | Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection. |
CVE-2019-11634 | Critical | 9.8 | 2019-05-22 | Citrix Workspace App before 1904 for Windows has Incorrect Access Control. |
CVE-2019-12044 | High | 7.5 | 2019-05-22 | A Buffer Overflow exists in Citrix NetScaler Gateway 10.5.x before 10.5.70.x, 11.1.x before 11.1.59.10, 12.0.x before 12.0.59.8, and 12.1.x before 12.1.49.23 a… |
CVE-2019-7218 | Medium | 5.9 | 2019-05-13 | Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's o… |
CVE-2019-7217 | High | 7.5 | 2019-05-13 | Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request t… |
CVE-2019-11550 | Medium | 5.9 | 2019-05-08 | Citrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper Certificate Validation. |
CVE-2019-6485 | Medium | 5.9 | 2019-02-22 | Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Appl… |
CVE-2018-19965 | Medium | 5.6 | 2018-12-08 | An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a n… |
CVE-2018-19962 | High | 7.8 | 2018-12-08 | An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings ar… |
CVE-2018-19961 | High | 7.8 | 2018-12-08 | An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not alwa… |
CVE-2018-18517 | Medium | 4.8 | 2018-10-24 | Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS. |
CVE-2018-18014 | Medium | 4.8 | 2018-10-24 | * Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private s… |
CVE-2018-18013 | High | 7.8 | 2018-10-24 | * Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. If this service is supplied with… |
CVE-2018-17448 | Critical | 9.8 | 2018-10-23 | An Incorrect Access Control issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4. |
CVE-2018-17447 | High | 7.5 | 2018-10-23 | An Information Exposure Through Log Files issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4. |
CVE-2018-17446 | Critical | 9.8 | 2018-10-23 | A SQL Injection issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4. |
CVE-2018-17445 | Critical | 9.8 | 2018-10-23 | A Command Injection issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4. |
CVE-2018-17444 | High | 7.5 | 2018-10-23 | A Directory Traversal issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4. |
CVE-2018-16969 | Medium | 4.3 | 2018-09-26 | Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message. |
CVE-2018-16968 | Low | 3.1 | 2018-09-26 | Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal. |
CVE-2018-14007 | Critical | 9.8 | 2018-08-15 | Citrix XenServer 7.1 and newer allows Directory Traversal. |
CVE-2016-9603 | Medium | 5.5 | 2018-07-27 | A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client… |
CVE-2017-2620 | Medium | 5.5 | 2018-07-27 | Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur whi… |
CVE-2017-2615 | Medium | 5.5 | 2018-07-03 | Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA dat… |
CVE-2018-11053 | Medium | 6.5 | 2018-06-26 | Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission… |
CVE-2018-3665 | Medium | 5.6 | 2018-06-21 | System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data… |
CVE-2018-10654 | High | 8.1 | 2018-05-23 | There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
CVE-2018-10653 | Critical | 9.8 | 2018-05-23 | There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
CVE-2018-10652 | High | 7.5 | 2018-05-23 | There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3. |
CVE-2018-10651 | Medium | 6.1 | 2018-05-23 | There are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
CVE-2018-10650 | High | 7.8 | 2018-05-23 | There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
CVE-2018-10649 | Medium | 6.1 | 2018-05-23 | There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3. |
CVE-2018-10648 | Critical | 9.8 | 2018-05-23 | There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
CVE-2018-7218 | Critical | 9.8 | 2018-05-17 | The AppFirewall functionality in Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5 before Build 68.7, 11.0 before Build 71.24, 11.1 b… |
CVE-2018-8897 | High | 7.8 | 2018-05-08 | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some… |
CVE-2018-6811 | Medium | 6.1 | 2018-03-06 | Multiple cross-site scripting (XSS) vulnerabilities in Citrix NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow… |
CVE-2018-6810 | High | 7.5 | 2018-03-06 | Directory traversal vulnerability in NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allows remote attackers to trav… |
CVE-2018-6809 | Critical | 9.8 | 2018-03-06 | NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to gain privilege on a target system. |
CVE-2018-6808 | High | 7.5 | 2018-03-06 | NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to download arbitrary files on the target sys… |
CVE-2018-5314 | High | 7.5 | 2018-03-01 | Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13; an… |
CVE-2018-6186 | High | 8.8 | 2018-02-01 | Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/read_url URI by an authenticated attacker who has a webapp account. The attack… |
CVE-2017-17549 | Medium | 5.9 | 2017-12-13 | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12… |
CVE-2017-17382 | Medium | 5.9 | 2017-12-13 | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12… |
CVE-2017-14602 | High | 7.2 | 2017-09-26 | A vulnerability has been identified in the management interface of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before bui… |
CVE-2017-12137 | High | 8.8 | 2017-08-24 | arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref. |
CVE-2017-12136 | High | 7.8 | 2017-08-24 | Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service (free list corruption and h… |
CVE-2017-12135 | High | 8.8 | 2017-08-24 | Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain privileges via vectors involving transiti… |
CVE-2017-12134 | High | 8.8 | 2017-08-24 | The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently… |
CVE-2015-7705 | Critical | 9.8 | 2017-08-07 | The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted re… |
CVE-2015-7704 | High | 7.5 | 2017-08-07 | The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages. |
CVE-2015-3642 | Medium | 5.9 | 2017-08-02 | The TLS and DTLS processing functionality in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway devices with firmware 9.x before 9.3… |
CVE-2017-6316 | Critical | 9.8 | 2017-07-20 | Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBri… |
CVE-2017-9231 | High | 7.5 | 2017-06-16 | XML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3 allows attackers to obtain sensitive information via unspecifie… |
CVE-2016-6877 | Medium | 5.3 | 2017-05-05 | Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a c… |
CVE-2017-7219 | High | 8.8 | 2017-04-13 | A heap overflow vulnerability in Citrix NetScaler Gateway versions 10.1 before 135.8/135.12, 10.5 before 65.11, 11.0 before 70.12, and 11.1 before 52.13 allows… |
CVE-2016-9637 | High | 7.5 | 2017-02-17 | The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to… |
CVE-2017-5933 | Medium | 5.9 | 2017-02-08 | Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly generates GCM nonces… |
CVE-2017-5573 | Medium | 4.9 | 2017-01-30 | An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can cancel tasks of other administra… |
CVE-2017-5572 | Medium | 6.5 | 2017-01-30 | An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can corrupt the host database. |
CVE-2016-10025 | Medium | 5.5 | 2017-01-26 | VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of s… |
CVE-2016-10024 | Medium | 6.0 | 2017-01-26 | Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asyn… |
CVE-2016-9386 | High | 7.8 | 2017-01-23 | The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges… |
CVE-2016-9385 | Medium | 6.0 | 2017-01-23 | The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host cr… |
CVE-2016-9383 | High | 8.8 | 2017-01-23 | Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a den… |
CVE-2016-9382 | High | 7.8 | 2017-01-23 | Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of serv… |
CVE-2016-9381 | High | 7.5 | 2017-01-23 | Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vu… |
CVE-2016-9380 | High | 7.5 | 2017-01-23 | The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbi… |
CVE-2016-9379 | High | 7.9 | 2017-01-23 | The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbit… |
CVE-2016-9680 | High | 7.5 | 2017-01-18 | Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive information from kernel memory via unspecified vectors. |
CVE-2016-9679 | Critical | 9.8 | 2017-01-18 | Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer. |
CVE-2016-9678 | Critical | 9.8 | 2017-01-18 | Use-after-free vulnerability in Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code via unspecified vectors. |
CVE-2016-9677 | Medium | 5.3 | 2017-01-18 | Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive kernel address information via unspecified vectors. |
CVE-2016-9676 | Critical | 9.8 | 2017-01-18 | Buffer overflow in Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code via unspecified vectors. |
CVE-2016-9111 | Medium | 6.8 | 2016-11-07 | Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication requirement by leveraging physical acces… |
CVE-2016-9028 | High | 8.8 | 2016-10-28 | Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal s… |
CVE-2016-6273 | High | 7.5 | 2016-10-07 | The lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) before 2015 SP5 and 2016 before R1 SP1, as used by Citrix License Server for Wind… |
CVE-2016-6276 | High | 7.8 | 2016-09-26 | Citrix Linux Virtual Delivery Agent (aka VDA, formerly Linux Virtual Desktop) before 1.4.0 allows local users to gain root privileges via unspecified vectors. |
CVE-2016-6493 | Critical | 9.8 | 2016-08-19 | Citrix XenApp 6.x before 6.5 HRP07 and 7.x before 7.9 and Citrix XenDesktop before 7.9 might allow attackers to weaken an unspecified security mitigation via v… |
CVE-2016-6259 | Medium | 6.2 | 2016-08-02 | Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bi… |
CVE-2016-6258 | High | 8.8 | 2016-08-02 | The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-pa… |
CVE-2016-5109 | Medium | 4.3 | 2016-07-13 | Citrix Worx Home for iOS before 10.3.6 and XenMobile MDX Toolkit for iOS before 10.3.6 might allow physically proximate attackers to bypass in-application Appl… |
CVE-2016-5433 | Medium | 6.1 | 2016-06-17 | Citrix iOS Receiver before 7.0 allows attackers to cause TLS certificates to be incorrectly validated via unspecified vectors. |
CVE-2016-5302 | Critical | 9.8 | 2016-06-13 | Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on the management networ… |
CVE-2016-4945 | Medium | 6.1 | 2016-06-01 | Cross-site scripting (XSS) vulnerability in vpn/js/gateway_login_form_view.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows remote attackers to in… |
CVE-2016-4810 | High | 7.5 | 2016-06-01 | Citrix Studio before 7.6.1000, Citrix XenDesktop 7.x before 7.6 LTSR Cumulative Update 1 (CU1), and Citrix XenApp 7.5 and 7.6 allow attackers to set Access Pol… |