CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2012-4603
https://notcve.org/view.php?id=CVE-2012-4603
Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow remote attackers to execute arbitrary code by convincing a target to open a specially crafted file from an SMB or WebDAV fileserver. Citrix XenApp Online Plug-in para Windows versión 12.1 y anteriores, y Citrix Receiver para Windows versión 3.2 y anteriores, podrían permitir a atacantes remotos ejecutar código arbitrario al convencer a un objetivo de que abra un archivo especialmente diseñado desde un servidor de archivos SMB o WebDAV. • http://www.securityfocus.com/bid/55518 http://www.securitytracker.com/id?1027521 http://www.securitytracker.com/id?1027522 https://exchange.xforce.ibmcloud.com/vulnerabilities/78433 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 0CVE-2019-11634 – Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-11634
Citrix Workspace App before 1904 for Windows has Incorrect Access Control. La aplicación Citrix Workspace antes de 1904 para Windows tiene un control de acceso incorrecto. Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives. • https://support.citrix.com/article/CTX251986 https://support.citrix.com/v1/search?searchQuery=%22%22&lang=en&sort=cr_date_desc&prod=&pver=&ct=Security+Bulletin •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 2CVE-2016-9111 – Citrix Receiver/Receiver Desktop Lock 4.5 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2016-9111
Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication requirement by leveraging physical access to a VDI for temporary disconnection of a LAN cable. NOTE: as of 20161208, the vendor could not reproduce the issue, stating "the researcher was unable to provide us with information that would allow us to confirm the behaviour and, despite extensive investigation on test deployments of supported products, we were unable to reproduce the behaviour as he described. The researcher has also, despite additional requests for information, ceased to respond to us." Acceso incorrecto a los mecanismos de control en Citrix Receiver Desktop Lock 4.5 permiten a un atacante eludir el requerimiento de autenticación aprovechando acceso físico a un VDI para una desconexión temporal de un cable LAN. NOTA: a partir del 08/12/2016, el fabricante no puede reproducir el problema, afirmando "el investigador no ha sido capaz de darnos información que nos permita confirmar el comportamiento y, a pesar de una extensa investigación en implementaciones de prueba de productos compatibles, no hemos sido capaces de reproducir el comportamiento como fue descrito. • https://www.exploit-db.com/exploits/40686 http://www.securityfocus.com/bid/94229 http://www.securitytracker.com/id/1037176 https://packetstormsecurity.com/files/139493/Citrix-Receiver-Receiver-Desktop-Lock-4.5-Authentication-Bypass.html https://vuldb.com/?id.93250 • CWE-254: 7PK - Security Features CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5433
https://notcve.org/view.php?id=CVE-2016-5433
Citrix iOS Receiver before 7.0 allows attackers to cause TLS certificates to be incorrectly validated via unspecified vectors. Citrix iOS Receiver en versiones anterioes a 7.0 permite a atacantes provocar certificados TLS para ser validados incorrectamente a través de vectores no especificados. • http://support.citrix.com/article/CTX213998 • CWE-20: Improper Input Validation CWE-310: Cryptographic Issues •
CVSS: 9.3EPSS: 2%CPEs: 5EXPL: 0CVE-2010-2990
https://notcve.org/view.php?id=CVE-2010-2990
Citrix Online Plug-in for Windows for XenApp & XenDesktop before 11.2, Citrix Online Plug-in for Mac for XenApp & XenDesktop before 11.0, Citrix ICA Client for Linux before 11.100, Citrix ICA Client for Solaris before 8.63, and Citrix Receiver for Windows Mobile before 11.5 allow remote attackers to execute arbitrary code via (1) a crafted HTML document, (2) a crafted .ICA file, or (3) a crafted type field in an ICA graphics packet, related to a "heap offset overflow" issue. Citrix Online Plug-in para Windows para XenApp & XenDesktop anterior v11.2, Citrix Online Plug-in para Mac para XenApp & XenDesktop anterior v11.0, Citrix ICA Client para Linux anterior v11.100, Citrix ICA Client para Solaris anterior v8.63, y Citrix Receiver para Windows Mobile before v11.5 permite a atacantes remotos ejecutar código de su elección a través de (1) un documento HTML manipulado, (2) un fichero .ICA manipulado, o (3) un tipo de campo manipulado, en un paquete gráfico ICA, relacionado con el tema de "desbordamiento de pila offset". • http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0040.html http://secunia.com/advisories/40808 http://support.citrix.com/article/CTX125975 http://www.securityfocus.com/archive/1/512861/100/0/threaded • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •