CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2016-2789
https://notcve.org/view.php?id=CVE-2016-2789
Cross-site scripting (XSS) vulnerability in the Web User Interface in Citrix XenMobile Server 10.0, 10.1 before Rolling Patch 4, and 10.3 before Rolling Patch 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en la Web User Interface en Citrix XenMobile Server 10.0, 10.1 en versiones anteriores a Rolling Patch 4 y 10.3 en versiones anteriores a Rolling Patch 1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://support.citrix.com/article/CTX207499 http://www.securitytracker.com/id/1035265 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.6EPSS: 0%CPEs: 17EXPL: 0CVE-2015-8555
https://notcve.org/view.php?id=CVE-2015-8555
Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors. Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x y versiones anteriores no inicializa registros de memoria de pila x86 FPU y XMM cuando XSAVE/XRSTOR no se utilizan para gestionar el estado del registro extendido de invitado, lo que permite a dominios de invitado local obtener información sensible de otros dominios a través de vectores no especificados. • http://support.citrix.com/article/CTX203879 http://www.debian.org/security/2016/dsa-3519 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securityfocus.com/bid/79543 http://www.securitytracker.com/id/1034477 http://xenbits.xen.org/xsa/advisory-165.html https://security.gentoo.org/glsa/201604-03 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2016-2072
https://notcve.org/view.php?id=CVE-2016-2072
The Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, 10.5.e before Build 59.1305.e, and 10.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors. La Administrative Web Interface en Citrix NetScaler Application Delivery Controller (ADC) y NetScaler Gateway 11.x en versiones anteriores a 11.0 Build 64.34, 10.5 en versiones anteriores a 10.5 Build 59.13, 10.5.e en versiones anteriores a Build 59.1305.e y 10.1 permite a atacantes remotos llevar a cabo ataques de secuestro de clic a través de vectores no especificados. • http://support.citrix.com/article/CTX206001 http://www.securitytracker.com/id/1035098 • CWE-254: 7PK - Security Features •
CVSS: 10.0EPSS: 0%CPEs: 8EXPL: 0CVE-2016-2071
https://notcve.org/view.php?id=CVE-2016-2071
Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, and 10.5.e before Build 59.1305.e allows remote attackers to gain privileges via unspecified NS Web GUI commands. Citrix NetScaler Application Delivery Controller (ADC) y NetScaler Gateway 11.x en versiones anteriores a 11.0 Build 64.34, 10.5 en versiones anteriores a 10.5 Build 59.13 y 10.5.e en versiones anteriores a Build 59.1305.e permite a atacantes remotos obtener privilegios a través de comandos NS Web GUI no especificados. • http://support.citrix.com/article/CTX206001 http://www.securitytracker.com/id/1035098 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.3EPSS: 0%CPEs: 37EXPL: 0CVE-2016-1571
https://notcve.org/view.php?id=CVE-2016-1571
The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check. La función paging_invlpg en include/asm-x86/paging.h en Xen 3.3.x hasta la versión 4.6.x, cuando se utiliza paginación en modo shadow o la virtualización anidada está habilitada, permite a usuarios HVM invitados locales provocar una denegación de servicio (caída de host) a través de una dirección de invitado no canónica en una instrucción INVVPID, lo que desencadena una comprobación de errores de hipervisor. • http://support.citrix.com/article/CTX205496 http://www.debian.org/security/2016/dsa-3519 http://www.securitytracker.com/id/1034745 http://xenbits.xen.org/xsa/advisory-168.html • CWE-17: DEPRECATED: Code •