CVSS: 7.5EPSS: 4%CPEs: 2EXPL: 2CVE-2015-2683
https://notcve.org/view.php?id=CVE-2015-2683
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmx_dynamic. Citrix Command Center anterior a 5.1 Build 35.4 y 5.2 anterior a Build 42.7 no restringe correctamente el acceso al servlet Advent Java Management Extensions (JMX), lo que permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados en servlets/Jmx_dynamic. • http://packetstormsecurity.com/files/130930/Citrx-Command-Center-Advent-JMX-Servlet-Accessible.html http://seclists.org/fulldisclosure/2015/Mar/127 http://support.citrix.com/article/CTX200584 http://www.securityfocus.com/archive/1/534933/100/0/threaded http://www.securityfocus.com/bid/73313 http://www.securitytracker.com/id/1031993 https://www.securify.nl/advisory/SFY20140804/advent_jmx_servlet_of_citrx_command_center_is_accessible_to_unauthenticated_users.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.9EPSS: 0%CPEs: 24EXPL: 0CVE-2014-8580
https://notcve.org/view.php?id=CVE-2014-8580
Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5.50.10 before 10.5-52.11, 10.1.122.17 before 10.1-129.11, and 10.1-120.1316.e before 10.1-129.1105.e, when using unspecified configurations, allows remote authenticated users to access "network resources" of other users via unknown vectors. Citrix NetScaler Application Delivery Controller y NetScaler Gateway 10.5.50.10 anterior a 10.5-52.11, 10.1.122.17 anterior a 10.1-129.11, y 10.1-120.1316.e anterior a 10.1-129.1105.e, cunado utilizan configuraciones no especificadas, permiten a usuarios remotos autenticados acceder a 'los recursos de la red' de otros usuarios a través de vectores desconocidos. • http://secunia.com/advisories/62114 http://support.citrix.com/article/CTX200254 http://www.securitytracker.com/id/1031212 https://exchange.xforce.ibmcloud.com/vulnerabilities/98661 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2014-8495
https://notcve.org/view.php?id=CVE-2014-8495
Citrix XenMobile MDX Toolkit before 9.0.4, when used to wrap iOS 8 applications, does not properly encrypt cached application data, which allows context-dependent attackers to obtain sensitive information by reading the cache. Citrix XenMobile MDX Toolkit anterior a 9.0.4, cuando utilizado para envolver las aplicaciones iOS 8, no codifica debidamente los datos de las aplicaciones en caché, lo que permite a atacantes dependientes de contexto obtener información sensible mediante la lectura del caché. • http://support.citrix.com/article/CTX200260 http://www.securityfocus.com/bid/70799 http://www.securitytracker.com/id/1031164 https://exchange.xforce.ibmcloud.com/vulnerabilities/98337 • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 55%CPEs: 3EXPL: 1CVE-2014-7140 – Citrix Netscaler SOAP Handler - Remote Code Execution
https://notcve.org/view.php?id=CVE-2014-7140
Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.x before 10.1-129.11 and 10.5 before 10.5-50.10 allows remote attackers to execute arbitrary code via unknown vectors. Vulnerabilidad no especificada en la interfaz de gestión en Citrix NetScaler Application Delivery Controller (ADC) y NetScaler Gateway 10.x anterior a 10.1-129.11 y 10.5 anterior a 10.5-50.10 permite a atacantes remotos ejecutar código arbitrario a través de vectores desconocidos. • https://www.exploit-db.com/exploits/35180 http://support.citrix.com/article/CTX200206 http://www.securitytracker.com/id/1031129 •
CVSS: 10.0EPSS: 89%CPEs: 345EXPL: 17CVE-2014-7169 – GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-7169
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271. GNU Bash hasta 4.3 bash43-025 procesa cadenas finales después de la definición malformada de funciones en los valores de variables de entorno, lo que permite a atacantes remotos escribir hacia ficheros o posiblemente tener otro impacto desconocido a través de un entorno manipulado, tal y como se ha demostrado por vectores que involucran la característica ForceCommand en sshd OpenSSH, los módulos mod_cgi y mod_cgid en el Apache HTTP Server, scripts ejecutados por clientes DHCP no especificados, y otras situaciones en la cual establecer el entorno ocurre a través de un límite privilegiado de la ejecución de Bash. Nota: Esta vulnerabilidad existe debido a una solución incompleta para CVE-2014-6271. It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. • https://www.exploit-db.com/exploits/34777 https://www.exploit-db.com/exploits/34895 https://www.exploit-db.com/exploits/34839 https://www.exploit-db.com/exploits/36503 https://www.exploit-db.com/exploits/36504 https://www.exploit-db.com/exploits/34766 https://www.exploit-db.com/exploits/35115 https://www.exploit-db.com/exploits/36933 https://www.exploit-db.com/exploits/34765 https://www.exploit-db.com/exploits/34860 https://www.exploit-db.com/exploits/34879 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-228: Improper Handling of Syntactically Invalid Structure •