CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2025-25294 – Envoy Gateway Log Injection Vulnerability
https://notcve.org/view.php?id=CVE-2025-25294
06 Mar 2025 — Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. This vulnerability is fixed in 1.3.1 and 1.2.7. • https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a • CWE-117: Improper Output Neutralization for Logs •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2025-24030 – Envoy Admin Interface Exposed through prometheus metrics endpoint
https://notcve.org/view.php?id=CVE-2025-24030
23 Jan 2025 — Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy`... • https://github.com/envoyproxy/gateway/commit/3eb3301ab3dbf12b201b47bdb6074d1233be07bd • CWE-419: Unprotected Primary Channel •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52528 – Auth Token can be passed dummy or wrong the middleware response is 200 OK
https://notcve.org/view.php?id=CVE-2024-52528
15 Nov 2024 — Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2. • https://github.com/BudgetControl/Gateway/security/advisories/GHSA-jqx6-gm7f-vp7m • CWE-285: Improper Authorization •
CVSS: 7.8EPSS: 36%CPEs: 9EXPL: 0CVE-2023-24487 – Arbitrary file read
https://notcve.org/view.php?id=CVE-2023-24487
10 Jul 2023 — Arbitrary file read in Citrix ADC and Citrix Gateway Arbitrary file read in Citrix ADC and Citrix Gateway • https://support.citrix.com/article/CTX477714/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202324487-cve202324488 • CWE-253: Incorrect Check of Function Return Value •
CVSS: 6.4EPSS: 89%CPEs: 8EXPL: 5CVE-2023-24488 – Cross site scripting
https://notcve.org/view.php?id=CVE-2023-24488
10 Jul 2023 — Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting Los productos ADC y Gateway de Citrix son vulnerables a ataques de tipo Cross-Site Scripting (XSS). Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting • https://github.com/NSTCyber/CVE-2023-24488-SIEM-Sigma-Rule • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 8EXPL: 0CVE-2022-27507 – Authenticated denial of service
https://notcve.org/view.php?id=CVE-2022-27507
24 Jan 2023 — Authenticated denial of service Denegación de servicio autenticada • https://support.citrix.com/article/CTX457048/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202227507-and-cve202227508 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-27508 – Unauthenticated denial of service
https://notcve.org/view.php?id=CVE-2022-27508
24 Jan 2023 — Unauthenticated denial of service Denegación de servicio no autenticada • https://support.citrix.com/article/CTX457048/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202227507-and-cve202227508 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-18177
https://notcve.org/view.php?id=CVE-2019-18177
26 Dec 2022 — In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint. This affects Citrix ADC and Citrix Gateway 13.0-58.30 and later releases before the CTX276688 update. En ciertos productos Citrix, un usuario de VPN autenticado puede lograr la divulgación de información cuando hay un endpoint de VPN SSL configurado. Esto afecta a Citrix ADC y Citrix Gateway 13.0-58.30 y versiones posteriores antes de la actualización CTX276688. • https://support.citrix.com/article/CTX276688/citrix-application-delivery-controller-citrix-gateway-and-citrix-sdwan-wanop-appliance-security-update •
CVSS: 10.0EPSS: 0%CPEs: 10EXPL: 0CVE-2022-27516 – User login brute force protection functionality bypass
https://notcve.org/view.php?id=CVE-2022-27516
08 Nov 2022 — User login brute force protection functionality bypass Omisión de la funcionalidad de protección de fuerza bruta de inicio de sesión de usuario • https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516 • CWE-307: Improper Restriction of Excessive Authentication Attempts CWE-693: Protection Mechanism Failure •
CVSS: 10.0EPSS: 0%CPEs: 10EXPL: 0CVE-2022-27510 – Unauthorized access to Gateway user capabilities
https://notcve.org/view.php?id=CVE-2022-27510
08 Nov 2022 — Unauthorized access to Gateway user capabilities Acceso no autorizado a las capacidades del usuario de Gateway • https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516 • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •