RSS   Vulnerabilities for 'Xenmobile server'   RSS

2018-10-24
 
CVE-2018-18014

CWE-264
 

 
** DISPUTED *** Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private services listening on ports 8000, 30000 and 30001. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost."

 
 
CVE-2018-18013

CWE-502
 

 
** DISPUTED *** Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. If this service is supplied with raw serialised Java objects, it deserialises them back into Java objects in memory, giving rise to a remote code execution vulnerability. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost."

 
2018-05-23
 
CVE-2018-10654

CWE-502
 

 
There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.

 
 
CVE-2018-10653

CWE-611
 

 
There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.

 
 
CVE-2018-10652

CWE-200
 

 
There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3.

 
 
CVE-2018-10651

CWE-601
 

 
There are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.

 
 
CVE-2018-10650

CWE-426
 

 
There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.

 
 
CVE-2018-10649

CWE-79
 

 
There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3.

 
 
CVE-2018-10648

CWE-434
 

 
There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.

 
2017-06-16
 
CVE-2017-9231

 

 
XML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3 allows attackers to obtain sensitive information via unspecified vectors.

 


Copyright 2019, cxsecurity.com

 

Back to Top