Monthly Archives: March 2015

Security

OpenSSL Patches Multiple Vulnerabilities

Original release date: March 19, 2015

OpenSSL has released new updates addressing multiple vulnerabilities, one of which is classified as a high severity issue. Exploitation could allow a remote attacker to cause a cause a Denial of Service attack against the server.

Updates available include:

  • OpenSSL 1.0.2a for 1.0.2 users
  • OpenSSL 1.0.1m for 1.0.1 users
  • OpenSSL 1.0.0r for 1.0.0 users
  • OpenSSL 0.9.8zf for 0.9.8 users

Users and administrators are encouraged to review the OpenSSL Security Advisory and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

Full Disclosure

Citrix NetScaler VPX help pages are vulnerable to Cross-Site Scripting

Posted by Securify B.V. on Mar 19

————————————————————————
Citrix NetScaler VPX help pages are vulnerable to Cross-Site Scripting
————————————————————————
Han Sahin, August 2014

————————————————————————
Abstract
————————————————————————
It was discovered that the help pages of Citrix VPX…

Full Disclosure

Advent JMX Servlet of Citrx Command Center is accessible to unauthenticated users

Posted by Securify B.V. on Mar 19

————————————————————————
Advent JMX Servlet of Citrx Command Center is accessible to
unauthenticated users
————————————————————————
Han Sahin, August 2014

————————————————————————
Abstract
————————————————————————
It was discovered that the Advent JMX…

Full Disclosure

Citrix NITRO SDK xen_hotfix page is vulnerable to Cross-Site Scripting

Posted by Securify B.V. on Mar 19

————————————————————————
Citrix NITRO SDK xen_hotfix page is vulnerable to Cross-Site Scripting
————————————————————————
Han Sahin, August 2014

————————————————————————
Abstract
————————————————————————
A Cross-Site Scripting vulnerability was found in the…

Full Disclosure

Command injection vulnerability in Citrix NITRO SDK xen_hotfix page

Posted by Securify B.V. on Mar 19

————————————————————————
Command injection vulnerability in Citrix NITRO SDK xen_hotfix page
————————————————————————
Han Sahin, August 2014

————————————————————————
Abstract
————————————————————————
Securify discovered a command injection vulnerability in…

Full Disclosure

Citrix Command Center allows downloading of configuration files

Posted by Securify B.V. on Mar 19

————————————————————————
Citrix Command Center allows downloading of configuration files
————————————————————————
Han Sahin, August 2014

————————————————————————
Abstract
————————————————————————
It was discovered that Citrix Command Center stores…

Redhat

RHSA-2015:0700-1: Moderate: unzip security update

Red Hat Enterprise Linux: Updated unzip packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
CVE-2014-8139, CVE-2014-8140, CVE-2014-8141, CVE-2014-9636