Citrix Access Gateway vulnerabilities

14 CVEs affecting Citrix Access Gateway, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-2263, published 2013-03-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-2882, published 2011-07-21. High severity, CVSS 9.3. EPSS: 56.4% chance of exploitation in the next 30 days. Stack-based buffer overflow in the NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 allows…
CVE-2010-4566, published 2011-01-14. High severity, CVSS 9.3. EPSS: 27.8% chance of exploitation in the next 30 days. The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and earlier, and the NTLM authentication component in Access Gateway Standard and…
CVE-2007-4013, published 2007-07-26. High severity, CVSS 9.3. EPSS: 4.2% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in (1) Net6Helper.DLL (aka Net6Launcher Class) 4.5.2 and earlier, (2) npCtxCAO.dll (aka Citrix Endpoint Analysis Client) in a Firefox plugin directory, and (3) a…
CVE-2006-4846, published 2006-09-19. Medium severity, CVSS 5.1. EPSS: 3.9% chance of exploitation in the next 30 days. Unspecified vulnerability in Citrix Access Gateway with Advanced Access Control (AAC) 4.2 before 20060914, when AAC is configured to use LDAP authentication, allows remote attackers to bypass…
CVE-2008-2528, published 2008-06-03. High severity, CVSS 10.0. EPSS: 2.7% chance of exploitation in the next 30 days. Unspecified vulnerability in Citrix Access Gateway Standard Edition 4.5.7 and earlier and Advanced Edition 4.5 HF2 and earlier allows attackers to bypass authentication and gain "access to network…
CVE-2007-4017, published 2007-07-26. High severity, CVSS 7.6. EPSS: 2.5% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in the web-based administration console in Citrix Access Gateway before firmware 4.5.5 allows remote attackers to perform certain configuration changes…
CVE-2007-4016, published 2007-07-26. Medium severity, CVSS 6.8. EPSS: 2.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the client components in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows attackers to execute arbitrary code via…
CVE-2007-0011, published 2007-11-05. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. The web portal interface in Citrix Access Gateway (aka Citrix Advanced Access Control) before Advanced Edition 4.5 HF1 places a session ID in the URL, which allows context-dependent attackers to…
CVE-2007-3679, published 2007-07-25. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. The Citrix EPA ActiveX control (aka the "endpoint checking control" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition…
CVE-2011-2883, published 2011-07-21. High severity, CVSS 9.3. EPSS: 1.5% chance of exploitation in the next 30 days. The NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 attempts to validate signed DLLs by…

Latest

CVE-2013-2263, published 2013-03-19. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network resources via unknown attack vectors.
CVE-2007-4018, published 2007-07-26. Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days. Citrix Access Gateway Advanced Edition before firmware 4.5.5 allows attackers to redirect users to arbitrary web sites and conduct phishing attacks via unknown vectors.