Citrix Presentation Server vulnerabilities

7 CVEs affecting Citrix Presentation Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2009-2453, published 2009-07-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-0356, published 2008-01-18. High severity, CVSS 10.0. EPSS: 73% chance of exploitation in the next 30 days. Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server) 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop…
CVE-2009-2453, published 2009-07-14. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. Citrix XenApp (formerly Presentation Server) 4.5 Hotfix Rollup Pack 3 does not apply an access policy when it is defined with the Access Gateway Advanced Edition filters, which allows attackers to…
CVE-2006-3779, published 2006-07-24. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. Citrix MetaFrame up to XP 1.0 Feature 1, except when running on Windows Server 2003, installs a registry key with an insecure ACL, which allows remote authenticated users to gain privileges.
CVE-2008-2299, published 2008-05-18. Medium severity, CVSS 5.0. EPSS: 1.1% chance of exploitation in the next 30 days. Unspecified vulnerability in SecureICA and ICA Basic encryption of Citrix Presentation Server 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 can cause clients to use…
CVE-2002-2426, published 2002-12-31. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute…
CVE-2008-5107, published 2008-11-17. Low severity, CVSS 1.9. EPSS: 0.3% chance of exploitation in the next 30 days. The installation process for Citrix Presentation Server 4.5 and Desktop Server 1.0, when MSI logging is enabled, stores database credentials in MSI log files, which allows local users to obtain these…
CVE-2008-4676, published 2008-10-22. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Citrix XenApp (formerly Presentation Server) 4.5 Feature Pack 1 and earlier, Presentation Server 4.0, and Access Essentials 1.0, 1.5, and 2.0 allows local users to gain…