Citrix Xenmobile Server
By the Year
In 2024 there have been 0 vulnerabilities in Citrix Xenmobile Server . Xenmobile Server did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 3 | 8.27 |
| 2021 | 0 | 0.00 |
| 2020 | 6 | 8.03 |
| 2019 | 1 | 9.10 |
| 2018 | 9 | 7.87 |
It may take a day or so for new Xenmobile Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Citrix Xenmobile Server Security Vulnerabilities
In Citrix XenMobile Server through 10.12 RP9
CVE-2021-44519
8.8 - High
- April 19, 2022
In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to remote code execution.
Directory traversal
In Citrix XenMobile Server through 10.12 RP9
CVE-2021-44520
8.8 - High
- April 13, 2022
In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges.
Command Injection
Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4
CVE-2022-26151
7.2 - High
- April 13, 2022
Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection.
Command Injection
Improper authentication in Citrix XenMobile Server 10.12 before RP2
CVE-2020-8253
7.5 - High
- September 18, 2020
Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 leads to the ability to access sensitive files.
authentification
Improper access control in Citrix XenMobile Server 10.12 before RP2
CVE-2020-8209
7.5 - High
- August 17, 2020
Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 and leads to the ability to read arbitrary files.
Directory traversal
Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3
CVE-2020-8210
7.5 - High
- August 17, 2020
Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 discloses credentials of a service account.
Insufficiently Protected Credentials
Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5
CVE-2020-8211
9.8 - Critical
- August 17, 2020
Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows SQL Injection.
SQL Injection
Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5
CVE-2020-8212
9.8 - Critical
- August 17, 2020
Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows access to privileged functionality.
AuthZ
Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.11 before RP6 and Citrix XenMobile Server before 10.9 RP5
CVE-2020-8208
6.1 - Medium
- August 17, 2020
Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.11 before RP6 and Citrix XenMobile Server before 10.9 RP5 allows Cross-Site Scripting (XSS).
XSS
An Incorrect Access Control vulnerability has been identified in Citrix XenMobile Server 10.8.0 before Rolling Patch 6 and 10.9.0 before Rolling Patch 3
CVE-2018-18571
9.1 - Critical
- June 05, 2019
An Incorrect Access Control vulnerability has been identified in Citrix XenMobile Server 10.8.0 before Rolling Patch 6 and 10.9.0 before Rolling Patch 3. An attacker can impersonate and take actions on behalf of any Mobile Application Management (MAM) enrolled device.
authentification
* Lack of authentication in Citrix Xen Mobile through 10.8
CVE-2018-18014
7.8 - High
- October 24, 2018
* Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private services listening on ports 8000, 30000 and 30001. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.
authentification
* Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input
CVE-2018-18013
7.8 - High
- October 24, 2018
* Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. If this service is supplied with raw serialised Java objects, it deserialises them back into Java objects in memory, giving rise to a remote code execution vulnerability. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.
Marshaling, Unmarshaling
There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3.
CVE-2018-10652
7.5 - High
- May 23, 2018
There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3.
Information Disclosure
There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVE-2018-10654
8.1 - High
- May 23, 2018
There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
Marshaling, Unmarshaling
There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVE-2018-10653
9.8 - Critical
- May 23, 2018
There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
XXE
There are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVE-2018-10651
6.1 - Medium
- May 23, 2018
There are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
Open Redirect
There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVE-2018-10650
7.8 - High
- May 23, 2018
There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
Untrusted Path
There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3.
CVE-2018-10649
6.1 - Medium
- May 23, 2018
There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3.
XSS
There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVE-2018-10648
9.8 - Critical
- May 23, 2018
There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
Unrestricted File Upload
Citrix XenMobile Server before 10.5.0.24
CVE-2016-6877
5.3 - Medium
- May 05, 2017
Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page. NOTE: the vendor reports "our internal analysis of this issue concluded that this was not a valid vulnerability" because an exploitation scenario would involve a man-in-the-middle attack against a TLS session
Improper Input Validation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Citrix Xenmobile Server or by Citrix? Click the Watch button to subscribe.
