CVE-2014-4700

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Citrix XenDesktop 7.x, 5.x, and 4.x, when pooled random desktop groups is enabled and ShutdownDesktopsAfterUse is disabled, allows local guest users to gain access to another user's desktop via unspecified vectors.

Metrics

CVSS 2.0 4.9/10AV:A/AC:M/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/59889Third Party Advisory
http://support.citrix.com/article/CTX139591Patch, Vendor Advisory
http://www.securityfocus.com/bid/68530Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030566Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/94460Third Party Advisory, VDB Entry
http://secunia.com/advisories/59889Third Party Advisory
http://support.citrix.com/article/CTX139591Patch, Vendor Advisory
http://www.securityfocus.com/bid/68530Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030566Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/94460Third Party Advisory, VDB Entry

Timeline

Published: Jul 11, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-47012.1The check_dhcp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the CVE-2014-47022.1The check_icmp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the CVE-2014-47032.1lib/parse_ini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in CVE-2014-47057.5Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5300, S5700, S6300, and S6700 seri CVE-2014-47067.5Huawei Campus S3700HI with software V200R001C00SPC300; Campus S5700 with software V200R002C00SPC100; Campus S7700 with software V200R003C00S CVE-2014-47078.8Huawei Campus S7700 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300; S9300 with software V200R001C00SPC300, V200R002C0 CVE-2014-47104.3Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbitrary web script or H CVE-2014-47155.0Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer CVE-2014-47166.8Cross-site request forgery (CSRF) vulnerability in Thomson TWG87OUIR allows remote attackers to hijack the authentication of unspecified vic CVE-2014-47176.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordPress allow remote at CVE-2014-47186.8Multiple cross-site request forgery (CSRF) vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of CVE-2014-47194.3Cross-site scripting (XSS) vulnerability in the login panel (svn/login/) in User-Friendly SVN (aka USVN) before 1.0.7 allows remote attacker