CVE-2015-7999

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://support.citrix.com/article/CTX203787Vendor Advisory
http://www.securityfocus.com/bid/79659Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1034520Third Party Advisory, VDB Entry
http://support.citrix.com/article/CTX203787Vendor Advisory
http://www.securityfocus.com/bid/79659Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1034520Third Party Advisory, VDB Entry

Timeline

Published: Apr 14, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-80005.0db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE asse CVE-2015-80013.5The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploade CVE-2015-80026.8The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated u CVE-2015-80036.8MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated u CVE-2015-80044.0MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote CVE-2015-80055.0MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows CVE-2015-80064.3Cross-site scripting (XSS) vulnerability in the PageTriage toolbar in the PageTriage extension for MediWiki allows remote attackers to injec CVE-2015-80074.0The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see hidde CVE-2015-80087.5The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypas CVE-2015-80099.8The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 CVE-2015-80106.1Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remo CVE-2015-80119.8Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of se