There are many vulnerabilities, CVE or not, in all of Citrix's products -- http://www.cvedetails.com/product-list/vendor_id-422/Citrix.html -- but I would especially target each with tools such as Burp Suite Professional (copying or modifying HTTP headers appropriately, such as replaying a User-Agent header), or, if Windows, you will want to use a tool such as FuzzLabs -- http://fuzzlabs.dcnws.com -- perhaps along with a debugger or fault monitor, such as Immunity Debugger. The book, "Windows Stack Exploitation" goes in depth with the latter. There are also five clever Nmap NSE scripts: citrix-brute-xml, citrix-enum-servers, citrix-enum-servers-xml, citrix-enum-apps, and citrix-enum-apps-xml and a great third-party contributed NSE script: vulscan.
Yokoso has fingerprints for some Citrix services -- http://yokoso.inguardians.com -- These signatures are also likely to be in the Nmap http-enum NSE script.
use .*citrix_stream <tab>, <tab> <tab> (for port 6905)
use .*citrix_access <tab> (for port 443 in a Citrix environment)
use .*citrix_pub <tab>, <tab> <tab> (for port 1604)
Some of the best work I've seen is the seminal work on July 2009 and July 2008 from InsomniaSec (Brett Moore, et al) -- https://www.insomniasec.com/releases -- check out the prezos "Heaps about Heaps" and "Hacking Citrix".