Product:

Connect_secure

(Ivanti)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 78
Date Id Summary Products Score Patch Annotated
2020-10-27 CVE-2020-15352 An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure 7.2
2021-05-27 CVE-2021-22894 A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room. Connect_secure, Pulse_connect_secure 8.8
2020-10-28 CVE-2020-8261 A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection. Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure 4.3
2021-05-27 CVE-2021-22899 A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature Connect_secure, Pulse_connect_secure 8.8
2020-10-28 CVE-2020-8262 A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface. Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure 6.1
2021-05-27 CVE-2021-22900 A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface. Connect_secure, Pulse_connect_secure 7.2
2021-05-27 CVE-2021-22908 A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default. Connect_secure, Pulse_connect_secure 8.8
2021-08-16 CVE-2021-22933 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request. Connect_secure, Pulse_connect_secure 6.5
2021-08-16 CVE-2021-22934 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request. Connect_secure, Pulse_connect_secure 7.2
2021-08-16 CVE-2021-22935 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter. Connect_secure, Pulse_connect_secure 7.2