Product:

Pulse_connect_secure

(Pulsesecure)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 58
Date Id Summary Products Score Patch Annotated
2021-08-16 CVE-2021-22935 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter. Connect_secure, Pulse_connect_secure 7.2
2021-08-16 CVE-2021-22936 A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter. Connect_secure, Pulse_connect_secure 6.1
2021-08-16 CVE-2021-22937 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface. Connect_secure, Pulse_connect_secure 7.2
2021-08-16 CVE-2021-22938 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console. Connect_secure, Pulse_connect_secure 7.2
2021-11-19 CVE-2021-22965 A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device. Connect_secure, Pulse_connect_secure 7.5
2022-08-12 CVE-2021-44720 In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role. Connect_secure, Pulse_connect_secure 7.2
2022-09-30 CVE-2022-21826 Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS. Connect_secure, Pulse_connect_secure 5.4
2019-04-12 CVE-2019-11213 In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. (The endpoint would need to be already compromised for exploitation to succeed.) This affects Pulse Desktop Client 5.x before Secure Desktop 5.3R7 and Pulse Desktop Client 9.x before Secure Desktop 9.0R3. It also affects (for Network Connect customers) Pulse Connect Secure... Connect_secure, Pulse_connect_secure, Pulse_secure_desktop_client 8.1
2019-05-08 CVE-2019-11508 In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web interface) can exploit Directory Traversal to execute arbitrary code on the appliance. Connect_secure, Pulse_connect_secure 7.2
2019-04-26 CVE-2019-11543 XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1. Connect_secure, Pulse_connect_secure, Pulse_policy_secure 6.1