Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Policy_secure
(Ivanti)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 63 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2020-10-27 | CVE-2020-15352 | An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. | Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure | 7.2 | ||
| 2020-10-28 | CVE-2020-8261 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection. | Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure | 4.3 | ||
| 2020-10-28 | CVE-2020-8262 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface. | Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure | 6.1 | ||
| 2022-12-05 | CVE-2022-35254 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1. | Connect_secure, Neurons_for_zero\-Trust_access, Policy_secure | 7.5 | ||
| 2022-12-05 | CVE-2022-35258 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1. | Connect_secure, Neurons_for_zero\-Trust_access, Policy_secure | 7.5 | ||
| 2024-04-04 | CVE-2024-22023 | An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS. | Connect_secure, Policy_secure | 5.3 | ||
| 2024-04-04 | CVE-2024-22052 | A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack | Connect_secure, Policy_secure | 7.5 | ||
| 2024-04-04 | CVE-2024-22053 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack or in certain conditions read contents from memory. | Connect_secure, Policy_secure | 8.2 | ||
| 2024-04-04 | CVE-2024-21894 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution of arbitrary code | Connect_secure, Policy_secure | 9.8 | ||
| 2024-11-12 | CVE-2024-11007 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution. | Connect_secure, Policy_secure | 7.2 |