Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Pulse_connect_secure
(Pulsesecure)Repositories |
Unknown: This might be proprietary software. |
#Vulnerabilities | 58 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2021-08-16 | CVE-2021-22933 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request. | Connect_secure, Pulse_connect_secure | 6.5 | ||
2021-08-16 | CVE-2021-22934 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request. | Connect_secure, Pulse_connect_secure | 7.2 | ||
2021-08-16 | CVE-2021-22935 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter. | Connect_secure, Pulse_connect_secure | 7.2 | ||
2021-08-16 | CVE-2021-22936 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter. | Connect_secure, Pulse_connect_secure | 6.1 | ||
2021-08-16 | CVE-2021-22937 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface. | Connect_secure, Pulse_connect_secure | 7.2 | ||
2021-08-16 | CVE-2021-22938 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console. | Connect_secure, Pulse_connect_secure | 7.2 | ||
2021-11-19 | CVE-2021-22965 | A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device. | Connect_secure, Pulse_connect_secure | 7.5 | ||
2022-08-12 | CVE-2021-44720 | In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role. | Connect_secure, Pulse_connect_secure | 7.2 | ||
2022-09-30 | CVE-2022-21826 | Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS. | Connect_secure, Pulse_connect_secure | 5.4 | ||
2019-04-12 | CVE-2019-11213 | In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. (The endpoint would need to be already compromised for exploitation to succeed.) This affects Pulse Desktop Client 5.x before Secure Desktop 5.3R7 and Pulse Desktop Client 9.x before Secure Desktop 9.0R3. It also affects (for Network Connect customers) Pulse Connect Secure... | Connect_secure, Pulse_connect_secure, Pulse_secure_desktop_client | 8.1 |