Product:

Pulse_policy_secure

(Pulsesecure)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 32
Date Id Summary Products Score Patch Annotated
2020-07-30 CVE-2020-8221 A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface. Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure 4.9
2020-07-30 CVE-2020-8222 A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting. Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure 6.8
2020-09-30 CVE-2020-8238 A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS). Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure 6.1
2020-09-30 CVE-2020-8243 A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution. Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure 7.2
2020-10-27 CVE-2020-15352 An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure 7.2
2020-10-28 CVE-2020-8261 A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection. Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure 4.3
2020-10-28 CVE-2020-8262 A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface. Connect_secure, Policy_secure, Pulse_connect_secure, Pulse_policy_secure 6.1
2020-04-06 CVE-2020-11580 An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, accepts an arbitrary SSL certificate. Pulse_connect_secure, Pulse_policy_secure 9.1
2020-04-06 CVE-2020-11581 An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, allows a man-in-the-middle attacker to perform OS command injection attacks (against a client) via shell metacharacters to the doCustomRemediateInstructions method, because Runtime.getRuntime().exec() is used. Pulse_connect_secure, Pulse_policy_secure 8.1
2020-04-06 CVE-2020-11582 An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, launches a TCP server that accepts local connections on a random port. This can be reached by local HTTP clients, because up to 25 invalid lines are ignored, and because DNS rebinding can occur. (This server accepts, for example, a setcookie command that might be relevant to CVE-2020-11581 exploitation.) Pulse_connect_secure, Pulse_policy_secure 8.8