CS
VPN
Connect Secure
On CISA KEVExploited in the wildRansomware-linked
132
CVEs
15
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 15High 69Medium 46Low 2
Watch
Add Connect Secure to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-10644 | 7.2 | Feb 11 | Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +6 more |
| CVE-2024-11634 | 7.2 | Dec 10 | Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-11633 | 7.2 | Dec 10 | Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +6 more |
| CVE-2024-38655 | 7.2 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-11006 | 7.2 | Nov 12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a… Affected: before 9.1; after 9.1 before 22.7; 22.7; 22.7; 22.7; 22.7; +4 more |
| CVE-2024-11005 | 7.2 | Nov 12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a… Affected: before 9.1; after 9.1 before 22.7; 22.7; 22.7; 22.7; 22.7; +4 more |
| CVE-2024-11007 | 7.2 | Nov 12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +3 more |
| CVE-2023-41719 | 7.2 | Dec 14 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a specific web request which may lead to… Affected: 21.9; 21.12; 22.1; 22.1; 22.2; 22.3; +34 more |
| CVE-2021-44720 | 7.2 | Aug 12 | In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets >… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +14 more |
| CVE-2021-22938 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2021-22937 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2021-22935 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2021-22934 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2020-15352 | 7.2 | Oct 27 | An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +8 more |
| CVE-2020-8219 | 7.2 | Jul 30 | An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2019-11508 | 7.2 | May 8 | In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +34 more |
| CVE-2019-11542 | 7.2 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX… Affected: 8.1; 8.2; 8.3 |
| CVE-2026-111357 | 7.0 | Oct 15 | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the… Affected: 22.8R2.4 |
| CVE-2025-0283 | 7.0 | Jan 8 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version… Affected: before 9.1; 22.2 before 22.7; 9.1; 9.1; 9.1; 9.1; +34 more |