CS
VPN
Connect Secure
On CISA KEVExploited in the wildRansomware-linked
132
CVEs
15
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 15High 69Medium 46Low 2
Watch
Add Connect Secure to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-14366 | 6.1 | Sep 6 | download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an… Affected: 8.1; 8.3 |
| CVE-2016-4789 | 6.1 | May 26 | Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2,… Affected: 8.1; 8.0; 8.2 |
| CVE-2016-4788 | 5.8 | May 26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system file via unknown… Affected: 8.2; 8.1; 8.0 |
| CVE-2025-5468 | 5.5 | Aug 12 | Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2025-5464 | 5.5 | Jul 8 | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2025-5463 | 5.5 | Jul 8 | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a local authenticated… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2020-12880 | 5.5 | Jul 27 | An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8 Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2016-4790 | 5.5 | May 26 | Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before… Affected: 8.1; 8.0; 8.2 |
| CVE-2025-8712 | 5.4 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2025-8711 | 5.4 | Sep 9 | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2025-55144 | 5.4 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2022-21826 | 5.4 | Sep 30 | Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +32 more |
| CVE-2020-8217 | 5.4 | Jul 30 | A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2024-22023 | 5.3 | Apr 4 | An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +22 more |
| CVE-2018-20811 | 5.3 | Jun 28 | A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12 Affected: 8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +13 more |
| CVE-2016-4792 | 5.3 | May 26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1 allows remote attackers to disclose sign in pages via unspecified vectors Affected: 8.2 |
| CVE-2025-55146 | 4.9 | Sep 9 | An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2025-5466 | 4.9 | Aug 12 | XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2025-0292 | 4.9 | Jul 8 | SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to access internal… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2025-5451 | 4.9 | Jul 8 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2024-38657 | 4.9 | Feb 21 | External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +6 more |
| CVE-2024-12058 | 4.9 | Feb 11 | External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +8 more |
| CVE-2024-47909 | 4.9 | Nov 12 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-47905 | 4.9 | Nov 12 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2020-8256 | 4.9 | Sep 30 | A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +7 more |
| CVE-2020-8221 | 4.9 | Jul 30 | A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2024-13843 | 4.4 | Feb 11 | Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin… Affected: through 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +7 more |
| CVE-2024-13842 | 4.4 | Feb 11 | A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to… Affected: through 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +4 more |
| CVE-2020-8261 | 4.3 | Oct 28 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +2 more |
| CVE-2020-8216 | 4.3 | Jul 30 | An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2025-0293 | 2.7 | Jul 8 | CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2025-5450 | 2.7 | Jul 8 | Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |