CS
VPN
Connect Secure
On CISA KEVExploited in the wildRansomware-linked
132
CVEs
15
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 15High 69Medium 46Low 2
Watch
Add Connect Secure to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-55139 | 6.8 | Sep 9 | SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2020-8222 | 6.8 | Jul 30 | A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2021-22933 | 6.5 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2020-8220 | 6.5 | Jul 30 | A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2025-55143 | 6.1 | Sep 9 | Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2024-13830 | 6.1 | Feb 11 | Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticated attacker to obtain admin privileges Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +8 more |
| CVE-2024-11004 | 6.1 | Nov 12 | Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obtain admin privileges Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +3 more |
| CVE-2021-22936 | 6.1 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2020-8262 | 6.1 | Oct 28 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +2 more |
| CVE-2020-8238 | 6.1 | Sep 30 | A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS) Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +7 more |
| CVE-2020-8204 | 6.1 | Jul 30 | A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2018-20814 | 6.1 | Jun 28 | An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2 Affected: 8.3 |
| CVE-2018-20808 | 6.1 | Jun 28 | An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization Affected: 8.3; 8.3; 8.3 |
| CVE-2018-20807 | 6.1 | Jun 28 | An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL… Affected: 8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +33 more |
| CVE-2019-11507 | 6.1 | May 8 | In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launcher page Affected: 8.3; 8.3; 8.3; 8.3; 8.3; 8.3; +9 more |
| CVE-2019-11543 | 6.1 | Apr 26 | XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX… Affected: 8.1; 8.3 |
| CVE-2018-14366 | 6.1 | Sep 6 | download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an… Affected: 8.1; 8.3 |
| CVE-2016-4789 | 6.1 | May 26 | Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2,… Affected: 8.1; 8.0; 8.2 |
| CVE-2016-4788 | 5.8 | May 26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system file via unknown… Affected: 8.2; 8.1; 8.0 |
| CVE-2025-5468 | 5.5 | Aug 12 | Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2025-5464 | 5.5 | Jul 8 | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2025-5463 | 5.5 | Jul 8 | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a local authenticated… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2020-12880 | 5.5 | Jul 27 | An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8 Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2016-4790 | 5.5 | May 26 | Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before… Affected: 8.1; 8.0; 8.2 |
| CVE-2025-8712 | 5.4 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2025-8711 | 5.4 | Sep 9 | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2025-55144 | 5.4 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2022-21826 | 5.4 | Sep 30 | Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +32 more |
| CVE-2020-8217 | 5.4 | Jul 30 | A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2024-22023 | 5.3 | Apr 4 | An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +22 more |
| CVE-2018-20811 | 5.3 | Jun 28 | A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12 Affected: 8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +13 more |
| CVE-2016-4792 | 5.3 | May 26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1 allows remote attackers to disclose sign in pages via unspecified vectors Affected: 8.2 |
| CVE-2025-55146 | 4.9 | Sep 9 | An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2025-5466 | 4.9 | Aug 12 | XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2025-0292 | 4.9 | Jul 8 | SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to access internal… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2025-5451 | 4.9 | Jul 8 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +10 more |
| CVE-2024-38657 | 4.9 | Feb 21 | External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +6 more |
| CVE-2024-12058 | 4.9 | Feb 11 | External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +8 more |
| CVE-2024-47909 | 4.9 | Nov 12 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-47905 | 4.9 | Nov 12 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2020-8256 | 4.9 | Sep 30 | A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +7 more |
| CVE-2020-8221 | 4.9 | Jul 30 | A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2024-13843 | 4.4 | Feb 11 | Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin… Affected: through 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +7 more |
| CVE-2024-13842 | 4.4 | Feb 11 | A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to… Affected: through 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +4 more |
| CVE-2020-8261 | 4.3 | Oct 28 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +2 more |
| CVE-2020-8216 | 4.3 | Jul 30 | An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
Showing 46