PS
Product
Policy Secure
On CISA KEVExploited in the wildRansomware-linked
77
CVEs
8
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 36Medium 31Low 2
Watch
Add Policy Secure to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-8262 | 6.1 | Oct 28 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +2 more |
| CVE-2020-8238 | 6.1 | Sep 30 | A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS) Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +7 more |
| CVE-2020-8204 | 6.1 | Jul 30 | A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2025-5468 | 5.5 | Aug 12 | Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +1 more |
| CVE-2025-5463 | 5.5 | Jul 8 | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a local authenticated… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +1 more |
| CVE-2020-12880 | 5.5 | Jul 27 | An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8 Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +4 more |
| CVE-2025-55144 | 5.4 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more |
| CVE-2025-8711 | 5.4 | Sep 9 | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more |
| CVE-2025-8712 | 5.4 | Sep 9 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more |
| CVE-2020-8217 | 5.4 | Jul 30 | A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2024-22023 | 5.3 | Apr 4 | An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially… Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +26 more |
| CVE-2025-55146 | 4.9 | Sep 9 | An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more |
| CVE-2025-5466 | 4.9 | Aug 12 | XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +1 more |
| CVE-2023-39339 | 4.9 | Jul 12 | A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web… Affected: 22.6R1 before 22.6R1 |
| CVE-2025-0292 | 4.9 | Jul 8 | SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to access internal… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +1 more |
| CVE-2025-5451 | 4.9 | Jul 8 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +1 more |
| CVE-2024-38657 | 4.9 | Feb 21 | External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-12058 | 4.9 | Feb 11 | External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-47909 | 4.9 | Nov 12 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-47905 | 4.9 | Nov 12 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7 |
| CVE-2020-8221 | 4.9 | Jul 30 | A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2024-13843 | 4.4 | Feb 11 | Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin… Affected: through 22.7; 22.7; 22.7; 22.7 |
| CVE-2024-13842 | 4.4 | Feb 11 | A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to… Affected: through 22.7; 22.7; 22.7; 22.7 |
| CVE-2020-8261 | 4.3 | Oct 28 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +2 more |
| CVE-2020-8216 | 4.3 | Jul 30 | An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2025-0293 | 2.7 | Jul 8 | CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +1 more |
| CVE-2025-5450 | 2.7 | Jul 8 | Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +1 more |