PC
Product
Pulse Connect Secure
On CISA KEVExploited in the wild
57
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 5High 27Medium 25Low 0
Watch
Add Pulse Connect Secure to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-22900 In wildKEV | 7.2 | May 27 | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability Affected: through 9.1 |
| CVE-2016-4787 | 10.0 | May 26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in… Affected: 7.4; 8.1r1.0 |
| CVE-2019-11540 | 9.8 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an… Affected: 8.3rx; 9.0r1; 9.0r2; 9.0r2.1; 9.0r3; 9.0r3.1; +2 more |
| CVE-2018-6320 | 9.8 | Sep 6 | A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.2RX before… Affected: 8.1r1.0; 8.1rx; 8.3rx |
| CVE-2018-5299 | 9.8 | Jan 16 | A stack-based Buffer Overflow Vulnerability exists in the web server in Pulse Secure Pulse Connect Secure (PCS) before 8.3R4 and Pulse Policy Secure (PPS) before 5.4R4, leading to… Affected: 8.3r1 through 8.3r3 |
| CVE-2020-11580 | 9.1 | Apr 6 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06 Affected: through 2020-04-06 |
| CVE-2021-22908 | 8.8 | May 27 | A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code… Affected: 9.0rx |
| CVE-2020-11582 | 8.8 | Apr 6 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06 Affected: through 2020-04-06 |
| CVE-2017-11455 | 8.8 | Aug 29 | diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote… Affected: 8.1r1.0; 8.2r1.0; 8.2r1.1; 8.2r2.0; 8.2r3.0; 8.2r3.1; +3 more |
| CVE-2017-11196 | 8.8 | Jul 12 | Pulse Connect Secure 8.3R1 has CSRF in logout.cgi Affected: 8.3r1.0 |
| CVE-2017-11193 | 8.8 | Jul 12 | Pulse Connect Secure 8.3R1 has CSRF in diag.cgi Affected: 8.3r1.0 |
| CVE-2018-18284 | 8.6 | Oct 19 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator Affected: 8.2r1.0 before 8.2r12.1; 8.3r1 before 8.3r7.1; 9.0r1 before 9.0r3.4 |
| CVE-2016-4791 | 8.6 | May 26 | The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to… Affected: 8.1r1.0; 7.4 |
| CVE-2020-8206 | 8.1 | Jul 30 | An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP Affected: through 9.0 |
| CVE-2020-11581 | 8.1 | Apr 6 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06 Affected: through 2020-04-06 |
| CVE-2019-11213 | 8.1 | Apr 12 | In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end… Affected: 8.1r1.0 through 8.1r14.0; 8.3r1 before 8.3r7 |
| CVE-2018-16513 | 7.8 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have… Affected: 8.2r1.0 before 8.2r12.1; 8.3r1 before 8.3r7.1; 9.0r1 before 9.0r3.4 |
| CVE-2018-15911 | 7.8 | Aug 28 | In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter… Affected: 8.2r1.0 before 8.2r12.1; 8.3r1 before 8.3r7.1; 9.0r1 before 9.0r3.4 |
| CVE-2018-15910 | 7.8 | Aug 27 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or… Affected: 8.2r1.0 before 8.2r12.1; 8.3r1 before 8.3r7.1; 9.0r1 before 9.0r3.4 |
| CVE-2018-15909 | 7.8 | Aug 27 | In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the… Affected: 8.2r1.0 before 8.2r12.1; 8.3r1 before 8.3r7.1; 9.0r1 before 9.0r3.4 |
| CVE-2021-22965 | 7.5 | Nov 19 | A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device Affected: before 9.1 |
| CVE-2019-11541 | 7.5 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.2RX before 8.2R12.1, users using SAML authentication with the Reuse Existing NC… Affected: 8.2r1.0; 8.2r1.1; 8.2r2.0; 8.2r3.0; 8.2r3.1; 8.2r4.0; +15 more |
| CVE-2016-4786 | 7.5 | May 26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via… Affected: 8.1r1.0; 7.4 |
| CVE-2021-44720 | 7.2 | Aug 12 | In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets >… Affected: before 9.1 |
| CVE-2021-22938 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator… Affected: before 9.1 |
| CVE-2021-22937 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the… Affected: before 9.1 |
| CVE-2021-22935 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter Affected: before 9.1 |
| CVE-2021-22934 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to… Affected: before 9.1 |
| CVE-2020-15352 | 7.2 | Oct 27 | An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct… Affected: through 9.0 |
| CVE-2020-8219 | 7.2 | Jul 30 | An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator Affected: through 9.0 |
| CVE-2019-11508 | 7.2 | May 8 | In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web… Affected: 7.4 |
| CVE-2019-11542 | 7.2 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX… Affected: 8.1r1.0; 8.2r1.0; 8.2r1.1; 8.2r2.0; 8.2r3.0; 8.2r3.1; +16 more |
| CVE-2020-8222 | 6.8 | Jul 30 | A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file… Affected: through 9.0 |
| CVE-2021-22933 | 6.5 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request Affected: before 9.1 |
| CVE-2020-8220 | 6.5 | Jul 30 | A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can… Affected: through 9.0 |
| CVE-2016-3985 | 6.5 | Apr 12 | The Terminal Services Remote Desktop Protocol (RDP) client session restrictions feature in Pulse Connect Secure (aka PCS) 8.1R7 and 8.2R1 allow remote authenticated users to… Affected: 8.1r7; 8.2r1 |
| CVE-2021-22936 | 6.1 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized… Affected: before 9.1 |
| CVE-2020-8262 | 6.1 | Oct 28 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated… Affected: before 9.1 |
| CVE-2020-8238 | 6.1 | Sep 30 | A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS) Affected: through 9.0 |
| CVE-2020-8204 | 6.1 | Jul 30 | A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page Affected: through 9.0 |
| CVE-2019-11543 | 6.1 | Apr 26 | XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX… Affected: 8.1r1.0; 8.1rx; 8.3rx; 9.0r1; 9.0r2; 9.0r2.1; +4 more |
| CVE-2018-14366 | 6.1 | Sep 6 | download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an… Affected: 8.1r1.0; 8.1rx; 8.3rx |
| CVE-2017-11195 | 6.1 | Jul 12 | Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi Affected: 8.3r1.0 |
| CVE-2017-11194 | 6.1 | Jul 12 | Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi Affected: 8.3r1.0 |
| CVE-2016-4789 | 6.1 | May 26 | Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2,… Affected: 8.1r1.0; 7.4 |
| CVE-2016-4788 | 5.8 | May 26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system file via unknown… Affected: 8.1r1.0; 7.4 |
| CVE-2020-12880 | 5.5 | Jul 27 | An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8 Affected: through 9.0 |
| CVE-2018-9849 | 5.5 | May 10 | Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to… Affected: 8.1 before 8.1r14; 8.2 before 8.2r11; 8.3 before 8.3r5 |
| CVE-2016-4790 | 5.5 | May 26 | Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before… Affected: 8.1r1.0; 7.4 |
| CVE-2022-21826 | 5.4 | Sep 30 | Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's… Affected: before 9.1 |