PC
Product
Pulse Connect Secure
On CISA KEVExploited in the wild
57
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 5High 27Medium 25Low 0
Watch
Add Pulse Connect Secure to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-22900 In wildKEV | 7.2 | May 27 | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability Affected: through 9.1 |
| CVE-2021-22908 | 8.8 | May 27 | A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code… Affected: 9.0rx |
| CVE-2020-11582 | 8.8 | Apr 6 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06 Affected: through 2020-04-06 |
| CVE-2017-11455 | 8.8 | Aug 29 | diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote… Affected: 8.1r1.0; 8.2r1.0; 8.2r1.1; 8.2r2.0; 8.2r3.0; 8.2r3.1; +3 more |
| CVE-2017-11196 | 8.8 | Jul 12 | Pulse Connect Secure 8.3R1 has CSRF in logout.cgi Affected: 8.3r1.0 |
| CVE-2017-11193 | 8.8 | Jul 12 | Pulse Connect Secure 8.3R1 has CSRF in diag.cgi Affected: 8.3r1.0 |
| CVE-2018-18284 | 8.6 | Oct 19 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator Affected: 8.2r1.0 before 8.2r12.1; 8.3r1 before 8.3r7.1; 9.0r1 before 9.0r3.4 |
| CVE-2016-4791 | 8.6 | May 26 | The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to… Affected: 8.1r1.0; 7.4 |
| CVE-2020-8206 | 8.1 | Jul 30 | An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP Affected: through 9.0 |
| CVE-2020-11581 | 8.1 | Apr 6 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06 Affected: through 2020-04-06 |
| CVE-2019-11213 | 8.1 | Apr 12 | In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end… Affected: 8.1r1.0 through 8.1r14.0; 8.3r1 before 8.3r7 |
| CVE-2018-16513 | 7.8 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have… Affected: 8.2r1.0 before 8.2r12.1; 8.3r1 before 8.3r7.1; 9.0r1 before 9.0r3.4 |
| CVE-2018-15911 | 7.8 | Aug 28 | In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter… Affected: 8.2r1.0 before 8.2r12.1; 8.3r1 before 8.3r7.1; 9.0r1 before 9.0r3.4 |
| CVE-2018-15910 | 7.8 | Aug 27 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or… Affected: 8.2r1.0 before 8.2r12.1; 8.3r1 before 8.3r7.1; 9.0r1 before 9.0r3.4 |
| CVE-2018-15909 | 7.8 | Aug 27 | In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the… Affected: 8.2r1.0 before 8.2r12.1; 8.3r1 before 8.3r7.1; 9.0r1 before 9.0r3.4 |
| CVE-2021-22965 | 7.5 | Nov 19 | A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device Affected: before 9.1 |
| CVE-2019-11541 | 7.5 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.2RX before 8.2R12.1, users using SAML authentication with the Reuse Existing NC… Affected: 8.2r1.0; 8.2r1.1; 8.2r2.0; 8.2r3.0; 8.2r3.1; 8.2r4.0; +15 more |
| CVE-2016-4786 | 7.5 | May 26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via… Affected: 8.1r1.0; 7.4 |
| CVE-2021-44720 | 7.2 | Aug 12 | In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets >… Affected: before 9.1 |
| CVE-2021-22938 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator… Affected: before 9.1 |
| CVE-2021-22937 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the… Affected: before 9.1 |
| CVE-2021-22935 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter Affected: before 9.1 |
| CVE-2021-22934 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to… Affected: before 9.1 |
| CVE-2020-15352 | 7.2 | Oct 27 | An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct… Affected: through 9.0 |
| CVE-2020-8219 | 7.2 | Jul 30 | An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator Affected: through 9.0 |
| CVE-2019-11508 | 7.2 | May 8 | In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web… Affected: 7.4 |
| CVE-2019-11542 | 7.2 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX… Affected: 8.1r1.0; 8.2r1.0; 8.2r1.1; 8.2r2.0; 8.2r3.0; 8.2r3.1; +16 more |
Showing 27