PU
Vendor
Pulsesecure
127
CVEs
3
On KEV
0
New 30D
Products
PP9.8
Pulse Policy Secure
Pulsesecure
31 CVEs2 on KEV0 new
PC10.0
Pulse Connect Secure
Pulsesecure
57 CVEs1 on KEV0 new
PS9.8
Pulse Secure Desktop Client
Pulsesecure
18 CVEs0 on KEV0 new
PS7.8
Pulse Secure Desktop
Pulsesecure
3 CVEs0 on KEV0 new
VT7.5
Virtual Traffic Manager
Pulsesecure
3 CVEs0 on KEV0 new
CL9.8
Client
Pulsesecure
2 CVEs0 on KEV0 new
PS7.5
Pulse Secure Virtual Application Delivery Controller
Pulsesecure
2 CVEs0 on KEV0 new
SB9.8
Steel Belted Radius
Pulsesecure
2 CVEs0 on KEV0 new
DL6.5
Desktop Linux Client
Pulsesecure
1 CVEs0 on KEV0 new
OA7.8
Odyssey Access Client
Pulsesecure
1 CVEs0 on KEV0 new
PF2.3
Psa-5000 Firmware
Pulsesecure
1 CVEs0 on KEV0 new
PF2.3
Psa-7000 Firmware
Pulsesecure
1 CVEs0 on KEV0 new
PO7.5
Pulse One On-premise
Pulsesecure
1 CVEs0 on KEV0 new
PS7.0
Pulse Secure Installer Service
Pulsesecure
1 CVEs0 on KEV0 new
PS7.8
Pulse Secure Security
Pulsesecure
1 CVEs0 on KEV0 new
SA8.8
Secure Access Series Ssl Vpn Sa-4000
Pulsesecure
1 CVEs0 on KEV0 new
SP7.8
Standalone Pulse Installer Service
Pulsesecure
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2022-21826 | PC Pulse Connect Secure Pulsesecure | 5.4 | Sep 30 | Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's… |
| CVE-2021-44720 | PC Pulse Connect Secure Pulsesecure | 7.2 | Aug 12 | In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets >… |
| CVE-2021-22965 | PC Pulse Connect Secure Pulsesecure | 7.5 | Nov 19 | A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device |
| CVE-2021-22938 | PC Pulse Connect Secure Pulsesecure | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator… |
| CVE-2021-22937 | PC Pulse Connect Secure Pulsesecure | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the… |
| CVE-2021-22936 | PC Pulse Connect Secure Pulsesecure | 6.1 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized… |
| CVE-2021-22935 | PC Pulse Connect Secure Pulsesecure | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter |
| CVE-2021-22934 | PC Pulse Connect Secure Pulsesecure | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to… |
| CVE-2021-22933 | PC Pulse Connect Secure Pulsesecure | 6.5 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request |
| CVE-2021-22908 | PC Pulse Connect Secure Pulsesecure | 8.8 | May 27 | A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code… |
| CVE-2021-22900 In wildKEV | PC Pulse Connect Secure Pulsesecure | 7.2 | May 27 | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability |
| CVE-2021-31922 | VT Virtual Traffic Manager Pulsesecure | 7.5 | May 14 | An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header |
| CVE-2021-22887 | PF Psa-7000 Firmware Pulsesecure | 2.3 | Mar 16 | A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware |
| CVE-2020-8263 | PS Pulse Secure Desktop Client Pulsesecure | 5.4 | Oct 28 | A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) through the CGI file |
| CVE-2020-8262 | PP Pulse Policy Secure Pulsesecure | 6.1 | Oct 28 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated… |
| CVE-2020-8261 | PP Pulse Policy Secure Pulsesecure | 4.3 | Oct 28 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection |
| CVE-2020-8255 | PS Pulse Secure Desktop Client Pulsesecure | 4.9 | Oct 28 | A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary file reading vulnerability is fixed using… |
| CVE-2020-8254 | PS Pulse Secure Desktop Client Pulsesecure | 8.8 | Oct 28 | A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server |
| CVE-2020-8250 | PS Pulse Secure Desktop Client Pulsesecure | 7.8 | Oct 28 | A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege |
| CVE-2020-8249 | PS Pulse Secure Desktop Client Pulsesecure | 7.8 | Oct 28 | A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer overflow |
| CVE-2020-8248 | PS Pulse Secure Desktop Client Pulsesecure | 7.8 | Oct 28 | A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege |
| CVE-2020-8241 | PS Pulse Secure Desktop Client Pulsesecure | 7.5 | Oct 28 | A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a MITM Attack if end users are convinced to connect to a malicious server |
| CVE-2020-8240 | PS Pulse Secure Desktop Client Pulsesecure | 7.8 | Oct 28 | A vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an endpoint machine can use system-level privileges if the Embedded Browser is configured… |
| CVE-2020-8239 | PS Pulse Secure Desktop Client Pulsesecure | 9.8 | Oct 28 | A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry privilege escalation attack |
| CVE-2020-8956 | PS Pulse Secure Desktop Pulsesecure | 3.3 | Oct 27 | Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled |
| CVE-2020-15352 | PC Pulse Connect Secure Pulsesecure | 7.2 | Oct 27 | An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct… |
| CVE-2020-8256 | PC Pulse Connect Secure Pulsesecure | 4.9 | Sep 30 | A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration… |
| CVE-2020-8238 | PC Pulse Connect Secure Pulsesecure | 6.1 | Sep 30 | A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS) |
| CVE-2020-8222 | PC Pulse Connect Secure Pulsesecure | 6.8 | Jul 30 | A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file… |
| CVE-2020-8221 | PP Pulse Policy Secure Pulsesecure | 4.9 | Jul 30 | A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface |
| CVE-2020-8220 | PP Pulse Policy Secure Pulsesecure | 6.5 | Jul 30 | A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can… |
| CVE-2020-8219 | PP Pulse Policy Secure Pulsesecure | 7.2 | Jul 30 | An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator |
| CVE-2020-8217 | PC Pulse Connect Secure Pulsesecure | 5.4 | Jul 30 | A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA |
| CVE-2020-8216 | PP Pulse Policy Secure Pulsesecure | 4.3 | Jul 30 | An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID |
| CVE-2020-8206 | PC Pulse Connect Secure Pulsesecure | 8.1 | Jul 30 | An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP |
| CVE-2020-8204 | PC Pulse Connect Secure Pulsesecure | 6.1 | Jul 30 | A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page |
| CVE-2020-8218 In wildKEV | PP Pulse Policy Secure Pulsesecure | 7.2 | Jul 30 | Pulse Connect Secure Code Injection Vulnerability |
| CVE-2020-15408 | PC Pulse Connect Secure Pulsesecure | 4.6 | Jul 28 | An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8 |
| CVE-2020-12880 | PP Pulse Policy Secure Pulsesecure | 5.5 | Jul 27 | An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8 |
| CVE-2020-13162 | PS Pulse Secure Desktop Client Pulsesecure | 7.0 | Jun 16 | A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM)… |
| CVE-2020-11582 | PC Pulse Connect Secure Pulsesecure | 8.8 | Apr 6 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06 |
| CVE-2020-11581 | PP Pulse Policy Secure Pulsesecure | 8.1 | Apr 6 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06 |
| CVE-2020-11580 | PP Pulse Policy Secure Pulsesecure | 9.1 | Apr 6 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06 |
| CVE-2018-20814 | PP Pulse Policy Secure Pulsesecure | 6.1 | Jun 28 | An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2 |
| CVE-2018-20812 | PS Pulse Secure Desktop Client Pulsesecure | 7.5 | Jun 28 | An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists in Pulse Secure Pulse Secure Desktop… |
| CVE-2018-20810 | PP Pulse Policy Secure Pulsesecure | 9.8 | Jun 28 | Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and Pulse Policy Secure… |
| CVE-2018-20809 | PP Pulse Policy Secure Pulsesecure | 7.5 | Jun 28 | A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R5 and Pulse Policy Secure 5.4RX before 5.4R5 |
| CVE-2019-11478 | PP Pulse Policy Secure Pulsesecure | 7.5 | Jun 19 | Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective… |
| CVE-2019-11477 | PP Pulse Policy Secure Pulsesecure | 7.5 | Jun 19 | Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs) |
| CVE-2019-11509 | PP Pulse Policy Secure Pulsesecure | 8.8 | Jun 3 | In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2… |
| CVE-2019-11508 | PC Pulse Connect Secure Pulsesecure | 7.2 | May 8 | In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web… |
| CVE-2019-11543 | PC Pulse Connect Secure Pulsesecure | 6.1 | Apr 26 | XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX… |
| CVE-2019-11542 | PP Pulse Policy Secure Pulsesecure | 7.2 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX… |
| CVE-2019-11541 | PC Pulse Connect Secure Pulsesecure | 7.5 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.2RX before 8.2R12.1, users using SAML authentication with the Reuse Existing NC… |
| CVE-2019-11540 | PC Pulse Connect Secure Pulsesecure | 9.8 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an… |
| CVE-2019-11539 RansomwareIn wildKEV | PP Pulse Policy Secure Pulsesecure | 7.2 | Apr 26 | Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability |
| CVE-2019-11213 | PC Pulse Connect Secure Pulsesecure | 8.1 | Apr 12 | In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end… |
| CVE-2018-20193 | SA Secure Access Series Ssl Vpn Sa-4000 Pulsesecure | 8.8 | Dec 21 | Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC) allow privilege escalation, as… |
| CVE-2018-20307 | VT Virtual Traffic Manager Pulsesecure | 4.3 | Dec 20 | Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity information by leveraging… |
| CVE-2018-20306 | VT Virtual Traffic Manager Pulsesecure | 5.4 | Dec 20 | A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to… |