CVSS: 10.0EPSS: 96%CPEs: 36EXPL: 2CVE-2021-22893 – Ivanti Pulse Connect Secure Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2021-22893
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild. Pulse Connect Secure versiones 9.0R3/9.1R1 y posteriores, es susceptible a una vulnerabilidad de omisión de autenticación expuesta por las funciones de Windows File Share Browser y Pulse Secure Collaboration de Pulse Connect Secure, que pueden permitir a un usuario no autenticado llevar a cabo una ejecución de código remoto arbitrario en Pulse Connect Secure gateway. Esta vulnerabilidad ha sido explotado en el wild Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services. • https://github.com/Mad-robot/CVE-2021-22893 https://github.com/orangmuda/CVE-2021-22893 https://blog.pulsesecure.net/pulse-connect-secure-security-update https://kb.cert.org/vuls/id/213092 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784 https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html • CWE-287: Improper Authentication CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 97EXPL: 0CVE-2019-11509
https://notcve.org/view.php?id=CVE-2019-11509
In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance. En Pulse Secure Pulse Secure Connect (PCS) anterior de la versión 8.1R15.1, 8.2 anterior de la versión 8.2R12.1, 8.3 anterior de la versión 8.3R7.1 y 9.0 anterior de 9.0R3.4 y Pulse Policy Secure (PPS) anterior de la versión 5.1R15.1, 5.2 anterior de la versión 5.2R12.1, 5.3 anterior de la versión 5.3R15.1, 5.4 anterior de la versión 5.4R7.1 y 9.0 ante de la versión 9.0R3.2, un atacante identificado (a través de la interfaz web de administración) puede operar el control de acceso incorrecto para ejecutar código arbitrario en el dispositivo . • https://kb.pulsesecure.net/?atype=sa https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 https://www.kb.cert.org/vuls/id/927237 •
CVSS: 6.1EPSS: 1%CPEs: 15EXPL: 2CVE-2019-11507
https://notcve.org/view.php?id=CVE-2019-11507
In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launcher page. En Pulse Secure Pulse Connect Secure (PCS) 8.3.x versiones anteriores a 8.3R7.1 y 9.0.x anteriores a 9.0R3, se ha encontrado un problema de XSS en la página Application Launcher. • http://www.securityfocus.com/bid/108073 https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf https://kb.pulsesecure.net/?atype=sa https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516 https://www.kb.cert.org/vuls/id/927237 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.6EPSS: 3%CPEs: 115EXPL: 2CVE-2019-11508
https://notcve.org/view.php?id=CVE-2019-11508
In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web interface) can exploit Directory Traversal to execute arbitrary code on the appliance. En Pulse Secure Pulse Connect Connect (PCS) versión anterior a 8.1R15.1, versión 8.2 anterior a 8.2 R12.1, versión 8.3 anterior a 8.3R7.1 y versión 9.0 anteior a 9.0R3.4, un atacante identificado (por medio de la interfaz web de administrador) puede operar un salto de directorio para ejecutar código arbitrario en el dispositivo. • http://www.securityfocus.com/bid/108073 https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf https://kb.pulsesecure.net/?atype=sa https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 https://www.kb.cert.org/vuls/id/927237 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 97%CPEs: 37EXPL: 6CVE-2019-11510 – Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2019-11510
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability . En Pulse Secure Pulse Connect Secure (PCS) versión 8.2 en versiones anteriores a la 8.2R12.1, versión 8.3 en versiones anteriores a la 8.3R7.1 y versión 9.0 en versiones anteriores a la 9.0R3.4, un atacante remoto no autenticado puede enviar una URI especialmente diseñado para realizar una vulnerabilidad de lectura de archivos arbitraria. Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI. • https://www.exploit-db.com/exploits/47297 https://github.com/projectzeroindia/CVE-2019-11510 https://github.com/jas502n/CVE-2019-11510-1 https://github.com/imjdl/CVE-2019-11510-poc https://github.com/jason3e7/CVE-2019-11510 https://github.com/pwn3z/CVE-2019-11510-PulseVPN http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.html http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html ht • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •