Page 4 of 43 results (0.002 seconds)

CVSS: 9.3EPSS: 39%CPEs: 5EXPL: 1

CVE-2020-11581

https://notcve.org/view.php?id=CVE-2020-11581

06 Apr 2020 — An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, allows a man-in-the-middle attacker to perform OS command injection attacks (against a client) via shell metacharacters to the doCustomRemediateInstructions method, because Runtime.getRuntime().exec() is used. Se detectó un problema en Pulse Secure Pulse Connect Secure (PCS) hasta el 06-04-2020. El applet en el ar... • https://git.lsd.cat/g/pulse-host-checker-rce • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 1

CVE-2020-11582

https://notcve.org/view.php?id=CVE-2020-11582

06 Apr 2020 — An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, launches a TCP server that accepts local connections on a random port. This can be reached by local HTTP clients, because up to 25 invalid lines are ignored, and because DNS rebinding can occur. (This server accepts, for example, a setcookie command that might be relevant to CVE-2020-11581 exploitation.) Se detect... • https://git.lsd.cat/g/pulse-host-checker-rce • CWE-668: Exposure of Resource to Wrong Sphere •

CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 1

CVE-2020-11580

https://notcve.org/view.php?id=CVE-2020-11580

06 Apr 2020 — An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, accepts an arbitrary SSL certificate. Se detectó un problema en Pulse Secure Pulse Connect Secure (PCS) hasta el 06-04-2020. El applet en el archivo tncc.jar, ejecutado en clientes macOS, Linux y Solaris cuando se aplica una política Host Checker, acepta un certificado de tipo SSL arbitrario. • https://git.lsd.cat/g/pulse-host-checker-rce • CWE-295: Improper Certificate Validation •

CVSS: 8.3EPSS: 0%CPEs: 44EXPL: 0

CVE-2019-11543

https://notcve.org/view.php?id=CVE-2019-11543

26 Apr 2019 — XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1. Existe una vulnerabilidad Cross-site scripting (XSS), en la consola web de administración de Pulse Secure Pulse Connect Secure (PCS) versiones 9.0RX anteriores a 9.0R3.4, versiones 8.3RX anteriores a 8.3R7.1, y versiones 8.1RX anteriores a 8.1R15.1; Pulse Policy Secur... • http://www.securityfocus.com/bid/108073 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.0EPSS: 27%CPEs: 97EXPL: 2

CVE-2019-11542

https://notcve.org/view.php?id=CVE-2019-11542

26 Apr 2019 — In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, an authenticated attacker (via the admin web interface) can send a specially crafted message resulting in a stack buffer overflow. En Pulse Secure Pulse Connect Secure versiones 9.0RX anteriores a 9.0R3.4, versiones 8.3RX ant... • http://www.securityfocus.com/bid/108073 • CWE-787: Out-of-bounds Write •

CVSS: 8.3EPSS: 1%CPEs: 23EXPL: 0

CVE-2019-11541

https://notcve.org/view.php?id=CVE-2019-11541

26 Apr 2019 — In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.2RX before 8.2R12.1, users using SAML authentication with the Reuse Existing NC (Pulse) Session option may see authentication leaks. En Pulse Secure Pulse Connect Secure versiones 9.0RX anteriores a 9.0R3.4, versiones 8.3RX anteriores a 8.3R7.1 y versiones 8.2RX anteriores a 8.2R12.1, los usuarios que utilizan la autenticación SAML con la opción Reuse Existing NC (Pulse), pueden tener fugas de autenticación. • http://www.securityfocus.com/bid/108073 •

CVSS: 9.8EPSS: 22%CPEs: 26EXPL: 2

CVE-2019-11540

https://notcve.org/view.php?id=CVE-2019-11540

26 Apr 2019 — In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an unauthenticated, remote attacker can conduct a session hijacking attack. En Pulse Secure Pulse Connect Secure versiones 9.0RX anteriores a 9.0R3.4 y versiones 8.3RX anteriores a 8.3R7.1 y Pulse Policy Secure versiones 9.0RX anteriores a 9.0R3.2 y versiones 5.4RX anteriores a 5.4R7.1, un atacante remoto no autenticado puede llevar a cabo ... • http://www.securityfocus.com/bid/108073 •

CVSS: 8.0EPSS: 94%CPEs: 97EXPL: 7

CVE-2019-11539 – Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability

https://notcve.org/view.php?id=CVE-2019-11539

26 Apr 2019 — In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands. En Pulse Secure Pulse Connect Secure versiones 9.0RX anteriores a 9.0R3.4, versiones 8.3RX anteriores a 8.3R7.1, versiones 8.2RX anterio... • https://packetstorm.news/files/id/155277 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 8.6EPSS: 0%CPEs: 17EXPL: 1

CVE-2018-18284 – ghostscript: 1Policy operator allows a sandbox protection bypass

https://notcve.org/view.php?id=CVE-2018-18284

18 Oct 2018 — Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. Artifex Ghostscript 9.25 y anteriores permite que los atacantes omitan un mecanismo de protección de sandbox mediante vectores relacionados con el operador 1Policy. Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service, disclosure of existence and size of arbitrary files, or the execution of arbi... • http://git.ghostscript.com/?p=ghostpdl.git%3Bh=8d19fdf63f91f50466b08f23e2d93d37a4c5ea0b •

CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0

CVE-2018-16513 – Gentoo Linux Security Advisory 201811-12

https://notcve.org/view.php?id=CVE-2018-16513

05 Sep 2018 — In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have unspecified other impact. En Artifex Ghostscript en versiones anteriores a la 9.24, los atacantes que puedan proporcionar archivos PostScript manipulados podrían emplear una confusión de tipos en la función setcolor para provocar el cierre inesperado del intérprete u otro tipo de impacto sin especificar. Tavis Ormandy discovered m... • http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=b326a71659b7837d3acde954b18bda1a6f5e9498 • CWE-704: Incorrect Type Conversion or Cast •