CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 1CVE-2020-11582
https://notcve.org/view.php?id=CVE-2020-11582
06 Apr 2020 — An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, launches a TCP server that accepts local connections on a random port. This can be reached by local HTTP clients, because up to 25 invalid lines are ignored, and because DNS rebinding can occur. (This server accepts, for example, a setcookie command that might be relevant to CVE-2020-11581 exploitation.) Se detect... • https://git.lsd.cat/g/pulse-host-checker-rce • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 1CVE-2020-11580
https://notcve.org/view.php?id=CVE-2020-11580
06 Apr 2020 — An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, accepts an arbitrary SSL certificate. Se detectó un problema en Pulse Secure Pulse Connect Secure (PCS) hasta el 06-04-2020. El applet en el archivo tncc.jar, ejecutado en clientes macOS, Linux y Solaris cuando se aplica una política Host Checker, acepta un certificado de tipo SSL arbitrario. • https://git.lsd.cat/g/pulse-host-checker-rce • CWE-295: Improper Certificate Validation •
CVSS: 8.3EPSS: 0%CPEs: 44EXPL: 0CVE-2019-11543
https://notcve.org/view.php?id=CVE-2019-11543
26 Apr 2019 — XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1. Existe una vulnerabilidad Cross-site scripting (XSS), en la consola web de administración de Pulse Secure Pulse Connect Secure (PCS) versiones 9.0RX anteriores a 9.0R3.4, versiones 8.3RX anteriores a 8.3R7.1, y versiones 8.1RX anteriores a 8.1R15.1; Pulse Policy Secur... • http://www.securityfocus.com/bid/108073 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.0EPSS: 27%CPEs: 97EXPL: 2CVE-2019-11542
https://notcve.org/view.php?id=CVE-2019-11542
26 Apr 2019 — In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, an authenticated attacker (via the admin web interface) can send a specially crafted message resulting in a stack buffer overflow. En Pulse Secure Pulse Connect Secure versiones 9.0RX anteriores a 9.0R3.4, versiones 8.3RX ant... • http://www.securityfocus.com/bid/108073 • CWE-787: Out-of-bounds Write •
CVSS: 8.0EPSS: 93%CPEs: 97EXPL: 7CVE-2019-11539 – Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2019-11539
26 Apr 2019 — In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands. En Pulse Secure Pulse Connect Secure versiones 9.0RX anteriores a 9.0R3.4, versiones 8.3RX anteriores a 8.3R7.1, versiones 8.2RX anterio... • https://packetstorm.news/files/id/155277 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.1EPSS: 1%CPEs: 5EXPL: 0CVE-2019-11213
https://notcve.org/view.php?id=CVE-2019-11213
12 Apr 2019 — In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. (The endpoint would need to be already compromised for exploitation to succeed.) This affects Pulse Desktop Client 5.x before Secure Desktop 5.3R7 and Pulse Desktop Client 9.x before Secure Desktop 9.0R3. It also affects (for Network Connect customers) Pulse Connect Secure 8.1 before 8.1R14,... • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44114 • CWE-384: Session Fixation •
CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0CVE-2018-14366
https://notcve.org/view.php?id=CVE-2018-14366
06 Sep 2018 — download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability. download.cgi en Pulse Secure Pulse Connect Secure, en versiones 8.1RX anteriores a la 8.1R13 y versiones 8.3RX anteriores a la 8.3R4; y Pulse Policy Secure hasta versiones 5.2RX anteriores a la 5.2R10 y versiones 5.4RX anteriores a la 5.4R4 tienen una vulnerabilidad de redirección abierta. • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.8EPSS: 5%CPEs: 18EXPL: 0CVE-2018-6320
https://notcve.org/view.php?id=CVE-2018-6320
06 Sep 2018 — A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an http(s) Host header received from the browser is trusted without validation. Se ha descubierto una vulnerabilidad en login.cgi en Pulse Secure Pulse Connect Secure (PCS) en versiones 8.1RX anteriores a la 8.1R12 y versiones 8.3RX anteriores a la 8.3R2 y Pulse Policy Secure (PPS) en versiones 5... • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-9849
https://notcve.org/view.php?id=CVE-2018-9849
10 May 2018 — Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service (memory consumption and memory errors) via a crafted XML document. Pulse Secure Pulse Connect Secure en versiones 8.1.x anteriores a la 8.1R14, versiones 8.2.x anteriores a la 8.2R11 y versiones 8.3.x anteriores a la 8.3R5 no procesa correctamente las entidades XML anidadas, lo que permite que atacantes remo... • http://www.securityfocus.com/bid/104160 •
CVSS: 4.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-17947
https://notcve.org/view.php?id=CVE-2017-17947
16 Jan 2018 — A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure (PPS) before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL parameters not being sanitized. Exploitation does require the user to be logged in as administrator; the issue is not applicable to the end user portal. Se ha encontrado un problema de Cross-Site Scripting (XSS) en c... • http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43018 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •