CVSS: 6.1EPSS: 0%CPEs: 28EXPL: 1CVE-2020-8238
https://notcve.org/view.php?id=CVE-2020-8238
A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS). Una vulnerabilidad en la interfaz de usuario web autenticado de Pulse Connect Secure y Pulse Policy Secure versiones anteriores a 9.1R8.2, podría permitir a atacantes llevar a cabo un ataque de tipo Cross-Site Scripting (XSS) • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44588 https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13793
https://notcve.org/view.php?id=CVE-2020-13793
Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key. Un almacenamiento no seguro de credenciales del AD en Ivanti DSM netinst versión 5.1, debido a una clave de cifrado estática y embebida • https://forums.ivanti.com/s/article/Release-Notes-for-DSM-2020-1 https://insinuator.net/2020/06/security-advisories-for-ivanti-dsm-suite • CWE-798: Use of Hard-coded Credentials •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12441
https://notcve.org/view.php?id=CVE-2020-12441
Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The DoS can be triggered by sending a specially crafted network packet. Una Denegación de Servicio (DoS) en Ivanti Service Manager HEAT Remote Control versión 7.4, debido a un desbordamiento del búfer en el analizador de protocolos del agente "HEATRemoteService". El DoS se puede activar mediante el envío de un paquete de red especialmente diseñado • https://forums.ivanti.com/s/article/Release-Notes-for-DSM-2020-1 https://insinuator.net/2020/06/security-advisories-for-ivanti-dsm-suite • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 24EXPL: 0CVE-2020-8219
https://notcve.org/view.php?id=CVE-2020-8219
An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator. Se presenta una vulnerabilidad de comprobación de permisos insuficiente en Pulse Connect Secure versiones anteriores a 9.1R8, que permite a un atacante cambiar la contraseña de un administrador completa • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516 • CWE-276: Incorrect Default Permissions CWE-280: Improper Handling of Insufficient Permissions or Privileges •
CVSS: 6.5EPSS: 0%CPEs: 24EXPL: 0CVE-2020-8220
https://notcve.org/view.php?id=CVE-2020-8220
A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can cause DOS. Se presenta una vulnerabilidad denegación de servicio en Pulse Connect Secure versiones anteriores a 9.1R8, que permite a un atacante autenticado llevar a cabo una inyección de comandos por medio de la web del administrador que puede causar una DOS • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516 • CWE-400: Uncontrolled Resource Consumption •