CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 0CVE-2020-8216
https://notcve.org/view.php?id=CVE-2020-8216
An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID. Una vulnerabilidad de divulgación de información en la reunión de Pulse Connect Secure versiones anteriores a 9.1R8, permitió a usuarios finales autenticados encontrar detalles de la reunión, si conocen el ID de Reunión • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 24EXPL: 0CVE-2020-8204
https://notcve.org/view.php?id=CVE-2020-8204
A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page. Se presenta una vulnerabilidad de tipo cross site scripting (XSS) en Pulse Connect Secure versiones anteriores a 9.1R5, en la Página PSAL • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 23EXPL: 0CVE-2020-12880
https://notcve.org/view.php?id=CVE-2020-12880
An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8. By manipulating a certain kernel boot parameter, it can be tricked into dropping into a root shell in a pre-install phase where the entire source code of the appliance is available and can be retrieved. (The source code is otherwise inaccessible because the appliance has its hard disks encrypted, and no root shell is available during normal operation.) Se detectó un problema en Pulse Policy Secure (PPS) y Pulse Connect Secure (PCS) Virtual Appliance versiones anteriores a 9.1R8. Al manipular un determinado parámetro de arranque del kernel, puede ser engañado para que caiga en un shell root en una fase previa a la instalación donde el código fuente completo del dispositivo está disponible y puede ser recuperado. • https://kb.pulsesecure.net/?atype=sa https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17066
https://notcve.org/view.php?id=CVE-2019-17066
In Ivanti WorkSpace Control before 10.4.40.0, a user can elevate rights on the system by hijacking certain user registries. This is possible because pwrgrid.exe first checks the Current User registry hives (HKCU) when starting an application with elevated rights. En Ivanti WorkSpace Control versiones anteriores a 10.4.40.0, un usuario puede elevar los derechos en el sistema mediante el secuestro de determinados registros de usuarios. Esto es posible porque el archivo pwrgrid.exe primero comprueba las colmenas del registro Current User (HKCU) al iniciar una aplicación con derechos elevados. • https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-acquire-admin-privileges-by-hijacking-certain-user-registry-entries • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12442
https://notcve.org/view.php?id=CVE-2020-12442
Ivanti Avalanche 6.3 allows a SQL injection that is vaguely associated with the Apache HTTP Server, aka Bug 683250. Ivanti Avalanche versión 6.3, permite una inyección SQL que está vagamente asociada con el Servidor Apache HTTP, también se conoce como Bug 683250. • https://forums.ivanti.com/s/article/SQL-Injection-Vulnerability-in-Avalanche • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •