CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11193
https://notcve.org/view.php?id=CVE-2017-11193
12 Jul 2017 — Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these commands against any IP if they can get an admin to visit their malicious CSRF page. Pulse Connect Secure versión 8.3R1, presenta un problema de tipo CSRF en el archivo diag.cgi. • http://www.securityfocus.com/bid/99621 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11194
https://notcve.org/view.php?id=CVE-2017-11194
12 Jul 2017 — Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi. In the admin panel, the certid parameter of adminservercacertdetails.cgi is reflected in the application's response and is not properly sanitized, allowing an attacker to inject tags. An attacker could come up with clever payloads to make the system run commands such as ping, ping6, traceroute, nslookup, arp, etc. En Pulse Connect Secure versión 8.3R1, presenta un problema de tipo XSS reflejado en el archivo adminservercacertdetai... • http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11195
https://notcve.org/view.php?id=CVE-2017-11195
12 Jul 2017 — Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can use javascript: or data: to abuse this. Pulse Connect Secure versión 8.3R1, tiene una vulnerabilidad de tipo cross-site scripting (XSS) reflejado en el archivo launchHelp.cgi. • http://www.securityfocus.com/bid/99615 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11196
https://notcve.org/view.php?id=CVE-2017-11196
12 Jul 2017 — Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page. Pulse Connect Secure versión 8.3R1, tiene una vulnerabilidad de tipo CSRF en el archivo logout.cgi. La función logout del panel de administración no está protegida por ningún token CSRF, lo que permite a un atacante cerrar la sesión de un usuario haciéndole visitar una página web maliciosa. • http://www.securityfocus.com/bid/99613 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 3%CPEs: 5EXPL: 0CVE-2016-4786
https://notcve.org/view.php?id=CVE-2016-4786
26 May 2016 — Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. Pulse Connect Secure (PCS) 8.2 en versiones anteriores a 8.2r1, 8.1 en versiones anteriores a 8.1r3, 8.0 en versiones anteriores a 8.0r11 y 7.4 en versiones anteriores a 7.4r13.4 permite a atacantes remotos provocar una denegación de servicio (consumo de CPU) a través de vectores no especificados. • http://www.securitytracker.com/id/1035932 •
CVSS: 10.0EPSS: 2%CPEs: 5EXPL: 0CVE-2016-4787
https://notcve.org/view.php?id=CVE-2016-4787
26 May 2016 — Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directory via unknown vectors. Pulse Connect Secure (PCS) 8.2 en versiones anteriores a 8.2r1, 8.1 en versiones anteriores a 8.1r2, 8.0 en versiones anteriores a 8.0r10 y 7.4 en versiones anteriores a 7.4r13.4 permite a atacantes remotos leer archivos de autenticación sensibles del sistema en un directorio no especifi... • http://www.securitytracker.com/id/1035932 •
CVSS: 5.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-4788
https://notcve.org/view.php?id=CVE-2016-4788
26 May 2016 — Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system file via unknown vectors. Pulse Connect Secure (PCS) 8.2 en versiones anteriores a 8.2r1, 8.1 en versiones anteriores a 8.1r2, 8.0 en versiones anteriores a 8.0r10 y 7.4 en versiones anteriores a 7.4r13.4 permite a atacantes remotos leer un archivo de sistema no especificado a través de vectores desconocidos. • http://www.securitytracker.com/id/1035932 •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2016-4789
https://notcve.org/view.php?id=CVE-2016-4789
26 May 2016 — Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en la sección de configuración del sistema en la interaz de usuario administrativo en Pulse Connect Secure (PCS) 8.2 en versiones anteriores a 8.2r1, 8.1 en versiones anteriores a ... • http://www.securitytracker.com/id/1035932 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2016-4790
https://notcve.org/view.php?id=CVE-2016-4790
26 May 2016 — Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en la interfaz de usuario administrativo en Pulse Connect Secure (PCS) 8.2 en versiones anteriores a 8.2r1, 8.1 en versiones anteriores a 8.1r2, 8.0 en versiones anteriores a 8.0r9 y 7.4 en versiones anteriores a 7.4... • http://www.securitytracker.com/id/1035932 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.6EPSS: 0%CPEs: 5EXPL: 0CVE-2016-4791
https://notcve.org/view.php?id=CVE-2016-4791
26 May 2016 — The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to enumerate files, read arbitrary files, and conduct server side request forgery (SSRF) attacks via unspecified vectors. La interfaz de usuario administrativo en Pulse Connect Secure (PCS) 8.2 en versiones anteriores a 8.2r1, 8.1 en versiones anteriores a 8.1r2, 8.0 en versiones anteriores a 8.0r9 y 7.4 en versiones anteriores a 7.4r13.4 ... • http://www.securitytracker.com/id/1035932 •