CVSS: 7.5EPSS: 0%CPEs: 53EXPL: 0CVE-2018-20812
https://notcve.org/view.php?id=CVE-2018-20812
16 Mar 2019 — An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists in Pulse Secure Pulse Secure Desktop 9.0R1 and below. This is applicable only to dual-stack (IPv4/IPv6) endpoints. Existe un problema de exposición a la información donde el tráfico DNS de IPv6 se enviaría fuera del túnel VPN (cuando se habilitó la aplicación de tráfico) en Pulse Secure Pulse Secure Desktop 9.0R1 e inferior. Esto se aplica solo a los puntos finales de do... • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-20814
https://notcve.org/view.php?id=CVE-2018-20814
16 Mar 2019 — An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX or PPS 5.2RX. Se ha encontrado un fallo de Cross-Site Scripting (XSS) con Psaldownload.cgi en Pulse Secure Pulse Connect Secure (PCS) versión 8.3R2 anteriores a la 8.3R2 y Pulse Policy Secure (PPS) versión 5.4RX anteriores a la versión 5.4R2. Esto no es aplicable a PC versión 8.1RX o PPS 5.2RX. • http://www.securityfocus.com/bid/109033 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 2CVE-2018-20193 – Juniper Secure Access SSL VPN Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-20193
21 Dec 2018 — Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC) allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 (build 9627) 4.2 Release (build 7631). This occurs because appropriate controls are not performed. Specifically, it is possible for a readonly user to change the administrator user password by making a local copy of the /dana-admin/user/update.cgi page, changing the "user" value, and savi... • https://packetstorm.news/files/id/150882 • CWE-269: Improper Privilege Management •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2018-20306
https://notcve.org/view.php?id=CVE-2018-20306
20 Dec 2018 — A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials. Affected releases are Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1. Una vulnerabilidad de Cross-Site Scripting (XSS) persistente en la interfaz web de usuario administrador de Pulse Secure Virtual Traffic Manager po... • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-20307
https://notcve.org/view.php?id=CVE-2018-20307
20 Dec 2018 — Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity information by leveraging incorrect permission validation. Pulse Secure Virtual Traffic Manager, en versiones 9.9 anteriores a la 9.9r2 y la 10.4r1 permiten que un usuario autenticado remoto obtenga información sensible del historial de actividades aprovechando la validación incorrecta de permisos. • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.8EPSS: 0%CPEs: 10EXPL: 1CVE-2018-11002
https://notcve.org/view.php?id=CVE-2018-11002
29 Nov 2018 — Pulse Secure Desktop Client 5.3 up to and including R6.0 build 1769 on Windows has Insecure Permissions. Pulse Secure Desktop Client desde la versión 5.3 hasta la R6.0 build 1769 en Windows tiene permisos no seguros. • http://www.securityfocus.com/bid/106054 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.6EPSS: 0%CPEs: 17EXPL: 1CVE-2018-18284 – ghostscript: 1Policy operator allows a sandbox protection bypass
https://notcve.org/view.php?id=CVE-2018-18284
18 Oct 2018 — Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. Artifex Ghostscript 9.25 y anteriores permite que los atacantes omitan un mecanismo de protección de sandbox mediante vectores relacionados con el operador 1Policy. Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service, disclosure of existence and size of arbitrary files, or the execution of arbi... • http://git.ghostscript.com/?p=ghostpdl.git%3Bh=8d19fdf63f91f50466b08f23e2d93d37a4c5ea0b •
CVSS: 7.2EPSS: 0%CPEs: 9EXPL: 0CVE-2018-7572
https://notcve.org/view.php?id=CVE-2018-7572
12 Sep 2018 — Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN users during Windows Logon, can allow attackers to bypass Windows authentication and execute commands on the system with the privileges of Pulse Secure Client. The attacker must interrupt the client's network connectivity, and trigger a connection to a crafted proxy server with an invalid SSL certificate that allows certification-manager access, leading to the ability to browse local files and execute local programs. Pulse... • https://www.mdsec.co.uk/2018/09/advisory-cve-2018-7572-pulse-secure-client-authentication-bypass • CWE-287: Improper Authentication •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2018-16261
https://notcve.org/view.php?id=CVE-2018-16261
06 Sep 2018 — In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege Escalation Vulnerability with Dynamic Certificate Trust. Pulse Secure Pulse Desktop Client, en versiones 5.3RX anteriores a la 5.3R5 y versión 9.0R1, tiene una vulnerabilidad de escalada de privilegios con Dynamic Certificate Trust. • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877 • CWE-295: Improper Certificate Validation •
CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0CVE-2018-14366
https://notcve.org/view.php?id=CVE-2018-14366
06 Sep 2018 — download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability. download.cgi en Pulse Secure Pulse Connect Secure, en versiones 8.1RX anteriores a la 8.1R13 y versiones 8.3RX anteriores a la 8.3R4; y Pulse Policy Secure hasta versiones 5.2RX anteriores a la 5.2R10 y versiones 5.4RX anteriores a la 5.4R4 tienen una vulnerabilidad de redirección abierta. • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •