CVE-2020-8216

An information disclosure vulnerability in meeting of Pulse Connect Secure 9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID...

CVE-2020-8217

A cross site scripting XSS vulnerability in Pulse Connect Secure 9.1R8 allowed attackers to exploit in the URL used for Citrix ICA...

CVE-2020-8219

Pulse Connect Secure (PCS) and Pulse Policy Secure versions prior to 9.1R8 are affected by CVE-2020-8219 due to an insufficient permission check that allows an attacker to change the password of a full administrator. Impact is limited to unauthorized password change of admin accounts; no exploit ...

CVE-2020-8204

CVE-2020-8204 is an XSS vulnerability affecting Pulse Connect Secure (

CVE-2020-8220

A denial of service vulnerability exists in Pulse Connect Secure 9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can cause DOS...

CVE-2020-8220

Pulse Connect Secure prior to 9.1R8 is affected by CVE-2020-8220: an authenticated attacker can use the administrator web interface to perform command injection, causing a denial of service. The Red Hat/IVANTI/Nessus entries confirm the issue and point to upgrading to 9.1R8 as the remediation."

CVE-2020-8216

CVE-2020-8216 describes an information-disclosure vulnerability in Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) prior to version 9.1R8, where an authenticated end-user can reveal meeting details if they know the Meeting ID. Public sources in the provided documents confirm the affected...

CVE-2020-8219

An insufficient permission check vulnerability exists in Pulse Connect Secure 9.1R8 that allows an attacker to change the password of a full administrator...

CVE-2020-8217

Pulse Connect Secure versions prior to 9.1R8 are affected by a cross-site scripting (XSS) vulnerability in the URL used for Citrix ICA. The root cause is insufficient validation/cleaning of client data in the web application, allowing attacker-controlled input to execute client-side code. Impact ...

CVE-2020-8222

A path traversal vulnerability exists in Pulse Connect Secure 9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting...

CVE-2020-8206

CVE-2020-8206 affects Pulse Connect Secure and Pulse Policy Secure versions prior to 9.1RB, enabling an attacker who has a user’s primary credentials to bypass Google TOTP authentication. Multiple connected sources confirm the same core issue: improper authentication that directly bypasses TOTP. ...

CVE-2020-8218

A code injection vulnerability exists in Pulse Connect Secure 9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface...

CVE-2020-8218

A code injection vulnerability exists in Pulse Connect Secure 9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface...

CVE-2020-8218

Pulse Connect Secure

CVE-2020-8222

CVE-2020-8222 describes a path-traversal vulnerability in Pulse Connect Secure versions older than 9.1R8. An authenticated attacker, using the administrator web interface (via Meeting), can read arbitrary files due to the underlying file-reading weakness. Connected sources (Red Hat advisory, Ness...

CVE-2020-8204

A cross site scripting XSS vulnerability exists in Pulse Connect Secure 9.1R5 on the PSAL Page...

Pulse Secure Pulse Connect Secure and Pulse Policy Secure Information Disclosure Vulnerabilities

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse and Pulse Policy Secure are both products of Pulse Secure, Inc.Pulse Connect Secure is an SSL VPN solution. Pulse Connect Secure is an SSL VPN solution. Pulse Policy Secure is a network access control solution. A...

CVE-2020-8206: Improper Authentication

An improper authentication vulnerability exists in Pulse Connect Secure 9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP...

CVE-2020-8222: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in Pulse Connect Secure 9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting...

PT-2020-20025 · Google +1 · Google Totp +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1RB Description: An issue exists where improper authentication allows an attacker with a user's primary credentials to bypass Google TOTP authentication. Recommendations: For versions prior to 9.1RB,...