The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure, related to the implementation or modification of arguments, allows a perpetrator to execute arbitrary code.

The vulnerability of Ivanti Connect Secure formerly Pulse Connect Secure and Ivanti Policy Secure lies in the exploitation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of Ivanti Connect Secure and Ivanti Policy Secure, which are network access control tools, stems from the failure to take measures to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary code.

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary co...

The vulnerability of the network control tools Ivanti Connect Secure (previously Pulse Connect Secure) and Ivanti Policy Secure access, related to incorrect processing of input data, allows a perpetrator to execute arbitrary code.

The vulnerability of the Ivanti Connect Secure previously Pulse Connect Secure and Ivanti Policy Secure access controls lies in the improper processing of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted request...

Pulse Connect Secure < 9.1R18.7 / < 22.7R2.1 Multiple Vulnerabilities (000096001)

The version of Pulse Connect Secure installed on the remote host is prior to 9.1R18.7 or 22.7R2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 000096001 advisory. - Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy...

Pulse Connect Secure < 22.7R2.1 Multiple Vulnerabilities (000096001)

The version of Pulse Connect Secure installed on the remote host is prior to 22.7R2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 000096001 advisory. - Argument injection in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version...

Pulse Connect Secure < 22.6R2.0 (000096001)

The version of Pulse Connect Secure installed on the remote host is prior to 22.6R2.0. It is, therefore, affected by a vulnerability as referenced in the 000096001 advisory. - Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 and Ivanti Policy Secure before version 22.6R1...

Pulse Connect Secure < 22.7R2.3 Multiple Vulnerabilities (000096001)

The version of Pulse Connect Secure installed on the remote host is prior to 22.7R2.3. It is, therefore, affected by multiple vulnerabilities as referenced in the 000096001 advisory. - An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker ...

Ivanti Connect Secure Out-of-Bounds Read Vulnerability

Ivanti Connect Secure is an enterprise-grade SSL VPN remote access solution for securely connecting to corporate resources over an encrypted channel, with support for a zero-trust architecture and multiple deployment options. Ivanti Connect Secure suffers from an out-of-bounds read vulnerability...

Ivanti Connect Secure Buffer Overflow Vulnerability

Ivanti Connect Secure is an enterprise-grade SSL VPN remote access solution for securely connecting to corporate resources over an encrypted channel, with support for a zero-trust architecture and multiple deployment options. Ivanti Connect Secure suffers from a buffer overflow vulnerability that...

Ivanti Connect Secure and Ivanti Policy Secure Multiple Vulnerabilities

RISK EVALUATION Ivanti Connect Secure and Ivanti Policy Secure contain multiple vulnerabilities that allow a remote, authenticated attacker to execute arbitrary code. All of the vulnerabilities except for CVE-2024-39709 require the attacker to be authenticated with administrative privileges to...

Vulnerabilities fixed in Ivanti Connect Secure and Policy Secure

Ivanti has fixed vulnerabilities in Connect Secure and Policy Secure. A malicious party could exploit the vulnerabilities to launch attacks that could result in the following categories of damage: Denial-of-Service DoS Cross-Site Scripting XSS. Increased user privileges Remote code execution User...

CVE-2024-39710

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39711

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39712

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39711

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39712

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39710

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-37400

An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service...

CVE-2024-38649

An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1Not Applicable to 9.1Rx allows a remote unauthenticated attacker to cause a denial of service...

CVE-2024-39709

Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1 Not Applicable to 9.1Rx allow a local authenticated attacker to escalate their privileges...