CVE-2023-41719

CVE-2023-41719 affects Ivanti Connect Secure prior to 22.6R2 (both 9.1Rx and 22x branches). An attacker impersonating an administrator can craft a specific web request that leads to remote code execution. Remediation per patch guidance: upgrade to fixed versions such as 22.6R2.2, 22.5R2.3, 22.4R1...

CVE-2023-41719

A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a specific web request which may lead to remote code execution...

Ivanti Connect Secure Security Vulnerability

Ivanti Connect Secure is a secure remote network connection tool from Ivanti USA. A security vulnerability exists in versions prior to Ivanti Connect Secure 22.6R2, which stems from an attacker being able to escalate his privileges by exploiting vulnerable installed applications...

Ivanti Connect Secure Security Vulnerability

Ivanti Connect Secure is a secure remote network connection tool from Ivanti USA. A security vulnerability exists in versions prior to Ivanti Connect Secure 22.6R2, which stems from the possibility that an attacker posing as an administrator could craft a specific Web request that could lead to...

PT-2023-28060 · Ivanti · Ivanti Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.6R2 Description: A vulnerability exists where an attacker impersonating an administrator may craft a specific web request which may lead to remote code execution. Recommendations: For versions prior ...

PT-2023-28062 · Ivanti · Ivanti Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.6R2 Description: A vulnerability exists where an attacker with a foothold on an Ivanti Connect Secure appliance can escalate their privileges by exploiting a vulnerable installed application, allowin...

Security patch release - Ivanti Connect Secure 22.6R2 and 22.6R2.1

Resolutions for Ivanti Connect Secure Security Issues: As part of Ivanti's commitment to continuous security hardening, Ivanti has released a security update for Ivanti Connect Secure. This update resolves important vulnerabilities. To our knowledge, none of the CVEs identified in this review hav...

PT-2023-29834 · Ivanti · Ivanti Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Wpmet Wp Ultimate Review plugin versions 2.2.4 and earlier ICS versions 9.x and 22.x IPS affected versions not specified Ivanti Connect Secure and Policy Secure gateways affected versions not specified Description: The issue concerns an...

The vulnerability in the web administration interface of the Pulse Connect Secure VPN server for corporate networks allows a perpetrator to execute arbitrary code.

The vulnerability in the web-based administration interface of the Pulse Connect Secure VPN server for corporate networks is related to insufficient cleaning of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted request...

SUSE CVE-2017-11455

diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CS...

The vulnerability in the web interface of the Pulse Connect Secure VPN server for corporate networks allows a perpetrator to execute arbitrary code.

The vulnerability in the web interface of the administrator’s VPN server for corporate networks, Pulse Connect Secure, is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

JSA10571 - 2013-06 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Internal and test Certificate Authority Root Servers unintentionally added to Trusted CA list

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The Pulse Connect Secure PCS and Pulse Policy Secure PPS software use Trusted Server CA Root Certificate list in order to verify the validity of certificates. Internal and development...

JSA10502 - 2012-03 Security Bulletin: Pulse Connect Secure (PCS): Cross Site Scripting Issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been found in the Pulse Connect Secure device. The cause of this issue is due to incorrect validation of user input sent to the web server. This issue...

JSA10591 - 2013-09 Security Bulletin: Pulse Connect Secure and Pulse Policy Secure: Multiple OpenSSL vulnerabilities

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Multiple OpenSSL vulnerabilities have been found in the PCS and PPS devices. CVE| Issue| CVE Description| CVSS Score ---|---|---|--- CVE-2012-2131| OpenSSL buffer overflow issue| Multip...

JSA10453 - 2010-09 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Local Client Logging Issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. User session information is saved to the local system even when client logging is disabled. Pulse Secure would like to acknowledge Espion Ltd. Dublin, Ireland for bringing this to our...

JSA10590 - 2013-09 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Crafted packet can cause denial of service

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A denial of service DoS issue has been found on the Pulse Connect Secure PCS and Pulse Policy Secure PPS devices. This issue can cause the system to hang ultimately requiring a restart ...

JSA10471 - Out of Cycle Security Bulletin: Pulse Connect Secure (PCS) Network Connect Credential Provider Issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. There is an issue with Network Connect Credential Provider where local machine authentication can be bypassed on Windows 7 and Vista. If Network Connect Credential Provider is configur...

JSA10628 - 2014-06 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Weak SSL cipher allowed unexpectedly when higher level cipher group is configured (CVE-2014-3812)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A weak cipher issue has been discovered on the Pulse Connect Secure PCS and Pulse Policy Secure PPS devices. When configuring the device to use a higher level cipher setting, a lower...

JSA10648 - 2014-09 Out of Cycle Security Bulletin: Multiple Products: Shell Command Injection Vulnerability in Bash

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Bash or the Bourne again shell has vulnerabilities in the way it handles environment variables when it is invoked. Under some scenarios, network based remote attackers can inject shell...

JSA10536 - 2012-09 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Specifically crafted https packet may cause denial of service

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A denial of service issue was found in the Pulse Connect Secure PCS and Pulse Policy Secure PPS system software. A specific malformed https packet can potentially cause a system service...