CVE-2018-6320

CVE-2018-6320 affects Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) where login.cgi improperly validates the http(s) Host header. Affected versions: PCS 8.1RX pre-8.1R12 and 8.3RX pre-8.3R2; PPS 5.2RX pre-5.2R9 and 5.4RX pre-5.4R2. The issue arises from trusting the Host header receive...

PT-2018-12466 · Pulse · Pulse Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions 8.1RX through 8.1R12 Pulse Connect Secure versions 8.3RX through 8.3R3 Pulse Policy Secure versions 5.2RX through 5.2R9 Pulse Policy Secure versions 5.4RX through 5.4R3 Description: The issue is related to an Ope...

PT-2018-17475 · Pulse · Pulse Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure PCS versions 8.1RX through 8.1R11 Pulse Connect Secure PCS versions 8.3RX through 8.3R1 Pulse Policy Secure PPS versions 5.2RX through 5.2R8 Pulse Policy Secure PPS versions 5.4RX through 5.4R1 Description: A vulnerabilit...

Pulse Policy Secure Multiple Vulnerabilities (SA43730)

According to its self-reported version, the version of Pulse Policy Secure running on the remote host is affected by multiple vulnerabilities. Refer to the vendor advisory for additional information. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid109920;...

Pulse Policy Secure Cross-Site Scripting Vulnerability (SA43018)

According to its self-reported version, the version of Pluse Policy Secure running on the remote host is affected by a cross-site scripting vulnerability in custompage.cgi. Refer to the vendor advisory for additional information. C Tenable Network Security, Inc. include"compat.inc"; if descriptio...

Pulse Connect Secure and Pulse Policy Secure Cross-Site Scripting Vulnerabilities

Pulse Connect Secure PCS and Pulse Policy Secure PPS are both products of Pulse Secure, Inc. of the U.S. Pulse Connect Secure is an SSL VPN solution. Pulse Policy Secure is a NAC and BYOD Pulse Connect Secure is an SSL VPN solution. A cross-site scripting vulnerability exists in the custompage.cg...

Pulse Connect Secure and Pulse Policy Secure Stack Buffer Overflow Vulnerability

Pulse Connect Secure PCS and Pulse Policy Secure PPS are both products of Pulse Secure Inc. of the U.S. Pulse Connect Secure is an SSL VPN solution. Pulse Policy Secure is a NAC and BYOD solution. Pulse Connect Secure is an SSL VPN solution, Pulse Policy Secure is a NAC and BYOD solution, and Web...

CVE-2018-5299

A stack-based Buffer Overflow Vulnerability exists in the web server in Pulse Secure Pulse Connect Secure PCS before 8.3R4 and Pulse Policy Secure PPS before 5.4R4, leading to memory corruption and possibly remote code execution...

Cross site scripting

A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure PCS before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure PPS before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL...

CVE-2017-17947

A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure PCS before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure PPS before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL...

CVE-2017-17947

A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure PCS before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure PPS before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL...

CVE-2017-17947

CVE-2017-17947 is a cross-site scripting vulnerability in Pulse Secure’s Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) affecting custompage.cgi. The issue arises from one unsanitized URL parameter, enabling injected script when the attacker is authenticated as an administrator; it does...

Ivanti Policy Secure Detection

Binary data pulsepolicysecuredetect.nbin...

Pulse Policy Secure Cross-Site Request Forgery (SA40793)

According to its self-reported version, the version of Pluse Policy Secure running on the remote host is affected by a cross-site request forgery vulnerability in diag.cgi. This vulnerability may allow remote attackers to hijack the authentication of administrators for requests to start tcpdump. ...

Pulse Connect Secure and Pulse Policy Secure Cross-Site Request Forgery Vulnerabilities

Pulse Connect Secure and Pulse Policy Secure are both products of Pulse Secure, Inc. Pulse Connect Secure is an SSL VPN solution. Pulse Policy Secure is a NAC and BYOD solution. A cross-site request forgery vulnerability exists in the diag.cgi file in Pulse Connect Secure and Pulse Policy Secure,...

Design/Logic Flaw

diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CS...

CVE-2017-11455

diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CS...

CVE-2017-11455

diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CS...

CVE-2017-11455

CVE-2017-11455 affects Pulse Connect Secure diag.cgi and Pulse Policy Secure diag.cgi, enabling remote attackers to hijack administrator authentication for requests to start tcpdump due to missing anti-CSRF tokens. Affected: Pulse Connect Secure versions 8.2R1–8.2R5 and 8.1R1–8.1R10; Pulse Policy...

CVE-2017-11455

diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CS...