Command injection

A denial of service vulnerability exists in Pulse Connect Secure 9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can cause DOS...

Path traversal

A path traversal vulnerability exists in Pulse Connect Secure 9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface...

Information disclosure

An information disclosure vulnerability in meeting of Pulse Connect Secure 9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID...

Code injection

A code injection vulnerability exists in Pulse Connect Secure 9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface...

Cross site scripting

A cross site scripting XSS vulnerability exists in Pulse Connect Secure 9.1R5 on the PSAL Page...

CVE-2020-8219

An insufficient permission check vulnerability exists in Pulse Connect Secure 9.1R8 that allows an attacker to change the password of a full administrator...

CVE-2020-8221

A path traversal vulnerability exists in Pulse Connect Secure 9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface...

Cross site scripting

A cross site scripting XSS vulnerability in Pulse Connect Secure 9.1R8 allowed attackers to exploit in the URL used for Citrix ICA...

Design/Logic Flaw

An insufficient permission check vulnerability exists in Pulse Connect Secure 9.1R8 that allows an attacker to change the password of a full administrator...

CVE-2020-8206

An improper authentication vulnerability exists in Pulse Connect Secure 9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP...

CVE-2020-8222

A path traversal vulnerability exists in Pulse Connect Secure 9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting...

CVE-2020-8219

An insufficient permission check vulnerability exists in Pulse Connect Secure 9.1R8 that allows an attacker to change the password of a full administrator...

CVE-2020-8216

An information disclosure vulnerability in meeting of Pulse Connect Secure 9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID...

CVE-2020-8218

A code injection vulnerability exists in Pulse Connect Secure 9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface...

CVE-2020-8222

CVE-2020-8222 describes a path-traversal vulnerability in Pulse Connect Secure versions older than 9.1R8. An authenticated attacker, using the administrator web interface (via Meeting), can read arbitrary files due to the underlying file-reading weakness. Connected sources (Red Hat advisory, Ness...

CVE-2020-8216

CVE-2020-8216 describes an information-disclosure vulnerability in Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) prior to version 9.1R8, where an authenticated end-user can reveal meeting details if they know the Meeting ID. Public sources in the provided documents confirm the affected...

CVE-2020-8217

Pulse Connect Secure versions prior to 9.1R8 are affected by a cross-site scripting (XSS) vulnerability in the URL used for Citrix ICA. The root cause is insufficient validation/cleaning of client data in the web application, allowing attacker-controlled input to execute client-side code. Impact ...

CVE-2020-8219

Pulse Connect Secure (PCS) and Pulse Policy Secure versions prior to 9.1R8 are affected by CVE-2020-8219 due to an insufficient permission check that allows an attacker to change the password of a full administrator. Impact is limited to unauthorized password change of admin accounts; no exploit ...

CVE-2020-8220

Pulse Connect Secure prior to 9.1R8 is affected by CVE-2020-8220: an authenticated attacker can use the administrator web interface to perform command injection, causing a denial of service. The Red Hat/IVANTI/Nessus entries confirm the issue and point to upgrading to 9.1R8 as the remediation."

CVE-2020-8221

CVE-2020-8221 describes a path traversal weakness in Pulse Connect Secure prior to 9.1R8 that allows an authenticated attacker to read arbitrary files via the administrator web interface. The issue is tied to the Pulse Connect Secure/Policy Secure family (PCS/PPS) with the