JSA10488 - 2011-09 Security Bulletin: Pulse Connect Secure (PCS) & Pulse Policy Secure (PPS): Admin Interface Issue

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Custom Sign-In page upload requires additional validation. The following software releases have a fix for this issue: PCS: 6.5R9; 7.0R5, 7.1R2 or higher. PPS: 4.1R2 or higher. We...

JSA10379 - Security Vulnerability in Pulse Connect Secue (PCS) RADIUS authentication mechanism

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. If RADIUSis being used as the authentication mechanism on PCS running an affected release of the OS, then in a specific scenario, an unauthenticated user may be able to get past the...

JSA10490 - 2011-09 Security Bulletin: Pulse Connect Secure (PCS): Cross Site Scripting Issues

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Cross Site Scripting vulnerabilities found and fixed through a combination of internal and external proactive security testing: - Cross Site Scripting issue found in Secure Meeting web...

JSA10459 - Pulse Connect Secure (PCS) meeting_testjava.cgi XSS Vulnerability (ZDI-10-231)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The CGI script /dana-na/meeting/meetingtestjava.cgi is vulnerable to a cross-site scripting XSS attack. The script tests the presence of a JVM client by loading an applet. An attacker...

JSA10444 - 2010-06 Security Bulletin: Pulse Coennect Secure (PCS) and Pulse Policy Secure (PPS): Cross Site Scripting Issue during Signout

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Cross Site Scripting issue during sign out. This issue was found during external proactive security testing. To access the latest software, please visit: http://my.pulsesecure.net Puls...

SA40013 - TLS/SSL Renegotiation Vulnerability Pulse Connect Secure (PCS) (CVE-2009-3555) (Pulse Secure PSN-2009-11-573

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The industry-wide TLS/SSL renegotiation issue CVE-2009-3555 has been found in the Pulse Connect Secure PCS device. This issue has been reported as a man in the middle MITM attack by ma...

JSA10617 - 2014-03 Security Bulletin: Pulse Connect Secure: Cross site scripting issue (CVE-2014-2291)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been found in the Pulse Connect Secure product. The problem is a result of incorrect user input validation on the web server. The issue exists within a...

JSA10401 - Pulse Connect Secure (PCS) product - PCS Security Bundle - Internal System Function

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Internal System Function vulnerabilities found and fixed through a combination of internal and external proactive security testing: Issue with special characters used in a parameter in...

JSA10396 - Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) - OpenSSL - Incorrect checks for malformed signatures on DSA and ECDSA keys used with SSL/TLS on backend servers. CVE-2008-5077.

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Several functions inside OpenSSL incorrectly checked the result after calling the EVPVerifyFinal function, allowing a malformed signature to be treated as a good signature rather than ...

JSA10375 - Pulse Connect Secure (PCS): Cross-Site Scripting Vulnerability

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Older software versions of Pulse Connect Secure are prone to a cross-site scripting vulnerability. An attacker may leverage this issue to execute an arbitrary script. This issue is...

SA40006 - Details on fixes for SSL/TLS MITM vulnerability (CVE-2014-0224)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The following products and versions are vulnerable to the OpenSSL vulnerability CVE-2014-0224 The vulnerability exists when both the client AND the server are vulnerable. Server-side:...

SA40002 - [Pulse Secure] June 11th 2015 OpenSSL Security Advisory

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. On June 11th, 2015 the OpenSSL project announced a group of new security advisories. These issues may affect Pulse Secure products. The OpenSSL advisory can be found at the following...

SA40015 - OpenSSL security advisory for January 8th, 2015 (including SSL "FREAK" issue)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. On January 8th 2015, the OpenSSL project released a security advisory. This advisory included eight 8 new CVEs. This article will describe the vulnerability and fix status for the Puls...

JSA10645 - 2014-09 Security Bulletin: Pulse Connect Secure (PSC) and Pulse Policy Secure (PPS): Cross site scripting issue (CVE-2014-3820)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been found in the Pulse Connect Secure and Pulse Policy Secure PCS/PPS products. The problem is a result of incorrect user input validation on the PCS/P...

SA40053 - 2015-09: Security Advisory: Secure Meeting (Pulse Collaboration) information disclosure vulnerability (CVE-2015-7322)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An information disclosure issue has been discovered in Secure Meeting Pulse Collaboration. This issue could allow an attacker to enumerate currently in progress meetings on the device...

SA40793 - CSRF vulnerability in Pulse Connect Secure / Pulse Policy Secure (CVE-2017-11455)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A vulnerability in diag.cgi may allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CSRF tokens. PSIRT is no...

SA40771 - 2017-07 Security Bulletin: Pulse Connect Secure (PCS) / Pulse Policy Secure (PPS): Cross Site Scripting Issue

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Multiple cross site scripting issues has been found in the Pulse Connect Secure / Pulse Policy Secure device. The cause of this issue is due to incorrect validation of user input sent t...

SA43018 - 2018-01 Out-Of-Cycle Advisory: Pulse Connect Secure (PCS) / Pulse Policy Secure (PPS): Cross Site Scripting Issue

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue with custompage.cgi has been found in the Pulse Connect Secure / Pulse Policy Secure device. The cause is due to one of the URL parameters not sanitized. Th...

SA43604 - 2018-01 Out-of-Cycle Advisory: Stack buffer overflow Vulnerability (CVE-2018-5299)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A buffer overflow vulnerability has been found in the web server that could allow a remote attacker to cause memory corruption and possibly execute arbitrary code via a crafted web...

SA44114 - 2019-04: Out-of-Cycle Advisory: Pulse Desktop Client and Network Connect improper handling of session cookies (CVE-2019-11213)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Under certain conditions, the Pulse Desktop Client and Network Connect could allow an attacker to access session tokens to replay and spoof sessions, and as a result, gain unauthorized...