Design/Logic Flaw

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure 9.1R9 is vulnerable to arbitrary cookie injection...

CVE-2020-8262

CVE-2020-8262 affects Pulse Connect Secure and Pulse Policy Secure if running versions earlier than 9.1R9. The vulnerability allows Cross-Site Scripting (XSS) and Open Redirection via the authenticated user web interface. Public references in Red Hat advisory and Nessus entries confirm the issue ...

CVE-2020-8262

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting XSS and Open Redirection for authenticated user web interface...

CVE-2020-8261

CVE-2020-8261: A vulnerability in Pulse Connect Secure / Pulse Policy Secure versions prior to 9.1R9 allows arbitrary cookie injection via the admin/web interfaces. Root cause details are not elaborated in the provided sources, but multiple advisories corroborate the issue. Affected products are ...

CVE-2020-8261

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure 9.1R9 is vulnerable to arbitrary cookie injection...

PT-2020-20069 · Pulse · Pulse Connect Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure / Pulse Policy Secure versions prior to 9.1R9 Description: A vulnerability could allow attackers to conduct Cross-Site Scripting XSS and Open Redirection for authenticated user web interface. Recommendations: For versions...

PT-2020-20068 · Pulse · Pulse Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure / Pulse Policy Secure versions prior to 9.1R9 Description: A vulnerability in the Pulse Connect Secure / Pulse Policy Secure allows for arbitrary cookie injection. Recommendations: For Pulse Connect Secure / Pulse Policy...

Pulse Secure Pulse Connect Secure and Pulse Policy Secure Cross-Site Request Forgery Vulnerabilities

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse and Pulse Policy Secure are both products of Pulse Secure, Inc.Pulse Connect Secure is an SSL VPN solution. Pulse Connect Secure is an SSL VPN solution. Pulse Policy Secure is a network access control solution. A...

CVE-2020-15352

An XML external entity XXE vulnerability in Pulse Connect Secure PCS before 9.1R9 and Pulse Policy Secure PPS before 9.1R9 allows remote authenticated admins to conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

CVE-2020-15352

An XML external entity XXE vulnerability in Pulse Connect Secure PCS before 9.1R9 and Pulse Policy Secure PPS before 9.1R9 allows remote authenticated admins to conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

Server side request forgery (ssrf)

An XML external entity XXE vulnerability in Pulse Connect Secure PCS before 9.1R9 and Pulse Policy Secure PPS before 9.1R9 allows remote authenticated admins to conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

CVE-2020-15352

CVE-2020-15352 is an XXE-based SSRF vulnerability in Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) prior to 9.1R9. The issue arises from an XML External Entity in crafted XML requests that remote authenticated admins can abuse to reach server-side resources. Public sources in the conne...

CVE-2020-15352

An XML external entity XXE vulnerability in Pulse Connect Secure PCS before 9.1R9 and Pulse Policy Secure PPS before 9.1R9 allows remote authenticated admins to conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

PT-2020-14384 · Pulse · Pulse Connect Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R9 Pulse Policy Secure versions prior to 9.1R9 Description: The issue allows remote authenticated admins to conduct server-side request forgery attacks via a crafted DTD in an XML request. This is due...

Pulse Policy Secure < 9.1R8.2 (SA44588)

According to its self-reported version, the version of Pulse Policy Secure running on the remote host is prior to 9.1R8.2. It is, therefore, affected by the following vulnerabilities: - A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker t...

CVE-2020-8238

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure 9.1R8.2 could allow attackers to conduct Cross-Site Scripting XSS...

Cross site scripting

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure 9.1R8.2 could allow attackers to conduct Cross-Site Scripting XSS...

CVE-2020-8238

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure 9.1R8.2 could allow attackers to conduct Cross-Site Scripting XSS...

PT-2020-20049 · Pulse · Pulse Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure and Pulse Policy Secure versions prior to 9.1R8.2 Description: A vulnerability in the authenticated user web interface could allow attackers to conduct Cross-Site Scripting XSS. Recommendations: For Pulse Connect Secure a...

Pulse Policy Secure < 9.1R8 (SA44516)

According to its self-reported version, the version of Pulse Policy Secure running on the remote host is prior to 9.1R8. It is, therefore, affected by multiple vulnerabilities: - An attacker can bypass the Google TOTP, if the primary credentials are exposed to attacker CVE-2020-8206. - An...