CVE-2022-21826

Pulse Connect Secure (Pulse Secure) versions 9.115 and below are affected by a client-side HTTP request smuggling vulnerability. When handling a POST request, the application may ignore the Content-Length header and keep the POST body on the TCP/TLS socket, causing the body to prefix the next HTT...

CVE-2022-21826: Inconsistent Interpretation of HTTP Requests

Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down...

PT-2022-15159 · Pulse Secure · Pulse Secure

Name of the Vulnerable Software and Affected Versions: Pulse Secure versions 9.115 and below Description: The issue allows for client-side HTTP request smuggling. When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS...

CVE-2021-44720

In Ivanti Pulse Secure Pulse Connect Secure PCS before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance Push Configuration Targets Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role...

CVE-2021-44720

In Ivanti Pulse Secure Pulse Connect Secure PCS before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance Push Configuration Targets Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role...

CVE-2021-44720

In Ivanti Pulse Secure Pulse Connect Secure PCS before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance Push Configuration Targets Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role...

Design/Logic Flaw

In Ivanti Pulse Secure Pulse Connect Secure PCS before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance Push Configuration Targets Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role...

CVE-2021-44720

In Ivanti Pulse Secure Pulse Connect Secure PCS before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance Push Configuration Targets Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role...

CVE-2021-44720

Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12 stores administrator passwords in the HTML source of the Maintenance > Push Configuration > Targets > Target Name screen (targets.cgi). This enables a read-only administrative user to escalate to a read-write administrative rol...

PT-2022-12211 · Ivanti · Ivanti Pulse Secure Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Pulse Secure Pulse Connect Secure PCS versions prior to 9.1R12 Description: The administrator password is stored in the HTML source code of the "Maintenance Push Configuration Targets Target Name" targets.cgi screen, allowing a read-on...

CVE-2021-44720: Use of Hard-coded Credentials

In Ivanti Pulse Secure Pulse Connect Secure PCS before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance Push Configuration Targets Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role...

Vortex - VPN Overall Reconnaissance, Testing, Enumeration And eXploitation Toolkit

VPN Overall Reconnaissance, Testing, Enumeration and Exploitation Toolkit Overview A very simple Python framework, inspired by SprayingToolkit, that tries to automate most of the process required to detect, enumerate and attack common O365 and VPN endpoints like Cisco, Citrix, Fortinet, Pulse,...

FBI, NSA and CISA Warns of Russian Hackers Targeting Critical Infrastructure

Amid renewed tensions between the U.S. and Russia over Ukraine and Kazakhstan, American cybersecurity and intelligence agencies on Tuesday released a joint advisory on how to detect, respond to, and mitigate cyberattacks orchestrated by Russian state-sponsored actors. To that end, the Cybersecuri...

FBI issues flash alert after APT groups exploited VPN flaws

By Waqas With this; FatPipe joins the list of VPN providers that have faced a similar situation in the past, including Fortinet, Cisco, Pulse Secure, and Citrix. This is a post from HackRead.com Read the original post: FBI issues flash alert after APT groups exploited VPN flaws...

Exploit for Improper Authentication in Ivanti Connect_Secure

CVE-2021-22893 Proof-of-Concept PoC scrip...

Exploit for Improper Authentication in Ivanti Connect_Secure

CVE-2021-22893 Proof-of-Concept PoC scrip...

Exploit for Improper Authentication in Ivanti Connect_Secure

CVE-2021-22893 Proof-of-Concept PoC scrip...

Exploit for Improper Authentication in Ivanti Connect_Secure

CVE-2021-22893 Proof-of-Concept PoC scrip...

Exploit for Improper Authentication in Ivanti Connect_Secure

CVE-2021-22893 Proof-of-Concept PoC scrip...

CISA Releases Five Pulse Secure-Related MARs

As part of CISA’s ongoing response to Pulse Secure compromises, CISA has analyzed five malware samples related to exploited Pulse Secure devices. CISA encourages users and administrators to review the following five malware analysis reports MARs for threat actor tactics, techniques, and procedure...