Vulnerabilities fixed in Pulse Secure products for Windows, Linux and Mac

Vulnerabilities have been fixed in Pulse Secure products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS Denial-of-Service DoS. Circumvention of security...

Pulse Secure Pulse Desktop Client Information Disclosure Vulnerability

Pulse Secure Pulse Desktop Client is a suite of client software from Pulse Secure USA for accessing end devices on Juniper Pulse Secure gateways. An information disclosure vulnerability exists in Pulse Secure Desktop Client Windows platform versions 9.0R5 and earlier, 9.1R4 and earlier. The...

PT-2020-20057

Name of the Vulnerable Software and Affected Versions Pulse Secure Desktop Client Linux versions prior to 9.1R9 Description A local attacker could potentially exploit a vulnerability to escalate privileges. Recommendations For versions prior to 9.1R9, update to version 9.1R9 or later to resolve t...

PT-2020-20051

Name of the Vulnerable Software and Affected Versions Pulse Secure Desktop Client versions prior to 9.1R9 Description A vulnerability allows a restricted user on an endpoint machine to use system-level privileges if the Embedded Browser is configured with Credential Provider. This issue only...

PT-2020-20062

Name of the Vulnerable Software and Affected Versions Pulse Secure Desktop Client versions prior to 9.1R9 Description A vulnerability exists that allows for Remote Code Execution RCE if users connect to a malicious server. This issue is specific to the Windows Pulse Desktop Client. Recommendation...

PT-2020-20059

Name of the Vulnerable Software and Affected Versions Pulse Secure Desktop Client Linux versions prior to 9.1R9 Description A local attacker could potentially exploit this issue to escalate privileges. Recommendations For versions prior to 9.1R9, update to version 9.1R9 or later to resolve the...

PT-2020-20058

Name of the Vulnerable Software and Affected Versions Pulse Secure Desktop Client Linux versions prior to 9.1R9 Description A local attacker could perform a buffer overflow due to a vulnerability in the Pulse Secure Desktop Client. Recommendations For versions prior to 9.1R9, update to version...

CVE-2020-8241: Undefined Security Weakness

A vulnerability in the Pulse Secure Desktop Client 9.1R9 could allow the attacker to perform a MITM Attack if end users are convinced to connect to a malicious server...

CVE-2020-8239: Undefined Security Weakness

A vulnerability in the Pulse Secure Desktop Client 9.1R9 is vulnerable to the client registry privilege escalation attack. This fix also requires Server Side Upgrade due to Standalone Host Checker Client Windows and Windows PDC...

CVE-2020-8254: Relative Path Traversal

A vulnerability in the Pulse Secure Desktop Client 9.1R9 has Remote Code Execution RCE if users can be convinced to connect to a malicious server. This vulnerability only affects Windows PDC.To improve the security of connections between Pulse clients and Pulse Connect Secure, see below...

CVE-2020-8240: Undefined Security Weakness

A vulnerability in the Pulse Secure Desktop Client 9.1R9 allows a restricted user on an endpoint machine can use system-level privileges if the Embedded Browser is configured with Credential Provider. This vulnerability only affects Windows PDC if the Embedded Browser is configured with the...

CVE-2020-8250: Undefined Security Weakness

A vulnerability in the Pulse Secure Desktop Client Linux 9.1R9 could allow local attackers to escalate privilege...

CVE-2020-8249: Buffer Copy without Checking Size of Input

A vulnerability in the Pulse Secure Desktop Client Linux 9.1R9 could allow local attackers to perform buffer overflow...

CVE-2020-8248: Undefined Security Weakness

A vulnerability in the Pulse Secure Desktop Client Linux 9.1R9 could allow local attackers to escalate privilege...

CVE-2020-8956

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled...

Code injection

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled...

CVE-2020-8956

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled...

CVE-2020-8956

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled...

CVE-2020-8956

Summary (CVE-2020-8956): Pulse Secure Desktop Client on Windows (9.0Rx before 9.0R5 and 9.1Rx before 9.1R4; affected root cause) exposes saved passwords when the client’s Save Settings option is enabled. The issue is an information-disclosure vulnerability affecting Windows PDC. Fixed versions in...

PT-2020-20052 · Pulse Secure · Pulse Secure Desktop Client

Name of the Vulnerable Software and Affected Versions: Pulse Secure Desktop Client versions prior to 9.1R9 Description: A vulnerability could allow an attacker to perform a Man-in-the-Middle MITM attack if end users are convinced to connect to a malicious server. Recommendations: For versions pri...