Pulse Secure PSA5000 and PSA7000 安全漏洞

Pulse Secure PSA5000 and PSA7000 is a software application from Pulse Secure, Inc. It provides a VPN or NAC solution. A security vulnerability exists in the Pulse Secure PSA5000 and PSA7000 that allows an attacker to corrupt the BIOS firmware...

Imperva recognized as a ‘Leader’ in The Forrester Wave™: DDoS Mitigation Solutions, Q1 2021 Report

We are delighted to share that Imperva has been named a leader in The Forrester Wave: DDoS Mitigation Solutions, Q1 2021 report, a trusted source for technology buyers which helps security and risk professionals select the right vendor for their needs. You can download a copy of the report here...

Metasploit Wrap-Up

Struts2 Multi Eval OGNL RCE Our very own zeroSteiner added exploit/multi/http/struts2multievalognl, which exploits Struts2 evaluating OGNL expressions in HTML attributes multiple times CVE-2019-0230 and CVE-2020-17530. The CVE-2019-0230 OGNL chain for remote code execution requires a one-time cha...

Pulse Secure VPN Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Pulse Secure VPN gzip RCE', 'Description' = %q The Pulse Connect Secure appliance before 9.1R9 suffers from an uncontrolled gzip extraction...

Pulse Secure VPN Remote Code Execution Exploit

The Pulse Connect Secure appliance versions prior to 9.1R9 suffer from an uncontrolled gzip extraction vulnerability which allows an attacker to overwrite arbitrary files, resulting in remote code execution as root. Admin credentials are required for successful exploitation...

Pulse Secure Installer Service TOCTOU Privilege Escalation Vulnerability (SA44503)

The Pulse Secure Installer Service installed on the remote Windows system is affected by a TOCTOU time-of-check to time-of-use privilege escalation vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid144327; scriptversion"1.1";...

Download and Manage VCSP Licenses On The Pulse Portal

Purpose Accessing and managing the hosting rental Veeam Cloud & Service Provider licenses on the VCSP Pulse self-service portal. VCSP Pulse is an automated platform where the Service Providers can generate, edit, manage, and download rental licenses directly. The platform represents a collaborati...

VulnCheck KEV: CVE-2020-8218

A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface...

Windows Pulse Secure Connect Client Saved Password Extractor

This module extracts and decrypts saved Pulse Secure Connect Client passwords from the Windows Registry. This module can only access credentials created by the user that the Meterpreter session is running as. Note that this module cannot link the password to a username unless the Meterpreter...

Pulse Secure Desktop Client < 9.1R9 Multiple Vulnerabilities (SA44601)

The Pulse Secure Desktop Client installed on the remote Windows system is prior to 9.1R9. It is, therefore, affected by multiple vulnerabilities, including the following: - A vulnerability in the Pulse Secure Desktop Client 9.1R9 could allow the attacker to perform a MITM Attack if end users are...

Pulse Policy Secure < 9.1R9 (SA44601)

According to its self-reported version, the version of Pulse Policy Secure running on the remote host is prior to 9.1R9. It is, therefore, affected by the following vulnerabilities: - A vulnerability in the Pulse Connect Secure 9.1R9 admin web interface could allow an authenticated attacker to...

Pulse Connect Secure/Pulse Policy Secure Arbitrary Cookie Injection Vulnerability

Pulse Connect Secure is the mobile VPN that gives you secure access to enterprise applications and services in the data center or cloud from any device.Pulse Policy Secure is a suite of NAC and BYOD solutions. An arbitrary cookie injection vulnerability exists in Pulse Connect Secure/Pulse Policy...

Pulse Secure Pulse Connect Secure Arbitrary Code Execution Vulnerability

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure in the United States. An arbitrary code execution vulnerability exists in the management web interface of Pulse Connect Secure versions prior to 9.1R9. An...

Pulse Secure Desktop Client (Linux) Elevation of Privilege Vulnerability

Pulse Secure Linux Desktop Client is a suite of Linux-based client software from Pulse Secure, Inc. for accessing end devices on Juniper Pulse Secure gateways. An elevation of privilege vulnerability exists in Pulse Secure Pulse Secure Desktop Client Linux versions prior to 9.1R9, which can be...

Pulse Secure Pulse Connect Secure and Pulse Policy Secure Cross-Site Scripting Vulnerabilities

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse and Pulse Policy Secure are both products of Pulse Secure, Inc.Pulse Connect Secure is an SSL VPN solution. Pulse Connect Secure is an SSL VPN solution. Pulse Policy Secure is a network access control solution...

Pulse Secure Desktop Client Client Registry Elevation of Privilege Vulnerability

Pulse Secure Desktop Client is scalable, multi-service network client that supports integrated connectivity and secure location-aware network access. A client registry privilege escalation vulnerability exists in Pulse Secure Desktop Client Linux versions prior to 9.1R9, which originates in the...

Pulse Secure Desktop Client (Linux) Buffer Overflow Vulnerability

Pulse Secure Linux Desktop Client is a suite of Linux-based client software from Pulse Secure, Inc. for accessing end devices on Juniper Pulse Secure gateways. A buffer overflow vulnerability exists in Pulse Secure Desktop Client Linux versions prior to 9.1R9. A local attacker could exploit this...

Pulse Secure Desktop Client Remote Code Execution Vulnerability

Pulse Secure Desktop Client is scalable, multi-service network client that supports integrated connectivity and secure location-aware network access. A remote code execution vulnerability exists in Pulse Secure Desktop Client versions prior to 9.1R9. An attacker could exploit this vulnerability b...

Pulse Secure Linux Desktop Client Man-in-the-Middle Attack Vulnerability

Pulse Secure Linux Desktop Client is a suite of Linux-based client software from Pulse Secure, Inc. for accessing end devices on Juniper Pulse Secure gateways. A man-in-the-middle attack vulnerability exists in Pulse Secure Desktop Client Linux versions prior to 9.1R9. An attacker could exploit...

Pulse Secure Pulse Connect Secure Input Validation Error Vulnerability (CNVD-2020-60092)

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure in the United States. Pulse Connect Secure versions prior to 9.1R9 have an input validation error vulnerability that can be exploited by an attacker to execute an...