JSA10471 - Out of Cycle Security Bulletin: Pulse Connect Secure (PCS) Network Connect Credential Provider Issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. There is an issue with Network Connect Credential Provider where local machine authentication can be bypassed on Windows 7 and Vista. If Network Connect Credential Provider is configur...

JSA10402 - Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) - Multiple Web-based CGI and Cross Site Scripting (XSS) vulnerabilities.

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. CGI and Cross Site Scripting vulnerabilities found and fixed through a combination of internal and external proactive security testing: - Internal path was displayed in some error...

JSA10554 - 2013-03: Security Bulletin: Pulse Connect Secure (PCS): Multiple cross site scripting issues

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Multiple cross site scripting issues have been found in the Pulse Connect Secure PCS product. The issue is the result of incorrect validation of user input sent to the web server. This...

JSA10489 - 2011-09 Security Bulletin: Ivanti Connect Secure (ICS) & Ivanti Policy Secure (IPS): Cross Site Scripting Issue During Sign-in

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Cross Site Scripting issue during sign in. The following software releases have a fix for this issue: PCS: 6.5R9; 7.0R5, 7.1R2 or higher. PPS: 4.1R2 or higher. We recommend upgrading yo...

JSA10496 - 2011-12 Security Bulletin: Pulse Connect Secure (PCS): Cross Site Scripting Issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been found during proactive security testing in the Pulse Connect Secure PCS product. The cause of this issue is due to incorrect validation of user...

JSA10398 - Security Vulnerability in Pulse Connect Secure Platforms) RADIUS authentication mechanism

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. This Security Advisory is an addendum to PSN 2008-05-007. Affected releases: 6.0R1; 6.0R2; 6.0R3; 6.0R3.1 6.1R1; 6.1R2; 6.1R3; 6.1R4, 6.1R5; 6.1R6 To download the latest software, plea...

JSA10487 - 2011-09 Security Bulletin: Pulse Connect Secure (PCS) & Pulse Policy Secure (PPS): OpenLDAP Issue

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. LDAPS based authentication and authorization require additional validation. The following software releases have a fix for this issue: PCS: 7.1R1 or higher. PPS: 4.1R1 or higher. We...

JSA10428 - 2010-03 Security Bulletin: Pulse Connect Secure (PCS)- Cross site scripting issue on end user edit bookmarks page

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Cross site scripting issue on the end user edit bookmarks page. This issue was found during external proactive security testing. This vulnerability only affects users that are...

JSA10488 - 2011-09 Security Bulletin: Pulse Connect Secure (PCS) & Pulse Policy Secure (PPS): Admin Interface Issue

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Custom Sign-In page upload requires additional validation. The following software releases have a fix for this issue: PCS: 6.5R9; 7.0R5, 7.1R2 or higher. PPS: 4.1R2 or higher. We...

JSA10414 - Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) - Security Bundle - Admin Issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Admin vulnerability found and fixed through a combination of internal and external proactive security testing: - When an admin uses certain sub-menus within the console, a timeout is...

JSA10490 - 2011-09 Security Bulletin: Pulse Connect Secure (PCS): Cross Site Scripting Issues

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Cross Site Scripting vulnerabilities found and fixed through a combination of internal and external proactive security testing: - Cross Site Scripting issue found in Secure Meeting web...

JSA10325 - CERT-CSA Option Vulnerability, Released 3/10/03

If you have configured CSA in "Enabled" mode for one or more groups, then it is possible for an authenticated user in one of those groups to access servers that are not listed in the "Application List". If you have configured CSA in "Enabled, and user can add applications" mode or configured in...

JSA10444 - 2010-06 Security Bulletin: Pulse Coennect Secure (PCS) and Pulse Policy Secure (PPS): Cross Site Scripting Issue during Signout

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Cross Site Scripting issue during sign out. This issue was found during external proactive security testing. To access the latest software, please visit: http://my.pulsesecure.net Puls...

JSA10326 - PCS 2.2 Cross-Scripting Alert, Released 10/23/02

There are two specific issues that have been identified that could be exploited to generate a cross-site scripting attack. Please note that in all cases, the possibility that these issues can be exploited to compromise the system or the network is very unlikely but is possible. All customers...

JSA10361 - Pulse Connect Secure (PCS) ActiveX client vulnerability

This isn't an active SA and this edit is part of an article maintenance project. Ivanti 04/03/2024. A malicious web site could trick an PCS users to click a link exploiting a vulnerability present in the ActiveX component of the PCS client software When using Internet Explorer to access the PCS...

JSA10413 - Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) products - Security Bundle - Authentication & Authorization Issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Authentication & Authorization vulnerability found and fixed through a combination of internal and external proactive security testing: - When using NTLMv1 or NTLMv2 authentication...

SA40212 - [Pulse Secure] Sign in page disclosure issue (CVE-2016-4792)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An issue was found on the Pulse Connect Secure device that could allow disclosure of sign in pages. The security of the pages is not affected by this issue. This issue was assigned:...

SA44588 - 2020-09: Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.1R8.2

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. This advisory provides information about multiple vulnerabilities resolved in Pulse Connect Secure 9.1R8.2, Pulse Policy Secure 9.1R8.2 Refer to KB43892 - What releases will Pulse Secur...

CVE-2023-25160 IDOR Vulnerability in Nextcloud Mail

Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for...

GHSA-P6XQ-9H8R-V544 CodenameOne Pending Intent vulnerability

A vulnerability was found in CodenameOne 7.0.70. The manipulation leads to use of implicit intent for sensitive communication. It is possible to launch the attack remotely. Upgrading to version 7.0.71 is able to address this issue. The name of the patch is dad49c9ef26a598619fc48d2697151a02987d478...