Privilege escalation

The Pulse Secure Desktop macOS 5.3RX before 5.3R5 and 9.0R1 has a Privilege Escalation Vulnerability...

Privilege escalation

In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege Escalation Vulnerability with Dynamic Certificate Trust...

Input validation

A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure PCS 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an https Host header received from the browser is trusted without validation...

CVE-2018-15749

The Pulse Secure Desktop macOS 5.3RX before 5.3R5 and 9.0R1 has a Format String Vulnerability...

Open redirect

download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability...

CVE-2018-14366

download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability...

CVE-2018-15726

The Pulse Secure Desktop macOS 5.3RX before 5.3R5 and 9.0R1 has a Privilege Escalation Vulnerability...

CVE-2018-15865

CVE-2018-15865 affects Pulse Secure Desktop for macOS . The Ivanti bulletin consolidates multiple Pulse products and lists the macOS client as susceptible to a local privilege escalation through the "/tmp" folder. Affected versions are Pulse Secure Desktop macOS in the 5.1rX branch before 5.1R11 ...

CVE-2018-15865

The Pulse Secure Desktop macOS has a Privilege Escalation Vulnerability...

CVE-2018-15749

The Pulse Secure Desktop macOS 5.3RX before 5.3R5 and 9.0R1 has a Format String Vulnerability...

CVE-2018-15726

The connected IVANTI advisory specifies CVE-2018-15726 as affecting Pulse Secure Desktop for macOS, with a metacharacter injection vulnerability in 9.0R1 and 5.3RX before 5.3R5 that can lead to local privilege escalation. Remediation shown in the advisory includes fixes in Pulse Secure Desktop 9....

CVE-2018-6320

CVE-2018-6320 affects Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) where login.cgi improperly validates the http(s) Host header. Affected versions: PCS 8.1RX pre-8.1R12 and 8.3RX pre-8.3R2; PPS 5.2RX pre-5.2R9 and 5.4RX pre-5.4R2. The issue arises from trusting the Host header receive...

CVE-2018-6320

A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure PCS 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an https Host header received from the browser is trusted without validation...

CVE-2018-15749

Pulse Secure Desktop for macOS is affected by CVE-2018-15749. The issue is a format string vulnerability in macOS clients versions 5.3RX prior to 5.3R5 and 9.0R1, enabling a local attacker to trigger information display (information that should not be accessible). Exploitation is local, and the i...

CVE-2018-16261

Pulse Secure Desktop Client 9.0R1 and 5.3RX before 5.3R5 contains a local privilege escalation due to improper certificate handling when the credential provider feature is enabled. The vulnerability allows a local user to gain elevated privileges on affected systems. Exploitation is local and rel...

CVE-2018-16261

In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege Escalation Vulnerability with Dynamic Certificate Trust...

CVE-2018-14366

CVE-2018-14366 is an Open Redirect vulnerability affecting Pulse Connect Secure and Pulse Policy Secure. The issue resides in download.cgi and can be triggered on Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4, and on Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX befo...

CVE-2018-14366

download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability...

Design/Logic Flaw

Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service memory consumption and memory errors via a crafted XML document...

CVE-2018-9849

Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service memory consumption and memory errors via a crafted XML document...