Design/Logic Flaw

A vulnerability in the Pulse Secure Desktop Client 9.1R9 allows a restricted user on an endpoint machine can use system-level privileges if the Embedded Browser is configured with Credential Provider. This vulnerability only affects Windows PDC if the Embedded Browser is configured with the...

Remote code execution

A vulnerability in the Pulse Secure Desktop Client 9.1R9 has Remote Code Execution RCE if users can be convinced to connect to a malicious server. This vulnerability only affects Windows PDC.To improve the security of connections between Pulse clients and Pulse Connect Secure, see below...

Design/Logic Flaw

A vulnerability in the Pulse Secure Desktop Client 9.1R9 could allow the attacker to perform a MITM Attack if end users are convinced to connect to a malicious server...

Code injection

A vulnerability in the Pulse Connect Secure 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction...

Privilege escalation

A vulnerability in the Pulse Secure Desktop Client 9.1R9 is vulnerable to the client registry privilege escalation attack. This fix also requires Server Side Upgrade due to Standalone Host Checker Client Windows and Windows PDC...

Privilege escalation

A vulnerability in the Pulse Secure Desktop Client Linux 9.1R9 could allow local attackers to escalate privilege...

Design/Logic Flaw

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure 9.1R9 is vulnerable to arbitrary cookie injection...

CVE-2020-8263

A vulnerability in the authenticated user web interface of Pulse Connect Secure 9.1R9 could allow attackers to conduct Cross-Site Scripting XSS through the CGI file...

CVE-2020-8263

CVE-2020-8263 relates to Pulse Connect Secure (PCS) and affects versions earlier than 9.1R9. The issue is a Cross-Site Scripting (XSS) flaw in the authenticated user web interface accessible via the CGI file. Several connected sources confirm the vulnerability in PCS/PPS (admin vs. user interface...

CVE-2020-8262

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting XSS and Open Redirection for authenticated user web interface...

CVE-2020-8262

CVE-2020-8262 affects Pulse Connect Secure and Pulse Policy Secure if running versions earlier than 9.1R9. The vulnerability allows Cross-Site Scripting (XSS) and Open Redirection via the authenticated user web interface. Public references in Red Hat advisory and Nessus entries confirm the issue ...

CVE-2020-8261

CVE-2020-8261: A vulnerability in Pulse Connect Secure / Pulse Policy Secure versions prior to 9.1R9 allows arbitrary cookie injection via the admin/web interfaces. Root cause details are not elaborated in the provided sources, but multiple advisories corroborate the issue. Affected products are ...

CVE-2020-8261

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure 9.1R9 is vulnerable to arbitrary cookie injection...

CVE-2020-8260

A vulnerability in the Pulse Connect Secure 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction...

CVE-2020-8260

Pulse Connect Secure (PCS) vulnerable

CVE-2020-8260

A vulnerability in the Pulse Connect Secure 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction...

CVE-2020-8241

CVE-2020-8241 affects the Pulse Secure Desktop Client when running versions prior to 9.1R9, enabling a MITM attack if users connect to a malicious server. Public-coverage documents (SA44601) confirm remediation by upgrading to Pulse Secure Desktop Client 9.1R9 (and note related mitigations such a...

CVE-2020-8241

A vulnerability in the Pulse Secure Desktop Client 9.1R9 could allow the attacker to perform a MITM Attack if end users are convinced to connect to a malicious server...

CVE-2020-8255

A vulnerability in the Pulse Connect Secure 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary file reading vulnerability is fixed using encrypted URL blacklisting that prevents these messages...

CVE-2020-8255

The CVE-2020-8255 entry applies to Pulse Connect Secure (PCS) admin web interface prior to 9.1R9. Reported issue: an authenticated attacker can read arbitrary files due to an input/URL handling flaw; fix implemented via encrypted URL blacklisting. Red Hat and other advisories corroborate the same...