CVE-2020-8256

A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity XXE vulnerability...

CVE-2020-8238

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure 9.1R8.2 could allow attackers to conduct Cross-Site Scripting XSS...

CVE-2020-8238

CVE-2020-8238 affects Pulse Connect Secure and Pulse Policy Secure

PT-2020-6456 · Pulse · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R8.2 Description: The issue is related to the Pulse Connect Secure admin web interface, where an authenticated attacker could potentially upload a custom template to execute arbitrary code. This is du...

PT-2020-20064 · Pulse · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R8.2 Description: A vulnerability in the Pulse Connect Secure admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML Extern...

PT-2020-20049 · Pulse · Pulse Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure and Pulse Policy Secure versions prior to 9.1R8.2 Description: A vulnerability in the authenticated user web interface could allow attackers to conduct Cross-Site Scripting XSS. Recommendations: For Pulse Connect Secure a...

Vulnerabilities fixed in Pulse Secure

Vulnerabilities have been fixed in Pulse Secure. The vulnerabilities allow a malicious person to launch attacks that lead to the following categories of damage: Cross-Site Scripting XSS. Remote code execution User Rights Access to system data Pulse Secure has released updates to address the...

Pulse Connect Secure Remote Code Execution (CVE-2020-8218)

A remote code execution vulnerability exists in Pulse Connect Secure. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Chinese Antivirus Firm Was Part of APT41 ‘Supply Chain’ Attack

The U.S. Justice Department this week indicted seven Chinese nationals for a decade-long hacking spree that targeted more than 100 high-tech and online gaming companies. The government alleges the men used malware-laced phishing emails and "supply chain" attacks to steal data from companies and...

CISA: Chinese Hackers Exploiting Unpatched Devices to Target U.S. Agencies

The US Cybersecurity and Infrastructure Security Agency CISA issued a new advisory on Monday about a wave of cyberattacks carried by Chinese nation-state actors targeting US government agencies and private entities. "CISA has observed Chinese Ministry of State Security-affiliated cyber threat...

Feds Warn Nation-State Hackers are Actively Exploiting Unpatched Microsoft Exchange, F5, VPN Bugs

The U.S. government is warning that Chinese threat actors have successfully compromised several government and private sector entities in recent months, by exploiting vulnerabilities in F5 BIG-IP devices, Citrix and Pulse Secure VPNs and Microsoft Exchange servers. Patches are currently available...

Exploit for Code Injection in Ivanti Connect_Secure

pulse-gosecure-rce...

Sensitive data of 900 Pulse Secure VPN servers leaked on hacker forum

By Sudais Asif The team behind Pulse Secure VPN had a year to fix the flaw but it did not get a fix. This is a post from HackRead.com Read the original post: Sensitive data of 900 Pulse Secure VPN servers leaked on hacker forum...

Pulse Secure / Ivanti Connect Secure Detection Consolidation

Consolidation of Ivanti Connect Secure formerly Pulse Secure Connect Secure detections. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Pulse Secure Pulse Connect Secure Authorization Issues Vulnerability

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure in the United States. A security vulnerability exists in versions of Pulse Secure PCS prior to 9.1RB. An attacker could exploit the vulnerability to bypass Google...

Pulse Policy Secure < 9.1R8 (SA44516)

According to its self-reported version, the version of Pulse Policy Secure running on the remote host is prior to 9.1R8. It is, therefore, affected by multiple vulnerabilities: - An attacker can bypass the Google TOTP, if the primary credentials are exposed to attacker CVE-2020-8206. - An...

Pulse Secure Pulse Connect Secure Cross-Site Scripting Vulnerability

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure in the United States. A cross-site scripting vulnerability exists in versions of Pulse Secure PCS prior to 9.1R8. The vulnerability stems from the lack of proper...

Pulse Secure Pulse Connect Secure Code Injection Vulnerability

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure in the United States. A code injection vulnerability exists in Pulse Secure PCS versions prior to 9.1RB. The vulnerability can be exploited by an attacker to execu...

CVE-2020-8221

A path traversal vulnerability exists in Pulse Connect Secure 9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface...

CVE-2020-8222

A path traversal vulnerability exists in Pulse Connect Secure 9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting...