CVE-2019-11213

In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. The endpoint would need to be already compromised for exploitation to succeed...

CVE-2019-11213

CVE-2019-11213 affects Pulse Secure Pulse Desktop Client and Pulse Connect Secure (Network Connect). The issue is improper handling/storage of session cookies/tokens, enabling an attacker who already compromised the endpoint to replay/spoof sessions and gain unauthorized end-user access. Affected...

CVE-2019-11213

In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. The endpoint would need to be already compromised for exploitation to succeed...

PT-2019-12191 · Pulse · Pulse Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Pulse Desktop Client versions 5.x through 5.3R6 Pulse Desktop Client versions 9.x through 9.0R2 Pulse Connect Secure versions 8.1 through 8.1R13 Pulse Connect Secure versions 8.3 through 8.3R6 Pulse Connect Secure versions 9.0 through 9.0R2...

VPN applications insecurely store session cookies

Overview Multiple Virtual Private Network VPN applications store the authentication and/or session cookies insecurely in memory and/or log files. Description Virtual Private Networks VPNs are used to create a secure connection with another network over the internet. Multiple VPN applications stor...

PT-2019-3001

Name of the Vulnerable Software and Affected Versions Pulse Secure Pulse Connect Secure PCS versions 8.2 through 8.2R12.1 Pulse Secure Pulse Connect Secure PCS versions 8.3 through 8.3R7.1 Pulse Secure Pulse Connect Secure PCS versions 9.0 through 9.0R3.4 Description The issue is related to error...

CVE-2018-20807

CVE-2018-20807 affects Pulse Secure Pulse Connect Secure (PCS) via an XSS in welcome.cgi. Affected: PCS 8.1.x before 8.1R12, 8.2.x before 8.2R9, 8.3.x before 8.3R3. Root cause: improper sanitization of a URL parameter in the WEB app, enabling client-side script execution. Impact: client-side code...

CVE-2018-20811

A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12...

CVE-2018-20809

CVE-2018-20809 affects Pulse Secure Pulse Connect Secure (PCS) and Pulse Policy Secure. A crafted message can cause the web server to crash on PCS 8.3RX before 8.3R5 and Pulse Policy Secure 5.4RX before 5.4R5; PCS 8.1RX is not affected. Affected versions: PCS 8.3RX–8.3R4 and PPS 5.4RX–5.4R4. The ...

CVE-2018-20810

Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure PCS 8.3RX before 8.3R2 and Pulse Policy Secure PPS 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices...

CVE-2018-20808

Pulse Connect Secure is affected by a cross-site scripting vulnerability in the rd.cgi component due to improper header sanitization. Affected products are Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 (not applicable to 8.1RX). The issue can be exploited via a crafted URL leading to scrip...

CVE-2018-20813

An input validation issue has been found with loginmeeting.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2...

CVE-2018-20813

Pulse Secure Pulse Connect Secure is affected by an input validation issue in the login_meeting.cgi component for versions 8.3RX prior to 8.3R2. The CVE-2018-20813 entry (NVD, Red Hat, CNVD, and related feeds) documents a input validation vulnerability with high/critical impact, exploitable over ...

CVE-2018-20809

A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure PCS 8.3RX before 8.3R5 and Pulse Policy Secure 5.4RX before 5.4R5. This is not applicable to PCS 8.1RX...

CVE-2018-20808

An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization. This is not applicable to 8.1RX...

CVE-2018-20812

CVE-2018-20812 describes an information exposure in Pulse Secure Desktop where IPv6 DNS traffic could escape the VPN tunnel when Traffic Enforcement is enabled, affecting dual‑stack (IPv4/IPv6) endpoints. Affected: Pulse Secure Desktop 9.0R1 and earlier. Impact: potential disclosure of sensitive ...

CVE-2018-20807

An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure PCS 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly...

CVE-2018-20814

An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure PCS 8.3R2 before 8.3R2 and Pulse Policy Secure PPS 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX or PPS 5.2RX...

CVE-2018-20814

The CVE-2018-20814 issue is a cross-site scripting (XSS) vulnerability in Psaldownload.cgi affecting Pulse Connect Secure (PCS) 8.3R2 and earlier and Pulse Policy Secure (PPS) 5.4RX and earlier (not applicable to PCS 8.1RX or PPS 5.2RX). Root cause is insufficient validation of client data in the...

CVE-2018-20811

CVE-2018-20811 affects Pulse Secure Pulse Connect Secure: a hidden RPC service issue in PCS versions 8.3RX before 8.3R2 and 8.1RX before 8.1R12. Root cause is a hidden RPC service exposure, leading to potential partial confidentiality impact as indicated by the CVSS data (Network access, low atta...