CVE-2018-20810

CVE-2018-20810 affects Pulse Secure Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): session data exchanged during cluster synchronization between nodes is not properly encrypted in PCS 8.3RX before 8.3R2 and PPS 5.4RX before 5.4R2. The issue does not apply to PCS 8.1RX, PPS 5.2RX, or st...

PT-2019-10252 · Pulse Secure · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Secure Pulse Connect Secure versions 8.3RX before 8.3R2 Description: An input validation issue has been found in the login meeting.cgi component. Recommendations: For Pulse Secure Pulse Connect Secure versions 8.3RX before 8.3R2, update...

PT-2019-10245 · Pulse Secure · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Secure Pulse Connect Secure PCS versions 8.1.x through 8.1R11 Pulse Secure Pulse Connect Secure PCS versions 8.2.x through 8.2R8 Pulse Secure Pulse Connect Secure PCS versions 8.3.x through 8.3R2 Description: A cross-site scripting XSS...

PT-2019-10247 · Pulse Secure · Pulse Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Secure Pulse Connect Secure PCS versions 8.3RX through 8.3R4 Pulse Secure Pulse Policy Secure versions 5.4RX through 5.4R4 Description: A crafted message can cause the web server to crash. Recommendations: For Pulse Secure Pulse Connect...

PT-2019-10246 · Pulse Secure · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Secure Pulse Connect Secure versions 8.3RX before 8.3R3 Description: A security issue has been identified due to improper header sanitization in the rd.cgi component. This issue affects Pulse Secure Pulse Connect Secure, allowing for...

PT-2019-10253 · Pulse Secure · Pulse Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure PCS versions 8.3R2 and earlier Pulse Policy Secure PPS versions 5.4RX and earlier Description: A cross-site scripting XSS issue was discovered in Psaldownload.cgi. This issue affects Pulse Secure products. Recommendations...

PT-2019-10249 · Pulse · Pulse Connect Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure PCS versions 8.3RX through 8.3R1 Pulse Policy Secure PPS versions 5.4RX through 5.4R1 Description: The issue concerns the lack of proper encryption for session data between cluster nodes during cluster synchronization...

Fix for UB in failure to catch panics crossing FFI boundaries

Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which is a form of UB. This flaw was corrected by this commit1 which was included in version 2.6.0. 1: https://github.com/jnqnfe/pulse-binding-rust/commit/7fd282aef7787577c385aed88cb25d004b85f494...

Mail.ru: XXE on pulse.mail.ru

XML External Entity injection XXE in RSS/Atom feed parsing code in pulse.mail.ru allowed access to local files. All Mail.Ru projects are covered by extended scope bug bounty program...

Memory Corruption Vulnerability in CloudPulse Driving License Recognition Software

Xiamen Cloud Pulse Technology Co., Ltd. was founded in June 2002, Cloud Pulse Technology is in the leading position in cell phone photo text recognition, document recognition, bank card recognition, business card recognition, cell phone information network/PC synchronization and management...

Memory Corruption Vulnerability in CloudPulse Passport Recognition Software

Xiamen Cloud Pulse Technology Co., Ltd. was established in June 2002, Cloud Pulse technology is mainly developed in the cell phone photo text recognition, document recognition, bank card recognition, business card recognition, cell phone information network/PC synchronization and management...

Memory Corruption Vulnerability in CloudPulse Card Recognition Software

Xiamen Cloud Pulse Technology Co., Ltd. was founded in June 2002, Cloud Pulse Technology is in the leading position in cell phone photo text recognition, document recognition, bank card recognition, business card recognition, cell phone information network/PC synchronization and management...

Memory Corruption Vulnerability in Cloud Pulse License Plate Recognition Software

Xiamen Cloud Pulse Technology Co., Ltd. was established in June 2002, Cloud Pulse Technology mainly develops cell phone photo text recognition, document recognition, bank card recognition, business card recognition, cell phone information network/PC synchronization and management technology. A...

Memory Corruption Vulnerability in Cloud Pulse ID Recognition Tool

Xiamen Cloud Pulse Technology Co. Cloud Pulse ID card recognition tool is an ID card recognition software. Cloud Pulse ID Recognition Tool has a memory corruption vulnerability that can be exploited by attackers to cause a denial of service...

Pulse Secure Virtual Traffic Manager Information Disclosure Vulnerability

Pulse Secure Virtual Traffic Manager is a software-based, high-performance application delivery controller from Pulse Secure, USA. A security vulnerability exists in Pulse Secure Virtual Traffic Manager versions 9.9 prior to 9.9r2 and 10.4r1 prior to 10.4r1, which stems from the program failing t...

Pulse Secure Virtual Traffic Manager Cross-Site Scripting Vulnerability

Pulse Secure Virtual Traffic Manager is a software-based, high-performance application delivery controller from Pulse Secure, USA. A cross-site scripting vulnerability exists in the web management user interface in Pulse Secure Virtual Traffic Manager versions 9.9 prior to 9.9r2 and versions prio...

Juniper Secure Access SSL VPN Privilege Escalation Vulnerability

Certain Secure Access SA Series SSL VPN products originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 build 9627 4.2 Release build 7631. This occurs because appropriate controls...

Privilege escalation

Certain Secure Access SA Series SSL VPN products originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 build 9627 4.2 Release build 7631. This occurs because appropriate controls...

CVE-2018-20193

CVE-2018-20193 affects Secure Access SSL VPN SA Series (notably SA-4000 5.1R5 build 9627 / 4.2 Release build 7631). Description: a privilege-escalation flaw where a readonly user can change the administrator password by cloning and modifying the /dana-admin/user/update.cgi page and saving changes...

Input validation

Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity information by leveraging incorrect permission validation...