JSA10444 - 2010-06 Security Bulletin: Pulse Coennect Secure (PCS) and Pulse Policy Secure (PPS): Cross Site Scripting Issue during Signout

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Cross Site Scripting issue during sign out. This issue was found during external proactive security testing. To access the latest software, please visit: http://my.pulsesecure.net Puls...

JSA10377 - Pulse Policy Secure (PPS): Cross-Site Scripting Vulnerability

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Older software versions of Policy Secure are prone to a cross-site scripting vulnerability. An attacker may leverage this issue to execute an arbitrary script. This issue is caused by ...

SA40003 - [Pulse Secure] July 9th 2015 OpenSSL Security Advisory (CVE-2015-1793)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. On July 9th, 2015 the OpenSSL project announced a new high severity security advisory Alternative chains certificate forgery CVE-2015-1793. This issue does not affect Pulse Secure...

JSA10412 - VU#261869 - Clientless PCS products break web browser's domain-based security models

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Clientless PCS products from multiple vendors operate in a way that breaks fundamental browser security mechanisms. An attacker could use these devices to bypass authentication or...

JSA10375 - Pulse Connect Secure (PCS): Cross-Site Scripting Vulnerability

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Older software versions of Pulse Connect Secure are prone to a cross-site scripting vulnerability. An attacker may leverage this issue to execute an arbitrary script. This issue is...

JSA10401 - Pulse Connect Secure (PCS) product - PCS Security Bundle - Internal System Function

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Internal System Function vulnerabilities found and fixed through a combination of internal and external proactive security testing: Issue with special characters used in a parameter in...

JSA10617 - 2014-03 Security Bulletin: Pulse Connect Secure: Cross site scripting issue (CVE-2014-2291)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been found in the Pulse Connect Secure product. The problem is a result of incorrect user input validation on the web server. The issue exists within a...

SA40013 - TLS/SSL Renegotiation Vulnerability Pulse Connect Secure (PCS) (CVE-2009-3555) (Pulse Secure PSN-2009-11-573

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The industry-wide TLS/SSL renegotiation issue CVE-2009-3555 has been found in the Pulse Connect Secure PCS device. This issue has been reported as a man in the middle MITM attack by ma...

JSA10396 - Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) - OpenSSL - Incorrect checks for malformed signatures on DSA and ECDSA keys used with SSL/TLS on backend servers. CVE-2008-5077.

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Several functions inside OpenSSL incorrectly checked the result after calling the EVPVerifyFinal function, allowing a malformed signature to be treated as a good signature rather than ...

SA40005 - Details on fixes for OpenSSL Heartbleed issue (CVE-2014-0160)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. This article provides detailed information related to the fixes for OpenSSL "Heartbleed" issue CVE-2014-0160 for PCS/PPS products. The following PCS versions are vulnerable to the...

SA40006 - Details on fixes for SSL/TLS MITM vulnerability (CVE-2014-0224)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The following products and versions are vulnerable to the OpenSSL vulnerability CVE-2014-0224 The vulnerability exists when both the client AND the server are vulnerable. Server-side:...

SA40001 - [Pulse Secure] OpenSSL security advisory for March 19th, 2015

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. On March 19th the OpenSSL project released a new security advisory. This advisory can be viewed here: http://openssl.org/news/secadv20150319.txt All products are not vulnerable to the...

JSA10646 - 2014-09 Security Bulletin: Junos Pulse Secure Access Service (SSL VPN): Cross site scripting issue (CVE-2014-3824)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been found in the Pulse Connect Secure product. The problem is a result of incorrect user input validation on the SSL VPN web server. The issue exists...

SA40135 - Linux kernel: Possible use-after-free vulnerability in keyring facility (CVE-2016-0728)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An issue has been found within the Linux kernel that can allow exploitation. Pulse secure does utilize the Linux kernel, however we are not vulnerable as we are not using the vulnerabl...

SA40007 - 2014-09 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Secure Desktop client: User privilege escalation issue in Installer Service (CVE-2014-3811)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A privilege escalation issue has been found and corrected in the Pulse Secure Installer Service client Windows platform only software. This issue could allow a non-administrator user t...

SA40015 - OpenSSL security advisory for January 8th, 2015 (including SSL "FREAK" issue)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. On January 8th 2015, the OpenSSL project released a security advisory. This advisory included eight 8 new CVEs. This article will describe the vulnerability and fix status for the Puls...

SA40107 - Response to Juniper ScreenOS security advisory JSA10713 (CVE-2015-7755 and CVE-2015-7756)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Juniper announced a security advisory for their Netscreen Firewall ScreenOS product portfolio. The Juniper ScreenOS advisory can be found here: JSA10713 Related Links JSA10713...

JSA10645 - 2014-09 Security Bulletin: Pulse Connect Secure (PSC) and Pulse Policy Secure (PPS): Cross site scripting issue (CVE-2014-3820)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been found in the Pulse Connect Secure and Pulse Policy Secure PCS/PPS products. The problem is a result of incorrect user input validation on the PCS/P...

SA40004 - [Pulse Secure] TLS connection verification issue (CVE-2015-5369)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. On Pulse Connect Secure PCS that offer Hardware Acceleration PSC6000, PCS6500, MAG PSC360 and enabled, then TLS connections may be vulnerable to a protocol handshake vulnerability. This...

SA40053 - 2015-09: Security Advisory: Secure Meeting (Pulse Collaboration) information disclosure vulnerability (CVE-2015-7322)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An information disclosure issue has been discovered in Secure Meeting Pulse Collaboration. This issue could allow an attacker to enumerate currently in progress meetings on the device...