PT-2021-15283 · Pulse Secure · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R12 Description: A vulnerability could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request. Recommendations: For versions prior to 9.1R12,...

PT-2021-15286 · Pulse Secure · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R12 Description: A vulnerability could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter. Recommendations: For versions...

PT-2021-15284 · Pulse Secure · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R12 Description: A buffer overflow issue exists due to a maliciously crafted web request. This could be exploited by an authenticated administrator or a compromised Pulse Connect Secure device in a...

PT-2021-15287 · Pulse Secure · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R12 Description: A vulnerability could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console. Recommendations: For version...

PT-2021-15285 · Pulse Secure · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R12 Description: A vulnerability could allow an authenticated administrator to perform command injection via an unsanitized web parameter. Recommendations: For versions prior to 9.1R12, update to...

Popular Attack Surfaces, August 2021: What You Need to Know

See the Updates section at the end of this post for new information as it comes to light. Whether you attended virtually, IRL, or not at all, Black Hat and DEF CON have officially wrapped, and security folks’ brains are replete with fresh information on new and some not-so-new vulnerabilities and...

PT-2021-3892 · Pulse · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R12 Description: The issue allows an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface. This could potentially enable a...

Pulse Connect Secure 授权 RCE (CVE-2021-22937) 漏洞

...

Pulse Secure VPNs Get New Urgent Update for Poorly Patched Critical Flaw

Pulse Secure has shipped a fix for a critical post-authentication remote code execution RCE vulnerability in its Connect Secure virtual private network VPN appliances to address an incomplete patch for an actively exploited flaw it previously resolved in October 2020. "The Pulse Connect Secure...

Ivanti Releases Security Update for Pulse Connect Secure

Ivanti has released Pulse Connect Secure system software version 9.1R12 to address multiple vulnerabilities an attacker could exploit to take control of an affected system. CISA encourages users and administrators to review Ivanti's Security Advisory SA44858 and apply the necessary update. This...

Vulnerabilities fixed in Pulse Connect Secure

Pulse Connect has fixed vulnerabilities in Pulse Connect Secure. The vulnerabilities potentially enable a malicious person to able to perform attacks that result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Data manipulation. Remote code execution...

Pulse Secure Pulse Connect Secure 跨站脚本漏洞

Pulse Secure Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is an SSL VPN solution from Pulse Secure, Inc. in the United States. A cross-site scripting vulnerability exists in Pulse Secure Pulse Connect Secure that stems from the platform's failure to securely handle special...

Pulse Secure Pulse Connect Secure 代码问题漏洞

Pulse Secure Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is an SSL VPN solution from Pulse Secure, Inc. in the United States. A code issue vulnerability exists in Pulse Secure Pulse Connect Secure that stems from insufficient file validation when uploading files in the...

Pulse Secure Pulse Connect Secure 命令注入漏洞

Pulse Secure Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is an SSL VPN solution from Pulse Secure, Inc. in the United States. A command injection vulnerability exists in Pulse Secure Pulse Connect Secure that stems from the product's failure to filter input data for specia...

Pulse Secure Pulse Connect Secure 缓冲区错误漏洞

Pulse Secure Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is an SSL VPN solution from Pulse Secure, Inc. in the United States. A buffer error vulnerability exists in Pulse Secure Pulse Connect Secure that stems from the product's failure to validate memory boundaries. An...

Pulse Secure Pulse Connect Secure 路径遍历漏洞

Pulse Secure Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is an SSL VPN solution from Pulse Secure, Inc. in the United States. Pulse Connect Secure suffers from a path traversal vulnerability that originates from an input validation error when processing a directory travers...

Pulse Connect Secure < 9.1R12 (SA44858)

According to its self-reported version, the version of Pulse Connect Secure running on the remote host is prior to 9.1R12. It is, therefore, affected by multiple vulnerabilities, including: - A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perfo...

Pulse Secure Pulse Connect Secure 命令注入漏洞

Pulse Secure Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is an SSL VPN solution from Pulse Secure, Inc. in the United States. A command injection vulnerability exists in Pulse Secure Pulse Connect Secure that stems from the product's failure to filter input data for specia...

CISA’s Top 30 Bugs: One’s Old Enough to Buy Beer

In a perfect world, CISA would laminate cards with the year’s top 30 vulnerabilities: You could whip it out and ask a business if they’ve bandaged these specific wounds before you hand over your cash. This is not a perfect world. There are no laminated vulnerability cards. But at least we have th...

Malware Targeting Pulse Secure Devices

As part of CISA’s ongoing response to Pulse Secure compromises, CISA has analyzed 13 malware samples related to exploited Pulse Secure devices. CISA encourages users and administrators to review the following 13 malware analysis reports MARs for threat actor techniques, tactics, and procedures TT...