JSA10471 - Out of Cycle Security Bulletin: Pulse Connect Secure (PCS) Network Connect Credential Provider Issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. There is an issue with Network Connect Credential Provider where local machine authentication can be bypassed on Windows 7 and Vista. If Network Connect Credential Provider is configur...

JSA10325 - CERT-CSA Option Vulnerability, Released 3/10/03

If you have configured CSA in "Enabled" mode for one or more groups, then it is possible for an authenticated user in one of those groups to access servers that are not listed in the "Application List". If you have configured CSA in "Enabled, and user can add applications" mode or configured in...

JSA10375 - Pulse Connect Secure (PCS): Cross-Site Scripting Vulnerability

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Older software versions of Pulse Connect Secure are prone to a cross-site scripting vulnerability. An attacker may leverage this issue to execute an arbitrary script. This issue is...

JSA10646 - 2014-09 Security Bulletin: Junos Pulse Secure Access Service (SSL VPN): Cross site scripting issue (CVE-2014-3824)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been found in the Pulse Connect Secure product. The problem is a result of incorrect user input validation on the SSL VPN web server. The issue exists...

SA40053 - 2015-09: Security Advisory: Secure Meeting (Pulse Collaboration) information disclosure vulnerability (CVE-2015-7322)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An information disclosure issue has been discovered in Secure Meeting Pulse Collaboration. This issue could allow an attacker to enumerate currently in progress meetings on the device...

SA40209 - [Pulse Secure] Cross site scripting issue (CVE-2016-4789)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been discovered in the Pulse Connect Secure device. This issue is related to system configuration section of the administrative user interface. This...

SA40207 - [Pulse Secure] File content disclosure issue (CVE-2016-4787)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An issue was discovered with the Pulse Connect Secure device that could allow an attacker to print out contents from files from a limited and specific directory on the device. When...

SA40662 - Pulse Workspace data exposure

Problem A data exposure issue was discovered by a third party security research group where access to a small section of Pulse Secure customer data store on a recognized cloud service provider during the period of 11 AM to 2 PM on March 16, 2017. During this three-hour period, Pulse Secure has no...

SA43860 - 2018-08 Out-of-Cycle Advisory: Pulse One On-Premise Authentication bypass (CVE-2018-7750)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Pulse One On-Premise software version 2.0.1808 and 2.0.1820 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open...

SA44399 - 2020-03: Out-of-Cycle Advisory: Pulse Secure recommendations for Enterprise VPN Security (AA20-073A)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Many organizations are switching to alternate workplace options for employees in response to the rapidly spreading Novel Coronavirus COVID-19. Malicious cyber actors will inevitably...

SA44676 - December 08 2020 OpenSSL Security Advisory

Problem On December 08 2020, the OpenSSL project announced a new security advisory. These issues may affect Pulse Secure product. Refer to KB43892 - What releases will Pulse Secure apply fixes to resolve security vulnerabilities? per our End of Engineering EOE and End of Life EOL policies. The...

SA44899 - CVE-2021-22965: A Vulnerability in Pulse Connect Secure Before 9.1R12.1

Prior to 9.1R12.1 System Software, a vulnerability in the Pulse Secure server exists where malformed packets can, be used for Denial of Service. The impact and temporary mitigation is referenced in KB44879 CVE| ScoreCVSS:3.0| Vector| Description| Affected Versions ---|---|---|---|---...

MI Core - Vulnerability found security issue on jquery.

Last Modified Date Mar 12, 2024 4:32:15 PM...

Are MobileIron Products Vulnerable to CVE-2021-44521--apache-cassandra

Last Modified Date Mar 8, 2024 7:55:33 PM...

Security Alert - CVE's Addressed in Avalanche 6.3.3

Last Modified Date Dec 10, 2021 8:13:44 AM...

Security Advisory EPM December 2025 for EPM 2024

Summary: Ivanti has released an update for Ivanti Endpoint Manager EPM which addresses three high severity vulnerabilities and one critical severity vulnerability in the EPM core and remote consoles. We are not aware of any customers being exploited by these vulnerabilities at the time of...

Impact of CVE-2025-26465 and CVE-2025-26466 on EPMM, Sentry and Connector

Last Modified Date Apr 15, 2026 5:11:49 AM...

December 2024 Security Advisory Ivanti Performance Manager (CVE-2024-11597)

Summary Ivanti has released updates for Performance Manager which address one high severity vulnerability. Successful exploitation could lead to local privilege escalation. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. Vulnerability Details: CV...

SA-2023-07-26-CVE-2023-28129

SECURITY ADVISORY 07-26-2023 Product Affected: Ivanti Desktop and Server Management A vulnerability was recently discovered in DSM 2022.1 Service Update 1. This vulnerability is remediated in DSM 2022.2 Service Update 3. Vulnerability Information CVE | CVSS | Summary | Product Affected...

SA-2023-06-20-CVE-2023-28323

SECURITY ADVISORY 06-20-2023 Product Affected: Ivanti Endpoint Manager A vulnerability was recently discovered for EPM 2022 SU3 and all previous versions. We have a Hotfix available to remediate this vulnerability that can be found by going to CVE-2023-28323 Full details . Please log into the...

Avalanche ZDI-CAN-19513 Security Advisory

Last Modified Date Apr 3, 2023 8:41:48 PM...

JSA10553 - 2013-03: Security Bulletin: Pulse Secure Mobile: Android client privilege escalation

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A security issue has been found in the Pulse Secure Mobile for Android. This issue could only be carried out on an Android phone that was "rooted". An issue in the Pulse Secure Mobile f...

JSA10453 - 2010-09 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Local Client Logging Issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. User session information is saved to the local system even when client logging is disabled. Pulse Secure would like to acknowledge Espion Ltd. Dublin, Ireland for bringing this to our...

JSA10462 - Cross-site scripting issue with file browsing upload page

Problem A cross-site scripting XSS vulnerability was identified in the PCS / PPS file browsing upload page during a routine security scan. Specifically, this URL is called when a user attempts to upload a set of files. A malicious URL can be crafted with a bad payload that could allow unauthorize...

JSA10589 - 2013-09 Security Bulletin: Pulse Connect Secure (PCS): Multiple cross site scripting issues

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Multiple cross site scripting issues have been found in the Pulse Connect Secure PCS product. The issues are the result of incorrect validation of user input sent to the PCS web server...

JSA10515 - 2012-06: Security, Access, and, Acceleration: Security Advisories Released

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A new Security, Access, and, Acceleration bundle has been released. This message contains the links to the new PSN advisories that have been released. In the interest of speeding the...

JSA10428 - 2010-03 Security Bulletin: Pulse Connect Secure (PCS)- Cross site scripting issue on end user edit bookmarks page

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Cross site scripting issue on the end user edit bookmarks page. This issue was found during external proactive security testing. This vulnerability only affects users that are...

JSA10415 - Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) products - Security Bundle - Client Issues

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Client vulnerabilities found and fixed through a combination of internal and external proactive security testing: - A security issue has been identified that could allow an...

JSA10361 - Pulse Connect Secure (PCS) ActiveX client vulnerability

This isn't an active SA and this edit is part of an article maintenance project. Ivanti 04/03/2024. A malicious web site could trick an PCS users to click a link exploiting a vulnerability present in the ActiveX component of the PCS client software When using Internet Explorer to access the PCS...

SA40006 - Details on fixes for SSL/TLS MITM vulnerability (CVE-2014-0224)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The following products and versions are vulnerable to the OpenSSL vulnerability CVE-2014-0224 The vulnerability exists when both the client AND the server are vulnerable. Server-side:...

SA40136 - Pulse Secure product information about Dual_EC_DRBG

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Pulse Secure will use this document to comment on whether Dual Elliptic Curve Deterministic Random Bit Generator aka DualECDRBG is used by any Pulse Secure products. No Pulse Secure...

SA40160 - [Pulse Secure] Java deserialization vulnerability response

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Pulse Secure has investigated our products to see if we were affected by Java deserialisation issues. Pulse Secure products are not vulnerable to Java deserialisation vulnerabilities...

SA40771 - 2017-07 Security Bulletin: Pulse Connect Secure (PCS) / Pulse Policy Secure (PPS): Cross Site Scripting Issue

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Multiple cross site scripting issues has been found in the Pulse Connect Secure / Pulse Policy Secure device. The cause of this issue is due to incorrect validation of user input sent t...

SA40793 - CSRF vulnerability in Pulse Connect Secure / Pulse Policy Secure (CVE-2017-11455)

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A vulnerability in diag.cgi may allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CSRF tokens. PSIRT is no...

SA43620 - 2018-01 Out-Of-Cycle Advisory : Pulse Secure Desktop Linux Client - SSL Certificate Validation Issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The Pulse Linux GUI component does not perform strict SSL certificate validation which allows the attacker to manipulate the Pulse connection set. This issue is applicable only Pulse...

SA43582 - Out-of-Cycle Advisory: Virtual Traffic Manager (vTM) Password Management Vulnerability/Sensitive Data Protection Vulnerability/Principle Of Least Privilege Violation

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A vulnerability in vTM could allow an remote attacker to gain unauthorized access to a targeted system. The vulnerability is due to an insufficiently secure derivation method for the zc...

SA44574 - 2020-08: Out-of-Cycle Advisory: FBI and NSA Expose New Linux Malware Drovorub

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The United States National Security Agency and Federal Bureau of Investigation have released a Cybersecurity Advisory regarding the Drovorub malware. Drovorub is Linux malware that...

SA45038 - CVE-2022-23852 - Expat (AKA Libexpat) Before 2.4.4 Has a Signed Integer Overflow in XML_GetBuffer, for Configurations With a Nonzero XML_CONTEXT_BYTES

A vulnerability has been reported on the 23rd of Jan 2022 under https://nvd.nist.gov/vuln/detail/CVE-2022-23852 Description: Expat aka libexpat before 2.4.4 has a signed integer overflow in XMLGetBuffer, for configurations with a nonzero XMLCONTEXTBYTES. Related link:...

SA45653 - Cross-site Request Forgery in Login Form

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. In a login CSRF attack, the attacker forges a login request to an honest site using the attacker’s username and password at that site. If the forgery succeeds, the honest server...

SA45654 - Multiple OpenSSL Vulnerabilities in Layer 2 network filtering capabilities

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Multiple vulnerabilities were discovered with respect to Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0...

CVE-2023-39338 - Authenticated user access protected Sentry service vulnerability

Last Modified Date Jul 9, 2025 1:23:20 PM...

Sentry : Database Open Access Vulnerability

Last Modified Date Aug 17, 2023 3:23:30 PM...

ZDI-CAN-17769 Ivanti Avalanche getLogFile Directory Traversal Information Disclosure

This advisory presents a bypass for the ZDI-CAN-15967 Path Traversal leading to Arbitrary File Read patch. getLogFile method verifies the UUID input parameter. However, it does not verify the provided fileName path. According to that, the attacker can still exploit this issue and retrieve files...

ZDI-CAN-17812: Ivanti Avalanche FileStoreConfig Arbitrary File Upload Remote Code Execution Vulnerability

This vulnerability presents a bypass for the ZDI-CAN-14187 vulnerability patch Arbitrary File Upload leading to Remote Code Execution. Blacklist of the forbidden directories can be bypassed with the 8.3 filenames. Instead of the "Program Files" directory, the attacker may use "PROGRA1". .jsp...

JSA10350 - Optimistic TCP acknowledgements can cause denial of service (CERT/CC VU#102014)

The Transmission Control Protocol TCP is described in RFC 793 as a means to provide reliable host-to-host transmission between hosts in a packet-switched computer network. Numerous Internet protocols such as HTTP, SMTP, and FTP rely on TCP as their underlying transport protocol. Several different...

JSA10536 - 2012-09 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Specifically crafted https packet may cause denial of service

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A denial of service issue was found in the Pulse Connect Secure PCS and Pulse Policy Secure PPS system software. A specific malformed https packet can potentially cause a system service...

JSA10470 - Pre-authentication CGI script fails to fully validate all parameters

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. CGI scripts accessible during pre-authentication may fail to verify the validity of values supplied as parameters. This could lead to the arbitrary fetching of ".exe" files from the...

JSA10445 - 2010-06 Security Bulletin: Pulse Connect Secure (PCS) Cross Site Scripting Issue in Windows Secure Application Manager

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Cross site scripting issue on uninstallation link for Windows Secure Application Manager. This issue was found during internal proactive security testing. This vulnerability only affec...

JSA10656 - 2014-10 Out of Cycle Security Bulletin: Multiple products affected by SSL POODLE vulnerability (CVE-2014-3566)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The SSL protocol 3.0 SSLv3 uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack. This issue is...

JSA10511 - 2012-06 Security Bulletin: Pulse Connect Secure (PCS): Cross site scripting issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A cross site scripting issue has been found in the Pulse Connect Secure PCS product. The issue is the result of incorrect validation of user input sent to the PCS web server. This issu...