CVE-2020-15408

Pulse Connect Secure (PCS) before 9.1R8 is affected by CVE-2020-15408. An authenticated attacker can access the admin page console via the end-user web interface due to a rewrite. This is documented in multiple sources (NVD/NIST entry and Pulse advisory SA44516). The issue’s impact is limited to ...

CVE-2020-13162

CVE-2020-13162 (Pulse Secure TOCTOU Privilege Escalation) affects Pulse Secure Windows clients, specifically the Desktop Client and Standalone Installer Service. The vulnerability is a time-of-check to time-of-use race in PulseSecureService.exe that runs with SYSTEM privileges, allowing an unpriv...

CVE-2019-11213

CVE-2019-11213 affects Pulse Secure Pulse Desktop Client and Pulse Connect Secure (Network Connect). The issue is improper handling/storage of session cookies/tokens, enabling an attacker who already compromised the endpoint to replay/spoof sessions and gain unauthorized end-user access. Affected...

CVE-2020-8254

CVE-2020-8254 affects Pulse Secure Desktop Client on Windows prior to 9.1R9. The issue allows Remote Code Execution if a user is persuaded to connect to a malicious server; the Windows PDC component is the affected area. Remediation is to upgrade PDC to 9.1R9 or apply the recommended security set...

CVE-2020-8239

Pulse Secure Desktop Client prior to 9.1R9 is affected by a client registry privilege escalation vulnerability (CVE-2020-8239). Root cause involves registry escalations linked to Standalone Host Checker Client (Windows) and Windows PDC. The issue is addressed by upgrading Pulse Secure components ...

CVE-2020-8255

The CVE-2020-8255 entry applies to Pulse Connect Secure (PCS) admin web interface prior to 9.1R9. Reported issue: an authenticated attacker can read arbitrary files due to an input/URL handling flaw; fix implemented via encrypted URL blacklisting. Red Hat and other advisories corroborate the same...

CVE-2020-8241

CVE-2020-8241 affects the Pulse Secure Desktop Client when running versions prior to 9.1R9, enabling a MITM attack if users connect to a malicious server. Public-coverage documents (SA44601) confirm remediation by upgrading to Pulse Secure Desktop Client 9.1R9 (and note related mitigations such a...

CVE-2018-20812

CVE-2018-20812 describes an information exposure in Pulse Secure Desktop where IPv6 DNS traffic could escape the VPN tunnel when Traffic Enforcement is enabled, affecting dual‑stack (IPv4/IPv6) endpoints. Affected: Pulse Secure Desktop 9.0R1 and earlier. Impact: potential disclosure of sensitive ...

CVE-2020-8240

CVE-2020-8240 affects the Pulse Secure Desktop Client prior to 9.1R9. The issue allows a restricted user on Windows to obtain system-level privileges when the Embedded Browser is configured with Credential Provider (affecting Windows PDC only). The vulnerability is part of a set of issues in Puls...

CVE-2020-8263

CVE-2020-8263 relates to Pulse Connect Secure (PCS) and affects versions earlier than 9.1R9. The issue is a Cross-Site Scripting (XSS) flaw in the authenticated user web interface accessible via the CGI file. Several connected sources confirm the vulnerability in PCS/PPS (admin vs. user interface...

CVE-2020-8249

Pulse Secure Desktop Client (Linux) versions before 9.1R9 are affected by CVE-2020-8249, a local buffer overflow vulnerability that could be exploited by a local attacker. Remediation per the advisories is to upgrade to Pulse Secure Desktop Client 9.1R9 (and to apply related updates across PCS/PP...

CVE-2018-15726

The connected IVANTI advisory specifies CVE-2018-15726 as affecting Pulse Secure Desktop for macOS, with a metacharacter injection vulnerability in 9.0R1 and 5.3RX before 5.3R5 that can lead to local privilege escalation. Remediation shown in the advisory includes fixes in Pulse Secure Desktop 9....

CVE-2020-8250

The CVE-2020-8250 issue affects Pulse Secure Desktop Client (Linux) before version 9.1R9. The underlying flaw allows a local attacker to escalate privileges due to elevation of privilege in the Linux PDC. Public records show CVSSv3.1 base score 7.8 (LOCAL, LOW attack complexity, Privileges Requir...

CVE-2018-11002

Pulse Secure Desktop Client for Windows (versions 5.3 through R6.0 build 1769) has an insecure-permissions flaw in its file handling that can enable writing to arbitrary files and overwrite contents. Root cause is insecure permissions within the affected component/file paths on Windows. No explic...

CVE-2018-15865

CVE-2018-15865 affects Pulse Secure Desktop for macOS . The Ivanti bulletin consolidates multiple Pulse products and lists the macOS client as susceptible to a local privilege escalation through the "/tmp" folder. Affected versions are Pulse Secure Desktop macOS in the 5.1rX branch before 5.1R11 ...

CVE-2018-16261

Pulse Secure Desktop Client 9.0R1 and 5.3RX before 5.3R5 contains a local privilege escalation due to improper certificate handling when the credential provider feature is enabled. The vulnerability allows a local user to gain elevated privileges on affected systems. Exploitation is local and rel...

CVE-2020-8248

CVE-2020-8248 affects the Pulse Secure Desktop Client (Linux) prior to 9.1R9, enabling local privilege escalation. Root cause: elevation of privileges in Linux PDC. Impact: local attacker could obtain higher privileges. Remediation: upgrade to Pulse Secure Desktop Client 9.1R9 (also reflected in ...

CVE-2018-15749

Pulse Secure Desktop for macOS is affected by CVE-2018-15749. The issue is a format string vulnerability in macOS clients versions 5.3RX prior to 5.3R5 and 9.0R1, enabling a local attacker to trigger information display (information that should not be accessible). Exploitation is local, and the i...