← Back

Pulsesecure

pulsesecure

93 CVEs • 19 products

Products (19)

Click to collapse
Toggle
Pulse Connect Secure
pulse_connect_secure
57 CVEs
Pulse Policy Secure
pulse_policy_secure
31 CVEs
Pulse Secure Desktop Client
pulse_secure_desktop_client
18 CVEs
Pulse Secure Desktop
pulse_secure_desktop
3 CVEs
Virtual Traffic Manager
virtual_traffic_manager
3 CVEs
Client
client
2 CVEs
Steel Belted Radius
steel_belted_radius
2 CVEs
Pulse Secure Virtual Application Delivery Controller
pulse_secure_virtual_application_delivery_controller
2 CVEs
Odyssey Access Client
odyssey_access_client
1 CVE
Pulse Secure Security
pulse_secure_security
1 CVE
Standalone Pulse Installer Service
standalone_pulse_installer_service
1 CVE
Pulse One On Premise
pulse_one_on-premise
1 CVE
Desktop Linux Client
desktop_linux_client
1 CVE
Secure Access Series Ssl Vpn Sa 4000
secure_access_series_ssl_vpn_sa-4000
1 CVE
Pulse Secure Installer Service
pulse_secure_installer_service
1 CVE
Psa 5000 Firmware
psa-5000_firmware
1 CVE
Psa 7000 Firmware
psa-7000_firmware
1 CVE
Psa 5000
psa-5000
0 CVEs
Psa 7000
psa-7000
0 CVEs

CVEs (93)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-11002
1Pulsesecure
1Pulse Secure Desktop Client
Nov 21, 2024
Nov 29, 2018
N/A· v4
5.5 MEDIUM· v3
5.8 MEDIUM· v2
Pulse Secure Desktop Client 5.3 up to and including R6.0 build 1769 on Windows has Insecure Permissions.
CVE-2018-18284
5Artifex
CanonicalDebian+2 more
11Debian Linux
Enterprise Linux DesktopEnterprise Linux Server+8 more
Nov 21, 2024
Oct 19, 2018
N/A· v4
8.6 HIGH· v3
6.8 MEDIUM· v2
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.
CVE-2018-7572
1Pulsesecure
1Pulse Secure Desktop
Nov 21, 2024
Sep 12, 2018
N/A· v4
6.8 MEDIUM· v3
7.2 HIGH· v2
Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN users during Windows Logon, can allow attackers to bypass Windows authentication and execute commands on the system with the privilege...Show more
Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN users during Windows Logon, can allow attackers to bypass Windows authentication and execute commands on the system with the privileges of Pulse Secure Client. The attacker must interrupt the client's network connectivity, and trigger a connection to a crafted proxy server with an invalid SSL certificate that allows certification-manager access, leading to the ability to browse local files and execute local programs.Show less
CVE-2018-6320
2Ivanti
Pulsesecure
3Connect Secure
Pulse Connect SecurePulse Policy Secure
Nov 21, 2024
Sep 6, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an ht...Show more
A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an http(s) Host header received from the browser is trusted without validation.Show less
CVE-2018-16261
1Pulsesecure
1Pulse Secure Desktop Client
Nov 21, 2024
Sep 6, 2018
N/A· v4
6.8 MEDIUM· v3
4.6 MEDIUM· v2
In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege Escalation Vulnerability with Dynamic Certificate Trust.
CVE-2018-15865
1Pulsesecure
1Pulse Secure Desktop Client
Nov 21, 2024
Sep 6, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
The Pulse Secure Desktop (macOS) has a Privilege Escalation Vulnerability.
CVE-2018-15749
1Pulsesecure
1Pulse Secure Desktop Client
Nov 21, 2024
Sep 6, 2018
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Format String Vulnerability.
CVE-2018-15726
1Pulsesecure
1Pulse Secure Desktop Client
Nov 21, 2024
Sep 6, 2018
N/A· v4
5.3 MEDIUM· v3
4.6 MEDIUM· v2
The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Privilege Escalation Vulnerability.
CVE-2018-14366
2Ivanti
Pulsesecure
3Connect Secure
Pulse Connect SecurePulse Policy Secure
Nov 21, 2024
Sep 6, 2018
N/A· v4
6.1 MEDIUM· v3
5.8 MEDIUM· v2
download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability.
CVE-2018-16513
4Artifex
CanonicalDebian+1 more
5Debian Linux
GhostscriptGpl Ghostscript+2 more
Nov 21, 2024
Sep 5, 2018
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have unspecified other impact.
CVE-2018-15911
5Artifex
CanonicalDebian+2 more
11Debian Linux
Enterprise Linux DesktopEnterprise Linux Server+8 more
Nov 21, 2024
Aug 28, 2018
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.
CVE-2018-15910
5Artifex
CanonicalDebian+2 more
9Debian Linux
Enterprise Linux DesktopEnterprise Linux Server+6 more
Nov 21, 2024
Aug 27, 2018
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or execute code.
CVE-2018-15909
5Artifex
CanonicalDebian+2 more
11Debian Linux
Enterprise Linux DesktopEnterprise Linux Server+8 more
Nov 21, 2024
Aug 27, 2018
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code.
CVE-2018-9849
1Pulsesecure
1Pulse Connect Secure
Nov 21, 2024
May 10, 2018
N/A· v4
5.5 MEDIUM· v3
4.3 MEDIUM· v2
Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service (memory consumpti...Show more
Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service (memory consumption and memory errors) via a crafted XML document.Show less
CVE-2018-6374
1Pulsesecure
1Desktop Linux Client
Nov 21, 2024
Jan 31, 2018
N/A· v4
6.5 MEDIUM· v3
6.4 MEDIUM· v2
The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform strict SSL Certificate Validation. This can lead to the manipulation of the Pulse C...Show more
The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform strict SSL Certificate Validation. This can lead to the manipulation of the Pulse Connection set.Show less
CVE-2018-5299
1Pulsesecure
2Pulse Connect Secure
Pulse Policy Secure
Nov 21, 2024
Jan 16, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A stack-based Buffer Overflow Vulnerability exists in the web server in Pulse Secure Pulse Connect Secure (PCS) before 8.3R4 and Pulse Policy Secure (PPS) before 5.4R4, leading to memory corruption and possibly remote co...Show more
A stack-based Buffer Overflow Vulnerability exists in the web server in Pulse Secure Pulse Connect Secure (PCS) before 8.3R4 and Pulse Policy Secure (PPS) before 5.4R4, leading to memory corruption and possibly remote code execution.Show less
CVE-2017-17947
1Pulsesecure
1Pulse Connect Secure
Nov 21, 2024
Jan 16, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure (PPS) befo...Show more
A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure (PPS) before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL parameters not being sanitized. Exploitation does require the user to be logged in as administrator; the issue is not applicable to the end user portal.Show less
CVE-2017-14935
1Pulsesecure
1Pulse One On Premise
May 13, 2026
Sep 30, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Pulse Secure Pulse One On-Premise 2.0.1649 and below does not properly validate requests, which allows remote users to query and obtain sensitive information.
CVE-2017-11455
2Ivanti
Pulsesecure
3Connect Secure
Pulse Connect SecurePulse Policy Secure
May 13, 2026
Aug 29, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of...Show more
diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CSRF tokens.Show less
CVE-2017-11196
1Pulsesecure
1Pulse Connect Secure
May 13, 2026
Jul 12, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page.