pulse connect secure vulnerabilities and fixes

Recent CVEs affecting pulse connect secure, with upgrade or downgrade steps. 26 tracked.

Also searched as: pulseconnectsecure.

pulse connect secure has 26 tracked vulnerabilities, 0 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 25. Most recent: 2022-09-30. Highest priority: CVE-2021-22900 (score 74/100).

• CVE-2022-21826 MEDIUM 5.4 DOWNGRADE UPGRADE Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the applic
• CVE-2021-44720 HIGH 7.2 DOWNGRADE UPGRADE In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the H
• CVE-2021-22965 HIGH 7.5 DOWNGRADE UPGRADE A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes
• CVE-2021-22938 HIGH 7.2 DOWNGRADE UPGRADE A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform co
• CVE-2021-22937 HIGH 7.2 DOWNGRADE UPGRADE A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a
• CVE-2021-22936 MEDIUM 6.1 DOWNGRADE UPGRADE A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site scrip
• CVE-2021-22935 HIGH 7.2 DOWNGRADE UPGRADE A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform co
• CVE-2021-22934 HIGH 7.2 DOWNGRADE UPGRADE A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromise
• CVE-2021-22933 MEDIUM 6.5 DOWNGRADE UPGRADE A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an
• CVE-2021-22908 HIGH 8.8 DOWNGRADE DOWNGRADE A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated
• CVE-2021-22900 HIGH 7.2 EXPLOITED DOWNGRADE UPGRADE Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
• CVE-2020-8262 MEDIUM 6.1 DOWNGRADE DOWNGRADE A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct
• CVE-2020-8261 MEDIUM 4.3 DOWNGRADE DOWNGRADE A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie in
• CVE-2020-8256 MEDIUM 4.9 DOWNGRADE UPGRADE A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacke
• CVE-2020-8238 MEDIUM 6.1 DOWNGRADE DOWNGRADE A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R
• CVE-2020-8222 MEDIUM 6.8 DOWNGRADE UPGRADE A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker vi
• CVE-2020-8221 MEDIUM 4.9 DOWNGRADE UPGRADE A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to
• CVE-2020-8220 MEDIUM 6.5 DOWNGRADE UPGRADE A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker
• CVE-2020-8219 HIGH 7.2 DOWNGRADE UPGRADE An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker t
• CVE-2020-8217 MEDIUM 5.4 DOWNGRADE UPGRADE A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the
• CVE-2020-8216 MEDIUM 4.3 DOWNGRADE UPGRADE An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end
• CVE-2020-8206 HIGH 8.1 DOWNGRADE UPGRADE An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a
• CVE-2020-8204 MEDIUM 6.1 DOWNGRADE UPGRADE A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page.
• CVE-2020-15408 LOW 3.7 UPGRADE DOWNGRADE An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8
• CVE-2020-15352 HIGH 7.2 DOWNGRADE UPGRADE An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure
• CVE-2020-12880 MEDIUM 5.5 DOWNGRADE UPGRADE An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9

FAQ

How do I fix pulse connect secure vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is pulse connect secure being exploited right now?

Yes: 1 pulse connect secure CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which pulse connect secure CVE should I patch first?

CVE-2021-22900 currently ranks highest (74/100): Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability.

RSS feed for pulse connect secure · ← Back to latest CVEs