Pulse Connect Secure vulnerabilities
12 known CVE vulnerabilities in Pulse Connect Secure, translated and rated.
- CVE-2017-11196High
Pulse Connect Secure 8.3R1 has a CSRF vulnerability in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, allowing an attacker to log out a user by tricking them into visiting a malicious web page.
- CVE-2017-11193High
Pulse Connect Secure 8.3R1 has a CSRF vulnerability in the diag.cgi file, which allows commands like ping, traceroute, and nslookup to be executed. The lack of CSRF protections enables an attacker to run these commands against any IP if they can trick an admin into visiting their malicious page.
- CVE-2016-4786High
Pulse Connect Secure (PCS) versions 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
- CVE-2021-22900HighActively exploited
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
- CVE-2021-22899HighActively exploited
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature.
- CVE-2021-22894HighActively exploited
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
- CVE-2021-22893CriticalActively exploited
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
- CVE-2020-8260HighActively exploited
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
- CVE-2020-8243HighActively exploited
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload a custom template to perform arbitrary code execution.
- CVE-2020-8218HighActively exploited
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to craft a URI to perform arbitrary code execution via the admin web interface.
- CVE-2019-11510CriticalActively exploited
A vulnerability in Pulse Connect Secure allows an unauthenticated remote attacker to read arbitrary files by sending a specially crafted URI.
- CVE-2016-4787Critical
Pulse Connect Secure (PCS) versions 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directory via unknown vectors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS