Vulnerabilities > Pulsesecure > Pulse Connect Secure > 7.4r13.0

DATE CVE VULNERABILITY TITLE RISK
2022-09-30 CVE-2022-21826 HTTP Request Smuggling vulnerability in multiple products
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket.
network
low complexity
pulsesecure ivanti CWE-444
5.4
2022-08-12 CVE-2021-44720 Use of Hard-coded Credentials vulnerability in multiple products
In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen.
network
low complexity
pulsesecure ivanti CWE-798
7.2
2021-11-19 CVE-2021-22965 Resource Exhaustion vulnerability in multiple products
A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device.
network
low complexity
pulsesecure ivanti CWE-400
7.5
2021-08-16 CVE-2021-22933 Path Traversal vulnerability in multiple products
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request.
network
low complexity
pulsesecure ivanti CWE-22
6.5
2021-08-16 CVE-2021-22934 Classic Buffer Overflow vulnerability in multiple products
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request.
network
low complexity
pulsesecure ivanti CWE-120
7.2
2021-08-16 CVE-2021-22935 Command Injection vulnerability in multiple products
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter.
network
low complexity
pulsesecure ivanti CWE-77
7.2
2021-08-16 CVE-2021-22936 Cross-site Scripting vulnerability in multiple products
A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter.
network
low complexity
pulsesecure ivanti CWE-79
6.1
2021-08-16 CVE-2021-22937 Unrestricted Upload of File with Dangerous Type vulnerability in multiple products
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface.
network
low complexity
pulsesecure ivanti CWE-434
7.2
2021-08-16 CVE-2021-22938 Command Injection vulnerability in multiple products
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console.
network
low complexity
pulsesecure ivanti CWE-77
7.2
2021-05-27 CVE-2021-22894 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
network
low complexity
pulsesecure ivanti CWE-119
8.8