Ivanti

Policy Secure

78 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2022-35254

  • EPSS 0.71%
  • Published 05.12.2022 22:15:10
  • Last modified 24.04.2025 15:15:47

An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Iva...

6.1

CVE-2020-8262

  • EPSS 0.14%
  • Published 28.10.2020 13:15:13
  • Last modified 21.11.2024 05:38:36

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface.

4.3

CVE-2020-8261

  • EPSS 0.61%
  • Published 28.10.2020 13:15:13
  • Last modified 21.11.2024 05:38:36

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.

7.2

CVE-2020-15352

  • EPSS 6.56%
  • Published 27.10.2020 05:15:12
  • Last modified 21.11.2024 05:05:23

An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML requ...

7.2

CVE-2020-8243

Warning
  • EPSS 22.62%
  • Published 30.09.2020 18:15:29
  • Last modified 12.02.2025 19:56:52

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.

6.1

CVE-2020-8238

Exploit
  • EPSS 0.17%
  • Published 30.09.2020 18:15:28
  • Last modified 21.11.2024 05:38:34

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS).

4.9

CVE-2020-8221

  • EPSS 2.86%
  • Published 30.07.2020 13:15:12
  • Last modified 21.11.2024 05:38:31

A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface.

6.8

CVE-2020-8222

  • EPSS 0.86%
  • Published 30.07.2020 13:15:12
  • Last modified 21.11.2024 05:38:32

A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting.

6.5

CVE-2020-8220

  • EPSS 6.67%
  • Published 30.07.2020 13:15:11
  • Last modified 21.11.2024 05:38:31

A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can cause DOS.

7.2

CVE-2020-8219

  • EPSS 1.73%
  • Published 30.07.2020 13:15:11
  • Last modified 21.11.2024 05:38:31

An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator.