Ivanti: >> Connect Secure >> 9.1 Security Vulnerabilities
A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device.
CVSS Score
7.5
EPSS Score
0.113
Published
2021-11-19
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request.
CVSS Score
6.5
EPSS Score
0.063
Published
2021-08-16
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request.
CVSS Score
7.2
EPSS Score
0.044
Published
2021-08-16
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter.
CVSS Score
7.2
EPSS Score
0.039
Published
2021-08-16
A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter.
CVSS Score
6.1
EPSS Score
0.002
Published
2021-08-16
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface.
CVSS Score
7.2
EPSS Score
0.075
Published
2021-08-16
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console.
CVSS Score
7.2
EPSS Score
0.039
Published
2021-08-16
A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default.
CVSS Score
8.8
EPSS Score
0.318
Published
2021-05-27
CVE-2021-22894
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
Known exploited
CVSS Score
8.8
EPSS Score
0.497
Published
2021-05-27
CVE-2021-22899
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature
Known exploited
CVSS Score
8.8
EPSS Score
0.45
Published
2021-05-27