Pulsesecure vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2021-31922 An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2High 7.5 · May 13, 2021
• CVE-2020-8254 A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server.High 8.8 · Oct 28, 2020
• CVE-2020-8250 A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.High 7.8 · Oct 28, 2020
• CVE-2020-8249 A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer overflow.High 7.8 · Oct 28, 2020
• CVE-2020-8248 A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.High 7.8 · Oct 28, 2020
• CVE-2020-8241 A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a MITM Attack if end users are convinced to connect to a maliciouHigh 7.5 · Oct 28, 2020
• CVE-2020-8240 A vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an endpoint machine can use system-level privileges if the Embedded BrowsHigh 7.8 · Oct 28, 2020
• CVE-2020-8239 A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry privilege escalation attack.Critical 9.8 · Oct 28, 2020
• CVE-2020-13162 A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NTHigh 7 · Jun 16, 2020
• CVE-2020-11582 An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06.High 8.8 · Apr 6, 2020
• CVE-2020-11581 An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06.High 8.1 · Apr 6, 2020
• CVE-2020-11580 An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06.Critical 9.1 · Apr 6, 2020
• CVE-2018-20812 An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists in Pulse Secure PulseHigh 7.5 · Jun 28, 2019
• CVE-2018-20193 Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC) allow privilege escaHigh 8.8 · Dec 21, 2018
• CVE-2018-15865 The Pulse Secure Desktop (macOS) has a Privilege Escalation Vulnerability.High 7.8 · Sep 6, 2018
• CVE-2018-5299 A stack-based Buffer Overflow Vulnerability exists in the web server in Pulse Secure Pulse Connect Secure (PCS) before 8.3R4 and Pulse Policy Secure (PPS) beforCritical 9.8 · Jan 16, 2018
• CVE-2017-14935 Pulse Secure Pulse One On-Premise 2.0.1649 and below does not properly validate requests, which allows remote users to query and obtain sensitive information.High 7.5 · Sep 29, 2017
• CVE-2017-11196 Pulse Connect Secure 8.3R1 has CSRF in logout.cgi.High 8.8 · Jul 12, 2017
• CVE-2017-11193 Pulse Connect Secure 8.3R1 has CSRF in diag.cgi.High 8.8 · Jul 12, 2017
• CVE-2016-2408 Pulse Secure Desktop before 5.2R2 and Pulse Secure Installer Service before 8.2R2 and below for Windows allow restricted users to gain privileges via unspecifieHigh 7.8 · Aug 2, 2016