Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
224 results · page 2 of 5
Jul 15, 2025A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34.CVE-2025-34108 · Other software · Falconstor Software · reported by VulnCheckHigh 8.6
A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.
- Product
- Disk Pulse Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.checkpoint.comraw.githubusercontent.com
May 7, 2025SendPulse Email Marketing Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47547 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.1.6.
- Product
- SendPulse Email Marketing Newsletter
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update SendPulse Email Marketing Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025SendPulse Email Marketing Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22662 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.1.5.
- Product
- SendPulse Email Marketing Newsletter
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update SendPulse Email Marketing Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications.CVE-2024-55661 · Other software · laravel · reported by GitHubHigh 8.7
Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` method in the `Laravel\Pulse\Livewire\Concerns\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method in which the callable is a function or static method and the callable has no parameters or no strict parameter types. The vulnerable to component is `remember(callable $query, string $key = '')` method in `Laravel\Pulse\Livewire\Concerns\RemembersQueries`, and the vulnerability affects all Pulse card components that use this trait. Version 1.3.1 contains a patch.
- Product
- pulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected.CVE-2024-11586 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 4
Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected.
- Product
- Ubuntu's pulseaudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netcve.org
Oct 17, 2024SendPulse Free Web Push: Stored Cross-Site ScriptingCVE-2024-9184 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SendPulse Free Web Push plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.6 due to incorrect use of the wp_kses_allowed_html function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SendPulse Free Web Push
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update SendPulse Free Web Push to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 24, 2024A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, in Sync Breeze Enterprise Server 10.4.18 version, and in Disk Pulse EnterCVE-2023-49575 · Other software · Flexense · reported by cve-coordination@incibe.esHigh 7.1
A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, in Sync Breeze Enterprise Server 10.4.18 version, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attacker to execute persistent XSS through /setup_smtp in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.
- Product
- VX Search Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2024A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attackeCVE-2023-49572 · Other software · Flexense · reported by cve-coordination@incibe.esHigh 7.1
A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attacker to execute persistent XSS through /setup_odbc in odbc_data_source, odbc_user and odbc_password parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.
- Product
- VX Search Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024Pulse Secure Client SetupService Directory Traversal Local Privilege Escalation Vulnerability.CVE-2023-34298 · Network & remote access · Pulse Secure · reported by zdi-disclosures@trendmicro.comHigh 7.8
Pulse Secure Client SetupService Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Pulse Secure Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within SetupService. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service. Was ZDI-CAN-17687.
- Product
- Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jan 23, 2024Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.CVE-2022-4964 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.5
Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.
- Product
- Ubuntu pipewire-pulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netcve.mitre.org
Dec 7, 2023NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions VulnerabilityCVE-2023-40302 · Other software · Netscout · reported by MITRECritical 9.1
NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability
- Product
- Ngeniuspulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Dec 7, 2023NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.CVE-2023-40301 · Other software · Netscout · reported by MITRECritical 9.8
NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.
- Product
- Ngeniuspulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Dec 7, 2023NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.CVE-2023-40300 · Other software · Netscout · reported by MITRECritical 9.8
NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.
- Product
- Ngeniuspulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in SendPulse SendPulse Free Web Push plugin <= 1.3.1 versions.CVE-2023-45274 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SendPulse SendPulse Free Web Push plugin <= 1.3.1 versions.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2022Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.CVE-2022-34870 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.
- Product
- Apache Geode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Sep 30, 2022Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the requCVE-2022-21826 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 5.4
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Aug 12, 2022In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push ConfiguCVE-2021-44720 · Network & remote access · Ivanti · reported by MITREHigh 7.2
In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comkb.pulsesecure.net
Dec 26, 2021An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust.CVE-2019-25055 · Other software · Libpulse-binding Project · reported by MITREHigh 7.5
An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.
- Product
- Libpulse-binding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust.CVE-2018-25028 · Other software · Libpulse-binding Project · reported by MITREHigh 7.5
An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_context can cause a use-after-free.
- Product
- Libpulse-binding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust.CVE-2018-25027 · Other software · Libpulse-binding Project · reported by MITREHigh 7.5
An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_format_info can cause a use-after-free.
- Product
- Libpulse-binding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Nov 19, 2021A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sCVE-2021-22965 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Aug 16, 2021A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter iCVE-2021-22938 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Aug 16, 2021A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaCVE-2021-22937 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Aug 16, 2021A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator viCVE-2021-22936 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 6.1
A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Aug 16, 2021A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter.CVE-2021-22935 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Aug 16, 2021A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced cCVE-2021-22934 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Aug 16, 2021A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted wCVE-2021-22933 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 6.5
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
May 27, 2021Ivanti Pulse Connect Secure Unrestricted File Upload VulnerabilityCVE-2021-22900 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedHigh 7.2
Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogkb.pulsesecure.netkb.pulsesecure.net
May 27, 2021Ivanti Pulse Connect Secure Command Injection VulnerabilityCVE-2021-22899 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedHigh 8.8
Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogkb.pulsesecure.netkb.pulsesecure.net
May 27, 2021Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow VulnerabilityCVE-2021-22894 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedHigh 8.8
Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogkb.pulsesecure.netkb.pulsesecure.net
May 13, 2021An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2CVE-2021-31922 · Other software · Pulsesecure · reported by MITREHigh 7.5
An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.
- Product
- Virtual Traffic Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Apr 23, 2021Ivanti Pulse Connect Secure Use-After-Free VulnerabilityCVE-2021-22893 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedRansomwareCritical 10
Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogblog.pulsesecure.netkb.cert.org
Mar 16, 2021A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware.CVE-2021-22887 · Other software · Pulsesecure · reported by support@hackerone.comLow 2.3
A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit the device.
- Product
- Psa-5000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netsupermicro.com
Dec 31, 2020An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust.CVE-2018-25001 · Other software · Libpulse-binding Project · reported by MITREMedium 6.5
An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.
- Product
- Libpulse-binding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 3, 2020An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming frCVE-2020-16123 · Other software · Canonical · reported by security@ubuntu.comMedium 4.4
An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15.
- Product
- pulseaudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.netubuntu.com
Nov 18, 2020Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program.CVE-2020-15710 · Other software · Canonical · reported by security@ubuntu.comMedium 5.3
Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice in the fail condition in src/modules/bluetooth/module-bluez5-device.c and src/modules/bluetooth/module-bluez5-device.c. Fixed in 1:8.0-0ubuntu3.14.
- Product
- PulseAudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.netubuntu.com
Oct 28, 2020A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) through the CVE-2020-8263 · Other software · Pulsesecure · reported by support@hackerone.comMedium 5.4
A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) through the CGI file.
- Product
- Pulse Secure Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 28, 2020A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection fCVE-2020-8262 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 6.1
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 28, 2020A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.CVE-2020-8261 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 4.3
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 28, 2020Ivanti Pulse Connect Secure Code Execution VulnerabilityCVE-2020-8260 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedHigh 7.2
Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comkb.pulsesecure.net
Oct 28, 2020A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary file reading vulnerabilityCVE-2020-8255 · Other software · Pulsesecure · reported by support@hackerone.comMedium 4.9
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary file reading vulnerability is fixed using encrypted URL blacklisting that prevents these messages.
- Product
- Pulse Secure Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 28, 2020A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server.CVE-2020-8254 · Other software · Pulsesecure · reported by support@hackerone.comHigh 8.8
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server. This vulnerability only affects Windows PDC.To improve the security of connections between Pulse clients and Pulse Connect Secure, see below recommendation(s):Disable Dynamic certificate trust for PDC.
- Product
- Pulse Secure Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 28, 2020A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.CVE-2020-8250 · Other software · Pulsesecure · reported by support@hackerone.comHigh 7.8
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.
- Product
- Pulse Secure Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 28, 2020A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer overflow.CVE-2020-8249 · Other software · Pulsesecure · reported by support@hackerone.comHigh 7.8
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer overflow.
- Product
- Pulse Secure Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 28, 2020A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.CVE-2020-8248 · Other software · Pulsesecure · reported by support@hackerone.comHigh 7.8
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.
- Product
- Pulse Secure Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 28, 2020A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a MITM Attack if end users are convinced to connect to a maliciouCVE-2020-8241 · Other software · Pulsesecure · reported by support@hackerone.comHigh 7.5
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a MITM Attack if end users are convinced to connect to a malicious server.
- Product
- Pulse Secure Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 28, 2020A vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an endpoint machine can use system-level privileges if the Embedded BrowsCVE-2020-8240 · Other software · Pulsesecure · reported by support@hackerone.comHigh 7.8
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an endpoint machine can use system-level privileges if the Embedded Browser is configured with Credential Provider. This vulnerability only affects Windows PDC if the Embedded Browser is configured with the Credential Provider.
- Product
- Pulse Secure Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 28, 2020A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry privilege escalation attack.CVE-2020-8239 · Other software · Pulsesecure · reported by support@hackerone.comCritical 9.8
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry privilege escalation attack. This fix also requires Server Side Upgrade due to Standalone Host Checker Client (Windows) and Windows PDC.
- Product
- Pulse Secure Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 27, 2020Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.CVE-2020-8956 · Other software · Pulsesecure · reported by MITRELow 3.3
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
- Product
- Pulse Secure Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Oct 27, 2020An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admCVE-2020-15352 · Network & remote access · Ivanti · reported by MITREHigh 7.2
An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.pulsesecure.netkb.pulsesecure.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.