Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
ivanti connect secure 9.1 vulnerabilities and exploits
(subscribe to this query)
8.3
CVSSv3
CVE-2024-22024
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an malicious user to access certain restricted resources without authentication.
Ivanti Connect Secure 22.5
Ivanti Connect Secure 9.1
Ivanti Connect Secure 22.4
Ivanti Policy Secure 22.5
Ivanti Zero Trust Access 22.6
1 Github repository
6 Articles
8.8
CVSSv3
CVE-2021-22908
A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default.
Pulsesecure Pulse Connect Secure 9.0rx
Ivanti Connect Secure 9.1
Ivanti Connect Secure 9.0
8.8
CVSSv3
CVE-2021-22899
A command injection vulnerability exists in Pulse Connect Secure prior to 9.1R11.4 allows a remote authenticated malicious user to perform remote code execution via Windows Resource Profiles Feature
Pulsesecure Pulse Connect Secure 9.0rx
Pulsesecure Pulse Connect Secure
Ivanti Connect Secure 9.1
Ivanti Connect Secure 9.0
4.9
CVSSv3
CVE-2020-8256
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated malicious user to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.
Pulsesecure Pulse Connect Secure
Ivanti Connect Secure 9.1
6.5
CVSSv3
CVE-2021-22933
A vulnerability in Pulse Connect Secure prior to 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request.
Pulsesecure Pulse Connect Secure
Ivanti Connect Secure 9.1
7.2
CVSSv3
CVE-2021-22934
A vulnerability in Pulse Connect Secure prior to 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request.
Pulsesecure Pulse Connect Secure
Ivanti Connect Secure 9.1
7.2
CVSSv3
CVE-2021-22937
A vulnerability in Pulse Connect Secure prior to 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface.
Pulsesecure Pulse Connect Secure
Ivanti Connect Secure 9.1
7.5
CVSSv3
CVE-2021-22965
A vulnerability in Pulse Connect Secure prior to 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device.
Pulsesecure Pulse Connect Secure
Ivanti Connect Secure 9.1
5.4
CVSSv3
CVE-2022-21826
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HT...
Pulsesecure Pulse Connect Secure
Ivanti Connect Secure 9.1
7.2
CVSSv3
CVE-2021-44720
In Ivanti Pulse Secure Pulse Connect Secure (PCS) prior to 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen. A read-only administrative user can escalate to...
Pulsesecure Pulse Connect Secure
Ivanti Connect Secure 9.1
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
denial of service
CVE-2024-27371
CVE-2024-20405
CVE-2024-31627
CVE-2024-31625
race condition
CVE-2024-4358
cross-site scripting
CVE-2023-20938
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »