This security bulletin contains one medium risk vulnerability.
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service (memory consumption and memory errors) via a crafted XML document.Mitigation
Install update from vendor's website.Vulnerable software versions
Pulse Connect Secure: 8.3 - 8.3R4Fixed software versions
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?