Known vulnerabilities in Ivanti Connect Secure (formerly Pulse Connect Secure)

Vendor: Ivanti
Software: Ivanti Connect Secure (formerly Pulse Connect Secure)
Software CPE: cpe:2.3:a:ivanti:pulse_connect_secure:*:*:*:*:*:*:*:*
Website: https://www.ivanti.com/
Total vulnerabilities: 140
Public exploits: 13
Known exploited (KEV): 15
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Ivanti Connect Secure (formerly Pulse Connect Secure) Ivanti Connect Secure (formerly Pulse Connect Secure) is affected by 140 known vulnerabilities: 6 critical, 15 high, 56 medium, 63 low Critical High Medium Low

Vulnerabilities (140)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU115036 - Improper Authorization
CVE-2025-55144		 CWE-285 Low
No
No
 22.7R2.9, 22.8R2 09.09.2025 SB2025090963
#VU115035 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-55143		 CWE-79 Low
No
No
 22.7R2.9, 22.8R2 09.09.2025 SB2025090963
#VU115034 - Improper Authorization
CVE-2025-55142		 CWE-285 Medium
No
No
 22.7R2.9, 22.8R2 09.09.2025 SB2025090963
#VU115033 - Improper Authorization
CVE-2025-55141		 CWE-285 Medium
No
No
 22.7R2.9, 22.8R2 09.09.2025 SB2025090963
#VU115032 - Server-Side Request Forgery (SSRF)
CVE-2025-55139		 CWE-918 Low
No
No
 22.7R2.9, 22.8R2 09.09.2025 SB2025090963
#VU115031 - Improper Authorization
CVE-2025-55148		 CWE-285 Low
No
No
 22.7R2.9, 22.8R2 09.09.2025 SB2025090963
#VU115029 - Cross-Site Request Forgery (CSRF)
CVE-2025-55147		 CWE-352 Medium
No
No
 22.7R2.9, 22.8R2 09.09.2025 SB2025090963
#VU115025 - Unchecked Return Value
CVE-2025-55146		 CWE-252 Low
No
No
 22.7R2.9, 22.8R2 09.09.2025 SB2025090963
#VU115024 - Improper Authorization
CVE-2025-55145		 CWE-285 Medium
No
No
 22.7R2.9, 22.8R2 09.09.2025 SB2025090963
#VU115023 - Cross-Site Request Forgery (CSRF)
CVE-2025-8711		 CWE-352 Medium
No
No
 22.7R2.9, 22.8R2 09.09.2025 SB2025090963
#VU115022 - Improper Authorization
CVE-2025-8712		 CWE-285 Low
No
No
 22.7R2.9, 22.8R2 09.09.2025 SB2025090963
#VU113828 - Improper Link Resolution Before File Access ('Link Following')
CVE-2025-5468		 CWE-59 Low
No
No
 22.7R2.8, 22.8R2 12.08.2025 SB2025081240
#VU113827 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CVE-2025-5466		 CWE-776 Low
No
No
 22.7R2.8, 22.8R2 12.08.2025 SB2025081240
#VU113826 - NULL Pointer Dereference
CVE-2025-5462		 CWE-476 Medium
No
No
 22.7R2.8, 22.8R2 12.08.2025 SB2025081240
#VU113825 - Out-of-bounds read
CVE-2025-5456		 CWE-125 Medium
No
No
 22.7R2.8, 22.8R2 12.08.2025 SB2025081240
#VU112540 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2025-0293		 CWE-93 Low
No
No
 22.7R2.8 08.07.2025 SB2025070874
#VU112538 - Information Exposure Through Log Files
CVE-2025-5464		 CWE-532 Low
No
No
 22.7R2.8 08.07.2025 SB2025070874
#VU112537 - Information Exposure Through Log Files
CVE-2025-5463		 CWE-532 Low
No
No
 22.7R2.8 08.07.2025 SB2025070874
#VU112536 - Stack-based buffer overflow
CVE-2025-5451		 CWE-121 Low
No
No
 22.7R2.8 08.07.2025 SB2025070874
#VU112535 - Improper Access Control
CVE-2025-5450		 CWE-284 Low
No
No
 22.7R2.8 08.07.2025 SB2025070874


Showing elements 1 - 20 out of 140