Known vulnerabilities in Ivanti Connect Secure (formerly Pulse Connect Secure) - page 3

Vendor: Ivanti
Software: Ivanti Connect Secure (formerly Pulse Connect Secure)
Software CPE: cpe:2.3:a:ivanti:pulse_connect_secure:*:*:*:*:*:*:*:*
Website: https://www.ivanti.com/
Total vulnerabilities: 140
Public exploits: 13
Known exploited (KEV): 15
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Ivanti Connect Secure (formerly Pulse Connect Secure) Ivanti Connect Secure (formerly Pulse Connect Secure) is affected by 140 known vulnerabilities: 6 critical, 15 high, 56 medium, 63 low Critical High Medium Low

Vulnerabilities (140)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU100485 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-11004		 CWE-79 Low
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100484 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-11005		 CWE-78 Medium
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100483 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-11006		 CWE-78 Medium
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100482 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-11007		 CWE-78 Medium
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100481 - Argument Injection or Modification
CVE-2024-39712		 CWE-88 Low
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100480 - Argument Injection or Modification
CVE-2024-39711		 CWE-88 Low
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100479 - Argument Injection or Modification
CVE-2024-39710		 CWE-88 Low
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100477 - Incorrect Default Permissions
CVE-2024-39709		 CWE-276 Low
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100476 - Argument Injection or Modification
CVE-2024-38656		 CWE-88 Low
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100475 - Argument Injection or Modification
CVE-2024-38655		 CWE-88 Low
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100474 - Out-of-bounds write
CVE-2024-38649		 CWE-787 Medium
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100472 - NULL Pointer Dereference
CVE-2024-8495		 CWE-476 Medium
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100471 - Stack-based buffer overflow
CVE-2024-47909		 CWE-121 Low
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU100469 - Stack-based buffer overflow
CVE-2024-47907		 CWE-121 Medium
No
No
 22.7R2.3 14.11.2024 SB2024111422
#VU98388 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2024-37404		 CWE-93 Low
Available
No
 22.7R2.1, 22.7R2.2 11.10.2024 SB2024101122
#VU89721 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2023-38551		 CWE-93 Low
No
No
 9.1R18.6, 22.5R2.4, 22.7R2 22.05.2024 SB2024052216
#VU88142 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2024-22023		 CWE-611 Medium
No
No
 - 04.04.2024 SB2024040440
#VU88141 - Heap-based Buffer Overflow
CVE-2024-22053		 CWE-122 Medium
No
No
 - 04.04.2024 SB2024040440
#VU88140 - NULL Pointer Dereference
CVE-2024-22052		 CWE-476 Medium
No
No
 - 04.04.2024 SB2024040440
#VU88139 - Heap-based Buffer Overflow
CVE-2024-21894		 CWE-122 High
No
No
 - 04.04.2024 SB2024040440


Showing elements 41 - 60 out of 140