Known vulnerabilities in Ivanti Connect Secure (formerly Pulse Connect Secure) - page 4

Vendor: Ivanti
Software: Ivanti Connect Secure (formerly Pulse Connect Secure)
Software CPE: cpe:2.3:a:ivanti:pulse_connect_secure:*:*:*:*:*:*:*:*
Website: https://www.ivanti.com/
Total vulnerabilities: 140
Public exploits: 13
Known exploited (KEV): 15
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Ivanti Connect Secure (formerly Pulse Connect Secure) Ivanti Connect Secure (formerly Pulse Connect Secure) is affected by 140 known vulnerabilities: 6 critical, 15 high, 56 medium, 63 low Critical High Medium Low

Vulnerabilities (140)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU86282 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2024-22024		 CWE-611 High
Available
Exploited
 9.1R14.5, 9.1R17.3, 9.1R18.4, 22.4R2.3, 22.5R1.2, 22.5R2.3, 22.6R2.2 09.02.2024 SB2024020906
#VU85962 - Server-Side Request Forgery (SSRF)
CVE-2024-21893		 CWE-918 Critical
Available
Exploited
 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1 31.01.2024 SB2024011081
#VU85961 - Permissions, Privileges, and Access Controls
CVE-2024-21888		 CWE-264 Medium
Available
No
 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1 31.01.2024 SB2024011081
#VU85287 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-21887		 CWE-78 Critical
Available
Exploited
 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1 10.01.2024 SB2024011081
#VU85286 - Improper Authentication
CVE-2023-46805		 CWE-287 Critical
Available
Exploited
 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1 10.01.2024 SB2024011081
#VU67681 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
 CWE-444 Medium
No
No
 9.1R16.1 27.09.2022 SB2022092731
#VU57598 - Improper input validation
CVE-2021-22965		 CWE-20 Medium
No
No
 9.1R12.1 22.10.2021 SB2021102201
#VU55622 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-22938		 CWE-78 Low
No
No
 9.1R12 05.08.2021 SB2021080529
#VU55621 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-22936		 CWE-79 Medium
No
No
 9.1R12 05.08.2021 SB2021080529
#VU55620 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-22935		 CWE-78 Low
No
No
 9.1R12 05.08.2021 SB2021080529
#VU55619 - Memory corruption
CVE-2021-22934		 CWE-119 Low
No
No
 9.1R12 05.08.2021 SB2021080529
#VU55618 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-22933		 CWE-22 Low
No
No
 9.1R12 05.08.2021 SB2021080529
#VU55617 - Unrestricted Upload of File with Dangerous Type
CVE-2021-22937		 CWE-434 Low
No
Exploited
 9.1R12 05.08.2021 SB2021080529
#VU53277 - Memory corruption
CVE-2021-22908		 CWE-119 Medium
No
No
 9.1R11.5 14.05.2021 SB2021051411
#VU52876 - Unrestricted Upload of File with Dangerous Type
CVE-2021-22900		 CWE-434 Low
No
Exploited
 9.1R11.4 05.05.2021 SB2021050501
#VU52875 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-22899		 CWE-78 Medium
No
Exploited
 9.1R11.4 05.05.2021 SB2021050501
#VU52874 - Memory corruption
CVE-2021-22894		 CWE-119 Medium
No
Exploited
 9.1R11.4 05.05.2021 SB2021050501
#VU52369 - Improper Authentication
CVE-2021-22893		 CWE-287 Critical
No
Exploited
 9.1R11.4 20.04.2021 SB2021042012
#VU46998 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-8238		 CWE-79 Medium
No
No
 9.1R8.2 23.09.2020 SB2020092343
#VU46997 - Improper Control of Generation of Code ('Code Injection')
CVE-2020-8243		 CWE-94 Low
No
Exploited
 9.1R8.2 23.09.2020 SB2020092343


Showing elements 61 - 80 out of 140