CS
VPN
Connect Secure
On CISA KEVExploited in the wildRansomware-linked
132
CVEs
15
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 15High 69Medium 46Low 2
Watch
Add Connect Secure to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-37377 | 7.5 | Dec 11 | A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service Affected: 22.7R2.3 before 22.7R2.3 |
| CVE-2024-37400 | 7.5 | Nov 13 | An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service Affected: 22.7R2.3 before 22.7R2.3 |
| CVE-2024-38649 | 7.5 | Nov 13 | An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated attacker to cause a denial of service Affected: 22.7R2.1 before 22.7R2.1 |
| CVE-2024-8495 | 7.5 | Nov 12 | A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to cause a… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +3 more |
| CVE-2024-47907 | 7.5 | Nov 12 | A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-22052 | 7.5 | Apr 4 | A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +22 more |
| CVE-2023-39340 | 7.5 | Dec 16 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service (DoS) of the… Affected: 22.1; 22.1; 22.2; 22.2; 22.3; 22.4; +34 more |
| CVE-2022-35258 | 7.5 | Dec 5 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4,… Affected: before 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +34 more |
| CVE-2022-35254 | 7.5 | Dec 5 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4,… Affected: before 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +34 more |
| CVE-2021-22965 | 7.5 | Nov 19 | A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +19 more |
| CVE-2018-20809 | 7.5 | Jun 28 | A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R5 and Pulse Policy Secure 5.4RX before 5.4R5 Affected: 8.3; 8.3; 8.3; 8.3; 8.3 |
| CVE-2019-11478 | 7.5 | Jun 19 | Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective… Affected: All versions, or not specified |
| CVE-2019-11477 | 7.5 | Jun 19 | Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs) Affected: All versions, or not specified |
| CVE-2019-11541 | 7.5 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.2RX before 8.2R12.1, users using SAML authentication with the Reuse Existing NC… Affected: 8.2; 8.3 |
| CVE-2016-4786 | 7.5 | May 26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via… Affected: 8.1; 8.2; 8.0 |
| CVE-2024-10644 | 7.2 | Feb 11 | Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +6 more |
| CVE-2024-11634 | 7.2 | Dec 10 | Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +5 more |
| CVE-2024-11633 | 7.2 | Dec 10 | Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +6 more |
| CVE-2024-38655 | 7.2 | Nov 13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated… Affected: 22.7R2.1 before 22.7R2.1; 9.1R18.9 before 9.1R18.9 |
| CVE-2024-11005 | 7.2 | Nov 12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a… Affected: before 9.1; after 9.1 before 22.7; 22.7; 22.7; 22.7; 22.7; +4 more |
| CVE-2024-11006 | 7.2 | Nov 12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a… Affected: before 9.1; after 9.1 before 22.7; 22.7; 22.7; 22.7; 22.7; +4 more |
| CVE-2024-11007 | 7.2 | Nov 12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +3 more |
| CVE-2023-41719 | 7.2 | Dec 14 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a specific web request which may lead to… Affected: 21.9; 21.12; 22.1; 22.1; 22.2; 22.3; +34 more |
| CVE-2021-44720 | 7.2 | Aug 12 | In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets >… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +14 more |
| CVE-2021-22938 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2021-22937 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2021-22935 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2021-22934 | 7.2 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2020-15352 | 7.2 | Oct 27 | An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +8 more |
| CVE-2020-8219 | 7.2 | Jul 30 | An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2019-11508 | 7.2 | May 8 | In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.1; +34 more |
| CVE-2019-11542 | 7.2 | Apr 26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX… Affected: 8.1; 8.2; 8.3 |
| CVE-2026-111357 | 7.0 | Oct 15 | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the… Affected: 22.8R2.4 |
| CVE-2025-0283 | 7.0 | Jan 8 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version… Affected: before 9.1; 22.2 before 22.7; 9.1; 9.1; 9.1; 9.1; +34 more |
| CVE-2025-55139 | 6.8 | Sep 9 | SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2020-8222 | 6.8 | Jul 30 | A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2021-22933 | 6.5 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2020-8220 | 6.5 | Jul 30 | A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2025-55143 | 6.1 | Sep 9 | Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for… Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more |
| CVE-2024-13830 | 6.1 | Feb 11 | Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticated attacker to obtain admin privileges Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +8 more |
| CVE-2024-11004 | 6.1 | Nov 12 | Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obtain admin privileges Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +3 more |
| CVE-2021-22936 | 6.1 | Aug 16 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +6 more |
| CVE-2020-8262 | 6.1 | Oct 28 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated… Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +2 more |
| CVE-2020-8238 | 6.1 | Sep 30 | A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS) Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +7 more |
| CVE-2020-8204 | 6.1 | Jul 30 | A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page Affected: 9.1; 9.1; 9.1; 9.1; 9.1; 9.1; +5 more |
| CVE-2018-20814 | 6.1 | Jun 28 | An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2 Affected: 8.3 |
| CVE-2018-20808 | 6.1 | Jun 28 | An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization Affected: 8.3; 8.3; 8.3 |
| CVE-2018-20807 | 6.1 | Jun 28 | An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL… Affected: 8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +33 more |
| CVE-2019-11507 | 6.1 | May 8 | In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launcher page Affected: 8.3; 8.3; 8.3; 8.3; 8.3; 8.3; +9 more |
| CVE-2019-11543 | 6.1 | Apr 26 | XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX… Affected: 8.1; 8.3 |