Ivanti Connect Secure vulnerabilities

CVE-2020-8261 [MEDIUM] CWE-120 CVE-2020-8261: A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.

CVE-2016-4790 [MEDIUM] CWE-79 CVE-2016-4790: Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secur Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2025-5464 [MEDIUM] CWE-532 CVE-2025-5464: Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information.

CVE-2025-5463 [MEDIUM] CWE-532 CVE-2025-5463: Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a local authenticated attacker to obtain that information.

CVE-2018-14366 [MEDIUM] CWE-601 CVE-2018-14366: download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pul download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability.

CVE-2020-8216 [MEDIUM] CWE-200 CVE-2020-8216: An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authent An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID.

CVE-2024-13842 [MEDIUM] CWE-321 CVE-2024-13842: A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before ver A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data.

CVE-2024-13843 [MEDIUM] CWE-312 CVE-2024-13843: Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data.

CVE-2025-0293 [LOW] CWE-93 CVE-2025-0293: CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before vers CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk.

CVE-2025-5450 [LOW] CWE-602 CVE-2025-5450: Improper access control in the certificate management component of Ivanti Connect Secure before vers Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated admin with read-only rights to modify settings that should be restricted.