SB2016052606 - Multiple vulnerabilities in Pulse Connect Secure

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016052606

SB2016052606 - Multiple vulnerabilities in Pulse Connect Secure

Published: May 26, 2016 Updated: August 9, 2020

Security Bulletin ID SB2016052606
Severity
High
Patch available
NO
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 29% Medium 43% Low 29%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2016-4792)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Pulse Connect Secure (PCS) 8.2 before 8.2r1 allows remote attackers to disclose sign in pages via unspecified vectors.


2) Input validation error (CVE-ID: CVE-2016-4791)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to enumerate files, read arbitrary files, and conduct server side request forgery (SSRF) attacks via unspecified vectors.


3) Cross-site scripting (CVE-ID: CVE-2016-4790)

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


4) Cross-site scripting (CVE-ID: CVE-2016-4789)

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


5) Input validation error (CVE-ID: CVE-2016-4788)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system file via unknown vectors.


6) Input validation error (CVE-ID: CVE-2016-4787)

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directory via unknown vectors.


7) Input validation error (CVE-ID: CVE-2016-4786)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References