CVE-2019-11509

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jun 3, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-11518.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker CVE-2019-1151010.0In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attackCVE-2019-115116.1Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.CVE-2019-115129.8Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.CVE-2019-115134.8The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.CVE-2019-115147.5User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.CVE-2019-115154.9core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.CVE-2019-115168.1An issue was discovered in the Bluetooth component of the Cypress (formerly owned by Broadcom) Wireless IoT codebase. Extended Inquiry RespoCVE-2019-115176.5WampServer before 3.1.9 has CSRF in add_vhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incompletCVE-2019-115187.2An issue was discovered in SEMCMS 3.8. SEMCMS_Inquiry.php allows AID[] SQL Injection because the class.phpmailer.php inject_check_sql protecCVE-2019-115194.9Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> EdCVE-2019-11528.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker