Servers and applications
CVE-2018-6320
A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an http(s) Host header received from the browser is trusted without validation.
- Severity
- Critical 9.8
- Published
- 6 Sept 2018
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 4.1% in the next 30 daysHigher than 90% of CVEs. EPSS by FIRST, 10 Nov 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Ivanti Connect SecureServers and applications · cpe:a:ivanti:connect_secure |
|