CVE-2020-11582

An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, launches a TCP server that accepts local connections on a random port. This can be reached by local HTTP clients, because up to 25 invalid lines are ignored, and because DNS rebinding can occur. (This server accepts, for example, a setcookie command that might be relevant to CVE-2020-11581 exploitation.)

• CWE-668

• https://git.lsd.cat/g/pulse-host-checker-rceExploit, Third Party Advisory
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44426Vendor Advisory
• https://git.lsd.cat/g/pulse-host-checker-rceExploit, Third Party Advisory
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44426Vendor Advisory

Published

Apr 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1157An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-11576Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a use…5.3
• CVE-2020-11579An issue was discovered in Chadha PHPKB 9.0 Enterprise Editi…7.5
• CVE-2020-1158An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-11580An issue was discovered in Pulse Secure Pulse Connect Secure…9.1
• CVE-2020-11581An issue was discovered in Pulse Secure Pulse Connect Secure…8.1
• CVE-2020-11583A GET-based XSS reflected vulnerability in Plesk Obsidian 18…6.1
• CVE-2020-11584A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.1…6.1
• CVE-2020-11585There is an information disclosure issue in DNN (formerly Do…4.3
• CVE-2020-11586An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2…9.8
• CVE-2020-11587An issue was discovered in CIPPlanner CIPAce 9.1 Build 20190…7.5
• CVE-2020-11588An issue was discovered in CIPPlanner CIPAce 9.1 Build 20190…5.3