CVE report
CVE-2019-11507medium
Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)
Events 90d
190
Distinct IPs
72
Severity
medium
CISA KEV
Not listed
Detection signature
An event counts toward CVE-2019-11507 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /dana-na/auth/url_default/login.cgi
- · /dana-na/auth/url_default/welcome.cgi
- · /dana/home/cts_get_ica.cgi?bm_id=x&vdi=1&appname=aa%0d%0aContent-Type::text/html%0d%0aContent-Disposition::inline%0d%0aaa:bb<svg/onload=alert(document.domain)>
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 108 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2019-11507
- 178.16.53.180108 eventsNetherlands· Omegatech LTD
- 80.87.206.206 eventsRussia· OVH SAS
- 213.209.159.744 eventsTaiwan· Feo Prest SRL
- 80.87.206.192 eventsRussia· OVH SAS
- 86.54.25.2082 eventsLatvia· Shereverov Marat Ahmedovich
- 91.92.21.1802 eventsBulgaria
- 66.228.53.1051 eventsUnited States
- 147.182.149.2091 eventsCanada
- 194.195.211.1991 eventsUnited States
- 130.49.187.611 eventsRussia· Global Connectivity Solutions Llp
- 74.207.254.1271 eventsUnited States
- 74.207.243.861 eventsUnited States
- 159.65.226.1561 eventsUnited States
- 165.22.150.1721 eventsUnited States
- 157.245.185.1781 eventsUnited States
- 147.182.179.261 eventsUnited States
- 167.99.151.1641 eventsUnited States
- 134.122.36.2551 eventsCanada
- 139.177.205.431 eventsUnited States
- 66.228.47.1111 eventsUnited States
- 170.64.146.1801 eventsAustralia
- 101.36.125.581 eventsHong Kong· UCLOUD INFORMATION TECHNOLOGY HK LIMITED
- 165.227.23.21 eventsUnited States
- 159.89.55.591 eventsUnited States
- 157.230.180.2261 eventsUnited States
- 192.34.63.1741 eventsUnited States
- 212.77.75.201 eventsItaly· Uan Company S.r.l.
- 69.164.203.1381 eventsUnited States
- 138.124.51.1861 eventsGermany· Aeza Group LLC
- 165.227.21.391 eventsUnited States
Top networks the attempts come from
- AS202412 Omegatech LTD1 IPs · 108 ev
- AS14061 DigitalOcean, LLC33 IPs · 33 ev
- AS63949 Akamai Connected Cloud26 IPs · 26 ev
- AS16276 OVH SAS2 IPs · 8 ev
- AS208137 Feo Prest SRL1 IPs · 4 ev
- AS210006 Shereverov Marat Ahmedovich1 IPs · 2 ev
- AS142430 DIGI VPS1 IPs · 1 ev
- AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED1 IPs · 1 ev
- AS56971 Cgi Global Limited1 IPs · 1 ev
- AS215540 Global Connectivity Solutions Llp1 IPs · 1 ev
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
ja4h: ge11nn15en_a743836884dfja4h: ge11nn06en_e4773a62bf4cja4h: ge11nn0300_dedeb29cc523ja4h: ge11nn0400_9c3956fad5daja4h: ge11nn0400_ef4d07580f66ja4h: ge11nn05en_5fca7fb4a57aja4: t13i131300_f57a46bbacb6_3b244d8fbcc8ja4: t13i1010h1_61a7ad8aa9b6_792d2c6655cbja4: t13i3112h1_e8f1e7e78f70_d339722ba4afja4: t13i2511h2_b78ed14e2fd0_ab7e3b40a677ja4: t13i1010h1_61a7ad8aa9b6_3a8073edd8ef
Sample request paths observed
- //dana-na/auth/url_default/welcome.cgi
- /dana-na/auth/url_default/welcome.cgi