JSA10402 - Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) - Multiple Web-based CGI and Cross Site Scripting (XSS) vulnerabilities.

CGI and Cross Site Scripting vulnerabilities found and fixed through a combination of internal and external proactive security testing:
- Internal path was displayed in some error messages
- Parameter injection and XSS issues in File Browsing web pages (not applicable to UAC)
- XSS and response-splitting issues in File Browsing web pages (not applicable to UAC)
- XSS issues in Secure Meeting web page and launch CGI (not applicable to UAC)
- Issue with insufficient validation on parameters in dana-na/download URL

Pulse Secure recommends upgrading to one of the following or later releases:
PCS: 5.5R7.1; 6.0R8; 6.1R7; 6.2R3; 6.3R2
PPS: 2.2R3
No workarounds exist for these CGI and XSS issues. Software upgrades recommended in this Security Advisory are synchronized with the recommendations in other (PSN-2009-03-248 and PSN-2009-03-249). This enables customers to upgrade once and have all issues resolved with the upgrade.