Filtered by vendor Pega
Subscribe
Total
33 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-27654 | 1 Pega | 1 Infinity | 2023-12-10 | 4.6 MEDIUM | 7.8 HIGH |
| Forgotten password reset functionality for local accounts can be used to bypass local authentication checks. | |||||
| CVE-2021-27653 | 1 Pega | 1 Infinity | 2023-12-10 | 4.0 MEDIUM | 4.9 MEDIUM |
| Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure. | |||||
| CVE-2020-15390 | 1 Pega | 1 Pega Platform | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo. | |||||
| CVE-2021-27651 | 1 Pega | 1 Infinity | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. | |||||
| CVE-2020-23957 | 1 Pega | 1 Pega Platform | 2023-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI. | |||||
| CVE-2020-24353 | 1 Pega | 1 Pega Platform | 2023-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header. | |||||
| CVE-2020-8773 | 1 Pega | 1 Platform | 2023-12-10 | 6.0 MEDIUM | 8.9 HIGH |
| The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. | |||||
| CVE-2020-8774 | 1 Pega | 1 Pega Platform | 2023-12-10 | 6.8 MEDIUM | 8.8 HIGH |
| Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability in the "ActionStringID" function. | |||||
| CVE-2019-16374 | 1 Pega | 1 Platform | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be of unlimited length. An attacker can specify four characters of a username, followed by the * character, to bypass access control. | |||||
| CVE-2020-8775 | 1 Pega | 1 Platform | 2023-12-10 | 6.0 MEDIUM | 8.9 HIGH |
| Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags. | |||||
| CVE-2017-17478 | 1 Pega | 1 Pega Platform | 2023-12-10 | 3.5 LOW | 4.8 MEDIUM |
| An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2. A user with developer credentials can insert malicious code (up to 64 characters) into a text field in Designer Studio, after establishing context. Designer Studio is the developer workbench for Pega Platform. That XSS payload will execute when other developers visit the affected pages. | |||||
| CVE-2017-11356 | 1 Pega | 1 Pega Platform | 2023-12-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sensitive configuration information by leveraging a missing access control. | |||||
| CVE-2017-11355 | 1 Pega | 1 Pega Platform | 2023-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to the main page; the (2) beanReference parameter to the JavaBean viewer page; or the (3) pyTableName to the System database schema modification page. | |||||