Vulnerabilities

TI-2024-09930 CVE-2024-10716 · GHSA-c57h-9ch8-w8cv

Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.

LOW 26

Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.

CVSS 3.1MEDIUM 5.9 Network No auth User interaction EPSS 0.00215 Published 2024-12-05 Fixed in 24.2.1 CWE-79

TI-2024-09357 CVE-2024-10094 · GHSA-hwv8-q8m9-3f2j

Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code

MEDIUM 43

Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0048 Published 2024-11-20 Fixed in 24.1.2 CWE-94

TI-2024-06211 CVE-2024-6702 · GHSA-4qc3-9vcj-2gh8

Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.

LOW 23

Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.

CVSS 3.1MEDIUM 5.2 Network High privileges User interaction EPSS 0.00259 Published 2024-09-12 Fixed in 24.1.3 CWE-74

TI-2024-06210 CVE-2024-6701 · GHSA-mxxv-ww69-wr77

Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.

LOW 24

Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00259 Published 2024-09-12 Fixed in 24.1.3 CWE-79

TI-2024-06209 CVE-2024-6700 · GHSA-5jpg-grvp-4pr4

Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.

LOW 24

Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00259 Published 2024-09-12 Fixed in 24.1.3 CWE-79

TI-2022-08034 CVE-2022-24083 · GHSA-jmvp-c8vr-hx2j

Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.

MEDIUM 44

Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00936 Published 2022-07-25 Fixed in 8.7.2 CWE-285

TI-2022-08033 CVE-2022-24082 · GHSA-3crj-j3hg-7v57

Deserialization of untrusted data in Pegasystems Pega Infinity

MEDIUM 56

If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized pay…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.12191 Published 2022-07-19 Fixed in 8.7.3 CWE-502

TI-2021-09103 CVE-2021-27654 · GHSA-pf5r-8q35-xv4w

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.

LOW 35

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00603 Published 2022-01-28 Fixed in 8.6.1 CWE-640

TI-2021-09101 CVE-2021-27651 · GHSA-7px5-vqmh-8xj8

Improper authentication in Pegasystems Pega Infinity

HIGH 74

In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.53841 Published 2021-04-29 Fixed in 8.5.2 CWE-287

TI-2021-09102 CVE-2021-27653 · GHSA-gcxv-8mvq-5gwx

Improper access control in Pega Infinity

LOW 31

Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.01125 Published 2021-04-01 Fixed in 8.5.3 CWE-284

Vulnerabilities

Filters