Filtered by vendor Pega Subscriptions
Total 46 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-16386 1 Pega 1 Pega Platform 2024-11-21 4.3 Medium
PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect
CVE-2019-16374 1 Pega 1 Platform 2024-11-21 9.8 Critical
Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be of unlimited length. An attacker can specify four characters of a username, followed by the * character, to bypass access control.
CVE-2017-17478 1 Pega 1 Pega Platform 2024-11-21 N/A
An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2. A user with developer credentials can insert malicious code (up to 64 characters) into a text field in Designer Studio, after establishing context. Designer Studio is the developer workbench for Pega Platform. That XSS payload will execute when other developers visit the affected pages.
CVE-2024-6700 1 Pega 1 Infinity 2024-09-13 5.5 Medium
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.
CVE-2024-6701 1 Pega 1 Infinity 2024-09-13 5.5 Medium
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.
CVE-2024-6702 1 Pega 1 Infinity 2024-09-13 5.2 Medium
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.