Vulnerabilities (CVE)

Filtered by vendor Pega Subscribe
Filtered by product Pega Platform
Total 17 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-16388 1 Pega 1 Pega Platform 2024-08-05 4.0 MEDIUM 4.3 MEDIUM
PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect
CVE-2019-16387 1 Pega 1 Pega Platform 2024-08-05 5.5 MEDIUM 8.1 HIGH
PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request while using a low-privilege account. (This can perform actions and retrieve data that only an administrator should have access to.) NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect
CVE-2019-16386 1 Pega 1 Pega Platform 2024-08-05 4.0 MEDIUM 4.3 MEDIUM
PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect
CVE-2023-32090 1 Pega 1 Pega Platform 2024-02-28 N/A 9.8 CRITICAL
Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials
CVE-2023-4843 1 Pega 1 Pega Platform 2024-02-28 N/A 4.8 MEDIUM
Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user.
CVE-2023-26465 1 Pega 1 Pega Platform 2024-02-28 N/A 6.1 MEDIUM
Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.
CVE-2023-28094 1 Pega 1 Pega Platform 2024-02-28 N/A 9.8 CRITICAL
Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials.
CVE-2022-35656 1 Pega 1 Pega Platform 2024-02-28 N/A 4.5 MEDIUM
Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.
CVE-2022-35654 1 Pega 1 Pega Platform 2024-02-28 N/A 6.1 MEDIUM
Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
CVE-2022-35655 1 Pega 1 Pega Platform 2024-02-28 N/A 6.1 MEDIUM
Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.
CVE-2020-15390 1 Pega 1 Pega Platform 2024-02-28 7.5 HIGH 9.8 CRITICAL
pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo.
CVE-2020-24353 1 Pega 1 Pega Platform 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header.
CVE-2020-23957 1 Pega 1 Pega Platform 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.
CVE-2020-8774 1 Pega 1 Pega Platform 2024-02-28 6.8 MEDIUM 8.8 HIGH
Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability in the "ActionStringID" function.
CVE-2017-17478 1 Pega 1 Pega Platform 2024-02-28 3.5 LOW 4.8 MEDIUM
An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2. A user with developer credentials can insert malicious code (up to 64 characters) into a text field in Designer Studio, after establishing context. Designer Studio is the developer workbench for Pega Platform. That XSS payload will execute when other developers visit the affected pages.
CVE-2017-11356 1 Pega 1 Pega Platform 2024-02-28 4.0 MEDIUM 6.5 MEDIUM
The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sensitive configuration information by leveraging a missing access control.
CVE-2017-11355 1 Pega 1 Pega Platform 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to the main page; the (2) beanReference parameter to the JavaBean viewer page; or the (3) pyTableName to the System database schema modification page.