Vulnerabilities > Pega

DATE CVE VULNERABILITY TITLE RISK
2023-06-22 CVE-2023-28094 Unspecified vulnerability in Pega Platform
Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials.
network
low complexity
pega
critical
9.8
2023-06-09 CVE-2023-26465 Cross-site Scripting vulnerability in Pega Platform
Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.
network
low complexity
pega CWE-79
6.1
2023-04-10 CVE-2023-26467 Insufficient Verification of Data Authenticity vulnerability in Pega Synchronization Engine
A man in the middle can redirect traffic to a malicious server in a compromised configuration.
network
high complexity
pega CWE-345
5.4
2023-04-10 CVE-2023-26466 Unspecified vulnerability in Pega Synchronization Engine
A user with non-Admin access can change a configuration file on the client to modify the Server URL.
local
low complexity
pega
7.8
2023-04-10 CVE-2023-28093 Improper Certificate Validation vulnerability in Pega Synchronization Engine
A user with a compromised configuration can start an unsigned binary as a service.
network
low complexity
pega CWE-295
6.5
2022-08-22 CVE-2022-35654 Cross-site Scripting vulnerability in Pega Platform 8.6
Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
network
low complexity
pega CWE-79
6.1
2022-08-22 CVE-2022-35655 Cross-site Scripting vulnerability in Pega Platform
Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.
network
low complexity
pega CWE-79
6.1
2022-08-22 CVE-2022-35656 Cross-Site Request Forgery (CSRF) vulnerability in Pega Platform
Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.
network
low complexity
pega CWE-352
4.5
2022-07-25 CVE-2022-24083 Unspecified vulnerability in Pega Infinity
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.
network
low complexity
pega
critical
9.8
2022-07-19 CVE-2022-24082 Deserialization of Untrusted Data vulnerability in Pega Infinity
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system.
network
low complexity
pega CWE-502
critical
9.8