Vulnerabilities > Pega

DATE CVE VULNERABILITY TITLE RISK
2023-06-22 CVE-2023-28094 Unspecified vulnerability in Pega Platform
Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials.
network
low complexity
pega
critical
9.8
2023-06-09 CVE-2023-26465 Cross-site Scripting vulnerability in Pega Platform
Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.
network
low complexity
pega CWE-79
6.1
2023-04-10 CVE-2023-26467 Insufficient Verification of Data Authenticity vulnerability in Pega Synchronization Engine
A man in the middle can redirect traffic to a malicious server in a compromised configuration.
network
high complexity
pega CWE-345
5.4
2023-04-10 CVE-2023-28093 Improper Certificate Validation vulnerability in Pega Synchronization Engine
A user with a compromised configuration can start an unsigned binary as a service.
network
low complexity
pega CWE-295
6.5
2022-07-19 CVE-2022-24082 Deserialization of Untrusted Data vulnerability in Pega Infinity
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system.
network
low complexity
pega CWE-502
critical
9.8
2022-01-28 CVE-2021-27654 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Pega Infinity
Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.
local
low complexity
pega CWE-640
4.6
2021-04-29 CVE-2021-27651 Improper Authentication vulnerability in Pega Infinity
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
network
low complexity
pega CWE-287
7.5
2021-04-12 CVE-2020-15390 Improper Privilege Management vulnerability in Pega Platform 8.4.0.237
pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo.
network
low complexity
pega CWE-269
7.5
2021-04-01 CVE-2021-27653 Unspecified vulnerability in Pega Infinity
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure.
network
low complexity
pega
4.0
2020-12-15 CVE-2020-23957 Cross-site Scripting vulnerability in Pega Platform 8.4/8.4.1/8.4.2
Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.
network
pega CWE-79
4.3