Vulnerabilities > Sage

DATE CVE VULNERABILITY TITLE RISK
2023-10-04 CVE-2023-2809 Cleartext Storage of Sensitive Information vulnerability in Sage 200 Spain 2023.38.001
Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application.
network
low complexity
sage CWE-312
critical
9.8
2023-06-22 CVE-2023-31867 Improper Neutralization of Formula Elements in a CSV File vulnerability in Sage X3 12.14.0.500
Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.
network
low complexity
sage CWE-1236
7.2
2023-06-22 CVE-2023-31868 Cross-site Scripting vulnerability in Sage X3 12.14.0.500
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS).
network
low complexity
sage CWE-79
5.4
2023-05-16 CVE-2023-29927 Unspecified vulnerability in Sage 300 2020/2021/2022
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side.
network
low complexity
sage
4.3
2023-04-28 CVE-2022-38583 Incorrect Default Permissions vulnerability in Sage 300 2020/2021/2022
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator.
local
low complexity
sage CWE-276
7.8
2023-04-28 CVE-2022-41397 Use of Hard-coded Credentials vulnerability in Sage 300 2020/2021/2022
The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to encrypt and decrypt secrets stored in configuration files and in database tables.
network
low complexity
sage CWE-798
critical
9.8
2023-04-28 CVE-2022-41398 Use of Hard-coded Credentials vulnerability in Sage 300 2020/2021/2022
The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance.
network
low complexity
sage CWE-798
7.5
2023-04-28 CVE-2022-41399 Use of Hard-coded Credentials vulnerability in Sage 300 2020/2021/2022
The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml".
network
low complexity
sage CWE-798
7.5
2023-04-28 CVE-2022-41400 Use of Hard-coded Credentials vulnerability in Sage 300 2020/2021/2022
Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory.
network
low complexity
sage CWE-798
critical
9.8
2023-01-27 CVE-2019-25053 Path Traversal vulnerability in Sage FRP 1000
A path traversal vulnerability exists in Sage FRP 1000 before November 2019.
network
low complexity
sage CWE-22
7.5