5.9
CVSS
Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.
Severity: MEDIUM
📦
infinity
Vendor: pega
Actively Exploited
0
CISA KEV List
PoC / Exploits
2
Code Available
Total RCEs
2
Remote Access
Total CVEs
10
Total Indexed
Avg. EPSS
7.01%
Exploit Prob.
Security Vulnerability Index
Page 1 / 1
9.1
CVSS
CVE-2024-10094
RCE
Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code
Severity: CRITICAL
5.2
CVSS
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.
Severity: MEDIUM
5.5
CVSS
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.
Severity: MEDIUM
5.5
CVSS
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.
Severity: MEDIUM
9.8
CVSS
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.
Severity: CRITICAL
9.8
CVSS
CVE-2022-24082
RCE
Exploit Found
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.
Severity: CRITICAL
7.8
CVSS
Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.
Severity: HIGH
9.8
CVSS
CVE-2021-27651
Exploit Found
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
Severity: CRITICAL
6.6
CVSS
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure.
Severity: MEDIUM