CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2023-45162 – Blind SQL vulnerability in 1E platform
https://notcve.org/view.php?id=CVE-2023-45162
13 Oct 2023 — Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Application of the relevant hotfix remediates this issue. for v8.1.2 apply hotfix Q23166 for v8.4.1 apply hotfix Q23164 for v9.0.1 apply hotfix Q23169 SaaS implementations on v23.7.1 will automatically have hotfix Q23173 applied. Customers with SaaS versions below this are urged to upgrade urgently - please contact 1E to arrange this Las versiones afectadas de 1E Platform tienen una vulnerabilid... • https://www.1e.com/trust-security-compliance/cve-info • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 5%CPEs: 6EXPL: 0CVE-2023-36825 – Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution
https://notcve.org/view.php?id=CVE-2023-36825
11 Jul 2023 — Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are... • https://github.com/orchidsoftware/platform/releases/tag/14.5.0 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-27225
https://notcve.org/view.php?id=CVE-2020-27225
09 Mar 2021 — In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process. En las versiones 4.18 y anteriores de la Eclipse Platform, el Subsistema de Ayuda no autentica unas peticiones de ayuda activas en el servidor web de ayuda local, permitiendo a un atacante local no autenticado... • https://bugs.eclipse.org/bugs/show_bug.cgi?id=569855 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15263 – XSS in platform
https://notcve.org/view.php?id=CVE-2020-15263
19 Oct 2020 — In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4. En platform versiones anteriores a 9.4.4, los atributos en línea no son escapados apropiadamente. Si los datos que provienen de los usuarios no se escaparon, entonces es posible una vulnerabilidad de tipo XSS. • https://github.com/orchidsoftware/platform/commit/03f9a113b1a70bc5075ce86a918707f0e7d82169 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-16374
https://notcve.org/view.php?id=CVE-2019-16374
13 Aug 2020 — Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be of unlimited length. An attacker can specify four characters of a username, followed by the * character, to bypass access control. Pega Platform versión 8.2.1, permite una inyección de LDAP porque un nombre de usuario puede contener un carácter * y puede ser de una longitud ilimitada. Un atacante puede especificar cuatro caracteres de un nombre de usuario, seguidos del carácter *, para omitir el control de acce... • https://community.pega.com/upgrade •
CVSS: 8.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8775
https://notcve.org/view.php?id=CVE-2020-8775
29 Apr 2020 — Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags. Pega Platform versiones anteriores a 8.2.6, está afectada por una vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado en las etiquetas de comentarios. • https://community.pega.com/knowledgebase/products/platform/resolved-issues?q=issue%20529706&f%5B0%5D=version%3A32536 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8773
https://notcve.org/view.php?id=CVE-2020-8773
29 Apr 2020 — The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. El Richtext Editor en Pega Platform versiones anteriores a 8.2.6, está afectado por una vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado. • https://community.pega.com/knowledgebase/products/platform/resolved-issues?q=issue%20529706&f%5B0%5D=version%3A32536 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •