CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-35656
https://notcve.org/view.php?id=CVE-2022-35656
Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly. La vulnerabilidad de Pega Platform versiones desde 8.3 a 8.7.3, puede permitir a administradores de seguridad autenticados alterar la configuración de tipo CSRF directamente. • https://support.pega.com/support-doc/pega-security-advisory-d22-e22-f22-vulnerabilities-%E2%80%93-hotfix-matrix • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-35655
https://notcve.org/view.php?id=CVE-2022-35655
Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting. Pega Platform versiones desde 7.3 a 8.7.3, está afectada por un problema de tipo XSS debido a una configuración errónea de un ajuste de la página de datos. • https://support.pega.com/support-doc/pega-security-advisory-d22-e22-f22-vulnerabilities-%E2%80%93-hotfix-matrix • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24353
https://notcve.org/view.php?id=CVE-2020-24353
Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header. Pega Platform versiones anteriores a 8.4.0, presenta un problema de tipo XSS por medio de los parámetros de reglas de transmisión usados en el encabezado de la petición • https://community.pega.com/knowledgebase/products/platform/release-notes https://community.pega.com/knowledgebase/products/platform/resolved-issues?q=527502 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8774
https://notcve.org/view.php?id=CVE-2020-8774
Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability in the "ActionStringID" function. Pega Platform versiones anteriores a 8.2.6, está afectada por una vulnerabilidad de tipo Cross-Site Scripting Reflejado en la función "ActionStringID". • https://community.pega.com/node/1913996 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2019-16388
https://notcve.org/view.php?id=CVE-2019-16388
PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect ** EN DISPUTA ** PEGA Platform versión 8.3.0, es vulnerable a una divulgación de información por medio de una petición directa de prweb/sso/random_token/! • https://blog.cybercastrum.com/2019/11/25/cve-2019-16388 • CWE-425: Direct Request ('Forced Browsing') •