CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24353
https://notcve.org/view.php?id=CVE-2020-24353
Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header. Pega Platform versiones anteriores a 8.4.0, presenta un problema de tipo XSS por medio de los parámetros de reglas de transmisión usados en el encabezado de la petición • https://community.pega.com/knowledgebase/products/platform/release-notes https://community.pega.com/knowledgebase/products/platform/resolved-issues?q=527502 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8774
https://notcve.org/view.php?id=CVE-2020-8774
Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability in the "ActionStringID" function. Pega Platform versiones anteriores a 8.2.6, está afectada por una vulnerabilidad de tipo Cross-Site Scripting Reflejado en la función "ActionStringID". • https://community.pega.com/node/1913996 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2019-16388
https://notcve.org/view.php?id=CVE-2019-16388
PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect ** EN DISPUTA ** PEGA Platform versión 8.3.0, es vulnerable a una divulgación de información por medio de una petición directa de prweb/sso/random_token/! • https://blog.cybercastrum.com/2019/11/25/cve-2019-16388 • CWE-425: Direct Request ('Forced Browsing') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-16387
https://notcve.org/view.php?id=CVE-2019-16387
PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request while using a low-privilege account. (This can perform actions and retrieve data that only an administrator should have access to.) NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. • https://blog.cybercastrum.com/2019/11/25/cve-2019-16387 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 1CVE-2019-16386
https://notcve.org/view.php?id=CVE-2019-16386
PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect ** EN DISPUTA ** PEGA Platform versiones 7.x y 8.x, es vulnerable a una divulgación de información por medio de una petición directa de prweb/sso/random_token/! • https://blog.cybercastrum.com/2019/11/25/cve-2019-16386 • CWE-425: Direct Request ('Forced Browsing') •