CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24083
https://notcve.org/view.php?id=CVE-2022-24083
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. Una vulnerabilidad de omisión de autenticación de contraseñas para cuentas locales puede ser usada para omitir las comprobaciones de autenticación local • https://support.pega.com/support-doc/pega-security-advisory-c22-vulnerability-%E2%80%93-hotfix-matrix-0 • CWE-285: Improper Authorization •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 2CVE-2022-24082 – Pega Platform 8.1.0 - Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2022-24082
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture. Si una instalación local de Pega Platform está configurada con el puerto de la interfaz JMX expuesto a Internet y el filtrado de puertos no está configurado apropiadamente, puede ser posible cargar cargas útiles serializadas para atacar el sistema subyacente. Esto no afecta a sistemas que son ejecutados en PegaCloud debido a su diseño y arquitectura. Pega Platform versions 8.1.0 through 8.7.3 suffer from a remote code execution vulnerability. • https://www.exploit-db.com/exploits/51099 http://packetstormsecurity.com/files/169480/Pega-Platform-8.7.3-Remote-Code-Execution.html https://support.pega.com/support-doc/pega-security-advisory-b22-vulnerability-%E2%80%93-hotfix-matrix-0 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27654
https://notcve.org/view.php?id=CVE-2021-27654
Forgotten password reset functionality for local accounts can be used to bypass local authentication checks. La funcionalidad Forgotten password reset para cuentas locales puede ser usada para omitir las comprobaciones de autenticación local • https://collaborate.pega.com/discussion/pega-security-advisory-c21 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43561
https://notcve.org/view.php?id=CVE-2021-43561
An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability. Se ha detectado un problema de tipo XSS en la extensión google_for_jobs (también se conoce como Google for Jobs) versiones anteriores a 1.5.1 y versiones 2.x anteriores a 2.1.1 para TYPO3. La extensión no codifica correctamente la entrada del usuario para la salida en el contexto HTML. • https://typo3.org/security/advisory/typo3-ext-sa-2021-015 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 6%CPEs: 1EXPL: 3CVE-2021-27651
https://notcve.org/view.php?id=CVE-2021-27651
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. En versiones 8.2.1 hasta 8.5.2 de Pega Infinity, la funcionalidad password reset para cuentas locales puede ser usada para omitir las comprobaciones de autenticación locales • https://github.com/samwcyo/CVE-2021-27651-PoC https://github.com/Vulnmachines/CVE-2021-27651 https://github.com/orangmuda/CVE-2021-27651 https://collaborate.pega.com/discussion/pega-security-advisory-a21-hotfix-matrix • CWE-287: Improper Authentication •