Advisories · Technology
Pegasystems Pega Infinity.
Every CVE that names Pegasystems Pega Infinity among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences becaus…
- Pegasystems Pega Infinity
- CWE-606
- CVSS 8.6 High
Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.
- Pegasystems Pega Infinity
- Weak cryptography or TLS
- CVSS 4.6 Medium
Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 7.1 High
Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.
- Pegasystems Pega Infinity
- Broken access control
- CVSS 4.8 Medium
Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access right…
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file.
- Pegasystems Pega Infinity
- Unrestricted file upload
- CVSS 5.3 Medium
Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated us…
- Pegasystems Pega Infinity
- CWE-204
- CVSS 6.5 Medium
Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data
- Pegasystems Pega Infinity
- Broken access control
- CVSS 5.5 Medium
Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 7.1 High
Cross-site scripting in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 8.1 High
Cross-site scripting in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-site scripting in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
Cross-site scripting in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 9.1 CriticalCritical · CVSS 9+
Code injection in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Code injection
- CVSS 5.2 Medium
Injection in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Other injection
- CVSS 5.5 Medium
Cross-site scripting in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
Cross-site scripting in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 8.0 High
Cross-site scripting in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Cross-site request forgery in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Cross-site request forgery (CSRF)
- CVSS 6.1 Medium
Cross-site scripting in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-site scripting in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper authorization in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Deserialization of untrusted data in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Insecure deserialization
- CVSS 8.8 High
Weak password recovery in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Improper authentication in Pegasystems Pega Infinity
- Pegasystems Pega Infinity
- Authentication bypass