CVE-2021-27653

CVE-2021-27653 concerns a misconfiguration in the Pega Chat Access Group Portal on Pegasystem’s Pega Platform (versions 7.4.0–8.5.x) that can cause unintended data exposure. A connected ThreatPost report ties the CVE to a scenario where the portal defaults to admin credentials, enabling access ac...

CVE-2021-27653

Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure...

Pegasystem PEGA Platform 访问控制错误漏洞

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. An access control error vulnerability...

CVE-2021-27653

Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure...

Pegasystem Pega Platform Cross-Site Scripting Vulnerability (CNVD-2021-28267)

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. A cross-site scripting vulnerability...

CVE-2020-23957

Pega Platform through 8.4.x is affected by Cross Site Scripting XSS via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI...

CVE-2020-23957

Pega Platform through 8.4.x is affected by Cross Site Scripting XSS via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI...

Cross site scripting

Pega Platform through 8.4.x is affected by Cross Site Scripting XSS via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI...

CVE-2020-23957

Pega Platform through 8.4.x is affected by Cross Site Scripting XSS via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI...

CVE-2020-23957

CVE-2020-23957 affects Pegasystem Pega Platform up to version 8.4.x. The vulnerability is a Cross Site Scripting (XSS) flaw exploitable via the ConnectionID parameter, demonstrated by a request such as pyActivity=Data-TRACERSettings.pzStartTracerSession to a PRAuth URI. The provided connected doc...

Pega Platform through 跨站脚本漏洞

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. A cross-site scripting vulnerability...

Pegasystem Pega Platform Cross-Site Scripting Vulnerability (CNVD-2020-63481)

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. A cross-site scripting vulnerability...

CVE-2020-24353

Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header...

CVE-2020-24353

Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header...

Cross site request forgery (csrf)

Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header...

CVE-2020-24353

Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header...

Pegasystem PEGA Platform Resource Management Error Vulnerability

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. A resource management error...

CVE-2019-16374

Pega Platform 8.2.1 allows LDAP injection because a username can contain a character and can be of unlimited length. An attacker can specify four characters of a username, followed by the character, to bypass access control...

CVE-2019-16374

Pega Platform 8.2.1 allows LDAP injection because a username can contain a character and can be of unlimited length. An attacker can specify four characters of a username, followed by the character, to bypass access control...

Improper access control

Pega Platform 8.2.1 allows LDAP injection because a username can contain a character and can be of unlimited length. An attacker can specify four characters of a username, followed by the character, to bypass access control...