Skip to content
Noroxi

pega records

50 published records for vendor pega.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
2%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

50 records
  • CVE-2021-27651
    55Plan

    In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentica

    CriticalCVSS 9.8Proof of conceptEPSS 53%

    pega · infinityApr 29, 2021

  • CVE-2022-24082
    43Plan

    If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filter

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    pega · infinityJul 19, 2022

  • CVE-2019-16374
    40Plan

    Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be of unlimited length.

    CriticalCVSS 9.8No exploitEPSS 1%

    pega · platformAug 13, 2020

  • CVE-2020-15390
    39Monitor

    pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo

    CriticalCVSS 9.8No exploitEPSS 1%

    pega · pega platformApr 12, 2021

  • CVE-2022-24083
    39Monitor

    Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.

    CriticalCVSS 9.8No exploitEPSS 0%

    pega · infinityJul 25, 2022

  • CVE-2023-32090
    39Monitor

    Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials

    CriticalCVSS 9.8No exploitEPSS 0%

    pega · pega platformAug 7, 2023

  • CVE-2023-28094
    39Monitor

    Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default creden

    CriticalCVSS 9.8No exploitEPSS 0%

    pega · pega platformJun 22, 2023

  • CVE-2024-10094
    39Monitor

    Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code

    CriticalCVSS 9.8No exploitEPSS 0%

    pega · infinityNov 20, 2024

  • CVE-2020-8775
    35Monitor

    Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags.

    HighCVSS 8.9No exploitEPSS 0%

    pega · platformApr 29, 2020

  • CVE-2020-8773
    35Monitor

    The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability.

    HighCVSS 8.9No exploitEPSS 0%

    pega · platformApr 29, 2020

  • CVE-2020-8774
    35Monitor

    Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability in the "ActionStringID" function.

    HighCVSS 8.8No exploitEPSS 0%

    pega · pega platformApr 29, 2020

  • CVE-2023-50165
    34Monitor

    Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents.

    HighCVSS 8.6No exploitEPSS 0%

    pega · platformJan 31, 2024

  • CVE-2019-16387
    32Monitor

    PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request

    HighCVSS 8.1No exploitEPSS 1%

    pega · pega platformNov 26, 2019

  • CVE-2021-27654
    31Monitor

    Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.

    HighCVSS 7.8No exploitEPSS 0%

    pega · infinityJan 28, 2022

  • CVE-2023-26466
    31Monitor

    A user with non-Admin access can change a configuration file on the client to modify the Server URL.

    HighCVSS 7.8No exploitEPSS 0%

    pega · synchronization engineApr 10, 2023

  • CVE-2023-50168
    30Monitor

    Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.

    HighCVSS 7.7No exploitEPSS 0%

    pega · pega platformMar 14, 2024

  • CVE-2017-11356
    27Monitor

    The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privil

    MediumCVSS 6.5Proof of conceptEPSS 3%

    pega · pega platformAug 2, 2017

  • CVE-2023-28093
    26Monitor

    A user with a compromised configuration can start an unsigned binary as a service.

    MediumCVSS 6.5No exploitEPSS 1%

    pega · synchronization engineApr 10, 2023

  • CVE-2025-9559
    26Monitor

    Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to

    MediumCVSS 6.5No exploitEPSS 0%

    pega · pega platformOct 16, 2025

  • CVE-2017-11355
    25Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web scri

    MediumCVSS 6.1Proof of conceptEPSS 2%

    pega · pega platformAug 2, 2017

  • CVE-2020-23957
    24Monitor

    Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-T

    MediumCVSS 6.1No exploitEPSS 0%

    pega · pega platformDec 15, 2020

  • CVE-2020-24353
    24Monitor

    Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header.

    MediumCVSS 6.1No exploitEPSS 0%

    pega · pega platformNov 9, 2020

  • CVE-2022-35654
    24Monitor

    Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.

    MediumCVSS 6.1No exploitEPSS 0%

    pega · pega platformAug 22, 2022

  • CVE-2022-35655
    24Monitor

    Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.

    MediumCVSS 6.1No exploitEPSS 0%

    pega · pega platformAug 22, 2022

  • CVE-2023-26465
    24Monitor

    Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.

    MediumCVSS 6.1No exploitEPSS 0%

    pega · pega platformJun 9, 2023