Skip to content
Noroxi

Sage records

28 published records for vendor sage.

Researcher profile

Entered KEV
0 · 0%
Weaponized
2 · 7.1%
Pre-auth RCE
2
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

28 records
  • CVE-2020-7388
    60This week

    Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing

    CriticalCVSS 9.8WeaponizedEPSS 69%

    sage · adxadminJul 22, 2021

  • CVE-2020-7387
    60This week

    Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized Actor

    MediumCVSS 5.3WeaponizedEPSS 34%

    sage · adxadminJul 22, 2021

  • CVE-2022-34324
    39Monitor

    Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add

    HighCVSS 8.8No exploitEPSS 11%

    sage · sage xrt business exchangeJan 1, 2023

  • CVE-2022-41397
    39Monitor

    The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKe

    CriticalCVSS 9.8No exploitEPSS 0%

    sage · sage 300Apr 28, 2023

  • CVE-2022-41400
    39Monitor

    Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM

    CriticalCVSS 9.8No exploitEPSS 0%

    sage · sage 300Apr 28, 2023

  • CVE-2023-2809
    39Monitor

    Use of Cleartext credentials in Sage 200 Spain

    CriticalCVSS 9.8No exploitEPSS 0%

    sage · sage 200 spainOct 4, 2023

  • CVE-2017-3183
    36Monitor

    Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to pri

    HighCVSS 8.8No exploitEPSS 2%

    sage · xrt treasuryJul 24, 2018

  • CVE-2022-34322
    36Monitor

    Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the conte

    CriticalCVSS 9.0No exploitEPSS 0%

    sage · sage enterprise intelligenceJan 1, 2023

  • CVE-2024-48646
    32Monitor

    An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validatio

    HighCVSS 8.1No exploitEPSS 0%

    sage · sage frp 1000Oct 30, 2024

  • CVE-2021-45492
    31Monitor

    In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the

    HighCVSS 7.8No exploitEPSS 0%

    sage · sage 300Jul 14, 2022

  • CVE-2022-38583
    31Monitor

    On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configura

    HighCVSS 7.8No exploitEPSS 0%

    sage · sage 300Apr 28, 2023

  • CVE-2019-25053
    30Monitor

    A path traversal vulnerability exists in Sage FRP 1000 before November 2019.

    HighCVSS 7.5No exploitEPSS 1%

    sage · sage frp 1000Jan 27, 2023

  • CVE-2022-41399
    30Monitor

    The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decryp

    HighCVSS 7.5No exploitEPSS 0%

    sage · sage 300Apr 28, 2023

  • CVE-2022-41398
    30Monitor

    The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr i

    HighCVSS 7.5No exploitEPSS 0%

    sage · sage 300Apr 28, 2023

  • CVE-2020-7389
    29Monitor

    Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment

    HighCVSS 7.2No exploitEPSS 2%

    sage · syracuseJul 22, 2021

  • CVE-2006-4712
    28Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScri

    MediumCVSS 6.8No exploitEPSS 2%

    sage · sageSep 12, 2006

  • CVE-2024-48647
    28Monitor

    A file disclosure vulnerability exists in Sage 1000 v7.0.0.

    HighCVSS 7.2No exploitEPSS 0%

    sage · sage frp 1000Oct 30, 2024

  • CVE-2023-31867
    28Monitor

    Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.

    HighCVSS 7.2No exploitEPSS 0%

    sage · x3Jun 22, 2023

  • CVE-2024-48648
    24Monitor

    A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0.

    MediumCVSS 6.1No exploitEPSS 0%

    sage · sage frp 1000Oct 30, 2024

  • CVE-2003-1242
    22Monitor

    Sage 1.0 b3 allows remote attackers to obtain the root web server path via a URL request for a non-existent module, which returns the path i

    MediumCVSS 5.0Proof of conceptEPSS 6%

    sage · sageDec 31, 2003

  • CVE-2020-7390
    21Monitor

    Sage X3 Syracuse Persistent XSS in Edit User page

    MediumCVSS 5.4No exploitEPSS 0%

    sage · syracuseJul 22, 2021

  • CVE-2020-13893
    21Monitor

    Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web s

    MediumCVSS 5.4No exploitEPSS 0%

    sage · easypayOct 18, 2020

  • CVE-2022-34323
    21Monitor

    Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context

    MediumCVSS 5.4No exploitEPSS 0%

    sage · sage xrt business exchangeJan 1, 2023

  • CVE-2023-31868
    21Monitor

    Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS).

    MediumCVSS 5.4No exploitEPSS 0%

    sage · x3Jun 22, 2023

  • CVE-2003-1243
    18Monitor

    Cross-site scripting vulnerability (XSS) in Sage 1.0 b3 allows remote attackers to insert arbitrary HTML or web script via the mod parameter

    MediumCVSS 4.3Proof of conceptEPSS 3%

    sage · sageDec 31, 2003