Browse CVEs

HIGH 8.1 CVE-2024-48646 An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validation. An att… Sage Frp 1000 No fix yet Fix from $1,9502024-10-30 HIGH 7.2 CVE-2024-48647 A file disclosure vulnerability exists in Sage 1000 v7.0.0. This vulnerability allows remote attackers to retrieve arbitrary files from the server's … Sage Frp 1000 No fix yet Fix from $1,9502024-10-30 MEDIUM 6.1 CVE-2024-48648 A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. This vulnerability allows attackers to inject malicious scripts… Sage Frp 1000 No fix yet Fix from $1,6002024-10-30 CRITICAL 9.8 CVE-2023-2809 Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQ… Sage 200 Spain Mitigation only Fix from $2,3002023-10-04 HIGH 7.2 CVE-2023-31867 Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. X3 Mitigation only Fix from $1,9502023-06-22 MEDIUM 5.4 CVE-2023-31868 Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application are dynamically built using user's inputs… X3 Mitigation only Fix from $1,6002023-06-22 CRITICAL 9.8 CVE-2022-41397 The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to en… Sage 300 after 2022 Fix from $2,3002023-04-28 CRITICAL 9.8 CVE-2022-41400 Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database… Sage 300 after 2022 Fix from $2,3002023-04-28 HIGH 7.8 CVE-2022-38583 On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a l… Sage 300 after 2022 Fix from $1,9502023-04-28 HIGH 7.5 CVE-2022-41398 The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. … Sage 300 after 2022 Fix from $1,9502023-04-28 HIGH 7.5 CVE-2022-41399 The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the dat… Sage 300 after 2022 Fix from $1,9502023-04-28 HIGH 7.5 CVE-2019-25053 A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of … Sage Frp 1000 2019-11+ Fix from $1,9502023-01-27 CRITICAL 9.0 CVE-2022-34322 Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the context of use… Sage Enterprise Intelligence No fix yet Fix from $2,3002023-01-01 HIGH 8.8 CVE-2022-34324EPSS 12% Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencie… Sage Xrt Business Exchange No fix yet Fix from $1,9502023-01-01 MEDIUM 5.4 CVE-2022-34323 Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context of other … Sage Xrt Business Exchange No fix yet Fix from $1,6002023-01-01 HIGH 7.8 CVE-2021-45492 In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-w… Sage 300 after 2022 Fix from $1,9502022-07-14 CRITICAL 9.8 CVE-2020-7388EPSS 69% Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an atta… Adxadmin 93.2.53+ Fix from $2,3002021-07-22 HIGH 7.2 CVE-2020-7389 Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by t… Syracuse 9.22.7.2 / 11.25.2.6+ Fix from $1,9502021-07-22 MEDIUM 5.4 CVE-2020-7390 Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email… Syracuse 12.10.0+ Fix from $1,6002021-07-22 MEDIUM 5.3 CVE-2020-7387EPSS 36% Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installati… Adxadmin 93.2.53+ Fix from $1,6002021-07-22 MEDIUM 5.4 CVE-2020-13893 Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or … Easypay Mitigation only Fix from $1,6002020-10-18 HIGH 8.8 CVE-2017-3183 Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full ac… Xrt Treasury Mitigation only Fix from $1,9502018-07-24 MEDIUM 6.8 CVE-2006-4712 Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a c… Sage No fix yet Fix from $1,6002006-09-12