Michal Skowron

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

**Name of the Vulnerable Software and Affected Versions** Pega Platform versions 8.1.0 through 25.1.1 **Description** An HTML Injection issue exists in a user interface component. Exploitation requires a high privileged user with a developer role. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Micro Focus ArcSight Logger versions prior to 7.2.2 **Description** The issue affects Micro Focus ArcSight Logger, where potential vulnerabilities could be remotely exploited, resulting in Information Disclosure or Self Cross-Site Scripting (XSS). **Recommendations** For versions prior to 7.2.2, update to version 7.2.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Micro Focus ArcSight Logger versions prior to 7.2.2 **Description** The issue affects Micro Focus ArcSight Logger, where potential vulnerabilities could be remotely exploited, resulting in Information Disclosure or Self Cross-Site Scripting (XSS). **Recommendations** For versions prior to 7.2.2, update to version 7.2.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Oracle Business Intelligence Enterprise Edition versions 12.2.1.3.0 through 12.2.1.4.0 **Description** The issue is related to insufficient access control in the Analytics Actions component of Oracle Business Intelligence Enterprise Edition. It can be exploited by a remote attacker to gain unauthorized access to protected information or cause a denial of service using the HTTP protocol. Successful attacks may require human interaction and can impact additional products, resulting in unauthorized access to data and potential partial denial of service. **Recommendations** For versions 12.2.1.3.0 and 12.2.1.4.0, consider restricting access to the Analytics Actions component until a patch is available. As a temporary workaround, limit the use of the HTTP protocol to minimize the risk of exploitation. Restrict access to sensitive data and ensure that only authorized personnel have access to the Oracle Business Intelligence Enterprise Edition.