Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description

Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation

Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation

Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user.

Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials

Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials.

Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.

A man in the middle can redirect traffic to a malicious server in a compromised configuration.

A user with a compromised configuration can start an unsigned binary as a service.

A user with non-Admin access can change a configuration file on the client to modify the Server URL.