Every CVE whose affected-product data names Sage Sage 300, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (7)
CVE-2022-41400 — CVSS 9.8 (critical): Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in…
CVE-2022-41397 — CVSS 9.8 (critical): The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key…
CVE-2022-38583 — CVSS 7.8 (high): On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network"…
CVE-2021-45492 — CVSS 7.8 (high): In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in…
CVE-2022-41398 — CVSS 7.5 (high): The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr…
CVE-2022-41399 — CVSS 7.5 (high): The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and…
CVE-2023-29927 — CVSS 4.3 (medium): Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users…