Softwareag

13 CVEs across 6 Softwareag products. Browse Softwareag vulnerabilities, severities, and proof-of-concept exploits.

Softwareag products with known CVEs

ProductCVEs
Mashzone Nextgen4
Aris2
Connx2
Quartz2
Webmethods2
Terracotta Server Oss1
Softwareag CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-66837Medium6.82026-01-07A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware
CVE-2025-66838Medium6.52026-01-07In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unr…
CVE-2023-6578High7.32023-12-07A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/…
CVE-2023-0925Critical9.82023-09-06Version 10.11 of webMethods OneData runs an embedded instance of Azul Zulu Java 11.0.15 which hosts a Java RMI registry (listening on TCP port 2099 by default)…
CVE-2023-39017Critical9.82023-07-28quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This…
CVE-2021-40650Medium6.52022-06-14In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set.
CVE-2021-40649Medium6.52022-06-14In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set.
CVE-2021-33207Critical9.82022-04-05The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code.
CVE-2021-33523High7.22022-03-30MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary c…
CVE-2021-33581High7.22022-03-30MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the…
CVE-2021-33208High7.22022-03-30The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file.
CVE-2020-35469Critical9.82020-12-16The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed using affected versions of the Terracott…
CVE-2019-13990Critical9.82019-07-26initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.