CVE-2022-34322

Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the context of users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in the Notify Users About Modification menu and the Notifications feature. A user can send malicious notifications and execute JavaScript code in the browser of every user who has enabled notifications. This is a stored XSS, and can lead to privilege escalation in the context of the application. (Another issue is present in the Favorites tab. The name of a favorite or a folder of favorites is interpreted as HTML, and can thus embed JavaScript code, which is executed when displayed. This is a self-XSS.)

• CWE-79
• CWE-79

• https://www.synacktiv.com/sites/default/files/2022-12/sage_sei_multiple_xss.pdfExploit, Technical Description, Third Party Advisory
• https://www.synacktiv.com/sites/default/files/2022-12/sage_sei_multiple_xss.pdfExploit, Technical Description, Third Party Advisory

Published

Jan 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-34317 IBM CICS TX 11.1 is vulnerable to cross-site scripting. Thi…5.4
• CVE-2022-34318 IBM CICS TX 11.1 could allow a remote attacker to hijack th…6.1
• CVE-2022-34319IBM CICS TX 11.7 uses weaker than expected cryptographic alg…7.5
• CVE-2022-3432A potential vulnerability in a driver used during manufactur…6.7
• CVE-2022-34320 IBM CICS TX 11.1 uses weaker than expected cryptographic al…7.5
• CVE-2022-34321Improper Authentication vulnerability in Apache Pulsar Proxy…8.2
• CVE-2022-34323Multiple XSS issues were discovered in Sage XRT Business Exc…5.4
• CVE-2022-34324Multiple SQL injections in Sage XRT Business Exchange 12.4.3…8.8
• CVE-2022-34325DMA transactions which are targeted at input buffers used fo…7.8
• CVE-2022-34326In ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on…7.5
• CVE-2022-34328PMB 7.3.10 allows reflected XSS via the id parameter in an l…6.1
• CVE-2022-34329 IBM CICS TX 11.7 could allow an attacker to obtain sensitiv…5.3