Salesforce vulnerabilities

43 vulnerabilities

Known vulnerabilities in Salesforce products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 14 products.

Products

Tableau Server14 vulnerabilities
Marketing Cloud Engagement5 vulnerabilities
Omnistudio5 vulnerabilities
Mule4 vulnerabilities
Agentforce Vibes3 vulnerabilities
Agentforce Vibes Extension3 vulnerabilities
Mulesoft Anypoint Code Builder3 vulnerabilities
Tough Cookie3 vulnerabilities
Mobile Software Development Kit1 vulnerabilities
Pardot1 vulnerabilities
Salesforce CLI1 vulnerabilities
Tableau Server, Tableau Desktop1 vulnerabilities
Uni2Ts1 vulnerabilities
Workbench1 vulnerabilities

CVE-2021-1630salesforcemule5y ago05-08-2021 20:29

EPSS score

1.07%

XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Cloud Foundry, Private Cloud Edition, and on-premise customers.CVE-2021-1627salesforcemule5y ago26-03-2021 16:17

EPSS score

1.08%

MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. This affects: Mule 3.8.x,3.9.x,4.x runtime released before February 2, 2021.CVE-2021-1626salesforcemule5y ago26-03-2021 16:17

EPSS score

2.10%

MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Versions affected: Mule 4.1.x and 4.2.x runtime released before February 2, 2021.CVE-2021-1628salesforcemule5y ago26-03-2021 16:19

EPSS score

1.24%

MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Affected versions: Mule 4.x runtime released before February 2, 2021.CVE-2016-1000232ibmapi_connect+38y ago05-09-2018 17:00

EPSS score

2.36%

NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.CVE-2016-15012forcedotcomsalesforcemobilesdk-windows+13y ago07-01-2023 12:59

EPSS score

0.69%

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in forcedotcom SalesforceMobileSDK-Windows up to 4.x. It has been rated as critical. This issue affects the function ComputeCountSql of the file SalesforceSDK/SmartStore/Store/QuerySpec.cs. The manipulation leads to sql injection. Upgrading to version 5.0.0 is able to address this issue. The patch is named 83b3e91e0c1e84873a6d3ca3c5887eb5b4f5a3d8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217619. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.CVE-2025-52451salesforcetableau server+11y ago22-08-2025 20:20

EPSS score

0.21%

Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-52447salesforcetableau server+11y ago25-07-2025 18:50

EPSS score

0.40%

Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-52449salesforcetableau server+11y ago25-07-2025 18:56

EPSS score

0.28%

Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-52452salesforcetableau server+11y ago25-07-2025 19:00

EPSS score

0.48%

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows Absolute Path Traversal. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-52446salesforcetableau server+11y ago25-07-2025 18:43

EPSS score

0.26%

Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-52450salesforcetableau server+11y ago22-08-2025 20:18

EPSS score

0.43%

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (abdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-52455salesforcetableau server+11y ago25-07-2025 19:11

EPSS score

0.37%

Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-52453salesforcetableau server+11y ago25-07-2025 19:05

EPSS score

0.33%

Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-52454salesforcetableau server+11y ago25-07-2025 19:08

EPSS score

0.33%

Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-52448salesforcetableau server+11y ago25-07-2025 18:53

EPSS score

0.40%

Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-26498salesforcetableau server+11y ago22-08-2025 20:16

EPSS score

0.29%

Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-26495salesforcetableau server+11y ago11-02-2025 17:56

EPSS score

0.34%

Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.CVE-2025-26494salesforcetableau server+11y ago11-02-2025 17:33

EPSS score

0.57%

Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server allows Authentication Bypass.This issue affects Tableau Server: from 2023.3 through 2023.3.5.CVE-2025-26496salesforcetableau server, tableau desktop+11y ago22-08-2025 20:10

EPSS score

0.21%

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.