Salesforce vulnerabilities and threats

32 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.2	EPSS 0.3%	CVE-2025-52453Salesforce Tableau Server · Server-Side Request Forgery (SSRF) High8.2EPSS 0.3%2025-07-25CVE Database V5CVE-2025-52453 Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.3%Vulnerability CWE-918	CVE Database V5	2025-07-25
High	8.5	EPSS 0.5%	CVE-2025-52452Salesforce Tableau Server · Path Traversal High8.5EPSS 0.5%2025-07-25CVE Database V5CVE-2025-52452 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows Absolute Path Traversal. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.5%Vulnerability CWE-22	CVE Database V5	2025-07-25
High	8.5	EPSS 0.3%	CVE-2025-52449Salesforce Tableau Server · Unrestricted File Upload High8.5EPSS 0.3%2025-07-25CVE Database V5CVE-2025-52449 Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.3%Vulnerability CWE-434	CVE Database V5	2025-07-25
High	8.1	EPSS 0.4%	CVE-2025-52448Salesforce Tableau Server · Insecure Direct Object Reference High8.1EPSS 0.4%2025-07-25CVE Database V5CVE-2025-52448 Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.4%Vulnerability CWE-639	CVE Database V5	2025-07-25
High	8.1	EPSS 0.4%	CVE-2025-52447Salesforce Tableau Server · Insecure Direct Object Reference High8.1EPSS 0.4%2025-07-25CVE Database V5CVE-2025-52447 Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.4%Vulnerability CWE-639	CVE Database V5	2025-07-25
High	8.0	EPSS 0.3%	CVE-2025-52446Salesforce Tableau Server · Insecure Direct Object Reference High8.0EPSS 0.3%2025-07-25CVE Database V5CVE-2025-52446 Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.3%Vulnerability CWE-639	CVE Database V5	2025-07-25
Medium	5.3	EPSS 0.4%	CVE-2025-43699Salesforce OmniStudio · Client-Side Enforcement of Server-Side Security Medium5.3EPSS 0.4%2025-06-10CVE Database V5CVE-2025-43699 Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission check. This impacts OmniStudio: before Spring 2025 EPSS 0.4%Vulnerability CWE-602	CVE Database V5	2025-06-10
Critical	9.1	EPSS 0.5%	CVE-2025-43698Salesforce OmniStudio · Improper Preservation of Permissions Critical9.1EPSS 0.5%2025-06-10CVE Database V5CVE-2025-43698 Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects. This impacts OmniStudio: before Spring 2025 EPSS 0.5%Vulnerability CWE-281	CVE Database V5	2025-06-10
High	7.5	EPSS 0.4%	CVE-2025-43697Salesforce OmniStudio · Improper Preservation of Permissions High7.5EPSS 0.4%2025-06-10CVE Database V5CVE-2025-43697 Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025 EPSS 0.4%Vulnerability CWE-281	CVE Database V5	2025-06-10
High	7.5	EPSS 0.4%	CVE-2025-43701Salesforce OmniStudio · Improper Preservation of Permissions High7.5EPSS 0.4%2025-06-10CVE Database V5CVE-2025-43701 Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: before version 254. EPSS 0.4%Vulnerability CWE-281	CVE Database V5	2025-06-10
High	7.5	EPSS 0.4%	CVE-2025-43700Salesforce OmniStudio · Improper Preservation of Permissions High7.5EPSS 0.4%2025-06-10CVE Database V5CVE-2025-43700 Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025. EPSS 0.4%Vulnerability CWE-281	CVE Database V5	2025-06-10
Medium	4.3	EPSS 0.3%	CVE-2024-32148Pardot (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.3%2024-06-11CVE Database V5CVE-2024-32148 Missing Authorization vulnerability in Salesforce Pardot.This issue affects Pardot: from n/a through 2.1.0. EPSS 0.3%Vulnerability Salesforce CWE-862	CVE Database V5	2024-06-11

Page 2 of 2