Hitachi ABB Power Grids eSOMS Telerik

Summary

Vulnerabilities 7

• Critical 9.8
  CVE-2017-11317 Exploited Public exploit EPSS 84%

  Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUploa…

  Aug 23, 2017

  KEV Apr 11, 2022
• Critical 9.8
  CVE-2017-11357 Exploited · Ransomware Public exploit EPSS 78%

  Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which …

  Aug 23, 2017

  KEV Jan 26, 2023
• Critical 9.8
  CVE-2017-9248 Exploited Public exploit EPSS 75%

  Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does no…

  Jul 3, 2017

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2019-18935 Exploited · Ransomware Public exploit EPSS 100%

  Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncU…

  Dec 11, 2019

  KEV Nov 3, 2021
• Unscored —
  CVE-2014-2217

  Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX b…

  Dec 25, 2014
• Unscored —
  CVE-2014-4958

  Cross-site scripting (XSS) vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20…

  Sep 26, 2014
• Unscored —
  CVE-2019-19790

  Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with ext…

  Dec 13, 2019

Revision history

1. 2021-03-18 #1

   ICSA-21-077-03 Hitachi ABB Power Grids eSOMS Telerik

References

• ICS Advisory ICSA-21-077-03 Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-21-077-03
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B