Vendor
Progress Software
286 known vulnerabilities.
Products
158 results · Clear filters · Feed
-
High 8.8
Unsafe Deserialization Vulnerability
In Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability.
-
High 7.2CVE-2024-5016 EPSS 22%
WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability
In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. The vulnerability exists in the main message processing routines NmDistributed…
-
High 7.1
WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to e…
-
High 7.1
WhatsUp Gold GetASPReport Server-Side Request Forgery Information Disclosure
In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML form.
-
High 7.5
WhatsUp Gold InstallController Denial-of-Service Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible.
-
High 8.6
WhatsUp Gold Missing Authentication GetWindowsCredential Information Disclosure Vulnerability
In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials. This vulnerability allows unauthenticated attackers to disclose Windows Credentials stored in the product Credential Library.
-
High 7.5CVE-2024-5011 EPSS 47%
WhatsUp Gold TestController Chart denial of service vulnerability
In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists. A specially crafted unauthenticated HTTP request to the TestController Chart functionality can lead to denial of service.
-
High 7.5CVE-2024-5010 EPSS 70%
WhatsUp Gold TestController multiple information disclosure vulnerabilities
In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality. A specially crafted unauthenticated HTTP request can lead to a disclosure of sensitive information.
-
High 8.4
WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.
-
High 8.8CVE-2024-5008 EPSS 17%
WhatsUp Gold APM Unrestricted File Upload Remote Code Execution Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController.
-
High 7.7
Progress Telerik Reporting Local Deserialization Vulnerability
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.
-
High 7.7
Progress Telerik Reporting Local Instantiation Vulnerability
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability.
-
High 7.2
Local code execution vulnerability in Telerik UI for WinForms
A local code execution vulnerability is possible in Telerik UI for WinForms beginning in v2021.1.122 but prior to v2024.2.514. This vulnerability could allow an untrusted theme assembly to execute arbitrary code on the local Windows system.
-
High 7.5
LoadMaster Hardcoded SSH Key
Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner commun…
-
High 7.5CVE-2024-2449 EPSS 13%
LoadMaster Cross-Site Request Forgery (CSRF)
A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party s…
-
High 8.4CVE-2024-2448 EPSS 55%
LoadMaster Command Injection Vulnerability
An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection.
-
High 8.5
Progress Telerik Reporting Remote Deserialization Vulnerability
In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability.
-
High 7.7
Progress Telerik Reporting Local Deserialization Vulnerability
In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.
-
High 8.0
Potential Cross-Site Scripting (XSS) in the page editing area
Potential Cross-Site Scripting (XSS) in the page editing area.
-
High 8.8
Incorrect access control in the Sitefinity backend
Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area.
-
High 7.8
Privilege Elevation via Telerik Test Studio
In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower privileged user has th…
-
High 7.8
Privilege Elevation via Telerik Reporting Installer
In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Reporting install is present, a lower privileged user has the ability…
-
High 7.8
Privilege Elevation via Telerik JustDecompile Installer
In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik JustDecompile install is present, a lower privileged user has the…
-
High 7.5
Progress Application Server (PAS) for OpenEdge Denial of Service
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0 . An attacker who can produce a malformed web request may cause the crash of a PASOE agent pot…
-
High 7.1
Missing Server-Side Input Validation in HTTP Parameter
In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modifi…
-
High 7.5CVE-2023-6595 Public exploit
WhatsUp Gold Unauthenticated Access to an API Endpoint
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.
-
High 7.6
WhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Roles. If a WhatsUp Gold user interacts with the crafte…
-
High 7.6
WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert Center
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Alert Center. If a WhatsUp Gold user interacts with the…
-
High 7.6
WhatsUp Gold Stored Cross-Site Scripting (XSS) via Device Groups
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a device group. If a WhatsUp Gold user interacts with t…
-
High 7.6
WhatsUp Gold Stored Cross-Site Scripting (XSS) via Dashboard
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a dashboard component. If a WhatsUp Gold user interact…
-
High 7.2
MOVEit Transfer Group Admin Privilege Escalation
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group …
-
High 7.1
MOVEit Transfer XSS via MOVEit Gateway
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attac…
-
High 8.8
InSpec Archive Command Vulnerable to Maliciously Crafted Profile
Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.
-
High 8.3
WS_FTP Server Stored Cross-Site Scripting Vulnerability
In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site s…
-
High 8.2
WS_FTP Server SQL Injection via Administrative Interface
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alte…
-
High 8.3
WS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting Vulnerability
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload …
-
High 7.2
MOVEit Transfer System Administrator SQL Injection
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administra…
-
High 8.8
MOVEit Transfer Machine Interface SQL Injection
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attac…