Vendor
Progress Software
285 known vulnerabilities.
Products
285 results · Feed
-
High 7.7
Progress Telerik Reporting Local Deserialization Vulnerability
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.
-
High 7.7
Progress Telerik Reporting Local Instantiation Vulnerability
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability.
-
High 7.2
Local code execution vulnerability in Telerik UI for WinForms
A local code execution vulnerability is possible in Telerik UI for WinForms beginning in v2021.1.122 but prior to v2024.2.514. This vulnerability could allow an untrusted theme assembly to execute arbitrary code on the local Windows system.
-
Medium 5.4
WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via HttpMonitorSettings
In WhatsUp Gold versions released before 2023.1.2 , an SSRF vulnerability exists in Whatsup Gold's Issue exists in the HTTP Monitoring functionality. Due to the lack of proper authorization, any authenticated user can access the HTTP monitoring functionality…
-
Medium 4.2
WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconController
In WhatsUp Gold versions released before 2023.1.2 , a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send arbitrary HTTP requests on behalf of the vulnerable server.
-
High 7.5
LoadMaster Hardcoded SSH Key
Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner commun…
-
Medium 6.4
LoadMaster Reversible Password Encryption Algorithm
Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system.
-
Critical 10.0
Flowmon Unauthenticated Command Injection Vulnerability
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary syste…
-
High 7.5CVE-2024-2449 EPSS 13%
LoadMaster Cross-Site Request Forgery (CSRF)
A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party s…
-
High 8.4CVE-2024-2448 EPSS 55%
LoadMaster Command Injection Vulnerability
An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection.
-
Medium 4.3
MOVEit Transfer Logging Bypass Vulnerability
In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging me…
-
High 8.5
Progress Telerik Reporting Remote Deserialization Vulnerability
In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability.
-
High 7.7
Progress Telerik Reporting Local Deserialization Vulnerability
In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.
-
Critical 9.9
Progress Telerik Report Server Deserialization
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.
-
High 8.0
Potential Cross-Site Scripting (XSS) in the page editing area
Potential Cross-Site Scripting (XSS) in the page editing area.
-
High 8.8
Incorrect access control in the Sitefinity backend
Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area.
-
Critical 10.0
LoadMaster Pre-Authenticated OS Command Injection
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
KEV Nov 18, 2024 -
High 7.8
Privilege Elevation via Telerik Test Studio
In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower privileged user has th…
-
High 7.8
Privilege Elevation via Telerik Reporting Installer
In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Reporting install is present, a lower privileged user has the ability…
-
High 7.8
Privilege Elevation via Telerik JustDecompile Installer
In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik JustDecompile install is present, a lower privileged user has the…
-
High 7.5
Progress Application Server (PAS) for OpenEdge Denial of Service
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0 . An attacker who can produce a malformed web request may cause the crash of a PASOE agent pot…
-
Critical 9.1
Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to…
-
High 7.1
Missing Server-Side Input Validation in HTTP Parameter
In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modifi…
-
Medium 4.7
Potential Use of the Sitefinity System for Distribution of Phishing Emails
A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.
-
Medium 5.9
WhatsUp Gold Unauthenticated Access to an API Endpoint
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold.
-
High 7.5CVE-2023-6595 Public exploit
WhatsUp Gold Unauthenticated Access to an API Endpoint
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.
-
High 7.6
WhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Roles. If a WhatsUp Gold user interacts with the crafte…
-
High 7.6
WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert Center
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Alert Center. If a WhatsUp Gold user interacts with the…
-
High 7.6
WhatsUp Gold Stored Cross-Site Scripting (XSS) via Device Groups
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a device group. If a WhatsUp Gold user interacts with t…
-
High 7.6
WhatsUp Gold Stored Cross-Site Scripting (XSS) via Dashboard
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a dashboard component. If a WhatsUp Gold user interact…
-
High 7.2
MOVEit Transfer Group Admin Privilege Escalation
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group …
-
High 7.1
MOVEit Transfer XSS via MOVEit Gateway
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attac…
-
Critical 9.1
WS_FTP Server Arbitrary File Upload
In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying o…
-
High 8.8
InSpec Archive Command Vulnerable to Maliciously Crafted Profile
Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.
-
Critical 9.9
Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application
Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.
-
Medium 5.3
WS_FTP Server Information Disclosure via Directory Listing
In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing.
-
Medium 6.8
WS_FTP Server Cross-Site Request Forgery (CSRF) Vulnerability
In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server administrative function.
-
High 8.3
WS_FTP Server Stored Cross-Site Scripting Vulnerability
In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site s…
-
High 8.2
WS_FTP Server SQL Injection via Administrative Interface
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alte…
-
High 8.3
WS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting Vulnerability
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload …