Threat database

In Progress Telerik UI for WinUI versions prior to 2025 Q1 (3.0.0), a command injection attack is possible through improper neutralization of hyperlink elements.

In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.

EPSS 0.7%VulnerabilityProgress Software#cwe-77Germany+6

In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.

EPSS 0.2%VulnerabilityProgress Software#cwe-470Germany+7

In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.

EPSS 0.6%VulnerabilityProgress Software#cwe-470Germany+5

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

KEVEPSS 93%VulnerabilityProgress Software Corporation#cwe-89United States+9

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

KEVEPSS 99%VulnerabilityProgress Software Corporation#cwe-22United States+10

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

KEVEPSS 97%VulnerabilityProgress Software Corporation#cwe-290United States+11

In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.  An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands.

EPSS 93%VulnerabilityProgress Software#cwe-78Germany+7

In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability.

EPSS 1.1%VulnerabilityProgress Software Corporation#cwe-502Germany+6

In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.

EPSS 0.4%VulnerabilityProgress Software Corporation#cwe-502Germany+7

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

KEVEPSS 95%VulnerabilityProgress Software#cwe-78United States+10

In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component.  In an environment where an existing Telerik JustDecompile install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system.

EPSS 0.2%VulnerabilityProgress Software#cwe-269Germany+7

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.

EPSS 0.6%VulnerabilityProgress Software Corporation#cwe-434Germany+8

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

KEVEPSS 90%VulnerabilityProgress Software Corporation#cwe-502Germany+9