CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 1CVE-2024-2291 – MOVEit Transfer Logging Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2024-2291
20 Mar 2024 — In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly. • https://github.com/ASR511-OO7/CVE-2024-22917 • CWE-778: Insufficient Logging •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1856 – Progress Telerik Reporting Remote Deserialization Vulnerability
https://notcve.org/view.php?id=CVE-2024-1856
20 Mar 2024 — In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Telerik Reporting. Authentication is required to exploit this vulnerability. The specific flaw exists within the ObjectReader class. The issue results from the lack of proper validation of user-supplied data, wh... • https://docs.telerik.com/reporting/knowledge-base/deserialization-vulnerability-cve-2024-1801-cve-2024-1856 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1801 – Progress Telerik Reporting Local Deserialization Vulnerability
https://notcve.org/view.php?id=CVE-2024-1801
20 Mar 2024 — In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Telerik Reporting. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ObjectReader class. The i... • https://docs.telerik.com/reporting/knowledge-base/deserialization-vulnerability-cve-2024-1801-cve-2024-1856 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.9EPSS: 42%CPEs: 1EXPL: 3CVE-2024-1800 – Progress Telerik Report Server Deserialization
https://notcve.org/view.php?id=CVE-2024-1800
20 Mar 2024 — In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Telerik Report Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the ObjectReader class. The issue results from the lack of proper validation of user-supplied data, which can re... • https://packetstorm.news/files/id/179406 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-1636 – Potential Cross-Site Scripting (XSS) in the page editing area
https://notcve.org/view.php?id=CVE-2024-1636
28 Feb 2024 — Potential Cross-Site Scripting (XSS) in the page editing area. • https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-1632-and-CVE-2024-1636-February-2024 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 12%CPEs: 3EXPL: 0CVE-2024-1632 – Incorrect access control in the Sitefinity backend
https://notcve.org/view.php?id=CVE-2024-1632
28 Feb 2024 — Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area. • https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-1632-and-CVE-2024-1636-February-2024 • CWE-284: Improper Access Control •
CVSS: 10.0EPSS: 63%CPEs: 3EXPL: 1CVE-2024-1403 – Authentication Bypass in OpenEdge Authentication Gateway and AdminServer
https://notcve.org/view.php?id=CVE-2024-1403
27 Feb 2024 — In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication. En OpenEdge Authentication Gateway y AdminServer anteriores a 11.7.19, 12.2.14, 12.8.1 e... • https://github.com/horizon3ai/CVE-2024-1403 • CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 10.0EPSS: 92%CPEs: 3EXPL: 5CVE-2024-1212 – Progress Kemp LoadMaster OS Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-1212
21 Feb 2024 — Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. Los atacantes remotos no autenticados pueden acceder al sistema a través de la interfaz de administración de LoadMaster, lo que permite la ejecución arbitraria de comandos del sistema. Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interfa... • https://packetstorm.news/files/id/178305 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1474 – WS_FTP Server Reflected Cross-Site Scripting in Administrative Interface
https://notcve.org/view.php?id=CVE-2024-1474
21 Feb 2024 — In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface. En las versiones del servidor WS_FTP anteriores a la 8.8.5, se identificaron problemas de Cross-Site Scripting Reflejado en varias entradas proporcionadas por el usuario en la interfaz administrativa del servidor WS_FTP. • https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0833 – Privilege Elevation via Telerik Test Studio
https://notcve.org/view.php?id=CVE-2024-0833
31 Jan 2024 — In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system. En las versiones de Telerik Test Studio anteriores a la v2023.3.1330, se identificó una vulnerabilidad de elevación de privilegios en el comp... • https://docs.telerik.com/teststudio/knowledge-base/product-notices-kb/legacy-installer-vulnerability • CWE-269: Improper Privilege Management CWE-276: Incorrect Default Permissions •