CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-0332 – Progress UI for WinForms decompression path traversal vulnerability
https://notcve.org/view.php?id=CVE-2025-0332
12 Feb 2025 — In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an archive's content into a restricted directory. • https://docs.telerik.com/devtools/winforms/knowledge-base/kb-security-path-traversal-cve-2025-0332 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8316 – Progress UI for WPF format provider unsafe deserialization vulnerability
https://notcve.org/view.php?id=CVE-2024-8316
25 Sep 2024 — In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability. • https://docs.telerik.com/devtools/wpf/knowledge-base/unsafe-deserialization-cve-2024-8316 • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7576 – Progress UI for WPF format provider unsafe deserialization vulnerability
https://notcve.org/view.php?id=CVE-2024-7576
25 Sep 2024 — In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability. • https://docs.telerik.com/devtools/wpf/knowledge-base/unsafe-deserialization-cve-2024-7576 • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7575 – Improper neutralization special element in hyperlinks
https://notcve.org/view.php?id=CVE-2024-7575
25 Sep 2024 — In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements. • https://docs.telerik.com/devtools/wpf/knowledge-base/command-injection-cve-2024-7575 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-7679 – Improper neutralization special element in hyperlinks
https://notcve.org/view.php?id=CVE-2024-7679
25 Sep 2024 — In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements. • https://docs.telerik.com/devtools/winforms/knowledge-base/command-injection-cve-2024-7679 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 94%CPEs: 1EXPL: 12CVE-2024-4358 – Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
https://notcve.org/view.php?id=CVE-2024-4358
29 May 2024 — In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability. En Progress Telerik Report Server, versión 2024 Q1 (10.0.24.305) o anterior, en IIS, un atacante no autenticado puede obtener acceso a la funcionalidad restringida de Telerik Report Server a través de una vulnerabilidad de omisión de autenticación. This vulnerability allows remote attacke... • https://packetstorm.news/files/id/179406 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 2CVE-2021-28141
https://notcve.org/view.php?id=CVE-2021-28141
11 Mar 2021 — An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebResource.axd file. This may allow the attacker to gain unauthorized access to the server and execute code. To exploit, one must use the parameter _TSM_HiddenField_ and inject a command at the end of the URI. NOTE: the vendor states that this is not a vulnerability. • https://gist.github.com/shreyasfegade/e2480e26b2ed1d0c7175ecf7cb15f9c1 • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13661
https://notcve.org/view.php?id=CVE-2020-13661
05 Nov 2020 — Telerik Fiddler through 5.0.20202.18177 allows attackers to execute arbitrary programs via a hostname with a trailing space character, followed by --utility-and-browser --utility-cmd-prefix= and the pathname of a locally installed program. The victim must interactively choose the Open On Browser option. Fixed in version 5.0.20204. Telerik Fiddler versiones hasta 5.0.20202.18177, permite a atacantes ejecutar programas arbitrarios por medio de un nombre de host con un carácter de espacio final, seguido de --u... • https://www.nagenrauft-consulting.com/blog •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11414
https://notcve.org/view.php?id=CVE-2020-11414
31 Mar 2020 — An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. The RadUploadHandler class in RadUpload for Silverlight expects a web request that provides the file location of the uploading file along with a few other parameters. The uploading file location should be inside the directory where the upload handler class is defined. Before 2020.1.330, a crafted web request could result in uploads to arbitrary locations. Se detectó un problema en Progress Telerik UI for Silverlight versiones ... • https://docs.telerik.com/devtools/silverlight/controls/radupload/how-to/secure-upload-file-path • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19790
https://notcve.org/view.php?id=CVE-2019-19790
13 Dec 2019 — Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, or .WMF on the server through a specially crafted request. NOTE: RadChart was discontinued in 2014 in favor of RadHtmlChart. All RadChart versions were affected. To avoid this vulnerability, you must remove RadChart's HTTP handler from a web.config (its type is Telerik.Web.UI.ChartHttpHandler). El salto de ruta en RadChart en la interfaz ... • https://docs.telerik.com/devtools/aspnet-ajax/controls/chart/overview • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •