Vulnerabilidades exploradas (CISA KEV)

CVE-2026-8037 Crítica · 9.8 KEV Urgente · 70 Exploit público CWE-77 04/06/2026

Progress LoadMaster Command Injection Vulnerability

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

CVE-2024-6670 Crítica · 9.8 KEV Urgente · 90 Exploit público Ransomware CWE-89 29/08/2024

Progress WhatsUp Gold SQL Injection Vulnerability

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

CVE-2024-4885 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-22 25/06/2024

Progress WhatsUp Gold Path Traversal Vulnerability

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

CVE-2024-1212 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-78 21/02/2024

Progress Kemp LoadMaster OS Command Injection Vulnerability

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

CVE-2023-40044 Alta · 8.8 KEV Urgente · 89 Exploit público Ransomware CWE-502 27/09/2023

Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

CVE-2023-34362 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-89 02/06/2023

Progress MOVEit Transfer SQL Injection Vulnerability

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

CVE-2017-11357 Crítica · 9.8 KEV Urgente · 81 Exploit público Ransomware CWE-434 23/08/2017

Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

CVE-2017-9248 Crítica · 9.8 KEV Urgente · 71 Exploit público CWE-522 03/07/2017

Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.