CVE Intelligence

Vulnerabilidades de Progress

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Progress: 55 registro(s), com severidade, exploração e correções.

Moveit Transfer 16Loadmaster 8Connection Manager For Objectscale 7Ecs Connection Manager 7Sitefinity 6Moveit Automation 6Sharefile Storage Zones Controller 5Telerik Ui For Asp.net Ajax 4Flowmon Anomaly Detection System 3DataDirect Connect for JDBC for MySQL 2DataDirect Connect for JDBC for Microsoft Sharepoint 2DataDirect Connect for JDBC for MongoDB 2DataDirect Connect for JDBC for Oracle Database 2DataDirect OpenAccess JDBC Driver 2DataDirect Connect for JDBC for Oracle Eloqua 2DataDirect Connect for JDBC for Oracle Sales Cloud 2DataDirect Connect for JDBC for Oracle Service Cloud 2DataDirect Connect for JDBC for PostgreSQL 2DataDirect Connect for JDBC for Progress OpenEdge 2DataDirect Connect for JDBC for Salesforce 2DataDirect Connect for JDBC for SAP HANA 2DataDirect Connect for JDBC for SAP S/4 HANA 2DataDirect Connect for JDBC for Sybase ASE 2DataDirect Connect for JDBC for Snowflake 2DataDirect Hybrid Data Pipeline Server 2DataDirect Hybrid Data Pipeline JDBC Driver 2DataDirect Hybrid Data Pipeline On Premises Connector 2DataDirect Hybrid Data Pipeline Docker 2DataDirect Connect for JDBC for Hive 2Moveit Web Application Firewall 2Whatsup Gold 2Flowmon 2Multi-tenant Hypervisor 2DataDirect Connect for JDBC for Amazon Redshift 2DataDirect Connect for JDBC for Apache Cassandra 2DataDirect Connect for JDBC for Microsoft SQLServer 2DataDirect Connect for JDBC for Apache Impala 2DataDirect Connect for JDBC for Apache SparkSQL 2DataDirect Connect for JDBC Autonomous REST Connector 2DataDirect Connect for JDBC for DB2 2

Somente exploradas (KEV) →

CVE-2026-89077 Alta · 7.5 CWE-303 14/10/2026
MOVEit Transfer Identity validation flaw in SFTP authentication
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89076 Alta · 7.2 CWE-89 14/10/2026
MOVEit Transfer SQL injection in custom reporting
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89075 Alta · 7.3 CWE-922 14/10/2026
MOVEit Transfer Local Disclosure of Session Information Vulnerability
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89074 Alta · 7.5 CWE-176 14/10/2026
MOVEit Transfer Email MFA Bypass
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89073 Alta · 7.5 CWE-613 14/10/2026
MOVEit Transfer Access restriction bypass in OAuth authentication
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89072 Alta · 7.5 CWE-863 14/10/2026
MOVEit Transfer Authorization Flaw in Certificate Management
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89071 Alta · 7.5 CWE-90 14/10/2026
MOVEit Transfer LDAP injection in certificate-based authentication
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89070 Alta · 7.5 CWE-294 14/10/2026
MOVEit Transfer OIDC Authentication Replay Vulnerability
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89069 Alta · 8.0 CWE-79 14/10/2026
MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89068 Alta · 8.1 CWE-304 14/10/2026
MOVEit Transfer Authentication bypass in LDAP sign-on
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-87093 Alta · 8.8 CWE-732 14/10/2026
MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89067 Alta · 8.8 CWE-288 14/10/2026
MOVEit Transfer Secure Messaging Authentication Bypass
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-93695 Alta · 7.4 CWE-22 12/10/2026
Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.
CVE-2026-93694 Média · 4.0 CWE-321 12/10/2026
Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
CVE-2026-93693 Média · 6.5 CWE-20 12/10/2026
Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.
CVE-2026-8037 Crítica · 9.8 KEV Urgente · 70 Exploit público CWE-77 04/06/2026
Progress LoadMaster Command Injection Vulnerability
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
CVE-2026-7313 Média · 4.9 CWE-522 02/06/2026
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.
CVE-2026-7312 Alta · 7.5 CWE-522 02/06/2026
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration.
CVE-2026-7201 Alta · 8.8 CWE-639 02/06/2026
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.
CVE-2026-7198 Crítica · 9.8 CWE-284 02/06/2026
CWE-284: Improper Access Control in web services in Progress Sitefinity
CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations.
CVE-2026-7195 Alta · 8.1 CWE-20 02/06/2026
CWE-20: Improper Input Validation in web services in Progress Sitefinity
CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.
CVE-2026-8488 Alta · 7.5 CWE-770 20/05/2026
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
CVE-2026-8487 Alta · 7.5 CWE-276 20/05/2026
Incorrect default permissions vulnerability in Progress Software MOVEit Automation
Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
CVE-2026-8486 Alta · 7.5 CWE-770 20/05/2026
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
CVE-2026-8485 Alta · 7.5 CWE-789 20/05/2026
Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation
Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.