Vulnerabilidades de Progress
CVEs publicadas que afetam produtos de Progress: 65 registro(s), com severidade, exploração e correções.
Moveit Transfer 24Loadmaster 8Connection Manager For Objectscale 7Ecs Connection Manager 7Sitefinity 6Moveit Automation 6Sharefile Storage Zones Controller 5Flowmon Anomaly Detection System 4Telerik Ui For Asp.net Ajax 4Flowmon 3DataDirect Connect for JDBC for MySQL 2DataDirect Connect for JDBC for Microsoft Sharepoint 2DataDirect Connect for JDBC for MongoDB 2DataDirect OpenAccess JDBC Driver 2DataDirect Connect for JDBC for Oracle Database 2DataDirect Connect for JDBC for Oracle Eloqua 2DataDirect Connect for JDBC for Oracle Sales Cloud 2DataDirect Connect for JDBC for Oracle Service Cloud 2DataDirect Connect for JDBC for PostgreSQL 2DataDirect Connect for JDBC for Progress OpenEdge 2DataDirect Connect for JDBC for Salesforce 2DataDirect Connect for JDBC for SAP HANA 2DataDirect Connect for JDBC for SAP S/4 HANA 2DataDirect Connect for JDBC for Sybase ASE 2DataDirect Connect for JDBC for Snowflake 2DataDirect Hybrid Data Pipeline Server 2DataDirect Hybrid Data Pipeline JDBC Driver 2DataDirect Hybrid Data Pipeline On Premises Connector 2DataDirect Hybrid Data Pipeline Docker 2DataDirect Connect for JDBC for Apache Impala 2Moveit Web Application Firewall 2Whatsup Gold 2Multi-tenant Hypervisor 2DataDirect Connect for JDBC for Amazon Redshift 2DataDirect Connect for JDBC for Apache Cassandra 2DataDirect Connect for JDBC for Hive 2DataDirect Connect for JDBC for Microsoft SQLServer 2DataDirect Connect for JDBC for Apache SparkSQL 2DataDirect Connect for JDBC Autonomous REST Connector 2DataDirect Connect for JDBC for DB2 2
CVE-2026-8037
Crítica · 9.8
KEV Urgente · 70 Exploit público CWE-77 04/06/2026
Progress LoadMaster Command Injection Vulnerability
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
CVE-2026-7313
Média · 4.9
CWE-522 02/06/2026
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.
CVE-2026-7312
Alta · 7.5
CWE-522 02/06/2026
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration.
CVE-2026-7201
Alta · 8.8
CWE-639 02/06/2026
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.
CVE-2026-7198
Crítica · 9.8
CWE-284 02/06/2026
CWE-284: Improper Access Control in web services in Progress Sitefinity
CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations.
CVE-2026-7195
Alta · 8.1
CWE-20 02/06/2026
CWE-20: Improper Input Validation in web services in Progress Sitefinity
CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.
CVE-2026-8488
Alta · 7.5
CWE-770 20/05/2026
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.
This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
CVE-2026-8487
Alta · 7.5
CWE-276 20/05/2026
Incorrect default permissions vulnerability in Progress Software MOVEit Automation
Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data.
This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
CVE-2026-8486
Alta · 7.5
CWE-770 20/05/2026
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding.
This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
CVE-2026-8485
Alta · 7.5
CWE-789 20/05/2026
Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation
Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.
This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
CVE-2026-5174
Alta · 8.8
CWE-20 30/04/2026
Improper Access Control Vulnerability in Progress MOVEit Automation
Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation.
This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.
CVE-2026-4670
Crítica · 9.8
CWE-305 30/04/2026
Improper Authentication vulnerability in Progress MOVEit Automation
Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass.
This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.
CVE-2026-6023
Crítica · 9.8
CWE-502 22/04/2026
Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.
CVE-2026-6022
Alta · 7.5
CWE-400 22/04/2026
Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.
CVE-2026-4048
Alta · 7.2
CWE-77 20/04/2026
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.
CVE-2026-3519
Alta · 7.2
CWE-77 20/04/2026
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command
CVE-2026-3518
Alta · 7.2
CWE-77 20/04/2026
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command
CVE-2026-3517
Alta · 7.2
CWE-77 20/04/2026
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command
CVE-2026-3692
Alta · 8.8
CWE-78 02/04/2026
Unintended command execution during report generation in Progress Flowmon
In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server.
CVE-2026-2737
Média · 6.1
CWE-79 02/04/2026
Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web application
A vulnerability exists in Progress Flowmon versions prior to 12.5.8 and 13.0.6, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.
CVE-2026-2701
Alta · 8.8
CWE-434 02/04/2026
RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)
Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.
CVE-2026-2699
Crítica · 9.8
Exploit público CWE-284 02/04/2026
EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)
Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.
CVE-2026-2514
Média · 6.1
CWE-79 12/03/2026
Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application
In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.
CVE-2026-2513
Média · 6.1
CWE-79 12/03/2026
Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon ADS web application
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.
CVE-2026-2878
Média · 5.9
CWE-331 25/02/2026
Insufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on timestamp and filename, can enable collisions and file content tampering.