Vulnerabilidades de Progress
CVEs publicadas que afetam produtos de Progress: 106 registro(s), com severidade, exploração e correções.
Moveit Transfer 28Telerik Ui For Asp.net Ajax 17Loadmaster 13Connection Manager For Objectscale 12Ecs Connection Manager 12Marklogic Server 10Sharefile Storage Zones Controller 9Whatsup Gold 7Moveit Web Application Firewall 7Sitefinity 6Moveit Automation 6Flowmon Anomaly Detection System 4Flowmon 3DataDirect Connect for JDBC for MySQL 2DataDirect Connect for JDBC for Microsoft SQLServer 2DataDirect Connect for JDBC for Oracle Database 2DataDirect Connect for JDBC for Oracle Eloqua 2DataDirect Connect for JDBC for Oracle Sales Cloud 2DataDirect Connect for JDBC for Oracle Service Cloud 2DataDirect Connect for JDBC for PostgreSQL 2DataDirect Connect for JDBC for Progress OpenEdge 2DataDirect Connect for JDBC for Salesforce 2DataDirect Connect for JDBC for SAP HANA 2DataDirect Connect for JDBC for SAP S/4 HANA 2DataDirect Connect for JDBC for Sybase ASE 2DataDirect Connect for JDBC for Snowflake 2DataDirect Hybrid Data Pipeline Server 2DataDirect Hybrid Data Pipeline JDBC Driver 2DataDirect Hybrid Data Pipeline On Premises Connector 2DataDirect Hybrid Data Pipeline Docker 2DataDirect OpenAccess JDBC Driver 2DataDirect Connect for JDBC for Microsoft Sharepoint 2Multi-tenant Hypervisor 2DataDirect Connect for JDBC for Amazon Redshift 2DataDirect Connect for JDBC for Apache Cassandra 2DataDirect Connect for JDBC for Hive 2DataDirect Connect for JDBC for Apache Impala 2DataDirect Connect for JDBC for Apache SparkSQL 2DataDirect Connect for JDBC Autonomous REST Connector 2DataDirect Connect for JDBC for DB2 2
CVE-2024-4885
Crítica · 9.8
KEV Urgente · 73 Exploit público CWE-22 25/06/2024
Progress WhatsUp Gold Path Traversal Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The
WhatsUp.ExportUtilities.Export.GetFileWithoutZip
allows execution of commands with iisapppool\nmconsole privileges.
CVE-2024-1212
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-78 21/02/2024
Progress Kemp LoadMaster OS Command Injection Vulnerability
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
CVE-2023-40044
Alta · 8.8
KEV Urgente · 89 Exploit público Ransomware CWE-502 27/09/2023
Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
CVE-2023-34362
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-89 02/06/2023
Progress MOVEit Transfer SQL Injection Vulnerability
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
CVE-2017-11357
Crítica · 9.8
KEV Urgente · 81 Exploit público Ransomware CWE-434 23/08/2017
Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
CVE-2017-9248
Crítica · 9.8
KEV Urgente · 71 Exploit público CWE-522 03/07/2017
Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.