Filtered by vendor Progress
Subscribe
Total
258 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-1403 | 1 Progress | 1 Openedge | 2026-06-17 | N/A | 10.0 CRITICAL |
| In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication. | |||||
| CVE-2024-12629 | 1 Progress | 1 Kendoreact | 2026-06-17 | N/A | 4.1 MEDIUM |
| In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection. | |||||
| CVE-2024-12251 | 1 Progress | 1 Telerik Ui For Winui | 2026-06-17 | N/A | 7.8 HIGH |
| In Progress Telerik UI for WinUI versions prior to 2025 Q1 (3.0.0), a command injection attack is possible through improper neutralization of hyperlink elements. | |||||
| CVE-2024-12108 | 2 Microsoft, Progress | 2 Windows, Whatsup Gold | 2026-06-17 | N/A | 9.6 CRITICAL |
| In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API. | |||||
| CVE-2024-12106 | 1 Progress | 1 Whatsup Gold | 2026-06-17 | N/A | 9.4 CRITICAL |
| In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings. | |||||
| CVE-2024-12105 | 1 Progress | 1 Whatsup Gold | 2026-06-17 | N/A | 6.5 MEDIUM |
| In WhatsUp Gold versions released before 2024.0.2, an authenticated user can use a specially crafted HTTP request that can lead to information disclosure. | |||||
| CVE-2024-11629 | 1 Progress | 1 Telerik Document Processing Libraries | 2026-06-17 | N/A | 7.1 HIGH |
| In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF. | |||||
| CVE-2024-11628 | 1 Progress | 1 Kendo Ui For Vue | 2026-06-17 | N/A | 4.1 MEDIUM |
| In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection. | |||||
| CVE-2024-11627 | 1 Progress | 1 Sitefinity | 2026-06-17 | N/A | 6.8 MEDIUM |
| : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421. | |||||
| CVE-2024-11626 | 1 Progress | 1 Sitefinity | 2026-06-17 | N/A | 8.4 HIGH |
| Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421. | |||||
| CVE-2024-11625 | 1 Progress | 1 Sitefinity | 2026-06-17 | N/A | 7.7 HIGH |
| Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421. | |||||
| CVE-2024-11343 | 1 Progress | 1 Telerik Document Processing Libraries | 2026-06-17 | N/A | 8.3 HIGH |
| In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access. | |||||
| CVE-2024-10013 | 1 Progress | 1 Telerik Ui For Winforms | 2026-06-17 | N/A | 7.8 HIGH |
| In Progress Telerik UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerability. | |||||
| CVE-2024-0833 | 1 Progress | 1 Telerik Test Studio | 2026-06-17 | N/A | 7.8 HIGH |
| In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system. | |||||
| CVE-2024-0832 | 1 Progress | 1 Telerik Reporting | 2026-06-17 | N/A | 7.8 HIGH |
| In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Reporting install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system. | |||||
| CVE-2024-0396 | 1 Progress | 1 Moveit Transfer | 2026-06-17 | N/A | 7.1 HIGH |
| In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modified transaction could lead to computational errors within MOVEit Transfer and potentially result in a denial of service. | |||||
| CVE-2024-0219 | 1 Progress | 1 Telerik Justdecompile | 2026-06-17 | N/A | 7.8 HIGH |
| In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik JustDecompile install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system. | |||||
| CVE-2023-6784 | 1 Progress | 1 Sitefinity | 2026-06-17 | N/A | 4.7 MEDIUM |
| A malicious user could potentially use the Sitefinity system for the distribution of phishing emails. | |||||
| CVE-2023-6595 | 1 Progress | 1 Whatsup Gold | 2026-06-17 | N/A | 7.5 HIGH |
| In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold. | |||||
| CVE-2023-6368 | 1 Progress | 1 Whatsup Gold | 2026-06-17 | N/A | 5.9 MEDIUM |
| In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold. | |||||