Progress Vulnerabilities and Affected Products
Vulnerabilities associated with telerik_reporting.
Products
Clear product- MOVEit Transfer22 vulnerabilities
- whatsup_gold21 vulnerabilities
- LoadMaster11 vulnerabilities
- telerik_reporting8 vulnerabilities
- ws_ftp_server6 vulnerabilities
- openedge5 vulnerabilities
- whatsupgold5 vulnerabilities
- ui_for_wpf4 vulnerabilities
- moveit_transfer3 vulnerabilities
- ShareFile Storage Zones Controller3 vulnerabilities
- sitefinity3 vulnerabilities
- WhatsUp Gold3 vulnerabilities
- DataDirect Connect for JDBC Autonomous REST Connector2 vulnerabilities
- DataDirect Connect for JDBC for Amazon Redshift2 vulnerabilities
- DataDirect Connect for JDBC for Apache Cassandra2 vulnerabilities
- DataDirect Connect for JDBC for Apache Impala2 vulnerabilities
- DataDirect Connect for JDBC for Apache SparkSQL2 vulnerabilities
- DataDirect Connect for JDBC for DB22 vulnerabilities
- DataDirect Connect for JDBC for Google Analytics 42 vulnerabilities
- DataDirect Connect for JDBC for Google BigQuery2 vulnerabilities
- DataDirect Connect for JDBC for Greenplum2 vulnerabilities
- DataDirect Connect for JDBC for Hive2 vulnerabilities
- DataDirect Connect for JDBC for Informix2 vulnerabilities
- DataDirect Connect for JDBC for Microsoft Dynamics 3652 vulnerabilities
- DataDirect Connect for JDBC for Microsoft Sharepoint2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-7840HIGH | Improper neutralization special element in hyperlinksIn Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements. CWE-77Oct 9, 2024 | CVSS7.8v3.1 | EPSS0.659% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-6096HIGH | Unsafe Deserialization VulnerabilityIn Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability. CWE-470Jul 24, 2024 | CVSS8.8v3.1 | EPSS0.861% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-6327CRITICAL | Progress Telerik Report Server DeserializationIn Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability. CWE-502Jul 24, 2024 | CVSS9.9v3.1 | EPSS2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-4837MEDIUM | Trust Boundary Violation VulnerabilityIn Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability. CWE-200May 15, 2024 | CVSS5.3v3.1 | EPSS0.431% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-4200HIGH | Progress Telerik Reporting Local Deserialization VulnerabilityIn Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability. CWE-502May 15, 2024 | CVSS7.7v3.1 | EPSS0.292% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-4202HIGH | Progress Telerik Reporting Local Instantiation VulnerabilityIn Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability. CWE-94May 15, 2024 | CVSS7.7v3.1 | EPSS0.271% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-1856HIGH | Progress Telerik Reporting Remote Deserialization VulnerabilityIn Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability. CWE-502Mar 20, 2024 | CVSS8.5v3.1 | EPSS1.13% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-1801HIGH | Progress Telerik Reporting Local Deserialization VulnerabilityIn Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability. CWE-502Mar 20, 2024 | CVSS7.7v3.1 | EPSS0.422% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |