Filtered by vendor Progress
Subscribe
Total
326 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-8651 | 1 Progress | 1 Moveit Transfer | 2026-10-25 | N/A | 3.7 LOW |
| Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3. | |||||
| CVE-2026-15724 | 1 Progress | 1 Sharefile Storage Zones Controller | 2026-10-24 | N/A | 8.7 HIGH |
| In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server. | |||||
| CVE-2026-13183 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-10-24 | N/A | 7.5 HIGH |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values. | |||||
| CVE-2026-13187 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-10-24 | N/A | 8.1 HIGH |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation. | |||||
| CVE-2026-13186 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-10-24 | N/A | 8.1 HIGH |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution. | |||||
| CVE-2026-13181 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-10-24 | N/A | 8.1 HIGH |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments. | |||||
| CVE-2026-13182 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-10-24 | N/A | 7.5 HIGH |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers. | |||||
| CVE-2026-13184 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-10-24 | N/A | 7.5 HIGH |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains. | |||||
| CVE-2026-13185 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-10-24 | N/A | 8.1 HIGH |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution. | |||||
| CVE-2026-65937 | 1 Progress | 1 Whatsup Gold | 2026-10-24 | N/A | 8.0 HIGH |
| In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content. | |||||
| CVE-2026-65940 | 1 Progress | 1 Whatsup Gold | 2026-10-24 | N/A | 6.8 MEDIUM |
| In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server. | |||||
| CVE-2026-65939 | 1 Progress | 1 Whatsup Gold | 2026-10-24 | N/A | 6.8 MEDIUM |
| In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root. | |||||
| CVE-2026-65938 | 1 Progress | 1 Whatsup Gold | 2026-10-24 | N/A | 4.3 MEDIUM |
| In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions. | |||||
| CVE-2026-65941 | 1 Progress | 1 Whatsup Gold | 2026-10-24 | N/A | 8.8 HIGH |
| In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account. | |||||
| CVE-2026-7327 | 1 Progress | 1 Marklogic Server | 2026-10-24 | N/A | 8.1 HIGH |
| An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-side data when it is accessed by a higher-privileged user. | |||||
| CVE-2026-7326 | 1 Progress | 1 Marklogic Server | 2026-10-24 | N/A | 7.5 HIGH |
| A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthorized changes to security configuration. | |||||
| CVE-2026-7329 | 1 Progress | 1 Marklogic Server | 2026-10-24 | N/A | 9.9 CRITICAL |
| An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access. | |||||
| CVE-2026-13190 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-10-24 | N/A | 8.1 HIGH |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution. | |||||
| CVE-2026-15966 | 1 Progress | 1 Moveit Transfer | 2026-10-24 | N/A | 7.5 HIGH |
| Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3. | |||||
| CVE-2026-14865 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-10-24 | N/A | 5.3 MEDIUM |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion. | |||||