Filtered by vendor Progress
Subscribe
Total
326 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-106151 | 1 Progress | 1 Kendo Ui | 2026-10-20 | N/A | 5.4 MEDIUM |
| In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when the user triggers validation. Successful exploitation can execute JavaScript in a user's browser and compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015. | |||||
| CVE-2026-106153 | 1 Progress | 1 Kendo Ui | 2026-10-20 | N/A | 5.4 MEDIUM |
| In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data. | |||||
| CVE-2026-108116 | 1 Progress | 1 Kendo Ui | 2026-10-20 | N/A | 7.5 HIGH |
| In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection. | |||||
| CVE-2026-106147 | 1 Progress | 1 Kendo Ui | 2026-10-20 | N/A | 5.4 MEDIUM |
| In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute JavaScript in a user's browser when the affected list item is rendered. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015. | |||||
| CVE-2026-106148 | 1 Progress | 1 Kendo Ui | 2026-10-20 | N/A | 5.4 MEDIUM |
| In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected component renders the image. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015. | |||||
| CVE-2026-106157 | 1 Progress | 1 Kendo Ui | 2026-10-20 | N/A | 4.7 MEDIUM |
| In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected item is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015. | |||||
| CVE-2026-106158 | 1 Progress | 1 Kendo Ui | 2026-10-20 | N/A | 4.7 MEDIUM |
| In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected event is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015. | |||||
| CVE-2026-89067 | 1 Progress | 1 Moveit Transfer | 2026-10-19 | N/A | 8.8 HIGH |
| Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||
| CVE-2026-89068 | 1 Progress | 1 Moveit Transfer | 2026-10-19 | N/A | 8.1 HIGH |
| Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||
| CVE-2026-89069 | 1 Progress | 1 Moveit Transfer | 2026-10-19 | N/A | 8.0 HIGH |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||
| CVE-2026-89070 | 1 Progress | 1 Moveit Transfer | 2026-10-19 | N/A | 7.5 HIGH |
| Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||
| CVE-2026-89071 | 1 Progress | 1 Moveit Transfer | 2026-10-19 | N/A | 7.5 HIGH |
| Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||
| CVE-2026-89072 | 1 Progress | 1 Moveit Transfer | 2026-10-19 | N/A | 7.5 HIGH |
| Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||
| CVE-2026-89073 | 1 Progress | 1 Moveit Transfer | 2026-10-19 | N/A | 7.5 HIGH |
| Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||
| CVE-2026-89074 | 1 Progress | 1 Moveit Transfer | 2026-10-19 | N/A | 7.5 HIGH |
| Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||
| CVE-2026-89075 | 1 Progress | 1 Moveit Transfer | 2026-10-19 | N/A | 7.3 HIGH |
| Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||
| CVE-2026-89076 | 1 Progress | 1 Moveit Transfer | 2026-10-19 | N/A | 7.2 HIGH |
| Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||
| CVE-2026-89077 | 1 Progress | 1 Moveit Transfer | 2026-10-19 | N/A | 7.5 HIGH |
| Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||
| CVE-2025-13147 | 1 Progress | 1 Moveit Transfer | 2026-10-18 | N/A | 5.3 MEDIUM |
| Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4. | |||||
| CVE-2026-87093 | 1 Progress | 1 Moveit Transfer | 2026-10-16 | N/A | 8.8 HIGH |
| Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | |||||