Filtered by vendor Progress
Subscribe
Total
326 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-8037 | 1 Progress | 4 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 1 more | 2026-10-15 | N/A | 9.6 CRITICAL |
| OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints | |||||
| CVE-2021-41318 | 1 Progress | 1 Whatsup Gold | 2026-09-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser. | |||||
| CVE-2026-2514 | 1 Progress | 1 Flowmon Anomaly Detection System | 2026-09-03 | N/A | 6.1 MEDIUM |
| In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context. | |||||
| CVE-2026-2513 | 1 Progress | 1 Flowmon Anomaly Detection System | 2026-09-03 | N/A | 6.1 MEDIUM |
| A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session. | |||||
| CVE-2026-16139 | 1 Progress | 1 Sharefile Storage Zones Controller | 2026-09-02 | N/A | 7.2 HIGH |
| In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions. | |||||
| CVE-2026-16138 | 1 Progress | 1 Sharefile Storage Zones Controller | 2026-09-02 | N/A | 8.0 HIGH |
| In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host. | |||||
| CVE-2026-16137 | 1 Progress | 1 Sharefile Storage Zones Controller | 2026-09-02 | N/A | 7.2 HIGH |
| In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code. | |||||
| CVE-2017-11357 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-08-14 | 7.5 HIGH | 9.8 CRITICAL |
| Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code. | |||||
| CVE-2026-59686 | 1 Progress | 4 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 1 more | 2026-08-11 | N/A | 8.4 HIGH |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise. | |||||
| CVE-2026-59687 | 1 Progress | 4 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 1 more | 2026-08-11 | N/A | 8.4 HIGH |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise. | |||||
| CVE-2026-59688 | 1 Progress | 4 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 1 more | 2026-08-11 | N/A | 8.4 HIGH |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise. | |||||
| CVE-2026-59689 | 1 Progress | 4 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 1 more | 2026-08-11 | N/A | 8.0 HIGH |
| An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise. | |||||
| CVE-2026-59690 | 1 Progress | 5 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 2 more | 2026-08-11 | N/A | 8.0 HIGH |
| A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise. | |||||
| CVE-2025-13444 | 1 Progress | 5 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 2 more | 2026-08-10 | N/A | 8.4 HIGH |
| OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters | |||||
| CVE-2026-8486 | 1 Progress | 1 Moveit Automation | 2026-07-23 | N/A | 5.3 MEDIUM |
| Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7. | |||||
| CVE-2026-8487 | 1 Progress | 1 Moveit Automation | 2026-07-23 | N/A | 6.5 MEDIUM |
| Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7. | |||||
| CVE-2026-8485 | 1 Progress | 1 Moveit Automation | 2026-07-23 | N/A | 5.9 MEDIUM |
| Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7. | |||||
| CVE-2026-8488 | 1 Progress | 1 Moveit Automation | 2026-07-23 | N/A | 4.3 MEDIUM |
| Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7. | |||||
| CVE-2026-7313 | 1 Progress | 1 Sitefinity | 2026-07-22 | N/A | 8.7 HIGH |
| CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization. | |||||
| CVE-2026-7312 | 1 Progress | 1 Sitefinity | 2026-07-22 | N/A | 10.0 CRITICAL |
| CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration. | |||||