Progress Telerik Report Server vulnerabilities

7 vulnerabilities

Known vulnerabilities in Progress Telerik Report Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2025-0556progress softwaretelerik report server+1
EPSS score
0.31%
In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunnel, which can be subjected to local network traffic sniffing.9.9CVE-2024-1800progress software corporationtelerik report server+1
EPSS score
34.25%
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.5.3CVE-2024-4837progress softwaretelerik report server+1
EPSS score
0.43%
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability.8.8CVE-2024-7292progress software corporationtelerik report server+1
EPSS score
0.33%
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.7.1CVE-2024-7295progress software corporationtelerik report server+1
EPSS score
0.11%
In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information.9.9CVE-2024-6327progress software corporationtelerik report server+1
EPSS score
2.00%
In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.9.1CVE-2024-8015progress softwaretelerik reporting+1
EPSS score
0.82%
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.