Progress Software Corporation vulnerabilities, page 5

131 vulnerabilities

Known vulnerabilities in Progress Software Corporation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 15 products.

9.8CriticalCVE-2024-6671progress software corporation · whatsup gold +1 moreWhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass VulnerabilityIn WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.EPSS18.99%8.8HighCVE-2024-6672progress software corporation · whatsup gold +1 moreWhatsUp Gold getMonitorJoin SQL Injection Privilege Escalation VulnerabilityIn WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an authenticated low-privileged attacker to achieve privilege escalation by modifying a privileged user's password.EPSS0.71%5.3MediumCVE-2024-6097progress software corporation · progress® telerik® reporting +1 moreAbsolute Path Traversal VulnerabilityIn Progress® Telerik® Reporting versions prior to 2025 Q1 (19.0.25.211), information disclosure is possible by a local threat actor through an absolute path vulnerability.EPSS0.51%9.8CriticalCVE-2024-6096progress software corporation · telerik reporting +1 moreUnsafe Deserialization VulnerabilityIn Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability.EPSS0.87%9.8CriticalCVE-2024-6670progress software corporation · whatsup gold +1 moreWhatsUp Gold HasErrors SQL Injection Authentication Bypass VulnerabilityIn WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.KEVRansomwareEPSS93.00%9.6CriticalCVE-2024-12108progress software corporation · whatsup gold +1 moreWhatsUp Gold - Public API signing key rotation issueIn WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API.EPSS7.68%9.4CriticalCVE-2024-12106progress software corporation · whatsup gold +1 moreWhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authenticationIn WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings.EPSS9.48%6.5MediumCVE-2024-12105progress software corporation · whatsup gold +1 moreWhatsUp Gold - SnmpExtendedActiveMonitor path traversalIn WhatsUp Gold versions released before 2024.0.2, an authenticated user can use a specially crafted HTTP request that can lead to information disclosure.EPSS41.68%9.8CriticalCVE-2024-8785progress software corporation · whatsup gold +1 moreWhatsUp Gold Registry Overwrite Remote Code Execution VulnerabilityIn WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in registry path HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\.EPSS9.66%7.2HighCVE-2024-3892progress software corporation · telerik ui for winforms +1 moreLocal code execution vulnerability in Telerik UI for WinFormsA local code execution vulnerability is possible in Telerik UI for WinForms beginning in v2021.1.122 but prior to v2024.2.514. This vulnerability could allow an untrusted theme assembly to execute arbitrary code on the local Windows system.EPSS0.22%7.5HighCVE-2024-3543progress software corporation · loadmaster +1 moreLoadMaster Reversible Password Encryption AlgorithmUse of reversible password encryption algorithm allows attackers to decrypt passwords.  Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system.EPSS0.28%7.5HighCVE-2024-3544progress software corporation · loadmaster +1 moreLoadMaster Hardcoded SSH KeyUnauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.EPSS0.38%6.8MediumCVE-2026-65940progress software corporation · whatsup gold +1 moreWhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.EPSS0.35%8.8HighCVE-2026-65941progress software corporation · whatsup gold +1 moreWhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.EPSS0.68%4.3MediumCVE-2026-65938progress software corporation · whatsup gold +1 moreWhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.EPSS0.25%8HighCVE-2026-65937progress software corporation · whatsup gold +1 moreWhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UIIn WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.EPSS0.41%6.8MediumCVE-2026-65939progress software corporation · whatsup gold +1 moreWhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.EPSS0.38%9.1CriticalCVE-2026-9190progress software corporation · marklogic server +1 moreHTTP request smuggling in Progress MarkLogic ServerAn HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.EPSS0.74%9.8CriticalCVE-2026-9192progress software corporation · marklogic server +1 moreAuthentication bypass in Progress MarkLogic Server ODBC App ServerAn authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.EPSS0.83%8.5HighCVE-2026-9203progress software corporation · marklogic server +1 moreServer-side request forgery in Progress MarkLogic ServerA server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resources accessible to the host instance.EPSS0.34%