Progress Software vulnerabilities

Products

• WhatsUp Gold 42
• MarkLogic Server 41
• WS_FTP Server 32
• Kendo UI for jQuery 28
• Telerik UI for ASP.NET AJAX 19
• LoadMaster 17
• Telerik Report Server 14
• Sitefinity 12
• Telerik Reporting 12
• MOVEit WAF 10
• Object Scale Connection Manager 10
• Telerik Document Processing Libraries 9
• Telerik UI for WPF 8
• Flowmon 7
• MOVEit Automation 7
• MOVEit Transfer 7
• Telerik UI for WinForms 6
• ECS Connection Manager 5
• ECS Connections Manager 5
• OpenEdge 5
• Chef Automate 4
• Flowmon ADS 4
• Progress® Telerik® Fiddler® Classic 4
• Progress® Telerik® Fiddler® Everywhere 3
• Telerik UI for ASP.NET Core 3
• Telerik UI for ASP.NET MVC 3
• Telerik UI for Blazor 3
• Chef InSpec 2
• Hybrid Data Pipeline 2
• KendoReact 2

Latest Progress Software CVEs

Newest publication first · page 13 of 13

1. CVE-2023-40044 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

   Published 2023-09-27

   High·CVSS 8.8 EPSS 90.4% CISA KEV added 2023-10-05 Ransomware Exploited in the wild Framework module PoC

   In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

2. CVE-2023-42656 MOVEit Transfer Reflected XSS

   Published 2023-09-20

   Medium·CVSS 6.1 EPSS 0.55%

   In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payloa...

3. CVE-2023-40043 MOVEit Transfer System Administrator SQL Injection

   Published 2023-09-20

   High·CVSS 7.2 EPSS 0.68%

   In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain u...

4. CVE-2023-42660 MOVEit Transfer Machine Interface SQL Injection

   Published 2023-09-20

   High·CVSS 8.8 EPSS 0.70%

   In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthori...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.