8 source-linked records in the current knowledge graph.
Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionProgress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionProgress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionProgress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionProgress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionProgress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attributionProgress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attribution · 2 IOCsProgress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attribution · 3 IOCs