PT-2025-22349 · Unknown · Proget Mdm

Name of the Vulnerable Software and Affected Versions: Proget MDM versions prior to 2.17.5 Description: A low-privileged user can access information about changes contained in backups of all devices managed by the MDM, including user ids, email addresses, first names, last names, and device UUIDs...

PT-2025-22350 · Unknown · Konsola Proget

Name of the Vulnerable Software and Affected Versions: Konsola Proget versions prior to 2.17.5 Description: A low-privileged user can access information about profiles created in Proget MDM, which contain details about allowed/prohibited functions. The profiles do not reveal any sensitive...

PT-2025-22353 · Microsoft +1 · Office Excel +1

Name of the Vulnerable Software and Affected Versions: Konsola Proget server part of the MDM suite versions prior to 2.17.5 Description: The issue arises when data provided in a request to the server during new device activation is stored in a database. High-privileged users who download this dat...

Inedo ProGet 安全漏洞

Inedo ProGet is a package management system from Inedo. A security vulnerability exists in Inedo ProGet versions prior to 2.17.5, which stems from the possibility that device activation data could be downloaded as a CSV file by an elevated privileged user and cause damage to the PC, allowing an...

CVE-2025-1421: Improper Neutralization of Formula Elements in a CSV File

Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC...

CVE-2025-1415: Incorrect Authorization

A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM Mobile Device Management, as well as details of the devices like their UUIDs needed for exploitation of CVE-2025-1416. In order to perform the attack, one has to know a taskid, but since...

PT-2025-22329

Name of the Vulnerable Software and Affected Versions Proget MDM versions prior to 2.17.5 Description A low-privileged user can obtain information about tasks executed on devices controlled by Proget MDM, as well as details of the devices like their UUIDs. To perform the attack, an attacker needs...

Inedo ProGet 安全漏洞

Inedo ProGet is a package management system from Inedo. A security vulnerability exists in Inedo ProGet versions prior to 2.17.5 that stems from a low-privileged user having access to changed information in backups, including user IDs, email addresses, and device UUIDs...

PT-2025-22348

Name of the Vulnerable Software and Affected Versions Proget MDM affected versions not specified Description The issue concerns a privilege escalation in Proget MDM, where a low-privileged user can retrieve passwords for managed devices. This allows the user to access functionalities restricted b...

CVE-2025-47244

Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C reflection layer, as demonstrated by causing a denial of service when an attacker executes a loop calling RestartWeb or obtaining potentially sensitive information. Exploitation can occur if...

CVE-2025-47244

Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C reflection layer, as demonstrated by causing a denial of service when an attacker executes a loop calling RestartWeb or obtaining potentially sensitive information. Exploitation can occur if...

CVE-2025-47244

Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C reflection layer, as demonstrated by causing a denial of service when an attacker executes a loop calling RestartWeb or obtaining potentially sensitive information. Exploitation can occur if...

CVE-2025-47244

Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C reflection layer, as demonstrated by causing a denial of service when an attacker executes a loop calling RestartWeb or obtaining potentially sensitive information. Exploitation can occur if...

CVE-2025-47244

CVE-2025-47244 affects Inedo ProGet (versions 2024.22 and earlier). The vulnerability stems from the C# reflection layer, which can be abused by remote attackers to reach restricted functionality, potentially causing a denial of service (e.g., looping RestartWeb) or exposing sensitive information...

CVE-2025-47244: Authentication Bypass Using an Alternate Path or Channel

Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C reflection layer, as demonstrated by causing a denial of service when an attacker executes a loop calling RestartWeb or obtaining potentially sensitive information. Exploitation can occur if...

Inedo ProGet 安全漏洞

Inedo ProGet is a package management system from Inedo. A security vulnerability exists in Inedo ProGet version 2024.22 and earlier, which stems from a C reflection layer that allows remote attackers to access restricted functionality, potentially resulting in a denial of service or access to...

📄 Inedo ProGet 2024.22 Denial of Service / Information Disclosure / CSRF

Inedo ProGet version 2024.22 suffers from cross site request forgery, denial of service, and information disclosure vulnerabilities. Inedo ProGet 2024.22 and below are vulnerable to unauthenticated denial of service and information disclosure attacks among other things because the information...

PT-2025-18958 · Inedo · Inedo Proget

Name of the Vulnerable Software and Affected Versions: Inedo ProGet versions 2024.22 and earlier Description: Inedo ProGet allows remote attackers to reach restricted functionality through the C reflection layer. This can be demonstrated by causing a denial of service, such as when an attacker...

Jenkins Inedo ProGet Plugin Plugin has Cleartext Transmission of Sensitive Information

Inedo ProGet Plugin Plugin stores a service password in its global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site...

GHSA-F6G8-PXVP-9328 Jenkins Inedo ProGet Plugin Plugin has Cleartext Transmission of Sensitive Information

Inedo ProGet Plugin Plugin stores a service password in its global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site...