Progress Telerik Report Server <= 10.2.24.806 Insecure Type Resolution (CVE-2024-8015)

The version of Progress Telerik Report Server installed on the remote host is affected by an insecure type resolution vulnerability: - A remote code execution attack is possible through object injection via an insecure type resolution vulnerability. CVE-2024-8015 Note that Nessus has not tested f...

Progress Telerik UI for WinForms < 2024.3.924 Command Injection

The version of Progress Telerik UI for WinForms installed on the remote host is prior to 2024.3.924. It is, therefore, affected by a vulnerability as referenced in the cve-2024-7679 advisory. - In Progress Telerik UI for WinForms versions prior to 2024 Q3 2024.3.924, a command injection attack is...

Progress Telerik Reporting <= 2024 Q3 (18.2.24.806) Multiple Vulnerabilities

The version of Progress Telerik Reporting installed on the remote Windows host is prior or equal to 2024 Q3 18.2.24.806. It is, therefore, affected by multiple vulnerabilities: - In Progress® Telerik® Reporting, versions 2024 Q3 18.2.24.806 or earlier, hyperlinks were permitted in the desktop...

CVE-2024-8015

In Progress Telerik Report Server versions prior to 2024 Q3 10.2.24.924, a remote code execution attack is possible through object injection via an insecure type resolution vulnerability...

CVE-2024-8048

In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a code execution attack is possible using object injection via insecure expression evaluation...

CVE-2024-8015

In Progress Telerik Report Server versions prior to 2024 Q3 10.2.24.924, a remote code execution attack is possible through object injection via an insecure type resolution vulnerability...

CVE-2024-8048

In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a code execution attack is possible using object injection via insecure expression evaluation...

CVE-2024-7294

In Progress® Telerik® Report Server versions prior to 2024 Q3 10.2.24.806, an HTTP DoS attack is possible on anonymous endpoints without rate limiting...

CVE-2024-7293

In Progress® Telerik® Report Server versions prior to 2024 Q3 10.2.24.806, a password brute forcing attack is possible through weak password requirements...

CVE-2024-8014

In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a code execution attack is possible through object injection via an insecure type resolution vulnerability...

CVE-2024-7294

In Progress® Telerik® Report Server versions prior to 2024 Q3 10.2.24.806, an HTTP DoS attack is possible on anonymous endpoints without rate limiting...

CVE-2024-7840

In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a command injection attack is possible through improper neutralization of hyperlink elements...

CVE-2024-7293

In Progress® Telerik® Report Server versions prior to 2024 Q3 10.2.24.806, a password brute forcing attack is possible through weak password requirements...

CVE-2024-8014

In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a code execution attack is possible through object injection via an insecure type resolution vulnerability...

CVE-2024-7840

In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a command injection attack is possible through improper neutralization of hyperlink elements...

CVE-2024-7292

In Progress® Telerik® Report Server versions prior to 2024 Q3 10.2.24.806, a credential stuffing attack is possible through improper restriction of excessive login attempts...

CVE-2024-7292

In Progress® Telerik® Report Server versions prior to 2024 Q3 10.2.24.806, a credential stuffing attack is possible through improper restriction of excessive login attempts...

CVE-2024-8015 Telerik Report Server Insecure Type Resolution

In Progress Telerik Report Server versions prior to 2024 Q3 10.2.24.924, a remote code execution attack is possible through object injection via an insecure type resolution vulnerability...

CVE-2024-8015

CVE-2024-8015 affects Progress Telerik Report Server before 2024 Q3 (10.2.24.924). The root cause is an insecure type resolution that allows object injection, enabling remote code execution. Public references describe a remote code execution vulnerability in versions prior to 10.2.24.924. Remedia...

CVE-2024-7292 Account Controller allows high count of login attempts

In Progress® Telerik® Report Server versions prior to 2024 Q3 10.2.24.806, a credential stuffing attack is possible through improper restriction of excessive login attempts...