CVE-2024-4200 Progress Telerik Reporting Local Deserialization Vulnerability

In Progress® Telerik® Reporting versions prior to 2024 Q2 18.1.24.2.514, a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability...

CVE-2024-4202

CVE-2024-4202 affects Progress Telerik Reporting versions prior to 2024 Q2 (18.1.24.514). The vulnerability is described as an insecure instantiation vulnerability that enables code execution. The CVE details in the provided documents indicate high impact (confidentiality, integrity, and availabi...

CVE-2024-4202 Progress Telerik Reporting Local Instantiation Vulnerability

In Progress® Telerik® Reporting versions prior to 2024 Q2 18.1.24.514, a code execution attack is possible through an insecure instantiation vulnerability...

CVE-2024-4202 Progress Telerik Reporting Local Instantiation Vulnerability

In Progress® Telerik® Reporting versions prior to 2024 Q2 18.1.24.514, a code execution attack is possible through an insecure instantiation vulnerability...

PT-2024-29683 · Progress · Telerik Reporting

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Reporting versions prior to 2024 Q2 18.1.24.2.514 Description: A code execution attack is possible by a local threat actor through an insecure deserialization vulnerability, allowing for potential exploitation...

The vulnerability of the ObjectReader class in the Progress Telerik Reporting network reporting tool allows a hacker to execute arbitrary code.

The vulnerability of the ObjectReader software class used for creating network reports by Progress Telerik Reporting is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...

CVE-2024-1856

In Progress® Telerik® Reporting versions prior to 2024 Q1 18.0.24.130, a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability...

CVE-2024-1856

CVE-2024-1856 affects Progress Telerik Reporting: an ObjectReader deserialization vulnerability in versions prior to 2024 Q1 (18.0.24.130) allows remote code execution. Exploitation conditions vary by advisory (ZDI notes may require authentication and/or user interaction). Remediation is to upgra...

CVE-2024-1856 Progress Telerik Reporting Remote Deserialization Vulnerability

In Progress® Telerik® Reporting versions prior to 2024 Q1 18.0.24.130, a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability...

CVE-2024-1856 Progress Telerik Reporting Remote Deserialization Vulnerability

In Progress® Telerik® Reporting versions prior to 2024 Q1 18.0.24.130, a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability...

CVE-2024-1801 Progress Telerik Reporting Local Deserialization Vulnerability

In Progress® Telerik® Reporting versions prior to 2024 Q1 18.0.24.130, a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability...

CVE-2024-1801 Progress Telerik Reporting Local Deserialization Vulnerability

In Progress® Telerik® Reporting versions prior to 2024 Q1 18.0.24.130, a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability...

CVE-2024-1801

Progress Software Telerik Reporting ObjectReader deserialization vulnerability (CVE-2024-1801 / CVE-2024-1856) enables remote code execution through untrusted data. Affected: Telerik Reporting versions prior to 2024 Q1 (18.0.24.130). Attack requires user interaction (e.g., visiting a malicious pa...

CVE-2024-1800 Progress Telerik Report Server Deserialization

In Progress® Telerik® Report Server versions prior to 2024 Q1 10.0.24.130, a remote code execution attack is possible through an insecure deserialization vulnerability...

CVE-2024-1800 Progress Telerik Report Server Deserialization

In Progress® Telerik® Report Server versions prior to 2024 Q1 10.0.24.130, a remote code execution attack is possible through an insecure deserialization vulnerability...

CISA, FBI, and MS-ISAC Update Joint CSA on Progress Telerik Vulnerabilities

Today, CISA, the Federal Bureau of Investigation FBI, and Multi-State Information Sharing and Analysis Center MS-ISAC released an update for joint Cybersecurity Advisory CSA Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server. This iteration of the CSA—now renamed...

Threat Actors Exploit Progress Telerik Vulnerabilities in Multiple U.S. Government IIS Servers

SUMMARY From November 2022 through early January 2023, the Cybersecurity and Infrastructure Security Agency CISA and authoring organizations identified the presence of indicators of compromise IOCs at a federal civilian executive branch FCEB agency. Analysts determined that multiple cyber threat...

Unmasking XE Group: Experts Reveal Identity of Suspected Cybercrime Kingpin

Cybersecurity researchers have unmasked the identity of one of the individuals who is believed to be associated with the e-crime actor known as XE Group. According to Menlo Security, which pieced together the information from different online sources, "Nguyen Huu Tai, who also goes by the names J...

Multiple Hacker Groups Exploit 3-Year-Old Vulnerability to Breach U.S. Federal Agency

Multiple threat actors, including a nation-state group, exploited a critical three-year-old security flaw in Progress Telerik to break into an unnamed federal entity in the U.S. The disclosure comes from a joint advisory issued by the Cybersecurity and Infrastructure Security Agency CISA, Federal...

Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange

In recent weeks, there has been quite a lot of reporting on the exploitation of the latest disclosed vulnerabilities in Microsoft’s Exchange Server by an attacker referred to as HAFNIUM. One of the major reasons these latest vulnerabilities are so dangerous and appealing to attackers is that they...