Vulnerabilidades en Progress Software Corporation

101 resultados
Análisis Vexday

Com 4,65% das CVEs catalogadas confirmadas no CISA KEV, a Progress Software Corporation apresenta uma taxa de exploração ativa 10,3 vezes acima da média geral do catálogo, sinalizando que vulnerabilidades nesse ecossistema atraem atenção consistente de agentes maliciosos. Das 86 CVEs registradas, 19 são de severidade crítica e 5 contam com prova de conceito pública, o que amplia a superfície de risco para organizações que não mantêm ciclos ágeis de atualização. O pior caso ativo hoje é o CVE-2024-4885, com EPSS de 0,9929 — valor extremamente elevado que indica altíssima probabilidade de exploração —, exigindo atenção prioritária de equipes de resposta. O tipo de falha mais recorrente (CWE-79) aponta para problemas persistentes de sanitização de saída, aspecto que deve ser considerado em revisões de configuração e controles de segurança em camada de aplicação.

CVE-2023-42660HIGHMOVEit Transfer Machine Interface SQL InjectionEPSS 0.7%CVE-2023-6218HIGHMOVEit Transfer Group Admin Privilege EscalationEPSS 0.7%CVE-2024-7744MEDIUMImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Progress WS_FTP ServerEPSS 0.7%CVE-2026-65941HIGHWhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.EPSS 0.7%CVE-2023-40043HIGHMOVEit Transfer System Administrator SQL InjectionEPSS 0.7%CVE-2026-9195CRITICALCross-site scripting in Progress MarkLogic Server Query ConsoleEPSS 0.7%CVE-2024-7763CRITICALWhatsUp Gold getReport Missing Authentication Authentication Bypass VulnerabilityEPSS 0.6%CVE-2026-7329CRITICALPrivilege escalation in Progress MarkLogic Server REST query interfacesEPSS 0.6%CVE-2023-40052HIGHProgress Application Server (PAS) for OpenEdge Denial of ServiceEPSS 0.6%CVE-2023-40051CRITICALProgress Application Server (PAS) for OpenEdge File Upload via Directory TraversalEPSS 0.6%CVE-2023-6368MEDIUMWhatsUp Gold Unauthenticated Access to an API EndpointEPSS 0.6%CVE-2023-42656MEDIUMMOVEit Transfer Reflected XSSEPSS 0.6%CVE-2024-0396HIGHMissing Server-Side Input Validation in HTTP ParameterEPSS 0.5%CVE-2024-5015HIGHWhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure VulnerabilityEPSS 0.5%CVE-2023-6367HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via RolesEPSS 0.5%CVE-2023-6365HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via Device GroupsEPSS 0.5%CVE-2023-6364HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via DashboardEPSS 0.5%CVE-2023-6366HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert CenterEPSS 0.5%CVE-2023-6217HIGHMOVEit Transfer XSS via MOVEit GatewayEPSS 0.5%CVE-2024-6097MEDIUMAbsolute Path Traversal VulnerabilityEPSS 0.5%