Vulnerabilidades em Progress Software Corporation

132 resultados
Análise Vexday

Com 4,65% das CVEs catalogadas confirmadas no CISA KEV, a Progress Software Corporation apresenta uma taxa de exploração ativa 10,3 vezes acima da média geral do catálogo, sinalizando que vulnerabilidades nesse ecossistema atraem atenção consistente de agentes maliciosos. Das 86 CVEs registradas, 19 são de severidade crítica e 5 contam com prova de conceito pública, o que amplia a superfície de risco para organizações que não mantêm ciclos ágeis de atualização. O pior caso ativo hoje é o CVE-2024-4885, com EPSS de 0,9929 — valor extremamente elevado que indica altíssima probabilidade de exploração —, exigindo atenção prioritária de equipes de resposta. O tipo de falha mais recorrente (CWE-79) aponta para problemas persistentes de sanitização de saída, aspecto que deve ser considerado em revisões de configuração e controles de segurança em camada de aplicação.

CVE-2023-6217HIGHMOVEit Transfer XSS via MOVEit GatewayEPSS 0.5%CVE-2024-1632HIGHIncorrect access control in the Sitefinity backendEPSS 0.5%CVE-2026-85961HIGHSensitive information exposure in Progress MarkLogic Server Azure deploymentsEPSS 0.5%CVE-2026-85964HIGHPath traversal in Progress MarkLogic Server Query ConsoleEPSS 0.5%CVE-2024-5014HIGHWhatsUp Gold GetASPReport Server-Side Request Forgery Information DisclosureEPSS 0.5%CVE-2026-8709CRITICALPrivilege escalation in Progress MarkLogic Server REST document patch operationEPSS 0.5%CVE-2026-9193CRITICALPrivilege escalation in Progress MarkLogic Server Hadoop integrationEPSS 0.5%CVE-2026-7557CRITICALSAML authentication bypass in Progress MarkLogic ServerEPSS 0.5%CVE-2026-85948CRITICALImproper privilege management in Progress MarkLogic Server Management APIEPSS 0.4%CVE-2026-85947CRITICALImproper privilege management in Progress MarkLogic Server forest operationsEPSS 0.4%CVE-2024-5012HIGHWhatsUp Gold Missing Authentication GetWindowsCredential Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-4561MEDIUMWhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconControllerEPSS 0.4%CVE-2026-85963HIGHServer-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirectorEPSS 0.4%CVE-2024-1801HIGHProgress Telerik Reporting Local Deserialization VulnerabilityEPSS 0.4%CVE-2024-9999MEDIUMMulti-Factor Authentication Bypass in Progress WS_FTP ServerEPSS 0.4%CVE-2023-40047HIGHWS_FTP Server Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-65937HIGHWhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UIEPSS 0.4%CVE-2023-40048MEDIUMWS_FTP Server Cross-Site Request Forgery (CSRF) VulnerabilityEPSS 0.4%CVE-2026-85957HIGHImproper XML external entity restriction in Progress MarkLogic Server SAML processingEPSS 0.4%CVE-2024-1636HIGHPotential Cross-Site Scripting (XSS) in the page editing areaEPSS 0.4%