DevExpress

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

DevExpress records in CISA KEV

No DevExpress vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Devexpress 6 records MEDIUM Ajax Control Toolkit 1 record LOW Asp.net Web Forms Controls 1 record HIGH Aspxfilemanager Control For Webforms And Mvc 1 record MEDIUM

Records

9 records

TI-2022-19911 CVE-2022-41479 · GHSA-6prj-5r8w-3x38

The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms…

HIGH 66

The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects in the /DXR.axd?r= HTTP GET parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01417 Published 2022-10-18 No fix listed CWE-639

TI-2022-11328 CVE-2022-28684 · GHSA-cqm5-3ccf-cf57

Deserialization of untrusted data in DevExpress

MEDIUM 45

This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03754 Published 2022-08-03 No fix listed CWE-502

TI-2023-17901 CVE-2023-35817 · GHSA-5xhr-994v-5g9p

DevExpress before 23.1.3 allows AsyncDownloader SSRF.

MEDIUM 43

DevExpress before 23.1.3 allows AsyncDownloader SSRF.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00485 Published 2025-04-28 Fixed in 21.2.12, 22 +4 CWE-918

TI-2023-17899 CVE-2023-35815 · GHSA-h4mr-59x2-64f9

DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.

MEDIUM 43

DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-502

TI-2023-17898 CVE-2023-35814 · GHSA-84xx-9g7m-wh84

DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.

MEDIUM 43

DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00619 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-502

TI-2021-14777 CVE-2021-36483 · GHSA-h2qh-wp73-v6c9

DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.

MEDIUM 43

DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02923 Published 2021-08-04 No fix listed CWE-502

TI-2014-02062 CVE-2014-2575 · GHSA-363j-w49v-cj57

Directory traversal vulnerability in the File Manager component in DevExpress…

MEDIUM 40

Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or writ…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.08917 Published 2014-06-06 No fix listed CWE-22

TI-2015-03909 CVE-2015-4670 · GHSA-vxx4-cx7p-j268

Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX…

LOW 32

Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a ..

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.01912 Published 2015-08-18 No fix listed CWE-22

TI-2023-17900 CVE-2023-35816 · GHSA-22wj-vp2m-rxhc

DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.

LOW 25

DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00557 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-23

Open these records in search →

Critical	3
High	3
Medium	3
Low	0
No CVSS	0