Read the docs

Telerik

Records17All Threatist records
Exploited (KEV)5In CISA KEV
CVSS critical9CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9

Exploited now

Telerik records in CISA KEV
TI-2024-04060 Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability Priority CRITICAL 100KEV 2024-06-13TI-2017-08395 Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability Priority CRITICAL 100KEV 2023-01-26TI-2017-08355 Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2022-04-11TI-2017-06690 Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability Priority CRITICAL 100KEV 2021-11-03TI-2019-13651 Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability Priority CRITICAL 100KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records
Ui For Wpf 6 records MEDIUM Ui For Asp.net Ajax 3 records CRITICAL Analytics Monitor Library 1 record LOW Asp.net Ajax Radeditor Control 1 record LOW Fiddler 1 record MEDIUM Justassembly 1 record LOW Justdecompile 1 record LOW Radchart 1 record MEDIUM

Records

17 records

TI-2024-04060 CVE-2024-4358

Registration Authentication Bypass Vulnerability

Priority CRITICAL 100KEV

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerabilit…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.97482 Published 2024-05-29 Fixed in 10.1.24.514 CWE-290
TI-2017-08355 CVE-2017-11317 · GHSA-9v96-j7x8-6wjv

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2…

Priority CRITICAL 100KEV

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary co…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.84175 Published 2017-08-23 No fix listed CWE-326
TI-2017-06690 CVE-2017-9248 · GHSA-mfqq-q5rf-3hvq

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and…

Priority CRITICAL 100KEV

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it eas…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.75098 Published 2017-07-03 No fix listed CWE-522
TI-2019-14262 CVE-2019-19790 · GHSA-fm5g-pj4j-pr3h

Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to…

Priority MEDIUM 48

Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, or .WMF on the server through a specially crafte…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02991 Published 2019-12-13 No fix listed CWE-22
TI-2024-09358 CVE-2024-10095 · GHSA-3gpq-5q6x-q7pf

Progress UI for WPF format provider unsafe deserialization vulnerability

Priority MEDIUM 44

In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserialization vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0075 Published 2024-12-16 Fixed in 2024.4.1213 CWE-502
TI-2024-07020 CVE-2024-7575 · GHSA-jp9w-w77g-78h3

Improper neutralization special element in hyperlinks

Priority MEDIUM 44

In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00703 Published 2024-09-25 Fixed in 2024.3.924 CWE-77
TI-2024-07021 CVE-2024-7576 · GHSA-3x94-47mg-35rf

Progress UI for WPF format provider unsafe deserialization vulnerability

Priority MEDIUM 43

In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00463 Published 2024-09-25 Fixed in 2024.3.924 CWE-502
TI-2024-07118 CVE-2024-7679 · GHSA-4wh3-4hcw-ph3f

Improper neutralization special element in hyperlinks

Priority LOW 37

In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00744 Published 2024-09-25 Fixed in 2024.3.924 CWE-77
TI-2015-02004 CVE-2015-2264 · GHSA-55gj-vmg5-qqmm

Multiple untrusted search path vulnerabilities in (1)…

Priority LOW 31

Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Telerik Analytics Monitor Library before 3.2.125 allow local users to…

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.00501 Published 2015-03-13 No fix listed
TI-2014-04069 CVE-2014-4958 · GHSA-v23c-hjph-j9r7

Cross-site scripting (XSS) vulnerability in Telerik UI for ASP.NET AJAX RadEditor control…

Priority LOW 24

Cross-site scripting (XSS) vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20, and other versions allows remote attackers to inject arbitrary web script or HTML via CSS expressio…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01979 Published 2014-09-26 No fix listed CWE-79
Open these records in search →