Vulnerabilities

TI-2023-17901 CVE-2023-35817 · GHSA-5xhr-994v-5g9p

DevExpress before 23.1.3 allows AsyncDownloader SSRF.

MEDIUM 43

DevExpress before 23.1.3 allows AsyncDownloader SSRF.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00485 Published 2025-04-28 Fixed in 21.2.12, 22 +4 CWE-918

TI-2023-17900 CVE-2023-35816 · GHSA-22wj-vp2m-rxhc

LOW 25

DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00557 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-23

TI-2023-17899 CVE-2023-35815 · GHSA-h4mr-59x2-64f9

MEDIUM 43

DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-502

TI-2023-17898 CVE-2023-35814 · GHSA-84xx-9g7m-wh84

MEDIUM 43

DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00619 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-502

TI-2022-11328 CVE-2022-28684 · GHSA-cqm5-3ccf-cf57

MEDIUM 45

This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03754 Published 2022-08-03 No fix listed CWE-502

TI-2021-14777 CVE-2021-36483 · GHSA-h2qh-wp73-v6c9

MEDIUM 43

DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02923 Published 2021-08-04 No fix listed CWE-502