Vulnerabilities

TI-2023-17901 CVE-2023-35817 · GHSA-5xhr-994v-5g9p

DevExpress before 23.1.3 allows AsyncDownloader SSRF.

MEDIUM 43

DevExpress before 23.1.3 allows AsyncDownloader SSRF.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00485 Published 2025-04-28 Fixed in 21.2.12, 22 +4 CWE-918

TI-2023-17900 CVE-2023-35816 · GHSA-22wj-vp2m-rxhc

LOW 25

DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00557 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-23

TI-2023-17899 CVE-2023-35815 · GHSA-h4mr-59x2-64f9

MEDIUM 43

DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-502

TI-2023-17898 CVE-2023-35814 · GHSA-84xx-9g7m-wh84

MEDIUM 43

DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00619 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-502