CyberSecBulletin

DevExpress vulnerabilities

We track 2 vulnerabilities in DevExpress products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 18, 2022.

2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score

Latest DevExpress vulnerabilities

  • 7.5 High severity

    Asp.net Web Forms Controls: Authorization Bypass Through User-Controlled Key

    CVE-2022-41479DevExpressEPSS 1.42%

    The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects in the /DXR.axd?r= HTTP GET parameter. This leads to an Insecure Direct Object References (IDOR) vulnerability which al

  • 8.8 High severity

    DevExpress: Deserialization of Untrusted Data

    CVE-2022-28684DevExpressEPSS 3.75%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the