Telerik Reporting vulnerabilities
13 known vulnerabilities in Telerik Reporting from Progress Software. 13 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.3 High severity
Telerik Reporting: Deserialization of Untrusted Data
In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process
- 7.8 High severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.
- 7.2 High severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
- 8.8 High severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.
- 7.8 High severity
Telerik Reporting: Improper Neutralization of Special Elements used in a Command
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.
- 8.8 High severity
Telerik Report Server: Weak Password Requirements
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.
- 9.8 Critical severity
Telerik Report Server: Deserialization of Untrusted Data
In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.
- 9.8 Critical severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability.
- 8.6 High severity
Telerik Reporting: Improper Control of Generation of Code
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability.
- 7.8 High severity
Telerik Reporting: Deserialization of Untrusted Data
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.
- 8.8 High severity
Telerik Reporting: Deserialization of Untrusted Data
In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability.
- 7.8 High severity
Telerik Reporting: Deserialization of Untrusted Data
In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.
- 7.8 High severity
Telerik Reporting: Improper Privilege Management
In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Reporting install is present, a lower privileged user has the ability t