security@progress.com
organization01
Rollen
Rollen dieser Identität.
02
Referenzen
Weitere Namen und Kennungen dieser Entität.
nvdUS security@progress.com
03
bewertete Schwachstellen (306)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-108116US | — | — | ||
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP req… | ||||
| CVE-2026-106153US | — | — | ||
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitiz… | ||||
| CVE-2026-106151US | — | — | ||
In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the re… | ||||
| CVE-2026-106150US | — | — | ||
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.3… | ||||
| CVE-2026-106149US | — | — | ||
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutraliz… | ||||
| CVE-2026-106163US | — | — | ||
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and direct… | ||||
| CVE-2026-106162US | — | — | ||
In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default… | ||||
| CVE-2026-106161US | — | — | ||
In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including v… | ||||
| CVE-2026-106160US | — | — | ||
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__,… | ||||
| CVE-2026-106159US | — | — | ||
In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute afte… | ||||
| CVE-2026-106158US | — | — | ||
In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attribute… | ||||
| CVE-2026-106157US | — | — | ||
In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href a… | ||||
| CVE-2026-106148US | — | — | ||
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes witho… | ||||
| CVE-2026-106147US | — | — | ||
In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML witho… | ||||
| CVE-2026-89077US | high8.8 | — | ||
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0… | ||||
| CVE-2026-89076US | high8.8 | — | ||
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).
This issue affects MOVEit T… | ||||
| CVE-2026-89075US | — | — | ||
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | ||||
| CVE-2026-89074US | high8.8 | — | ||
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | ||||
| CVE-2026-89073US | critical9.8 | — | ||
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. | ||||
| CVE-2026-89072US | high8.8OT erhöht | — | ||
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0… | ||||