Search criteria

18 vulnerabilities found for DevExpress by DevExpress

FKIE_CVE-2023-35816

Vulnerability from fkie_nvd - Published: 2025-04-28 16:15 - Updated: 2025-06-05 14:30
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.
References
cve@mitre.orghttps://code-white.com/public-vulnerability-list/Vendor Advisory
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversionPermissions Required
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserializationPermissions Required
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023Permissions Required
Impacted products
Vendor Product Version
devexpress devexpress *
devexpress devexpress 22.1.8
devexpress devexpress 22.2.4
devexpress devexpress 22.2.5
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8A17F8A-D0F9-44E3-9B01-B45C891A0BAC",
              "versionEndExcluding": "21.2.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "2727DAD4-78F4-459D-A92A-A33D11021FEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5FA2CF5-4136-460C-841E-E38330CD4F33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "B81D56FB-7444-4436-9431-94D3DD48300E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DevExpress before 23.1.3 allows arbitrary TypeConverter conversion."
    },
    {
      "lang": "es",
      "value": "DevExpress anterior a 23.1.3 permite la conversi\u00f3n arbitraria de TypeConverter."
    }
  ],
  "id": "CVE-2023-35816",
  "lastModified": "2025-06-05T14:30:08.290",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "cve@mitre.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-04-28T16:15:26.300",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://code-white.com/public-vulnerability-list/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-704"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2023-35817

Vulnerability from fkie_nvd - Published: 2025-04-28 16:15 - Updated: 2025-06-05 14:30
Severity ?
5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
DevExpress before 23.1.3 allows AsyncDownloader SSRF.
References
cve@mitre.orghttps://code-white.com/public-vulnerability-list/Vendor Advisory
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t1157209/server-side-request-forgery-via-asyncdownloaderPermissions Required
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t1161404/report-and-dashboard-server-improper-default-configuration-can-lead-to-ssrf-attacksPermissions Required
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t1162045/reporting-bi-dashboard-office-file-api-web-app-configuration-to-help-prevent-ssrf-attacksPermissions Required
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023Permissions Required
Impacted products
Vendor Product Version
devexpress devexpress *
devexpress devexpress 22.1.8
devexpress devexpress 22.2.4
devexpress devexpress 22.2.5
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8A17F8A-D0F9-44E3-9B01-B45C891A0BAC",
              "versionEndExcluding": "21.2.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "2727DAD4-78F4-459D-A92A-A33D11021FEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5FA2CF5-4136-460C-841E-E38330CD4F33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "B81D56FB-7444-4436-9431-94D3DD48300E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DevExpress before 23.1.3 allows AsyncDownloader SSRF."
    },
    {
      "lang": "es",
      "value": "DevExpress anterior a 23.1.3 permite AsyncDownloader SSRF."
    }
  ],
  "id": "CVE-2023-35817",
  "lastModified": "2025-06-05T14:30:31.390",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4,
        "source": "cve@mitre.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-04-28T16:15:26.753",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://code-white.com/public-vulnerability-list/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1157209/server-side-request-forgery-via-asyncdownloader"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1161404/report-and-dashboard-server-improper-default-configuration-can-lead-to-ssrf-attacks"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1162045/reporting-bi-dashboard-office-file-api-web-app-configuration-to-help-prevent-ssrf-attacks"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-35814

Vulnerability from fkie_nvd - Published: 2025-04-28 16:15 - Updated: 2025-06-05 14:29
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
References
cve@mitre.orghttps://code-white.com/public-vulnerability-list/Vendor Advisory
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-formsPermissions Required
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-accessPermissions Required
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-formed-request-to-a-report-control-s-backend-can-usePermissions Required
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023Permissions Required
Impacted products
Vendor Product Version
devexpress devexpress *
devexpress devexpress 22.1.8
devexpress devexpress 22.2.4
devexpress devexpress 22.2.5
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8A17F8A-D0F9-44E3-9B01-B45C891A0BAC",
              "versionEndExcluding": "21.2.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "2727DAD4-78F4-459D-A92A-A33D11021FEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5FA2CF5-4136-460C-841E-E38330CD4F33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "B81D56FB-7444-4436-9431-94D3DD48300E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms."
    },
    {
      "lang": "es",
      "value": "DevExpress anterior a 23.1.3 no protege adecuadamente los datos serializados de XtraReport en formularios web ASP.NET."
    }
  ],
  "id": "CVE-2023-35814",
  "lastModified": "2025-06-05T14:29:42.040",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "cve@mitre.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-04-28T16:15:25.357",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://code-white.com/public-vulnerability-list/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-forms"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-access"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-formed-request-to-a-report-control-s-backend-can-use"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-35815

Vulnerability from fkie_nvd - Published: 2025-04-28 16:15 - Updated: 2025-06-05 14:29
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.
References
cve@mitre.orghttps://code-white.com/public-vulnerability-list/Vendor Advisory
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t1141947/data-source-protection-bypass-during-xml-deserializationPermissions Required
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t1159142/web-reporting-data-source-protection-bypassed-during-xml-deserializationPermissions Required
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023Permissions Required
Impacted products
Vendor Product Version
devexpress devexpress *
devexpress devexpress 22.1.8
devexpress devexpress 22.2.4
devexpress devexpress 22.2.5
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8A17F8A-D0F9-44E3-9B01-B45C891A0BAC",
              "versionEndExcluding": "21.2.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "2727DAD4-78F4-459D-A92A-A33D11021FEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5FA2CF5-4136-460C-841E-E38330CD4F33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "B81D56FB-7444-4436-9431-94D3DD48300E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data."
    },
    {
      "lang": "es",
      "value": "DevExpress anterior a 23.1.3 tiene un mecanismo de protecci\u00f3n de fuente de datos que se evita durante la deserializaci\u00f3n de datos XML."
    }
  ],
  "id": "CVE-2023-35815",
  "lastModified": "2025-06-05T14:29:53.303",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "cve@mitre.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-04-28T16:15:25.903",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://code-white.com/public-vulnerability-list/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1141947/data-source-protection-bypass-during-xml-deserialization"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1159142/web-reporting-data-source-protection-bypassed-during-xml-deserialization"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2022-28684

Vulnerability from fkie_nvd - Published: 2022-08-03 16:15 - Updated: 2024-11-21 06:57
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-872/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-872/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
devexpress devexpress *
devexpress devexpress *
devexpress devexpress *
devexpress devexpress *
devexpress devexpress *
devexpress devexpress *
devexpress devexpress *
devexpress devexpress *
devexpress devexpress 22.1.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A127F1DA-A376-4F1C-B096-AFFD6027337E",
              "versionEndExcluding": "18.1.18",
              "versionStartIncluding": "18.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AFE78F3-CCE4-4DD8-BA97-A83106D5846E",
              "versionEndExcluding": "18.2.17",
              "versionStartIncluding": "18.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "609BB707-4650-4760-BF9B-8DD7F303DFA0",
              "versionEndExcluding": "19.1.15",
              "versionStartIncluding": "19.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "948A442E-BC00-4D00-A6BA-1A11C796E60A",
              "versionEndExcluding": "19.2.14",
              "versionStartIncluding": "19.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE7065ED-9046-46DC-8B5E-625A6849E7C0",
              "versionEndExcluding": "20.1.15",
              "versionStartIncluding": "20.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DED82673-3289-44D1-A3D0-E1E2C3FB76D8",
              "versionEndExcluding": "20.2.11",
              "versionStartIncluding": "20.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "48A88268-3BC6-4178-9AC1-481C38810334",
              "versionEndExcluding": "21.1.9",
              "versionStartIncluding": "21.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C30FBCCA-4346-4411-949B-576DA4842C49",
              "versionEndExcluding": "21.2.7",
              "versionStartIncluding": "21.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:22.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A40A0836-5257-4DD9-8BB6-D2627DFD014B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en las instalaciones afectadas de DevExpress. Es requerida autenticaci\u00f3n para explotar esta vulnerabilidad. El fallo espec\u00edfico se presenta en la biblioteca SafeBinaryFormatter. El problema es debido a que no son comprobados apropiadamente los datos suministrados por el usuario, lo que puede resultar en una deserializaci\u00f3n de datos no confiables. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de la cuenta de servicio. Era ZDI-CAN-16710"
    }
  ],
  "id": "CVE-2022-28684",
  "lastModified": "2024-11-21T06:57:44.340",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-08-03T16:15:08.307",
  "references": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "zdi-disclosures@trendmicro.com",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2021-36483

Vulnerability from fkie_nvd - Published: 2021-08-04 11:15 - Updated: 2024-11-21 06:13
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.
References
cve@mitre.orghttps://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678eThird Party Advisory
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserializationPermissions Required, Vendor Advisory
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserializationPermissions Required, Vendor Advisory
cve@mitre.orghttps://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserializationPermissions Required, Vendor Advisory
cve@mitre.orghttps://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64fThird Party Advisory
cve@mitre.orghttps://www.zerodayinitiative.com/advisories/ZDI-22-341/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678eThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserializationPermissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserializationPermissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserializationPermissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64fThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-341/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
devexpress devexpress *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "450CA3B2-D9B7-4578-AF12-E9ACAC534C62",
              "versionEndIncluding": "21.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization."
    },
    {
      "lang": "es",
      "value": "DevExpress.XtraReports.UI versiones hasta v21.1, permite a atacantes ejecutar c\u00f3digo arbitrario por medio de una deserializaci\u00f3n no segura"
    }
  ],
  "id": "CVE-2021-36483",
  "lastModified": "2024-11-21T06:13:45.430",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-08-04T11:15:08.040",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2023-35816 (GCVE-0-2023-35816)

Vulnerability from cvelistv5 – Published: 2025-04-28 00:00 – Updated: 2025-04-28 18:08
VLAI?
Summary
DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.
Severity ?
3.5 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CWE
  • CWE-23 - Relative Path Traversal
Assigner
References
Impacted products
Vendor Product Version
DevExpress DevExpress Affected: 0 , < 21.2.12 (custom)
Affected: 22 , < 22.1.7 (custom)
Affected: 22.1.8 , < 22.1.9 (custom)
Affected: 22.2 , < 22.2.3 (custom)
Affected: 22.2.4 , < 22.2.6 (custom)
Affected: 23 , < 23.1.3 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-35816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-28T18:08:00.826540Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-28T18:08:07.672Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DevExpress",
          "vendor": "DevExpress",
          "versions": [
            {
              "lessThan": "21.2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.7",
              "status": "affected",
              "version": "22",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.9",
              "status": "affected",
              "version": "22.1.8",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.3",
              "status": "affected",
              "version": "22.2",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.6",
              "status": "affected",
              "version": "22.2.4",
              "versionType": "custom"
            },
            {
              "lessThan": "23.1.3",
              "status": "affected",
              "version": "23",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "21.2.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.7",
                  "versionStartIncluding": "22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.9",
                  "versionStartIncluding": "22.1.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.3",
                  "versionStartIncluding": "22.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.6",
                  "versionStartIncluding": "22.2.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "23.1.3",
                  "versionStartIncluding": "23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DevExpress before 23.1.3 allows arbitrary TypeConverter conversion."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23 Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-28T16:12:05.415Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization"
        },
        {
          "url": "https://code-white.com/public-vulnerability-list/"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-35816",
    "datePublished": "2025-04-28T00:00:00.000Z",
    "dateReserved": "2023-06-17T00:00:00.000Z",
    "dateUpdated": "2025-04-28T18:08:07.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-35814 (GCVE-0-2023-35814)

Vulnerability from cvelistv5 – Published: 2025-04-28 00:00 – Updated: 2025-04-28 15:56
VLAI?
Summary
DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
Severity ?
3.5 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
Vendor Product Version
DevExpress DevExpress Affected: 0 , < 21.2.12 (custom)
Affected: 22 , < 22.1.7 (custom)
Affected: 22.1.8 , < 22.1.9 (custom)
Affected: 22.2 , < 22.2.3 (custom)
Affected: 22.2.4 , < 22.2.6 (custom)
Affected: 23 , < 23.1.3 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-35814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-28T15:55:54.213286Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-28T15:56:00.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DevExpress",
          "vendor": "DevExpress",
          "versions": [
            {
              "lessThan": "21.2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.7",
              "status": "affected",
              "version": "22",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.9",
              "status": "affected",
              "version": "22.1.8",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.3",
              "status": "affected",
              "version": "22.2",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.6",
              "status": "affected",
              "version": "22.2.4",
              "versionType": "custom"
            },
            {
              "lessThan": "23.1.3",
              "status": "affected",
              "version": "23",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "21.2.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.7",
                  "versionStartIncluding": "22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.9",
                  "versionStartIncluding": "22.1.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.3",
                  "versionStartIncluding": "22.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.6",
                  "versionStartIncluding": "22.2.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "23.1.3",
                  "versionStartIncluding": "23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-28T15:54:16.095Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
        },
        {
          "url": "https://code-white.com/public-vulnerability-list/"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-forms"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-formed-request-to-a-report-control-s-backend-can-use"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-access"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-35814",
    "datePublished": "2025-04-28T00:00:00.000Z",
    "dateReserved": "2023-06-17T00:00:00.000Z",
    "dateUpdated": "2025-04-28T15:56:00.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-35815 (GCVE-0-2023-35815)

Vulnerability from cvelistv5 – Published: 2025-04-28 00:00 – Updated: 2025-04-28 18:08
VLAI?
Summary
DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.
Severity ?
3.5 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
Vendor Product Version
DevExpress DevExpress Affected: 0 , < 21.2.12 (custom)
Affected: 22 , < 22.1.7 (custom)
Affected: 22.1.8 , < 22.1.9 (custom)
Affected: 22.2 , < 22.2.3 (custom)
Affected: 22.2.4 , < 22.2.6 (custom)
Affected: 23 , < 23.1.3 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-35815",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-28T18:08:24.167602Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-28T18:08:30.889Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DevExpress",
          "vendor": "DevExpress",
          "versions": [
            {
              "lessThan": "21.2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.7",
              "status": "affected",
              "version": "22",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.9",
              "status": "affected",
              "version": "22.1.8",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.3",
              "status": "affected",
              "version": "22.2",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.6",
              "status": "affected",
              "version": "22.2.4",
              "versionType": "custom"
            },
            {
              "lessThan": "23.1.3",
              "status": "affected",
              "version": "23",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "21.2.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.7",
                  "versionStartIncluding": "22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.9",
                  "versionStartIncluding": "22.1.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.3",
                  "versionStartIncluding": "22.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.6",
                  "versionStartIncluding": "22.2.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "23.1.3",
                  "versionStartIncluding": "23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-28T16:11:40.586Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1159142/web-reporting-data-source-protection-bypassed-during-xml-deserialization"
        },
        {
          "url": "https://code-white.com/public-vulnerability-list/"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1141947/data-source-protection-bypass-during-xml-deserialization"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-35815",
    "datePublished": "2025-04-28T00:00:00.000Z",
    "dateReserved": "2023-06-17T00:00:00.000Z",
    "dateUpdated": "2025-04-28T18:08:30.889Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-35817 (GCVE-0-2023-35817)

Vulnerability from cvelistv5 – Published: 2025-04-28 00:00 – Updated: 2025-04-28 18:03
VLAI?
Summary
DevExpress before 23.1.3 allows AsyncDownloader SSRF.
Severity ?
5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
Vendor Product Version
DevExpress DevExpress Affected: 0 , < 21.2.12 (custom)
Unaffected: 22 , < 22.1.7 (custom)
Affected: 22.1.8 , < 22.1.9 (custom)
Affected: 22.2 , < 22.2.3 (custom)
Affected: 22.2.4 , < 22.2.6 (custom)
Affected: 23 , < 23.1.3 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-35817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-28T18:02:56.672870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-28T18:03:18.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DevExpress",
          "vendor": "DevExpress",
          "versions": [
            {
              "lessThan": "21.2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.7",
              "status": "unaffected",
              "version": "22",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.9",
              "status": "affected",
              "version": "22.1.8",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.3",
              "status": "affected",
              "version": "22.2",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.6",
              "status": "affected",
              "version": "22.2.4",
              "versionType": "custom"
            },
            {
              "lessThan": "23.1.3",
              "status": "affected",
              "version": "23",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DevExpress before 23.1.3 allows AsyncDownloader SSRF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-28T16:12:35.996Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1161404/report-and-dashboard-server-improper-default-configuration-can-lead-to-ssrf-attacks"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1162045/reporting-bi-dashboard-office-file-api-web-app-configuration-to-help-prevent-ssrf-attacks"
        },
        {
          "url": "https://code-white.com/public-vulnerability-list/"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1157209/server-side-request-forgery-via-asyncdownloader"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-35817",
    "datePublished": "2025-04-28T00:00:00.000Z",
    "dateReserved": "2023-06-17T00:00:00.000Z",
    "dateUpdated": "2025-04-28T18:03:18.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-28684 (GCVE-0-2022-28684)

Vulnerability from cvelistv5 – Published: 2022-08-03 15:20 – Updated: 2024-08-03 06:03
VLAI?
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710.
Severity ?
8.8 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
zdi
References
Impacted products
Vendor Product Version
DevExpress DevExpress Affected: 20.21.01.102
Create a notification for this product.
Credits
Markus Wulftange (@mwulftange)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:03:52.478Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DevExpress",
          "vendor": "DevExpress",
          "versions": [
            {
              "status": "affected",
              "version": "20.21.01.102"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Markus Wulftange (@mwulftange)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-03T15:20:46",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "zdi-disclosures@trendmicro.com",
          "ID": "CVE-2022-28684",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "DevExpress",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "20.21.01.102"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "DevExpress"
              }
            ]
          }
        },
        "credit": "Markus Wulftange (@mwulftange)",
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710."
            }
          ]
        },
        "impact": {
          "cvss": {
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-502: Deserialization of Untrusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2022-28684",
    "datePublished": "2022-08-03T15:20:46",
    "dateReserved": "2022-04-05T00:00:00",
    "dateUpdated": "2024-08-03T06:03:52.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-36483 (GCVE-0-2021-36483)

Vulnerability from cvelistv5 – Published: 2021-08-04 10:04 – Updated: 2024-08-04 00:54
VLAI?
Summary
DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:54:51.443Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-15T15:06:19",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-36483",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e",
              "refsource": "MISC",
              "url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
            },
            {
              "name": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization",
              "refsource": "MISC",
              "url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
            },
            {
              "name": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization",
              "refsource": "MISC",
              "url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
            },
            {
              "name": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f",
              "refsource": "MISC",
              "url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
            },
            {
              "name": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization",
              "refsource": "CONFIRM",
              "url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
            },
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-36483",
    "datePublished": "2021-08-04T10:04:29",
    "dateReserved": "2021-07-12T00:00:00",
    "dateUpdated": "2024-08-04T00:54:51.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-35816 (GCVE-0-2023-35816)

Vulnerability from nvd – Published: 2025-04-28 00:00 – Updated: 2025-04-28 18:08
VLAI?
Summary
DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.
Severity ?
3.5 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CWE
  • CWE-23 - Relative Path Traversal
Assigner
References
Impacted products
Vendor Product Version
DevExpress DevExpress Affected: 0 , < 21.2.12 (custom)
Affected: 22 , < 22.1.7 (custom)
Affected: 22.1.8 , < 22.1.9 (custom)
Affected: 22.2 , < 22.2.3 (custom)
Affected: 22.2.4 , < 22.2.6 (custom)
Affected: 23 , < 23.1.3 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-35816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-28T18:08:00.826540Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-28T18:08:07.672Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DevExpress",
          "vendor": "DevExpress",
          "versions": [
            {
              "lessThan": "21.2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.7",
              "status": "affected",
              "version": "22",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.9",
              "status": "affected",
              "version": "22.1.8",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.3",
              "status": "affected",
              "version": "22.2",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.6",
              "status": "affected",
              "version": "22.2.4",
              "versionType": "custom"
            },
            {
              "lessThan": "23.1.3",
              "status": "affected",
              "version": "23",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "21.2.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.7",
                  "versionStartIncluding": "22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.9",
                  "versionStartIncluding": "22.1.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.3",
                  "versionStartIncluding": "22.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.6",
                  "versionStartIncluding": "22.2.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "23.1.3",
                  "versionStartIncluding": "23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DevExpress before 23.1.3 allows arbitrary TypeConverter conversion."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23 Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-28T16:12:05.415Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization"
        },
        {
          "url": "https://code-white.com/public-vulnerability-list/"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-35816",
    "datePublished": "2025-04-28T00:00:00.000Z",
    "dateReserved": "2023-06-17T00:00:00.000Z",
    "dateUpdated": "2025-04-28T18:08:07.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-35814 (GCVE-0-2023-35814)

Vulnerability from nvd – Published: 2025-04-28 00:00 – Updated: 2025-04-28 15:56
VLAI?
Summary
DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
Severity ?
3.5 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
Vendor Product Version
DevExpress DevExpress Affected: 0 , < 21.2.12 (custom)
Affected: 22 , < 22.1.7 (custom)
Affected: 22.1.8 , < 22.1.9 (custom)
Affected: 22.2 , < 22.2.3 (custom)
Affected: 22.2.4 , < 22.2.6 (custom)
Affected: 23 , < 23.1.3 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-35814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-28T15:55:54.213286Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-28T15:56:00.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DevExpress",
          "vendor": "DevExpress",
          "versions": [
            {
              "lessThan": "21.2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.7",
              "status": "affected",
              "version": "22",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.9",
              "status": "affected",
              "version": "22.1.8",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.3",
              "status": "affected",
              "version": "22.2",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.6",
              "status": "affected",
              "version": "22.2.4",
              "versionType": "custom"
            },
            {
              "lessThan": "23.1.3",
              "status": "affected",
              "version": "23",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "21.2.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.7",
                  "versionStartIncluding": "22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.9",
                  "versionStartIncluding": "22.1.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.3",
                  "versionStartIncluding": "22.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.6",
                  "versionStartIncluding": "22.2.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "23.1.3",
                  "versionStartIncluding": "23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-28T15:54:16.095Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
        },
        {
          "url": "https://code-white.com/public-vulnerability-list/"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-forms"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-formed-request-to-a-report-control-s-backend-can-use"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-access"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-35814",
    "datePublished": "2025-04-28T00:00:00.000Z",
    "dateReserved": "2023-06-17T00:00:00.000Z",
    "dateUpdated": "2025-04-28T15:56:00.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-35815 (GCVE-0-2023-35815)

Vulnerability from nvd – Published: 2025-04-28 00:00 – Updated: 2025-04-28 18:08
VLAI?
Summary
DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.
Severity ?
3.5 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
Vendor Product Version
DevExpress DevExpress Affected: 0 , < 21.2.12 (custom)
Affected: 22 , < 22.1.7 (custom)
Affected: 22.1.8 , < 22.1.9 (custom)
Affected: 22.2 , < 22.2.3 (custom)
Affected: 22.2.4 , < 22.2.6 (custom)
Affected: 23 , < 23.1.3 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-35815",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-28T18:08:24.167602Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-28T18:08:30.889Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DevExpress",
          "vendor": "DevExpress",
          "versions": [
            {
              "lessThan": "21.2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.7",
              "status": "affected",
              "version": "22",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.9",
              "status": "affected",
              "version": "22.1.8",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.3",
              "status": "affected",
              "version": "22.2",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.6",
              "status": "affected",
              "version": "22.2.4",
              "versionType": "custom"
            },
            {
              "lessThan": "23.1.3",
              "status": "affected",
              "version": "23",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "21.2.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.7",
                  "versionStartIncluding": "22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.1.9",
                  "versionStartIncluding": "22.1.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.3",
                  "versionStartIncluding": "22.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.6",
                  "versionStartIncluding": "22.2.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:devexpress:devexpress:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "23.1.3",
                  "versionStartIncluding": "23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-28T16:11:40.586Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1159142/web-reporting-data-source-protection-bypassed-during-xml-deserialization"
        },
        {
          "url": "https://code-white.com/public-vulnerability-list/"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1141947/data-source-protection-bypass-during-xml-deserialization"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-35815",
    "datePublished": "2025-04-28T00:00:00.000Z",
    "dateReserved": "2023-06-17T00:00:00.000Z",
    "dateUpdated": "2025-04-28T18:08:30.889Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-35817 (GCVE-0-2023-35817)

Vulnerability from nvd – Published: 2025-04-28 00:00 – Updated: 2025-04-28 18:03
VLAI?
Summary
DevExpress before 23.1.3 allows AsyncDownloader SSRF.
Severity ?
5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
Vendor Product Version
DevExpress DevExpress Affected: 0 , < 21.2.12 (custom)
Unaffected: 22 , < 22.1.7 (custom)
Affected: 22.1.8 , < 22.1.9 (custom)
Affected: 22.2 , < 22.2.3 (custom)
Affected: 22.2.4 , < 22.2.6 (custom)
Affected: 23 , < 23.1.3 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-35817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-28T18:02:56.672870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-28T18:03:18.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DevExpress",
          "vendor": "DevExpress",
          "versions": [
            {
              "lessThan": "21.2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.7",
              "status": "unaffected",
              "version": "22",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1.9",
              "status": "affected",
              "version": "22.1.8",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.3",
              "status": "affected",
              "version": "22.2",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2.6",
              "status": "affected",
              "version": "22.2.4",
              "versionType": "custom"
            },
            {
              "lessThan": "23.1.3",
              "status": "affected",
              "version": "23",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DevExpress before 23.1.3 allows AsyncDownloader SSRF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-28T16:12:35.996Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1161404/report-and-dashboard-server-improper-default-configuration-can-lead-to-ssrf-attacks"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1162045/reporting-bi-dashboard-office-file-api-web-app-configuration-to-help-prevent-ssrf-attacks"
        },
        {
          "url": "https://code-white.com/public-vulnerability-list/"
        },
        {
          "url": "https://supportcenter.devexpress.com/ticket/details/t1157209/server-side-request-forgery-via-asyncdownloader"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-35817",
    "datePublished": "2025-04-28T00:00:00.000Z",
    "dateReserved": "2023-06-17T00:00:00.000Z",
    "dateUpdated": "2025-04-28T18:03:18.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-28684 (GCVE-0-2022-28684)

Vulnerability from nvd – Published: 2022-08-03 15:20 – Updated: 2024-08-03 06:03
VLAI?
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710.
Severity ?
8.8 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
zdi
References
Impacted products
Vendor Product Version
DevExpress DevExpress Affected: 20.21.01.102
Create a notification for this product.
Credits
Markus Wulftange (@mwulftange)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:03:52.478Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DevExpress",
          "vendor": "DevExpress",
          "versions": [
            {
              "status": "affected",
              "version": "20.21.01.102"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Markus Wulftange (@mwulftange)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-03T15:20:46",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "zdi-disclosures@trendmicro.com",
          "ID": "CVE-2022-28684",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "DevExpress",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "20.21.01.102"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "DevExpress"
              }
            ]
          }
        },
        "credit": "Markus Wulftange (@mwulftange)",
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710."
            }
          ]
        },
        "impact": {
          "cvss": {
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-502: Deserialization of Untrusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-872/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2022-28684",
    "datePublished": "2022-08-03T15:20:46",
    "dateReserved": "2022-04-05T00:00:00",
    "dateUpdated": "2024-08-03T06:03:52.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-36483 (GCVE-0-2021-36483)

Vulnerability from nvd – Published: 2021-08-04 10:04 – Updated: 2024-08-04 00:54
VLAI?
Summary
DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:54:51.443Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-15T15:06:19",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-36483",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e",
              "refsource": "MISC",
              "url": "https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e"
            },
            {
              "name": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization",
              "refsource": "MISC",
              "url": "https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization"
            },
            {
              "name": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization",
              "refsource": "MISC",
              "url": "https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization"
            },
            {
              "name": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f",
              "refsource": "MISC",
              "url": "https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f"
            },
            {
              "name": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization",
              "refsource": "CONFIRM",
              "url": "https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization"
            },
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-341/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-36483",
    "datePublished": "2021-08-04T10:04:29",
    "dateReserved": "2021-07-12T00:00:00",
    "dateUpdated": "2024-08-04T00:54:51.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}