Skip to content
Noroxi

Progress records

331 published records for vendor Progress. 8 of them have been exploited in the wild (listed in CISA KEV) and 17 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
8 · 2.4%
Weaponized
17 · 5.1%
Pre-auth RCE
37
With a fix record
43.8%
Median publish → KEV
158 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

331 records
  • CVE-2023-34362
    99Now

    In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    progress · moveit cloudJun 2, 2023

  • CVE-2026-8037
    99Now

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    progress · connection manager for objectscaleJun 4, 2026

  • CVE-2024-4885
    99Now

    WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    progress · whatsup goldJun 25, 2024

  • CVE-2024-1212
    98Now

    LoadMaster Pre-Authenticated OS Command Injection

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    progress · loadmasterFeb 21, 2024

  • CVE-2024-6670
    97Now

    WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    progress · whatsup goldAug 29, 2024

  • CVE-2023-40044
    92Now

    WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 90%

    progress · ws ftp serverSep 27, 2023

  • CVE-2017-11357
    92Now

    Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attacke

    CriticalCVSS 9.8KEVWeaponizedEPSS 77%

    progress · telerik ui for asp.net ajaxAug 23, 2017

  • CVE-2017-9248
    92Now

    Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Te

    CriticalCVSS 9.8KEVWeaponizedEPSS 75%

    progress · sitefinityJul 3, 2017

  • CVE-2023-35708
    68This week

    In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL

    CriticalCVSS 9.8Proof of conceptEPSS 96%

    progress · moveit transferJun 16, 2023

  • CVE-2024-2389
    67This week

    Flowmon Unauthenticated Command Injection Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 93%

    progress · flowmonApr 2, 2024

  • CVE-2023-36934
    65This week

    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023

    CriticalCVSS 9.1Proof of conceptEPSS 95%

    progress · moveit transferJul 5, 2023

  • CVE-2024-5806
    63This week

    MOVEit Transfer Authentication Bypass Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 81%

    progress · moveit transferJun 25, 2024

  • CVE-2022-29847
    60This week

    In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transac

    HighCVSS 7.5WeaponizedEPSS 57%

    progress · whatsup goldMay 11, 2022

  • CVE-2022-29846
    60This week

    In Progress Ipswitch WhatsUp Gold 16.1 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to obtain the WhatsUp Gold

    MediumCVSS 5.3WeaponizedEPSS 5%

    progress · whatsup goldMay 11, 2022

  • CVE-2024-4883
    58Plan

    WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 64%

    progress · whatsup goldJun 25, 2024

  • CVE-2026-2699
    57Plan

    EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)

    CriticalCVSS 9.8Proof of conceptEPSS 58%

    progress · sharefile storage zones controllerApr 2, 2026

  • CVE-2023-36932
    56Plan

    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023

    HighCVSS 8.1No exploitEPSS 81%

    progress · moveit transferJul 5, 2023

  • CVE-2003-0772
    55Plan

    Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a denial of service and possibly execute arbitrary cod

    HighCVSS 7.5Proof of conceptEPSS 84%

    ipswitch · ws ftp serverSep 22, 2003

  • CVE-2024-46909
    54Plan

    WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 48%

    progress · whatsup goldDec 2, 2024

  • CVE-2006-4847
    52Plan

    Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote authenticated users to execute arbitrary code via long

    MediumCVSS 6.5WeaponizedEPSS 85%

    ipswitch · ws ftp serverSep 18, 2006

  • CVE-2023-36933
    52Plan

    In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is

    HighCVSS 7.5No exploitEPSS 72%

    progress · moveit transferJul 5, 2023

  • CVE-2024-2448
    52Plan

    LoadMaster Command Injection Vulnerability

    HighCVSS 8.8No exploitEPSS 55%

    progress · loadmasterMar 22, 2024

  • CVE-2024-5010
    51Plan

    WhatsUp Gold TestController multiple information disclosure vulnerabilities

    HighCVSS 7.5No exploitEPSS 69%

    progress · whatsup goldJun 25, 2024

  • CVE-2026-2701
    51Plan

    RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)

    HighCVSS 8.8No exploitEPSS 54%

    progress · sharefile storage zones controllerApr 2, 2026

  • CVE-2004-0798
    49Plan

    Buffer overflow in the _maincfgret.cgi script for Ipswitch WhatsUp Gold before 8.03 Hotfix 1 allows remote attackers to execute arbitrary co

    HighCVSS 7.5WeaponizedEPSS 62%

    progress · whatsup goldOct 20, 2004