Progress Openedge any version

Authentication Bypass in OpenEdge Authentication Gateway and AdminServer

Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal

Direct local client connections to MS Agents can bypass authentication

In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and 12.3.x through 12.6.x before 12.7.

Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service

In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were susceptible to privilege escalation. If exploited, a local attacker could elevate their privileges and compromise the affected system.

Progress Application Server (PAS) for OpenEdge Denial of Service

Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation