Progress Telerik UI For ASP.NET AJAX

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, or .WMF on the server through a specially crafted request. NOTE: RadChart was discontinued in 2014 in favor of RadHtmlChart. All RadChart versions were affected. To avoid this vulnerability, you must remove RadChart's HTTP handler from a web.config (its type is Telerik.Web.UI.ChartHttpHandler).

An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebResource.axd file. This may allow the attacker to gain unauthorized access to the server and execute code. To exploit, one must use the parameter _TSM_HiddenField_ and inject a command at the end of the URI. NOTE: the vendor states that this is not a vulnerability. The request's output does not indicate that a "true" command was executed on the server, and the request's output does not leak any private source code or data from the server

Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX

AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX

RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX

DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX

Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX

Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via a full pathname in the UploadID metadata value.

SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX

Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX

RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX

RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAX

RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX

RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX

Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart

Insufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAX

DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX

XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX