CVE-2023-35814

Description

References

• code-white.com/public-vulnerability-list · Vendor Advisory
• supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-forms · Permissions Required
• supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-access · Permissions Required
• supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-formed-request-to-a-report-control-s-backend-can-use · Permissions Required
• supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 · Permissions Required

devexpress 的其他漏洞

• CVE-2023-35817严重 9.8DevExpress before 23.1.3 allows AsyncDownloader SSRF.
• CVE-2023-35816中危 5.3DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.
• CVE-2023-35815严重 9.8DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.
• CVE-2022-28684高危 8.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to …
• CVE-2021-36483高危 8.8DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.