Devexpress
7 CVEs across 4 Devexpress products. Browse Devexpress vulnerabilities, severities, and proof-of-concept exploits.
Devexpress products with known CVEs
Devexpress CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2023-35817 | Medium | 5.0 | 2025-04-28 | DevExpress before 23.1.3 allows AsyncDownloader SSRF. |
CVE-2023-35816 | Low | 3.5 | 2025-04-28 | DevExpress before 23.1.3 allows arbitrary TypeConverter conversion. |
CVE-2023-35815 | Low | 3.5 | 2025-04-28 | DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data. |
CVE-2023-35814 | Low | 3.5 | 2025-04-28 | DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms. |
CVE-2022-41479 | High | 7.5 | 2022-10-18 | The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects in the /DXR.axd?r=… |
CVE-2022-28684 | High | 8.8 | 2022-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulner… |
CVE-2021-36483 | High | 8.8 | 2021-08-04 | DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization. |
CVE-2015-4670 | | | 2015-08-18 | Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers… |
CVE-2014-2575 | | | 2014-06-06 | Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x be… |