devexpress 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには パス処理の欠陥 and vendor risk ssrf があり、vendor surface software deployment and vendor surface production workloads の利用場面で ファイル上書き などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2023-35817 | DevExpress before 23.1.3 allows AsyncDownloader SSRF. | [email protected] | 5.0 | 0.27% | 2025-04-28 | 2025-06-05 |
| CVE-2023-35816 | DevExpress before 23.1.3 allows arbitrary TypeConverter conversion. | [email protected] | 3.5 | 0.38% | 2025-04-28 | 2025-06-05 |
| CVE-2023-35815 | DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data. | [email protected] | 3.5 | 0.14% | 2025-04-28 | 2025-06-05 |
| CVE-2023-35814 | DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms. | [email protected] | 3.5 | 0.46% | 2025-04-28 | 2025-06-05 |
| CVE-2022-41479 | The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects in the /DXR.axd?r= HTTP GET parameter. This leads to an Insecure Direct Object References (IDOR) vulnerability which allows attackers to access the application source code. NOTE: the vendor disputes this because the retrieved source code is only the DevExpress client-side application code that is, of course, intentionally readable by web browsers (a site's | [email protected] | 7.5 | 0.39% | 2022-10-18 | 2025-05-15 |
| CVE-2022-28684 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710. | [email protected] | 8.8 | 24.09% | 2022-08-03 | 2024-11-21 |
| CVE-2021-36483 | DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization. | [email protected] | 8.8 | 4.20% | 2021-08-04 | 2024-11-21 |
| CVE-2015-4670 | Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd. | [email protected] | 6.4 | 0.88% | 2015-08-18 | 2026-05-06 |
| CVE-2014-2575 | Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. (dot dot) in the __EVENTARGUMENT parameter. | [email protected] | 6.5 | 9.55% | 2014-06-06 | 2026-05-06 |