{"items":[{"id":"CVE-2023-35817","published":"2025-04-28T00:00:00.000Z","updated":"2025-04-28T18:03:18.175Z","title":"DevExpress before 23.1.3 allows AsyncDownloader SSRF.","severity":"MEDIUM","score":5,"vendor":"DevExpress","product":"DevExpress","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2023-35816","published":"2025-04-28T00:00:00.000Z","updated":"2025-04-28T18:08:07.672Z","title":"DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.","severity":"LOW","score":3.5,"vendor":"DevExpress","product":"DevExpress","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2023-35815","published":"2025-04-28T00:00:00.000Z","updated":"2025-04-28T18:08:30.889Z","title":"DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.","severity":"LOW","score":3.5,"vendor":"DevExpress","product":"DevExpress","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2023-35814","published":"2025-04-28T00:00:00.000Z","updated":"2025-04-28T15:56:00.337Z","title":"DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.","severity":"LOW","score":3.5,"vendor":"DevExpress","product":"DevExpress","kev":false,"epss":0.00619,"kevAdded":null},{"id":"CVE-2022-28684","published":"2022-08-03T15:20:46.000Z","updated":"2024-08-03T06:03:52.478Z","title":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this…","severity":"HIGH","score":8.8,"vendor":"DevExpress","product":"DevExpress","kev":false,"epss":0.03754,"kevAdded":null}]}