GCVE - cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:devexpress:devexpress:22.2.4:*:*:*:*:*:*:*

part: a version: 22.2.4 update: *

Vendor	Devexpress (`c3b1625f-b89e-5484-934c-ec35ce2a9857`)
Product	Devexpress (`bc1acd59-921a-58c0-845a-8d4e1845cd07`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-35817`	vulnerable	2026-06-08 06:06:27.818234	Details available MEDIUM (5) DevExpress before 23.1.3 allows AsyncDownloader SSRF. Published: 2025-04-28T00:00:00.000Z Updated: 2025-04-28T18:03:18.175Z Open on db.gcve.eu Reference links https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 https://supportcenter.devexpress.com/ticket/details/t1161404/report-and-dashboard-server-improper-default-configuration-can-lead-to-ssrf-attacks https://supportcenter.devexpress.com/ticket/details/t1162045/reporting-bi-dashboard-office-file-api-web-app-configuration-to-help-prevent-ssrf-attacks https://code-white.com/public-vulnerability-list/ https://supportcenter.devexpress.com/ticket/details/t1157209/server-side-request-forgery-via-asyncdownloader	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-35816`	vulnerable	2026-06-08 06:06:27.816134	Details available LOW (3.5) DevExpress before 23.1.3 allows arbitrary TypeConverter conversion. Published: 2025-04-28T00:00:00.000Z Updated: 2025-04-28T18:08:07.672Z Open on db.gcve.eu Reference links https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 https://supportcenter.devexpress.com/ticket/details/t1159641/net-desktop-and-web-controls-unsafe-data-type-deserialization https://code-white.com/public-vulnerability-list/ https://supportcenter.devexpress.com/ticket/details/t1127422/insecure-arbitrary-typeconverter-conversion	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-35815`	vulnerable	2026-06-08 06:06:27.815600	Details available LOW (3.5) DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data. Published: 2025-04-28T00:00:00.000Z Updated: 2025-04-28T18:08:30.889Z Open on db.gcve.eu Reference links https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 https://supportcenter.devexpress.com/ticket/details/t1159142/web-reporting-data-source-protection-bypassed-during-xml-deserialization https://code-white.com/public-vulnerability-list/ https://supportcenter.devexpress.com/ticket/details/t1141947/data-source-protection-bypass-during-xml-deserialization	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-35814`	vulnerable	2026-06-08 06:06:27.814374	Details available LOW (3.5) DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms. Published: 2025-04-28T00:00:00.000Z Updated: 2025-04-28T15:56:00.337Z Open on db.gcve.eu Reference links https://supportcenter.devexpress.com/ticket/details/t394936/devexpress-security-advisory-updated-on-april-27-2023 https://code-white.com/public-vulnerability-list/ https://supportcenter.devexpress.com/ticket/details/t1141158/missing-protection-of-xtrareport-serialized-data-in-asp-net-web-forms https://supportcenter.devexpress.com/ticket/details/t1160535/web-reporting-well-formed-request-to-a-report-control-s-backend-can-use https://supportcenter.devexpress.com/ticket/details/t1158413/the-allowpassingdatasourceconnectionparameterstoclient-method-may-allow-untrusted-access	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.