A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild.
Security firm TantoSec has published a working exploit chain targeting vulnerabilities
from The Hacker News https://ift.tt/nZO1K4L
via IFTTT
from The Hacker News https://ift.tt/nZO1K4L
via IFTTT
Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
![Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released]()
Reviewed by Fully Health Tips And Tricks 2020
on
September 07, 2026
Rating:
No comments: