First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-35814

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
DevExpress	DevExpress	< 21.2.12; >= 22, < 22.1.7; >= 22.1.8, < 22.1.9; >= 22.2, < 22.2.3; >= 22.2.4, < 22.2.6; >= 23, < 23.1.3

References

Timeline

Published: Apr 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-358159.8DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.CVE-2023-358165.3DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.CVE-2023-358179.8DevExpress before 23.1.3 allows AsyncDownloader SSRF.CVE-2023-358186.8An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to CVE-2023-35824.3Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board CVE-2023-358237.0An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134 CVE-2023-358247.0An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c.CVE-2023-358267.0An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in cedrus_remove in drivers/staging/media/sunxi/cedrus/CVE-2023-358277.0An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_ma CVE-2023-358287.0An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesa CVE-2023-358297.0An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec CVE-2023-358309.8STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TC

CVE-2023-35814: Critical severity, CVSS 9.8 | Vulnix