Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
TantoSec published a working exploit chain that turns an AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution, releasing a command-line tool and two mixed-mode DLL payloads on September 7. Progress patched the...