Accellion Kiteworks

Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.

Kiteworks Core has an OS Command Injection

Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Management

Kiteworks Core is vulnerable to Improper Input Validation

Kiteworks Secure Data Forms has a SQL Injection vulnerability

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability

Kiteworks Secure Data Forms vulnerable to Cross-site Scripting

Kiteworks Email Protection Gateway has an Insufficient Session Expiration

Kiteworks Core has an Unrestricted Upload of File with Dangerous Type

Kiteworks Secure Data Forms is vulnerable to an Unrestricted Upload of File with Dangerous Type

Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow local access.

Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using a gathered token via a POST request to /oauth/token.

Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)

Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentials

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key