THREATIST.IORead the docs 82 records in Kiteworks · all components
Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow.
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to.
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF).
Improper authentication in a Kiteworks Email Protection Gateway administrative service.
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF).
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery.
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator wh…
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF).
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF).
A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required.
Kiteworks is a private data network (PDN).
Kiteworks is a private data network (PDN).
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it.
A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated priv…
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting.
Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed…
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated se…
An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request.
A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node.
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data.
Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read bac…
Kiteworks is a private data network (PDN).
Kiteworks is a private data network (PDN).
An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identi…