Filtered by vendor Accellion Subscriptions
Filtered by product Kiteworks Subscriptions
Total 8 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-28270 2 Accellion, Kiteworks 2 Kiteworks, Security-advisories 2026-03-04 4.9 Medium
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.
CVE-2026-28271 2 Accellion, Kiteworks 2 Kiteworks, Security-advisories 2026-03-04 6.5 Medium
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.
CVE-2026-28272 2 Accellion, Kiteworks 2 Kiteworks, Security-advisories 2026-03-04 8.1 High
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue.
CVE-2026-28269 2 Accellion, Kiteworks 2 Kiteworks, Security-advisories 2026-03-03 5.9 Medium
Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.
CVE-2025-53939 2 Accellion, Kiteworks 2 Kiteworks, Kiteworks 2025-12-04 6.3 Medium
Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly elevate another user's permissions on the share. This issue has been patched in version 9.1.0.
CVE-2021-31586 1 Accellion 1 Kiteworks 2024-11-21 8.8 High
Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.
CVE-2021-31585 1 Accellion 1 Kiteworks 2024-11-21 6.7 Medium
Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow local access.
CVE-2017-9421 1 Accellion 1 Kiteworks 2024-11-21 N/A
Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using a gathered token via a POST request to /oauth/token.