CVE-2016-5662

Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, which allows local users to gain privileges via unspecified vectors...

CVE-2016-5663

The CVE-2016-5663 entry relates to multiple cross-site scripting (XSS) flaws in oauth_callback.php on Accellion Kiteworks appliances prior to kw2016.03.00. The root cause is improper neutralization/validation of user-supplied input, allowing an unauthenticated remote attacker to inject scripts vi...

CVE-2016-5664

CVE-2016-5664 affects Accellion Kiteworks appliances prior to kw2016.03.00. The vulnerability is a directory traversal flaw that allows an unauthenticated remote attacker to read files outside the webroot via a crafted URI. Public sources (NVD) assign a network-based, low- to moderate-severity im...

CVE-2016-5662

CVE-2016-5662 affects Accellion Kiteworks appliances prior to kw2016.03.00. The root cause is that the script at /opt/bin/cli runs with setuid-root permissions, enabling an authenticated local user to escalate privileges to root via unspecified vectors. The vulnerability is limited to local privi...

Accellion Kiteworks contains multiple vulnerabilities

Overview The Accellion Kiteworks appliance prior to version kw2016.03.00 contains multiple vulnerabilities. Description CWE-276: Incorrect Default Permissions - CVE-2016-5662 The /opt/bin/cli script has setuid permissions by default, allowing an authenticated KiteWorks users to escalate privilege...