CVE-2017-9421

Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using a gathered token via a POST request to /oauth/token...

CVE-2017-9421

Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using a gathered token via a POST request to /oauth/token...

CVE-2017-9421

The CVE-2017-9421 issue affects Accellion kiteworks prior to 2017.01.00. A remote attacker can bypass authentication by using a token gathered via a POST to /oauth/token to perform certain API calls on behalf of a web user. The root cause is an authentication bypass linked to token handling in th...

PT-2018-8508

Name of the Vulnerable Software and Affected Versions Accellion kiteworks versions prior to 2017.01.00 Description The issue allows remote attackers to bypass authentication and execute certain API calls on behalf of a web user. This is achieved by using a gathered token via a POST request to...

CVE-2017-9421: Improper Authentication

Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using a gathered token via a POST request to /oauth/token...

Accellion Kiteworks Elevation of Privilege Vulnerability

Accellion Kiteworks is the leading private cloud platform for secure content. An elevation of privilege vulnerability exists in Accellion Kiteworks that allows authenticated KiteWorks users to elevate privileges...

Accellion Kiteworks Cross-Site Scripting Vulnerability

Accellion Kiteworks is the leading private cloud platform for secure content. A cross-site scripting vulnerability exists in versions of Accellion Kiteworks prior to 2016.03.00 due to the program failing to properly filter user-supplied parameters. Allowing an attacker to exploit the vulnerabilit...

Accellion Kiteworks Security Bypass Vulnerability

Accellion Kiteworks is the leading private cloud platform for secure content. A security bypass vulnerability exists in Accellion Kiteworks version 2016.03.00, which allows attackers to bypass security restrictions and perform unauthorized operations...

CVE-2016-5664

Directory traversal vulnerability on Accellion Kiteworks appliances before kw2016.03.00 allows remote attackers to read files via a crafted URI...

CVE-2016-5664

Directory traversal vulnerability on Accellion Kiteworks appliances before kw2016.03.00 allows remote attackers to read files via a crafted URI...

CVE-2016-5663

Multiple cross-site scripting XSS vulnerabilities in oauthcallback.php on Accellion Kiteworks appliances before kw2016.03.00 allow remote attackers to inject arbitrary web script or HTML via the 1 code, 2 error, or 3 errordescription parameter...

CVE-2016-5663

Multiple cross-site scripting XSS vulnerabilities in oauthcallback.php on Accellion Kiteworks appliances before kw2016.03.00 allow remote attackers to inject arbitrary web script or HTML via the 1 code, 2 error, or 3 errordescription parameter...

CVE-2016-5662

Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, which allows local users to gain privileges via unspecified vectors...

CVE-2016-5662

Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, which allows local users to gain privileges via unspecified vectors...

Design/Logic Flaw

Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, which allows local users to gain privileges via unspecified vectors...

Directory traversal

Directory traversal vulnerability on Accellion Kiteworks appliances before kw2016.03.00 allows remote attackers to read files via a crafted URI...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in oauthcallback.php on Accellion Kiteworks appliances before kw2016.03.00 allow remote attackers to inject arbitrary web script or HTML via the 1 code, 2 error, or 3 errordescription parameter...

CVE-2016-5664

Directory traversal vulnerability on Accellion Kiteworks appliances before kw2016.03.00 allows remote attackers to read files via a crafted URI...

CVE-2016-5663

Multiple cross-site scripting XSS vulnerabilities in oauthcallback.php on Accellion Kiteworks appliances before kw2016.03.00 allow remote attackers to inject arbitrary web script or HTML via the 1 code, 2 error, or 3 errordescription parameter...

CVE-2016-5663

The CVE-2016-5663 entry relates to multiple cross-site scripting (XSS) flaws in oauth_callback.php on Accellion Kiteworks appliances prior to kw2016.03.00. The root cause is improper neutralization/validation of user-supplied input, allowing an unauthenticated remote attacker to inject scripts vi...