Filtered by vendor Accellion
Subscribe
Total
65 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-8794 | 1 Accellion | 1 File Transfer Appliance | 2026-05-13 | 6.4 MEDIUM | 10.0 CRITICAL |
| An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match local https URLs) lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwd#https:// URL pattern. | |||||
| CVE-2017-8793 | 1 Accellion | 1 File Transfer Appliance | 2026-05-13 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site access with a bypass of the Same Origin Policy. | |||||
| CVE-2015-2857 | 1 Accellion | 1 File Transfer Appliance | 2026-05-13 | 7.5 HIGH | 9.8 CRITICAL |
| Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter. | |||||
| CVE-2016-5663 | 1 Accellion | 1 Kiteworks Appliance | 2026-05-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in oauth_callback.php on Accellion Kiteworks appliances before kw2016.03.00 allow remote attackers to inject arbitrary web script or HTML via the (1) code, (2) error, or (3) error_description parameter. | |||||
| CVE-2016-2351 | 1 Accellion | 1 File Transfer Appliance | 2026-05-06 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote attackers to execute arbitrary SQL commands via the client_id parameter. | |||||
| CVE-2016-2353 | 1 Accellion | 1 File Transfer Appliance | 2026-05-06 | 7.2 HIGH | 7.8 HIGH |
| The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors. | |||||
| CVE-2016-2352 | 1 Accellion | 1 File Transfer Appliance | 2026-05-06 | 6.5 MEDIUM | 8.8 HIGH |
| The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging the YUM_CLIENT restricted-user role. | |||||
| CVE-2016-2350 | 1 Accellion | 1 File Transfer Appliance | 2026-05-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) getimageajax.php, (2) move_partition_frame.html, or (3) wmInfo.html. | |||||
| CVE-2016-5662 | 1 Accellion | 1 Kiteworks Appliance | 2026-05-06 | 7.2 HIGH | 7.8 HIGH |
| Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, which allows local users to gain privileges via unspecified vectors. | |||||
| CVE-2016-5664 | 1 Accellion | 1 Kiteworks Appliance | 2026-05-06 | 5.0 MEDIUM | 4.3 MEDIUM |
| Directory traversal vulnerability on Accellion Kiteworks appliances before kw2016.03.00 allows remote attackers to read files via a crafted URI. | |||||
| CVE-2009-4645 | 1 Accellion | 1 Secure File Transfer Appliance | 2026-04-29 | 7.8 HIGH | N/A |
| Directory traversal vulnerability in web_client_user_guide.html in Accellion Secure File Transfer Appliance before 8_0_105 allows remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter. | |||||
| CVE-2009-4647 | 1 Accellion | 1 Secure File Transfer Appliance | 2026-04-29 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in Accellion Secure File Transfer Appliance before 7_0_296 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not properly handled when the administrator views audit logs. | |||||
| CVE-2009-4646 | 1 Accellion | 1 Secure File Transfer Appliance | 2026-04-29 | 9.0 HIGH | N/A |
| Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer Appliance allows remote authenticated administrators to inject arbitrary shell commands by appending them to a request to update the SNMP public community string. | |||||
| CVE-2009-4644 | 1 Accellion | 1 Secure File Transfer Appliance | 2026-04-29 | 9.0 HIGH | N/A |
| Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command, as demonstrated by modifying the cli program. | |||||
| CVE-2009-4648 | 1 Accellion | 1 Secure File Transfer Appliance | 2026-04-29 | 7.2 HIGH | N/A |
| Accellion Secure File Transfer Appliance before 8_0_105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via (1) arbitrary arguments in the --file_move action in /usr/local/bin/admin.pl, or a hard link attack in (2) chmod or (3) a certain cp command. | |||||
| CVE-2008-3850 | 1 Accellion | 1 Secure File Transfer Appliance | 2026-04-23 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in Accellion File Transfer FTA_7_0_135 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to courier/forgot_password.html. | |||||
| CVE-2008-7012 | 1 Accellion | 1 Secure File Transfer Appliance | 2026-04-23 | 7.8 HIGH | N/A |
| courier/1000@/api_error_email.html (aka "error reporting page") in Accellion File Transfer Appliance FTA_7_0_178, and possibly other versions before FTA_7_0_189, allows remote attackers to send spam e-mail via modified description and client_email parameters. | |||||
| CVE-2026-24750 | 1 Accellion | 1 Kiteworks | 2026-03-27 | N/A | 7.6 HIGH |
| Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch. | |||||
| CVE-2026-23635 | 1 Accellion | 1 Kiteworks | 2026-03-27 | N/A | 6.5 MEDIUM |
| Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotected Transport of Credentials under certain circumstances. Upgrade Kiteworks to version 9.2.1 or later to receive a patch. | |||||
| CVE-2026-23636 | 1 Accellion | 1 Kiteworks | 2026-03-27 | N/A | 5.5 MEDIUM |
| Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, the manager of a form could potentially exploit an Unrestricted Upload of File with Dangerous Type due to a missing validation. Upgrade Kiteworks to version 9.2.1 or later to receive a patch. | |||||