Filtered by vendor Accellion
Subscribe
Total
42 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-24110 | 1 Accellion | 1 Managed File Transfer | 2023-08-08 | 4.0 MEDIUM | 6.5 MEDIUM |
| Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later. | |||||
| CVE-2021-27101 | 1 Accellion | 1 Fta | 2023-08-08 | 7.5 HIGH | 9.8 CRITICAL |
| Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later. | |||||
| CVE-2021-31585 | 1 Accellion | 1 Kiteworks | 2022-07-12 | 4.6 MEDIUM | 6.7 MEDIUM |
| Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow local access. | |||||
| CVE-2019-5623 | 1 Accellion | 1 File Transfer Appliance | 2021-09-14 | 7.5 HIGH | 9.8 CRITICAL |
| Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'). | |||||
| CVE-2021-31586 | 1 Accellion | 1 Kiteworks | 2021-06-25 | 6.5 MEDIUM | 8.8 HIGH |
| Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search. | |||||
| CVE-2021-27731 | 1 Accellion | 1 Fta | 2021-03-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later. | |||||
| CVE-2021-27730 | 1 Accellion | 1 Fta | 2021-03-05 | 7.5 HIGH | 9.8 CRITICAL |
| Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. The fixed version is FTA_9_12_444 and later. | |||||
| CVE-2021-27102 | 1 Accellion | 1 Fta | 2021-02-19 | 7.2 HIGH | 7.8 HIGH |
| Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later. | |||||
| CVE-2021-27103 | 1 Accellion | 1 Fta | 2021-02-17 | 7.5 HIGH | 9.8 CRITICAL |
| Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later. | |||||
| CVE-2021-27104 | 1 Accellion | 1 Fta | 2021-02-17 | 10.0 HIGH | 9.8 CRITICAL |
| Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later. | |||||
| CVE-2015-2857 | 1 Accellion | 1 File Transfer Appliance | 2020-09-09 | 7.5 HIGH | 9.8 CRITICAL |
| Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter. | |||||
| CVE-2019-5622 | 1 Accellion | 1 File Transfer Appliance | 2020-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials. | |||||
| CVE-2016-9500 | 1 Accellion | 1 Ftp Server | 2019-10-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable to cross-site scripting. | |||||
| CVE-2016-9499 | 1 Accellion | 1 Ftp Server | 2019-10-09 | 5.0 MEDIUM | 5.3 MEDIUM |
| Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them. | |||||
| CVE-2017-8303 | 1 Accellion | 1 File Transfer Appliance | 2019-10-03 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter. | |||||
| CVE-2017-8793 | 1 Accellion | 1 File Transfer Appliance | 2019-10-03 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site access with a bypass of the Same Origin Policy. | |||||
| CVE-2017-9421 | 1 Accellion | 1 Kiteworks | 2018-06-27 | 6.4 MEDIUM | 6.5 MEDIUM |
| Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using a gathered token via a POST request to /oauth/token. | |||||
| CVE-2015-2856 | 1 Accellion | 1 File Transfer Appliance | 2017-10-23 | 5.0 MEDIUM | 7.5 HIGH |
| Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attackers to read arbitrary files via a .. (dot dot) in the statecode cookie. | |||||
| CVE-2009-4648 | 1 Accellion | 1 Secure File Transfer Appliance | 2017-08-17 | 7.2 HIGH | N/A |
| Accellion Secure File Transfer Appliance before 8_0_105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via (1) arbitrary arguments in the --file_move action in /usr/local/bin/admin.pl, or a hard link attack in (2) chmod or (3) a certain cp command. | |||||
| CVE-2009-4647 | 1 Accellion | 1 Secure File Transfer Appliance | 2017-08-17 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in Accellion Secure File Transfer Appliance before 7_0_296 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not properly handled when the administrator views audit logs. | |||||