{"resultsPerPage":33,"startIndex":0,"totalResults":33,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-29T21:27:39.356","vulnerabilities":[{"cve":{"id":"CVE-2016-5662","sourceIdentifier":"cret@cert.org","published":"2016-08-26T19:59:12.290","lastModified":"2026-06-17T00:49:50.017","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, which allows local users to gain privileges via unspecified vectors."},{"lang":"es","value":"Accesorios Accellion Kiteworks en versiones anteriores a kw2016.03.00 usa permisos setuid-root para /opt/bin/cli, lo que permite a usuarios locales obtener privilegios a través de vectores no especificados."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","baseScore":7.2,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":3.9,"impactScore":10.0,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks_appliance:*:*:*:*:*:*:*:*","versionEndIncluding":"kw2016.03.00","matchCriteriaId":"638858AC-D8A8-4596-A52C-96D8D5B549F0"}]}]}],"references":[{"url":"http://www.kb.cert.org/vuls/id/305607","source":"cret@cert.org","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/92662","source":"cret@cert.org"},{"url":"http://www.kb.cert.org/vuls/id/305607","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/92662","source":"af854a3a-2127-422b-91ae-364da2661108"}],"evaluatorComment":"<a href=\"http://cwe.mitre.org/data/definitions/276.html\">CWE-276: Incorrect Default Permissions</a>"}},{"cve":{"id":"CVE-2016-5663","sourceIdentifier":"cret@cert.org","published":"2016-08-26T19:59:13.273","lastModified":"2026-06-17T00:49:50.117","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in oauth_callback.php on Accellion Kiteworks appliances before kw2016.03.00 allow remote attackers to inject arbitrary web script or HTML via the (1) code, (2) error, or (3) error_description parameter."},{"lang":"es","value":"Múltiples vulnerabilidades de XSS en oauth_callback.php en accesorios Accellion Kiteworks en versiones anteriores a kw2016.03.00 permiten a atacantes remotos inyectar secuencias de comandos web y HTML arbitrarios a través de (1) el código, (2) el error o (3) el parámetro error_description."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks_appliance:*:*:*:*:*:*:*:*","versionEndIncluding":"kw2016.03.00","matchCriteriaId":"638858AC-D8A8-4596-A52C-96D8D5B549F0"}]}]}],"references":[{"url":"http://www.kb.cert.org/vuls/id/305607","source":"cret@cert.org","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/92662","source":"cret@cert.org"},{"url":"http://www.kb.cert.org/vuls/id/305607","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/92662","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2016-5664","sourceIdentifier":"cret@cert.org","published":"2016-08-26T19:59:14.257","lastModified":"2026-06-17T00:49:50.223","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Directory traversal vulnerability on Accellion Kiteworks appliances before kw2016.03.00 allows remote attackers to read files via a crafted URI."},{"lang":"es","value":"Vulnerabilidad de salto de directorio en accesorios Accellion Kiteworks en versiones anteriores a kw2016.03.00 permite a atacantes remotos leer archivos a través de una URI manipulada."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks_appliance:*:*:*:*:*:*:*:*","versionEndIncluding":"kw2016.03.00","matchCriteriaId":"638858AC-D8A8-4596-A52C-96D8D5B549F0"}]}]}],"references":[{"url":"http://www.kb.cert.org/vuls/id/305607","source":"cret@cert.org","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/92662","source":"cret@cert.org"},{"url":"http://www.kb.cert.org/vuls/id/305607","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/92662","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2017-9421","sourceIdentifier":"cve@mitre.org","published":"2018-05-24T13:29:00.227","lastModified":"2026-06-17T01:28:04.283","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using a gathered token via a POST request to /oauth/token."},{"lang":"es","value":"Vulnerabilidad de omisión de autenticación en Accellion kiteworks en versiones anteriores a la 2017.01.00 permite que atacantes remotos ejecuten ciertas llamadas API en nombre de un usuario web que emplea un token recopilado mediante una petición POST en oauth/token."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":4.9,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"2017.01.00","matchCriteriaId":"6B06FEDE-73B4-4265-888E-DC1B4E381A41"}]}]}],"references":[{"url":"https://github.com/jer1nj0y/Vulns/blob/master/Kiteworks%20Vulnerability","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/jer1nj0y/Vulns/blob/master/Kiteworks%20Vulnerability","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-31585","sourceIdentifier":"cve@mitre.org","published":"2021-06-23T12:15:07.940","lastModified":"2026-06-17T03:52:02.510","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow local access."},{"lang":"es","value":"Accellion Kiteworks versiones anteriores a 7.3.1, permite a un usuario con privilegios de administrador escalar sus privilegios al generar contraseñas SSH que permiten el acceso local"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","baseScore":4.6,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.1","matchCriteriaId":"060D6BF6-0CCD-4338-90CD-DFB3C1D89FA9"}]}]}],"references":[{"url":"https://github.com/accellion/CVEs","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/accellion/CVEs/blob/main/CVE-2021-31585.txt","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/accellion/CVEs","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/accellion/CVEs/blob/main/CVE-2021-31585.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-31586","sourceIdentifier":"cve@mitre.org","published":"2021-06-23T12:15:07.973","lastModified":"2026-06-17T03:52:02.627","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search."},{"lang":"es","value":"Accellion Kiteworks versiones anteriores a 7.4.0, permite a un usuario autenticado llevar a cabo una inyección SQL por medio de LDAPGroup Search"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"7.4.0","matchCriteriaId":"7ABB4CA7-838D-473A-8662-C62EBB5C6A53"}]}]}],"references":[{"url":"https://github.com/accellion/CVEs","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/accellion/CVEs/blob/main/CVE-2021-31586.txt","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/accellion/CVEs","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/accellion/CVEs/blob/main/CVE-2021-31586.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-24110","sourceIdentifier":"cve@mitre.org","published":"2022-02-14T12:15:27.443","lastModified":"2026-06-17T04:31:18.643","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later."},{"lang":"es","value":"Kiteworks MFT versión 7.5, puede permitir que un usuario no autorizado restablezca las contraseñas de otros usuarios. Esto ha sido corregido en versiones 7.6 y posteriores"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:managed_file_transfer:*:*:*:*:*:*:*:*","versionEndExcluding":"7.6","matchCriteriaId":"D1184F67-E9DB-4069-9D3B-5108485F3756"}]}]}],"references":[{"url":"https://github.com/accellion/CVEs/blob/main/CVE-2022-24110.txt","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.kiteworks.com/platform/simple/managed-file-transfer/","source":"cve@mitre.org","tags":["Product"]},{"url":"https://github.com/accellion/CVEs/blob/main/CVE-2022-24110.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.kiteworks.com/platform/simple/managed-file-transfer/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"]}]}},{"cve":{"id":"CVE-2024-28063","sourceIdentifier":"cve@mitre.org","published":"2024-05-18T22:15:07.133","lastModified":"2026-06-17T07:20:53.823","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS."},{"lang":"es","value":"Kiteworks Totemomail hasta 7.0.0 permite /responsiveUI/EnvelopeOpenServlet envolventeRecipient XSS reflejado."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"kiteworks","product":"totemomail","defaultStatus":"unknown","cpes":["cpe:2.3:a:kiteworks:totemomail:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThanOrEqual":"7.0.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-05-21T17:09:11.051389Z","id":"CVE-2024-28063","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:totemo:totemomail:*:*:*:*:*:*:*:*","versionEndIncluding":"7.0.0","matchCriteriaId":"B991B9F1-B535-4FB4-9D32-AB85400CEDA8"}]}]}],"references":[{"url":"https://www.objectif-securite.ch/advisories/totemomail-reflected-xss.txt","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.objectif-securite.ch/advisories/totemomail-reflected-xss.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2024-28064","sourceIdentifier":"cve@mitre.org","published":"2024-05-18T22:15:07.343","lastModified":"2026-06-17T07:20:53.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages)."},{"lang":"es","value":"Kiteworks Totemomail 7.x y 8.x anteriores a 8.3.0 permiten directory traversal en /responsiveUI/EnvelopeOpenServlet messageId para operaciones de lectura y eliminación de archivos no autenticados (con displayLoginChunkedImages) y operaciones de escritura (con storeLoginChunkedImages)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"kiteworks","product":"totemomail","defaultStatus":"unknown","cpes":["cpe:2.3:a:kiteworks:totemomail:7.0:*:*:*:*:*:*:*"],"versions":[{"version":"7.0","lessThan":"8.0","versionType":"custom","status":"affected"}]},{"vendor":"kiteworks","product":"totemomail","defaultStatus":"unknown","cpes":["cpe:2.3:a:kiteworks:totemomail:8.0:*:*:*:*:*:*:*"],"versions":[{"version":"8.0","lessThan":"8.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-29T20:01:04.316175Z","id":"CVE-2024-28064","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-26"}]}],"references":[{"url":"https://www.objectif-securite.ch/advisories/totemomail-path-traversal.txt","source":"cve@mitre.org"},{"url":"https://www.objectif-securite.ch/advisories/totemomail-path-traversal.txt","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2023-7273","sourceIdentifier":"a341c0d1-ebf7-493f-a84e-38cf86618674","published":"2024-10-01T13:15:02.463","lastModified":"2026-06-17T06:52:27.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests.\nIf a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing CSRF check is bypassed in this case. An attacker can, for example, create a new administrator account if the request is executed in the browser of an authenticated victim."},{"lang":"es","value":"Cross site request forgery en Kiteworks OwnCloud permite que un atacante no autenticado falsifique solicitudes. Si una solicitud no tiene un encabezado de autorización, se crea con una cadena vacía como valor mediante una regla de reescritura. La comprobación CSRF se realiza comparando el valor del encabezado con un valor nulo, lo que significa que en este caso se omite la comprobación CSRF existente. Un atacante puede, por ejemplo, crear una nueva cuenta de administrador si la solicitud se ejecuta en el navegador de una víctima autenticada."}],"affected":[{"source":"a341c0d1-ebf7-493f-a84e-38cf86618674","affectedData":[{"vendor":"Kiteworks","product":"OwnCloud","defaultStatus":"unaffected","repo":"https://github.com/owncloud/core","versions":[{"version":"0","lessThanOrEqual":"10.12.2","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"kiteworks","product":"owncloud","defaultStatus":"unknown","cpes":["cpe:2.3:a:kiteworks:owncloud:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"10.12.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"a341c0d1-ebf7-493f-a84e-38cf86618674","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-01T13:15:11.127537Z","id":"CVE-2023-7273","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"a341c0d1-ebf7-493f-a84e-38cf86618674","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://cirosec.de/sa/sa-2023-012","source":"a341c0d1-ebf7-493f-a84e-38cf86618674"},{"url":"https://hackerone.com/reports/2041007","source":"a341c0d1-ebf7-493f-a84e-38cf86618674"}]}},{"cve":{"id":"CVE-2025-53896","sourceIdentifier":"security-advisories@github.com","published":"2025-11-29T03:15:58.473","lastModified":"2026-06-17T09:39:05.717","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"security-advisories","versions":[{"version":"< 9.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-03T15:11:29.229080Z","id":"CVE-2025-53896","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks_managed_file_transfer:*:*:*:*:*:*:*:*","versionEndExcluding":"9.1.0","matchCriteriaId":"795C3F91-729E-4363-9C52-1C9C7CBAD284"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-23h2-3jj8-58hm","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-53897","sourceIdentifier":"security-advisories@github.com","published":"2025-11-29T03:15:58.653","lastModified":"2026-06-17T09:39:05.837","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted fake page of Kiteworks MFT. This issue has been patched in version 9.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"security-advisories","versions":[{"version":"< 9.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-01T15:42:26.731259Z","id":"CVE-2025-53897","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks_managed_file_transfer:*:*:*:*:*:*:*:*","versionEndExcluding":"9.1.0","matchCriteriaId":"795C3F91-729E-4363-9C52-1C9C7CBAD284"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-cxwc-7899-3h4m","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-53899","sourceIdentifier":"security-advisories@github.com","published":"2025-11-29T03:15:58.817","lastModified":"2026-06-17T09:39:05.943","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"security-advisories","versions":[{"version":"< 9.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-01T15:41:01.311382Z","id":"CVE-2025-53899","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-941"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks_managed_file_transfer:*:*:*:*:*:*:*:*","versionEndExcluding":"9.1.0","matchCriteriaId":"795C3F91-729E-4363-9C52-1C9C7CBAD284"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5gx5-vcpp-8cr5","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-53900","sourceIdentifier":"security-advisories@github.com","published":"2025-11-29T03:15:58.983","lastModified":"2026-06-17T09:39:06.060","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This issue has been patched in version 9.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"security-advisories","versions":[{"version":"< 9.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-01T15:39:06.848449Z","id":"CVE-2025-53900","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-267"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks_managed_file_transfer:*:*:*:*:*:*:*:*","versionEndExcluding":"9.1.0","matchCriteriaId":"795C3F91-729E-4363-9C52-1C9C7CBAD284"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gjq3-8v6p-2h6h","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-53939","sourceIdentifier":"security-advisories@github.com","published":"2025-11-29T03:15:59.153","lastModified":"2026-06-17T09:39:09.760","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly elevate another user's permissions on the share. This issue has been patched in version 9.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"security-advisories","versions":[{"version":"< 9.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-01T15:36:34.537366Z","id":"CVE-2025-53939","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.1.0","matchCriteriaId":"FB6BAD8B-DCA7-4BCE-85E4-2BA40AD4D1A2"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-hpf5-6376-2565","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-28269","sourceIdentifier":"security-advisories@github.com","published":"2026-02-26T23:16:36.910","lastModified":"2026-06-17T10:28:24.383","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.2.0, una vulnerabilidad en la funcionalidad de ejecución de comandos de Kiteworks permite a usuarios autenticados redirigir la salida de comandos a ubicaciones de archivo arbitrarias. Esto podría ser explotado para sobrescribir archivos críticos del sistema y obtener acceso elevado. La versión 9.2.0 contiene un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"security-advisories","versions":[{"version":"< 9.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-27T17:52:00.695724Z","id":"CVE-2026-28269","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.2.0","matchCriteriaId":"B494C8D4-2D4B-4F5E-99C1-4CCE8DF6C911"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-6j64-6fpp-9453","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-28270","sourceIdentifier":"security-advisories@github.com","published":"2026-02-27T21:16:18.397","lastModified":"2026-06-17T10:28:24.493","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.2.0, una vulnerabilidad en la configuración de Kiteworks permite la carga de archivos arbitrarios sin la validación adecuada. Administradores maliciosos podrían explotar esto para cargar tipos de archivos no autorizados al sistema. La versión 9.2.0 contiene un parche para el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"security-advisories","versions":[{"version":"< 9.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-03T20:27:12.054779Z","id":"CVE-2026-28270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.2.0","matchCriteriaId":"B494C8D4-2D4B-4F5E-99C1-4CCE8DF6C911"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-v8x9-vwg6-cj45","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-28271","sourceIdentifier":"security-advisories@github.com","published":"2026-02-27T21:16:18.550","lastModified":"2026-06-17T10:28:24.607","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.2.0, una vulnerabilidad en la funcionalidad de configuración de Kiteworks permite eludir las protecciones de SSRF a través de ataques de reencuadernación de DNS. Administradores maliciosos podrían explotar esto para acceder a servicios internos que deberían estar restringidos. La versión 9.2.0 contiene un parche para el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"security-advisories","versions":[{"version":"< 9.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-03T20:27:32.310501Z","id":"CVE-2026-28271","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-350"},{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.2.0","matchCriteriaId":"B494C8D4-2D4B-4F5E-99C1-4CCE8DF6C911"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rmfx-6h9w-fq87","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-28272","sourceIdentifier":"security-advisories@github.com","published":"2026-02-27T21:16:18.703","lastModified":"2026-06-17T10:28:24.717","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.2.0, una vulnerabilidad en Kiteworks Email Protection Gateway permite a los administradores autenticados inyectar scripts maliciosos a través de una interfaz de configuración. El script almacenado se ejecuta cuando los usuarios interactúan con la interfaz de usuario afectada. La versión 9.2.0 contiene un parche para el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"security-advisories","versions":[{"version":"< 9.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-03T20:27:52.607127Z","id":"CVE-2026-28272","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.2.0","matchCriteriaId":"B494C8D4-2D4B-4F5E-99C1-4CCE8DF6C911"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-7hxj-ch78-xqgr","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-23514","sourceIdentifier":"security-advisories@github.com","published":"2026-03-25T15:16:37.967","lastModified":"2026-06-17T10:21:42.400","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to access unauthorized content. Upgrade Kiteworks Core to version 9.2.2 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Las versiones 9.2.0 y 9.2.1 de Kiteworks Core tienen una vulnerabilidad de control de acceso que permite a los usuarios autenticados acceder a contenido no autorizado. Actualice Kiteworks Core a la versión 9.2.2 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"core","versions":[{"version":">= 9.2.0, < 9.2.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-25T14:45:07.568054Z","id":"CVE-2026-23514","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-282"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:9.2.0:*:*:*:*:*:*:*","matchCriteriaId":"E39C1D0F-1FB2-424A-9EE4-5B653A1AC66E"},{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:9.2.1:*:*:*:*:*:*:*","matchCriteriaId":"A06208F4-EF54-43E5-84D8-144173AA604A"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5gqr-cpr6-wvm5","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-24750","sourceIdentifier":"security-advisories@github.com","published":"2026-03-25T16:16:20.967","lastModified":"2026-06-17T10:23:32.087","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). En Kiteworks Secure Data Forms anterior a la versión 9.2.1, un atacante autenticado podría explotar una neutralización incorrecta de la entrada durante la generación de páginas web como XSS almacenado al modificar formularios. Actualice Kiteworks a la versión 9.2.1 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Secure Data Forms","versions":[{"version":"< 9.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.1,"impactScore":5.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-26T19:34:33.947653Z","id":"CVE-2026-24750","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.2.1","matchCriteriaId":"30A78D6E-2376-4B2C-B4AD-499D1DF88E34"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rfwm-2hq6-h84g","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-23635","sourceIdentifier":"security-advisories@github.com","published":"2026-03-25T17:16:35.480","lastModified":"2026-06-17T10:21:52.523","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotected Transport of Credentials under certain circumstances. Upgrade Kiteworks to version 9.2.1 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). En Kiteworks Secure Data Forms anteriores a la versión 9.2.1, una mala configuración de los atributos de seguridad podría potencialmente conducir a un Transporte de Credenciales No Protegido bajo ciertas circunstancias. Actualice Kiteworks a la versión 9.2.1 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Secure Data Forms","versions":[{"version":"< 9.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-25T17:51:55.311509Z","id":"CVE-2026-23635","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-523"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.2.1","matchCriteriaId":"30A78D6E-2376-4B2C-B4AD-499D1DF88E34"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9hw2-6qp4-3v8f","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-23636","sourceIdentifier":"security-advisories@github.com","published":"2026-03-25T17:16:35.660","lastModified":"2026-06-17T10:21:52.630","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, the manager of a form could potentially exploit an Unrestricted Upload of File with Dangerous Type due to a missing validation. Upgrade Kiteworks to version 9.2.1 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). En Kiteworks Secure Data Forms anteriores a la versión 9.2.1, el gestor de un formulario podría potencialmente explotar una carga de archivo sin restricciones de tipo peligroso debido a una validación faltante. Actualice Kiteworks a la versión 9.2.1 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Secure Data Forms","versions":[{"version":"< 9.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-27T14:56:42.752629Z","id":"CVE-2026-23636","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.2.1","matchCriteriaId":"30A78D6E-2376-4B2C-B4AD-499D1DF88E34"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-cfv8-p3hq-8wmm","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-29092","sourceIdentifier":"security-advisories@github.com","published":"2026-03-25T17:16:57.330","lastModified":"2026-06-17T10:29:35.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked users to maintain active sessions after their account is disabled. This could allow unauthorized access to continue until the session naturally expires. Upgrade Kiteworks to version 9.2.1 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.2.1, una vulnerabilidad en la gestión de sesiones de Kiteworks Email Protection Gateway permite a los usuarios bloqueados mantener sesiones activas después de que su cuenta sea deshabilitada. Esto podría permitir que el acceso no autorizado continúe hasta que la sesión expire naturalmente. Actualice Kiteworks a la versión 9.2.1 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Kiteworks Email Protection Gateway","versions":[{"version":"< 9.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-25T17:29:30.459619Z","id":"CVE-2026-29092","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.2.1","matchCriteriaId":"30A78D6E-2376-4B2C-B4AD-499D1DF88E34"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-92w7-fpjr-wpxc","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-23638","sourceIdentifier":"security-advisories@github.com","published":"2026-06-01T19:16:22.140","lastModified":"2026-07-22T07:10:00.107","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated attacker to tamper with the internal approval flow configurations of forms belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.3.0, una vulnerabilidad de referencia directa insegura a objetos (IDOR) en los formularios de datos seguros de Kiteworks permite a un atacante autenticado manipular las configuraciones internas del flujo de aprobación de formularios pertenecientes a otros usuarios debido a comprobaciones de autorización insuficientes sobre la propiedad de los recursos. Actualice Kiteworks a la versión 9.3.0 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Secure Data Forms","versions":[{"version":"< 9.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-01T18:59:31.552498Z","id":"CVE-2026-23638","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3.0","matchCriteriaId":"3553DA81-4AB9-47AA-8366-77E3BB3192D4"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-8wmh-mg2h-hf46","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-24751","sourceIdentifier":"security-advisories@github.com","published":"2026-06-01T21:16:26.950","lastModified":"2026-07-22T08:10:00.117","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.3.0, una vulnerabilidad de XSS reflejado en los Formularios de Datos Seguros de Kiteworks podría permitir a un atacante externo engañar a un usuario para que ejecute código JavaScript arbitrario. Actualice Kiteworks a la versión 9.3.0 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Secure Data Forms","versions":[{"version":"< 9.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-02T12:18:52.769352Z","id":"CVE-2026-24751","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3.0","matchCriteriaId":"3553DA81-4AB9-47AA-8366-77E3BB3192D4"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xp8m-wmmp-f947","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-24752","sourceIdentifier":"security-advisories@github.com","published":"2026-06-01T23:16:20.213","lastModified":"2026-07-22T19:10:00.120","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.3.0, una vulnerabilidad de XSS reflejado en los Formularios de Datos Seguros de Kiteworks podría permitir a un atacante externo engañar a un usuario para que ejecute código JavaScript arbitrario. Actualice Kiteworks a la versión 9.3.0 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Secure Data Forms","versions":[{"version":"< 9.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-02T14:09:12.546994Z","id":"CVE-2026-24752","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3.0","matchCriteriaId":"3553DA81-4AB9-47AA-8366-77E3BB3192D4"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-6798-vf3h-wcwr","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-24753","sourceIdentifier":"security-advisories@github.com","published":"2026-06-01T23:16:20.390","lastModified":"2026-07-22T19:10:00.120","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.3.0, una vulnerabilidad de Referencia Directa a Objeto Insegura (IDOR) en los Formularios de Datos Seguros de Kiteworks permite a un usuario autenticado modificar recursos pertenecientes a otros usuarios debido a comprobaciones de autorización insuficientes sobre la propiedad de los recursos. Actualice Kiteworks a la versión 9.3.0 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Secure Data Forms","versions":[{"version":"< 9.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-02T12:29:38.666754Z","id":"CVE-2026-24753","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3.0","matchCriteriaId":"3553DA81-4AB9-47AA-8366-77E3BB3192D4"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qmv7-28g4-hx9x","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-24754","sourceIdentifier":"security-advisories@github.com","published":"2026-06-01T23:16:20.540","lastModified":"2026-07-22T19:10:00.120","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kiteworks Secure Data Forms could allow an authenticated attacker to execute arbitrary JavaScript code in other users' sessions. Upgrade Kiteworks to version 9.3.0 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.3.0, una vulnerabilidad de XSS almacenado en los Formularios de Datos Seguros de Kiteworks podría permitir a un atacante autenticado ejecutar código JavaScript arbitrario en las sesiones de otros usuarios. Actualice Kiteworks a la versión 9.3.0 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"security-advisories","versions":[{"version":"< 9.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-02T15:09:02.817380Z","id":"CVE-2026-24754","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3.0","matchCriteriaId":"3553DA81-4AB9-47AA-8366-77E3BB3192D4"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gxvv-hwgc-w7gh","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-24755","sourceIdentifier":"security-advisories@github.com","published":"2026-06-01T23:16:20.677","lastModified":"2026-07-22T19:10:00.120","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.3.0, una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) en los Formularios de Datos Seguros de Kiteworks permite a un usuario autenticado modificar permisos sobre recursos pertenecientes a otros usuarios debido a comprobaciones de autorización insuficientes sobre la propiedad de los recursos. Actualice Kiteworks a la versión 9.3.0 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Secure Data Forms","versions":[{"version":"< 9.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-02T15:50:52.113692Z","id":"CVE-2026-24755","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3.0","matchCriteriaId":"3553DA81-4AB9-47AA-8366-77E3BB3192D4"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-f8rf-7jq6-gch9","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-24756","sourceIdentifier":"security-advisories@github.com","published":"2026-06-01T23:16:20.827","lastModified":"2026-07-22T19:10:00.120","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.3.0, una vulnerabilidad de Referencia Directa a Objeto Insegura (IDOR) en los Formularios de Datos Seguros de Kiteworks permite a un usuario autenticado modificar recursos pertenecientes a otros usuarios debido a comprobaciones de autorización insuficientes sobre la propiedad de los recursos. Actualice Kiteworks a la versión 9.3.0 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Secure Data Forms","versions":[{"version":"< 9.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-02T12:30:13.726777Z","id":"CVE-2026-24756","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3.0","matchCriteriaId":"3553DA81-4AB9-47AA-8366-77E3BB3192D4"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-jgvj-mf78-rxx8","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-24761","sourceIdentifier":"security-advisories@github.com","published":"2026-06-01T23:16:20.960","lastModified":"2026-07-22T19:10:00.120","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to access metadata of resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.3.0, una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) en los Formularios Seguros de Datos de Kiteworks permite a un usuario autenticado acceder a metadatos de recursos pertenecientes a otros usuarios debido a comprobaciones de autorización insuficientes sobre la propiedad de los recursos. Actualice Kiteworks a la versión 9.3.0 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Secure Data Forms","versions":[{"version":"< 9.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-02T13:02:17.093449Z","id":"CVE-2026-24761","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3.0","matchCriteriaId":"3553DA81-4AB9-47AA-8366-77E3BB3192D4"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-6489-ffwq-96hh","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-24782","sourceIdentifier":"security-advisories@github.com","published":"2026-06-01T23:16:21.093","lastModified":"2026-07-22T18:10:00.117","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch."},{"lang":"es","value":"Kiteworks es una red de datos privada (PDN). Antes de la versión 9.3.0, múltiples vulnerabilidades de inyección SQL en los formularios de datos seguros de Kiteworks podrían ser explotadas por un atacante autenticado con el rol FormBuilder para recuperar información o modificar las definiciones de formularios de otros usuarios y algunos parámetros de configuración global. Actualice Kiteworks a la versión 9.3.0 o posterior para recibir un parche."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kiteworks","product":"Secure Data Forms","versions":[{"version":"< 9.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-02T12:30:22.765666Z","id":"CVE-2026-24782","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3.0","matchCriteriaId":"3553DA81-4AB9-47AA-8366-77E3BB3192D4"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-849r-gm3r-4v5c","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}