Vendor
Kiteworks
86 known vulnerabilities.
Products
10 results · Clear filters · Feed
-
Critical 9.8CVE-2026-84473 Public exploit
CVE-2026-84473
Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentica…
-
Critical 9.1
Kiteworks Email Protection Gateway server-side request forgery
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gatew…
-
Critical 9.1
Kiteworks Email Protection Gateway improper authentication
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed…
-
Critical 9.8
Kiteworks Core Authentication Bypass in the Password Reset Workflow
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to t…
-
Critical 9.1
Kiteworks Email Protection Gateway server-side request forgery
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gatew…
-
Critical 9.1
Kiteworks Email Protection Gateway server-side request forgery
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gatew…
-
Critical 9.1
Kiteworks Email Protection Gateway server-side request forgery
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gatew…
-
Critical 9.4
Kiteworks Email Protection Gateway Improper Access Control
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account…
-
Critical 9.3
Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could h…
-
Critical 9.1
Kiteworks Email Protection Gateway server-side request forgery
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fe…