Accellion Archives - CVE Vulnerability

CVE-2008-7012

Sun, 26 Feb 2023 09:11:49 +0000

courier/1000@/api_error_email.html (aka “error reporting page”) in Accellion File Transfer Appliance FTA_7_0_178, and possibly other versions before FTA_7_0_189, allows remote attackers to send spam e-mail via modified description and client_email parameters.

The post CVE-2008-7012 appeared first on CVE Vulnerability.

CVE-2008-3850

Sun, 26 Feb 2023 09:10:14 +0000

Cross-site scripting (XSS) vulnerability in Accellion File Transfer FTA_7_0_135 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to courier/forgot_password.html.

The post CVE-2008-3850 appeared first on CVE Vulnerability.

CVE-2019-5622

Sun, 26 Feb 2023 06:33:43 +0000

Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials.

The post CVE-2019-5622 appeared first on CVE Vulnerability.

CVE-2019-5623

Sun, 26 Feb 2023 06:33:43 +0000

Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’).

The post CVE-2019-5623 appeared first on CVE Vulnerability.

CVE-2021-31585

Thu, 23 Feb 2023 14:09:36 +0000

Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow local access.

The post CVE-2021-31585 appeared first on CVE Vulnerability.

CVE-2021-31586

Thu, 23 Feb 2023 14:09:36 +0000

Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.

The post CVE-2021-31586 appeared first on CVE Vulnerability.

CVE-2021-27730

Thu, 23 Feb 2023 14:08:38 +0000

Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. The fixed version is FTA_9_12_444 and later.

The post CVE-2021-27730 appeared first on CVE Vulnerability.

CVE-2021-27731

Thu, 23 Feb 2023 14:08:38 +0000

Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later.

The post CVE-2021-27731 appeared first on CVE Vulnerability.

CVE-2021-27101

Thu, 23 Feb 2023 14:08:29 +0000

Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.

The post CVE-2021-27101 appeared first on CVE Vulnerability.

CVE-2021-27102

Thu, 23 Feb 2023 14:08:29 +0000

Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.

The post CVE-2021-27102 appeared first on CVE Vulnerability.