Accellion: Security Vulnerabilities
CVE-2021-27101
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
Known exploited
CVSS Score
9.8
EPSS Score
0.01
Published
2021-02-16
CVE-2021-27102
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
Known exploited
CVSS Score
7.8
EPSS Score
0.003
Published
2021-02-16
CVE-2021-27103
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
Known exploited
CVSS Score
9.8
EPSS Score
0.021
Published
2021-02-16
CVE-2021-27104
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
Known exploited
CVSS Score
9.8
EPSS Score
0.024
Published
2021-02-16
Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials.
CVSS Score
9.8
EPSS Score
0.004
Published
2020-04-29
Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').
CVSS Score
9.8
EPSS Score
0.013
Published
2020-04-29
Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.
CVSS Score
5.3
EPSS Score
0.005
Published
2018-07-13
Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable to cross-site scripting.
CVSS Score
6.1
EPSS Score
0.007
Published
2018-07-13
Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using a gathered token via a POST request to /oauth/token.
CVSS Score
6.5
EPSS Score
0.003
Published
2018-05-24
Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attackers to read arbitrary files via a .. (dot dot) in the statecode cookie.
CVSS Score
7.5
EPSS Score
0.712
Published
2017-10-10