kiteworks Vulnerabilities and Affected Products
Vulnerabilities associated with totemomail.
Products
Clear product- Secure Data Forms11 vulnerabilities
- security-advisories10 vulnerabilities
- totemomail2 vulnerabilities
- core1 vulnerability
- Kiteworks Email Protection Gateway1 vulnerability
- OwnCloud1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-28064CRITICAL | Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages). CWE-26May 18, 2024 | CVSS9.8v3.1 | EPSS0.856% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-28063MEDIUM | Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS. CWE-79May 18, 2024 | CVSS6.1v3.1 | EPSS0.269% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |