Kiteworks is a private data network (PDN)

A function in the Kiteworks Advanced Forms component was reachable without authentication

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service.

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affec…

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body

Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there