Kiteworks is a private data network (PDN)

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to

A function in the Kiteworks Advanced Forms component was reachable without authentication

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service.

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affec…