Kioware

kioware

7 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (7)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-3461 1Kioware 1Kioware Jun 17, 2026 May 14, 2024 N/A· v4 5.5 MEDIUM· v3 N/A· v2 KioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application from being closed, as there are no mechanisms preventing a user from excessively guessing the number.
CVE-2024-3460 1Kioware 1Kioware Jun 17, 2026 May 14, 2024 N/A· v4 7.0 HIGH· v3 N/A· v2 In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window before the forced automatic logout occurs. Then, by using so...Show more In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window before the forced automatic logout occurs. Then, by using some built-in function of these applications, one may launch any other programs. In order to exploit this vulnerability external applications must be left running when the KioWare software is launched. Additionally, an attacker must know the PIN set for this Kioware instance and also slow down the application with some specific task which extends the usable time window. Show less
CVE-2024-3459 1Kioware 1Kioware Jun 17, 2026 May 14, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using built-in functions of that viewer it is poss...Show more KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using built-in functions of that viewer it is possible to launch a web browser, search through local files and, subsequently, launch any program with user privileges. Show less
CVE-2023-34642 1Kioware 1Kioware Jun 17, 2026 Jun 19, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function showDirectoryPi...Show more KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function showDirectoryPicker() which can then be used to open an unprivileged command prompt.Show less
CVE-2023-34641 1Kioware 1Kioware Jun 17, 2026 Jun 19, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function window.print()...Show more KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function window.print() which can then be used to open an unprivileged command prompt.Show less
CVE-2022-44875 1Kioware 1Kioware Jun 17, 2026 Mar 6, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code.
CVE-2018-18435 1Kioware 1Kioware Server Nov 21, 2024 Mar 21, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any user full permission "Everyone: (F)" to the contents of the directory and it's sub-folders. In addi...Show more KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any user full permission "Everyone: (F)" to the contents of the directory and it's sub-folders. In addition, the program installs a service called "KWSService" which runs as "Localsystem", this will allow any user to escalate privileges to "NT AUTHORITY\SYSTEM" by substituting the service's binary with a malicious one.Show less